{ "Event": { "published": true, "date": "2026-02-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-22", "timestamp": 1771804982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4f81efc2-4d95-43f4-be14-046b6bf0ba13", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c5b11d-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779478, "uuid": "92e81629-4d73-4e3b-9aed-819463509ca2", "comment": "Malware payload (Mirai)", "value": "6e0f6791d0e3494def51cf08f51016d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779478, "uuid": "44aefd99-895e-41e9-b102-29aab9a61b51", "comment": "Malware payload (Mirai)", "value": "008502d1b7c130dac50988e2796c524dbe98f675acfeea907c602a8ae2dcc98c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779478, "uuid": "48cfc2b1-c492-499c-98a7-f069c34e87bd", "comment": "Malware payload (Mirai)", "value": "1b81858dd8581c3548747b73ab7ac92ddbac5def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779478, "uuid": "3e51be0c-5abe-4862-821e-15019592426c", "comment": "Malware payload (Mirai)", "value": "111c0dd89e480d8ba4f00ce996c1f77c40f2c94ff9f13ef5eb77c0f840b2d5616aed5c15f30c13ec8ae1672e43e29705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779478, "uuid": "7a100b3c-d4f9-45c4-b1ae-35035671fa3b", "value": "T1CCD32A46EB409A13C1D61B76FADF42093322CB55E3DB73078D189BB43F86A5E4E27609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779478, "uuid": "f19f6231-1e8f-4d71-a29e-7ff529bffc8a", "value": "3072:pBpdD1J9mrsplDKZU8QBKXAVanrX+F8JyvyGhLI8aI8xPlBdbhKI4sCH50rM/9SA:pBpd5J9mrsplDKZU8QBKXAVanrX+F8Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779478, "uuid": "775b64ac-71e5-41ee-bbfb-ad26084a761f", "value": 130684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779478, "uuid": "c5032feb-b448-4f9c-9e8d-cbc087186115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779478, "uuid": "cd1b4527-7c04-4fe3-ae03-e26bf0041e9f", "value": "purves.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b7534b-1005-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771775184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775184, "uuid": "139d41c5-7152-42a0-8aa7-1dd93fde94a4", "comment": "Malware payload (SalatStealer)", "value": "f3723644acff75f90d37addf03c9f083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775184, "uuid": "6bfd8127-f2e0-4c2c-8dbd-c50e530375b7", "comment": "Malware payload (SalatStealer)", "value": "0132e0c77a7f1d5d121fba44f08288250f9c61519bd7d31d76d34bb2686bf9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775184, "uuid": "779d27ff-fd2b-45f8-af06-8e9611b49e61", "comment": "Malware payload (SalatStealer)", "value": "2f31d8bfd2a15da6e86a459ff3da95d7d04d46f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775184, "uuid": "a172350e-70d8-474a-b730-7e7f4ff74fd5", "comment": "Malware payload (SalatStealer)", "value": "5689359cd5719deb028aff6351467c76d02f9e42f98c7591fc9988fe643b81d7c4393a90bef341c76447419741810382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775184, "uuid": "1db4fdf2-d9ce-465b-938f-bd268c7084e5", "value": "T126C65B41FA8B94F6E9031835406BB23F63315D049B28DBDBFB543F6AF87B6911D26209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775184, "uuid": "ffe8d34e-7b5a-416c-a416-fec5b69bc78a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775184, "uuid": "f93d375a-2e75-4a5e-8084-114e19cb0909", "value": "49152:+nQMOV4bcCXm3O+5xiU0yWFF8UY26n9L5AuPAQ87KNdaGVjPZNlv1V1HJEB0BYrl:wXOV4O3Xp6Q8KaGVrHBB3b/SmGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775184, "uuid": "de518345-9d2a-4364-bf5b-8ae0ddf6ace9", "value": 11673088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775184, "uuid": "aceb5de3-759c-4388-afaa-33dca7e4a9d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775184, "uuid": "df7df6fa-4755-46d2-8459-966881019aa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da46688-1024-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788433, "uuid": "2482520f-bc3a-4cdc-a1cf-4db41c934482", "comment": "Malware payload (Mirai)", "value": "511093944f395612d6e6a38be111f91a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788433, "uuid": "cfbd1fcb-25fb-4c0d-ac40-8fe72dda80ee", "comment": "Malware payload (Mirai)", "value": "017d709df0949a2fcd51fc79d73306ac2abc168ad5128efcc26e1a9975be588a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788433, "uuid": "2a249b8a-354a-4e5f-beda-c94ad8e7462e", "comment": "Malware payload (Mirai)", "value": "44292c0e1937bc1262e02c1a503dd82d75bed742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788433, "uuid": "35d0ff69-a9b7-452f-958b-fccef7657144", "comment": "Malware payload (Mirai)", "value": "47391853c45af4b0e4c6fb948abd34a906eb587d918d85a04ef001b56b62320e3729e583899a461343f1e42f22b1e1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788433, "uuid": "33ef5365-97e5-46c4-ae1c-e9b4b50a6a9f", "value": "T1A7734C9AF401CD7DF80FDA7A54570E0AB531A3E20AC30F366267FD63AD721961D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788433, "uuid": "06379593-d305-4dcb-994b-23f3e0ef1fc3", "value": "1536:8xoR0zi1qQIq96kXYG02VF52p/h4G28jydadcJvgDE1wRkExmINWEX:8x3z452p/h4GbydadciDGkZWEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788433, "uuid": "df7033f9-d9f8-4c95-83f5-01cb6a145182", "value": 73520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788433, "uuid": "abbceb1c-a905-4dd9-aea0-2fa5f0a01f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788433, "uuid": "c4359faa-cb67-4812-9a61-167dab7867bc", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4076f7b-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778753, "uuid": "8dad6e50-82d2-46d5-a4a8-8a6119d42602", "comment": "Malware payload (Mirai)", "value": "10633f23df58dad362e6f3294fc79a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778753, "uuid": "447de2d4-cf5f-47de-a668-084df036d996", "comment": "Malware payload (Mirai)", "value": "02424ce34e19d075315ccc60731d60924bf82ec1e90da03c7964b8906eeb8583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778753, "uuid": "8f256941-2b89-4c80-88af-174b097e0c3a", "comment": "Malware payload (Mirai)", "value": "04ff9fe9714b25e98ce094920cd3f5dea547b6d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778753, "uuid": "3d81b750-e463-4961-b2a2-524e026d7ecc", "comment": "Malware payload (Mirai)", "value": "4e91f77e0499b24aa6f4694f7b9fb66c4b6ff2d75c0c77a3b486ac112343cd975341486d600c97a24d01b27537e0f8df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778753, "uuid": "d410c297-f144-4c73-8af4-355ae4c4580f", "value": "T179E46B6277328FA4E360C27402F387655AED11A207E35586A37CC6207B51B6D6C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778753, "uuid": "aecdb55f-a8ce-4e80-89e6-872616bace54", "value": "12288:Y93rHDwbb4qwp25BnHA0GVsqWkHj0qannYXdo8HStsYss8pdnsvyZL+0v/h:Ogb4qwpeBgDVsqWbodZHIsYAywq0vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778753, "uuid": "b03c2bb0-d741-4fa6-a0c4-c574f574927b", "value": 696296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778753, "uuid": "3c2962a9-7b54-4f31-83dd-d21e52a91964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778753, "uuid": "5d05316e-543e-477d-8694-f5ece9ad3c6b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d75080-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784201, "uuid": "1891c05b-8fa2-4d05-aa9f-da0fb4511cc7", "comment": "Malware payload", "value": "ad9ea3c0d03fa9b338a2bfaa9936778e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784201, "uuid": "4f86dc32-3b76-43d5-b47e-e6d0e014634a", "comment": "Malware payload", "value": "02654237367ed430ea7b7e3a8bd49fb161fa5e4649d3ccd43f63fa49c4afeffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784201, "uuid": "4deb6add-0964-4390-a228-d03da3a72cf7", "comment": "Malware payload", "value": "449313d7e67d4b99ca49488d0227b7b22c10e2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784201, "uuid": "62a94fa7-749b-44a3-9d7e-ff36f305a483", "comment": "Malware payload", "value": "a9dc8c223d59f80e42a93fbb656687835dee2c692962bb9b4ab5e98cfaee47caa34457475c466f410830f7c8f42c92b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784201, "uuid": "abffd08f-5661-447c-8c27-bcbe888e2404", "value": "T128A55A07BCA049E6C0AA9231896691927F71BC840F3123D72E60B7BD3F72BE49D79751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784201, "uuid": "b21444d1-c423-46ad-abf0-cdffab439da7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784201, "uuid": "8e11360f-4276-4479-abd5-f31bdf1b8ba2", "value": "24576:D02MslR4PzMhhTiAz6o4GMU+GI84cS89IJz3e6eleXq9DdaAoUEYlTO:D0lKRcghhhz60t1I84qb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784201, "uuid": "f9b0ff6d-cb21-4119-b72b-d7e8ed020fe5", "value": 2228736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784201, "uuid": "8a5acaba-0bba-4359-a8cc-a461a2aebcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784201, "uuid": "37760ee3-b789-4842-b97f-be0daeecbf7d", "value": "revshell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2426e6c-100e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779099, "uuid": "a1857bbd-9e53-4a54-8d20-3face2169674", "comment": "Malware payload", "value": "926fef929129191415637ac174ebe093", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779099, "uuid": "f7597867-719a-4cfe-a777-55f2e472b3ef", "comment": "Malware payload", "value": "02cd1f9777760d4f9efd5fb77bb356e056c375ab2dc09446db76437243627406", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779099, "uuid": "92a94175-c255-4a09-9796-93ad3756a65c", "comment": "Malware payload", "value": "5b5766b7c766c2fa634c5a85f5b0d91be8a5e20a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779099, "uuid": "5473e5d5-fa8e-4678-93ff-fbd960bd2a09", "comment": "Malware payload", "value": "ae1eb9af1866e63f4015503d73f8de03f768703a8c04311addf674810ab93bf947e9f096e575aae25bea29eb54025bd1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779099, "uuid": "b805b816-cf88-4a89-b6e0-a67a4479a0a8", "value": "T12A61E7E5A2381D2A75CA8D48F555D1911CDBBB32BFFA60C0D0C2EDB15EA97082E18F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779099, "uuid": "f16b9f1f-902f-4530-b066-7fad4c9b29d4", "value": "24:1RGXNLwhWUNDwdkHE3/3EDfkHE3/3tGdDQkHE3/3PQDnwkHE3/3qLDFkHE3/34DH:1IvakVklgkekTkgk4kW4kq/kPkIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779099, "uuid": "f5ede96d-4c5f-4a23-9949-27a765c4da06", "value": 3451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779099, "uuid": "a242eb43-10c0-4301-b2b1-a29726f8799e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779099, "uuid": "a591351a-efa5-412a-b48b-3fae8a9a82f8", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449d7b7-1005-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771775130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775130, "uuid": "38a7d6b0-8f0c-4c7f-b3e7-660d55932635", "comment": "Malware payload (SalatStealer)", "value": "86350441ef00f17b2ab6ed184a319e90", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775130, "uuid": "1d4c1ed5-e868-4656-8d85-689035acd4b1", "comment": "Malware payload (SalatStealer)", "value": "02ddfae5499c560790df90e28819279652210092e121fbd2d880aaf87f80ad05", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775130, "uuid": "13990390-5a82-4c55-aa60-472d56450bb3", "comment": "Malware payload (SalatStealer)", "value": "7b5fe5ee040932d828f9676182fb07264b15b11d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775130, "uuid": "8a9f59c3-a97b-4711-8572-f3b7863cbe0b", "comment": "Malware payload (SalatStealer)", "value": "599719e3813c300b319ebb7af96448bb46ae98a313f43bb10879ec4722674a9f59976019339f9ba6f023d7fa11ef400d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775130, "uuid": "4abf1a38-84a5-430b-94b1-384eb674eeb7", "value": "T14CE533085C826477F0FEA0B73887FB79E4D560095E56F84A2C1F709F235A422729BE76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775130, "uuid": "13217b8d-6666-411d-bcd5-3e61023a96fd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775130, "uuid": "af9e0811-47f9-4cca-8d0e-42aa21d36969", "value": "98304:iGCNd4OOqKn60K8Dtesxkigwkg5GZXg/KFVf+R9BOr:DOxF05esxkcxGZXVfsOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775130, "uuid": "e5336aea-aec8-4a09-9ef2-597739ad3e5f", "value": 3298816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775130, "uuid": "9a7c362d-7619-482b-ba1c-503691e93a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775130, "uuid": "1610b690-0daf-4cb4-b3a2-ee7e95fdf01f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608510db-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784089, "uuid": "d4e76507-d7f7-4add-bd7e-af95161f5456", "comment": "Malware payload", "value": "c3270905e2da14e91f14e8d679eb2334", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784089, "uuid": "2d8beab9-575f-4f84-9ec9-13982e61e0c5", "comment": "Malware payload", "value": "02ec371868f200a73be422bad4762884f6aec9932550b9a344db25d7a8f32ccc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784089, "uuid": "b35b49cd-e15a-4932-8ea2-dd9f574b45f1", "comment": "Malware payload", "value": "adf117a33767ac638b5194c977fd926249ca360f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784089, "uuid": "7db19aa3-3f1a-4cdf-8887-a4f0abed9c79", "comment": "Malware payload", "value": "f7fba56c2c6012270167bd58a784cf6b4a664f0ba806434d97c1413e9f58fd69255fe317317ec6f63251889f8ecf4c99", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784089, "uuid": "1d0885da-67b1-403e-b4a8-f173b0852060", "value": "T1EDF2F134CA2760F1F4A7FB75ED390951F66C49A081C63BAA3C2FC299D0B3B4D6A27504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784089, "uuid": "7f8af35a-20c7-42d1-9566-9dabba2dbadf", "value": "768:BADnm7rdW8RhejMaCRWrY/CGD5uLiNTKUUESvGOfoZ42o:Am7rZHISr/CGD5uLmdU7e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784089, "uuid": "927372f7-1a76-4d0f-9636-22e30dcdc18f", "value": 36754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784089, "uuid": "fb0ad34d-76ea-4948-8302-851e47b01a8a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784089, "uuid": "4fe7ba3c-319f-42ef-96c7-d0d9669a0ebb", "value": "dde_payload.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d0045-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784124, "uuid": "977cca5c-4087-45be-aa47-1a17d76fc2a9", "comment": "Malware payload", "value": "a385bef541e9de8f01230af9b60f4d77", "object_relation": "md5", "Tag": [ { "name": "jpg", "colour": "#0EBD80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784124, "uuid": "b09f2a2a-f135-448e-9453-e6b40f2de7fe", "comment": "Malware payload", "value": "02f89a312cd55d84a39e241b8fd53b4f912ce9958860f8e1e12a3889db574863", "object_relation": "sha256", "Tag": [ { "name": "jpg", "colour": "#0EBD80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784124, "uuid": "e8e54a52-5868-425d-a8d8-67b22109f155", "comment": "Malware payload", "value": "3e829783c73442d0732a04715850868dc1be453b", "object_relation": "sha1", "Tag": [ { "name": "jpg", "colour": "#0EBD80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784124, "uuid": "7cda6970-e91f-4891-8a55-4434e390d892", "comment": "Malware payload", "value": "ac9c3cd5a218bef05eafb05a371b24689976875264a1645b04a56e69df4cf0ece7055bbf076173a306fe4db07efe2f60", "object_relation": "sha3-384", "Tag": [ { "name": "jpg", "colour": "#0EBD80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784124, "uuid": "423fa6b3-143e-4f89-8913-389244fd9bc5", "value": "T1219002461615C544401E5CB5552003158168D7421000978956C45964BE544C50D2A9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784124, "uuid": "2c5689d2-cfe1-48c9-95d1-c311221b6932", "value": "3:nStlEVM/a4m8YfFEn:PLaIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784124, "uuid": "aaad5fda-ebeb-4f88-aa38-6bafd763a567", "value": 52, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784124, "uuid": "6b7a2a51-e210-484f-8d22-88b37e39d8ac", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784124, "uuid": "1b6cfe59-c0fb-4c29-9999-b94c8b9c6fbe", "value": "poly.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbde21-103a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771797733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771797733, "uuid": "3d637edb-d239-4b34-9611-dff159c8d5c3", "comment": "Malware payload", "value": "f086f61436a0e29a1ad8bb531c3cfeaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771797733, "uuid": "3d374718-d264-45fe-bb11-e74e6c8f672a", "comment": "Malware payload", "value": "0323da67b133228d6b955513892821613152df7bf7bd156e9fd112d07da3d189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771797733, "uuid": "9b105dfb-9c2c-422b-befc-df5b41b974a6", "comment": "Malware payload", "value": "0e20fcf673de43f5f255a6f64fa03c28239b03a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771797733, "uuid": "ce9565bd-a19b-4cda-823a-9b3ef7e4ae14", "comment": "Malware payload", "value": "959306df35ca86e9fa5361e39c433495ffa6134a780027c9c9ef92c10337518d3fa9a353cc3627a04ad8a65a245e7360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771797733, "uuid": "c148223e-37d9-4678-aa7b-a0853c16e5f4", "value": "T166666C12AB9995E9D1BAC034D3574236A97230CA0B34ABFF85C44A792F65FF46E3C344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771797733, "uuid": "e76e2937-a444-4e0f-aa9d-4e5201de2eeb", "value": "4c20e0e322d25c36f7c8c1bbf017fa06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771797733, "uuid": "b3da622b-5c55-4005-b14d-71a60b096e27", "value": "98304:YjfTevlB6gQb0vyJWQUw9wFDMaKIsL8UqA+qY9X8:Y3J5myJWQUw9wFDMHwqf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771797733, "uuid": "1022d106-82f6-4159-a5c9-201345738c2b", "value": 7006208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771797733, "uuid": "130f562d-b3b3-49ea-b21d-8021e97450fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771797733, "uuid": "35ee7541-a8e6-42df-947a-edb0b325a7cd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2253fa4-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788146, "uuid": "7497ece2-e41c-43bb-85c2-66efa2c17e26", "comment": "Malware payload (Mirai)", "value": "4cfd09ae7ca4b4ee3df70ffb453fcaf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788146, "uuid": "64a5d7f1-5853-4c75-a089-671f0302af3e", "comment": "Malware payload (Mirai)", "value": "03a77d7a4ac8f4c75816a169c641fd7892073ac1f661d2319681448f9486c243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788146, "uuid": "91924544-8ac2-44cd-b0b5-a3695e7881e4", "comment": "Malware payload (Mirai)", "value": "b95fb034cab4b1648c71125b1951d282ae97910b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788146, "uuid": "3d31e94a-ab4e-4bdc-bec4-e24a5416125e", "comment": "Malware payload (Mirai)", "value": "f837d6e46eb0c05ce3a3d812a1acd10f13da59887b7ecb59986d226e20a4ba2610040c0ec99c66a7e588a21663b8157a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788146, "uuid": "8b643c3d-515a-4163-839d-b7ef7cec04a8", "value": "T1B893380379C090FCC98AC13457AFA136D863F47D1239B24F27D4EA167E99E612F6DA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788146, "uuid": "f5f913b0-45a6-4e4d-86fa-f6d3bdd58fcc", "value": "1536:pfrFDudrmQNYkb7DpMghbLqyZKg5w9FP1i1eoy904R11r53A3VdBCzBn:pGrmQLb7DpMgh5Kg5k1i1eoySYr53AXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788146, "uuid": "16231444-c4f0-4a27-86e4-a06c26d6e22c", "value": 94144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788146, "uuid": "99a571b2-146c-40fa-9893-7d23dfbb88c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788146, "uuid": "7e0f8c33-89ca-43f4-b0a1-c469d2856f50", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082cb6d3-0fe9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1771762896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762896, "uuid": "08b4df8f-54e8-4d60-a652-4052a2669d7d", "comment": "Malware payload (ACRStealer)", "value": "ffafb94fb5d197750e123a9a41897929", "object_relation": "md5", "Tag": [ { "name": "193-33-195-37", "colour": "#DE50A1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762896, "uuid": "124580cd-cb59-4517-9635-a1561550e0fa", "comment": "Malware payload (ACRStealer)", "value": "03db9caa1a8a271ab28e5b80a649a6074d0c5158d16e3a7d483250dedffbea29", "object_relation": "sha256", "Tag": [ { "name": "193-33-195-37", "colour": "#DE50A1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762896, "uuid": "a77db6ca-9df8-4549-9b19-fa4de71055b2", "comment": "Malware payload (ACRStealer)", "value": "cc4e37607ac92f1063770b4da026a1a751710047", "object_relation": "sha1", "Tag": [ { "name": "193-33-195-37", "colour": "#DE50A1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762896, "uuid": "6e35ce5a-ec8d-456b-8950-d69bd5a6583c", "comment": "Malware payload (ACRStealer)", "value": "3c3b0b0656161b3d1bafbfc39c041a25e2d2d698513051aade20045750f7c043b4616d029c820849b3aade61caa2c58b", "object_relation": "sha3-384", "Tag": [ { "name": "193-33-195-37", "colour": "#DE50A1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762896, "uuid": "6a1fd338-6700-4b05-b59a-ef93ef038df8", "value": "T12F26CFA27D5942A7E0A701318EFDF738E17F7DE4F63D21931160B729B9322824D29927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762896, "uuid": "2f908026-4508-4549-b86d-7b123a74929c", "value": "e3c5de562377b8cd6c9e2e0e38f749a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762896, "uuid": "84086c84-6df5-42c0-9d03-6e7f2ad96157", "value": "98304:Z/6A2lDl6QKfR3Rd98zHQCLRMvVeDAvYL9Ro3HIJHgYm2Lk4PH1FLOAkGkzdnEVT:Z/L2+rRURMvV/Mk4/1FLOyomFHKnPnda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762896, "uuid": "174bec00-bd40-433e-99b8-ece0b7e32263", "value": 4602728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762896, "uuid": "f1e60292-da3e-4137-9b6f-7bb514d637ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762896, "uuid": "85f7bdd0-fca6-4100-a77c-9c25ba9dd443", "value": "S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2ddd75-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738821, "uuid": "77a241a7-c780-4470-9048-a6fe5f126437", "comment": "Malware payload (Gafgyt)", "value": "dc2c7b72013c96d5f433febc0ae35d7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738821, "uuid": "df4b12cb-53d6-46cf-94c5-82e23a2258c9", "comment": "Malware payload (Gafgyt)", "value": "04327611737a523e8971b22789c4783d77539b145ed8b219bf27723c2f686192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738821, "uuid": "7d53fc20-1e35-4023-8958-8672b9ce829c", "comment": "Malware payload (Gafgyt)", "value": "d3fadbbefe2a6f7218efe04b579d321b1c604bb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738821, "uuid": "2850292d-1952-44bf-a3a6-a2870a161167", "comment": "Malware payload (Gafgyt)", "value": "421b382f890dbe490188d1ea55fef4e3fd2968e9970cacd4e8d3df323f1f9446027258876df5473d7a6cf1c9d04f35bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738821, "uuid": "eaa81d6b-cc57-43d5-b1f6-335084aafe96", "value": "T12B935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738821, "uuid": "8f88106c-8526-4fcd-b794-0b91e78e62fc", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3QyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKAifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738821, "uuid": "39a653a3-89eb-480b-98fc-682518eaeaa1", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738821, "uuid": "1ac7b20c-0d2e-4f61-ac73-b74230d086bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738821, "uuid": "9eeb7270-d1d1-4f22-a458-cd2ee3e1afd8", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0798e406-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759459, "uuid": "52ddbc94-4c99-4a29-ad2a-01b771a8d6b8", "comment": "Malware payload (Kaiji)", "value": "1bba32bf4fcb8185e174e741a1059d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759459, "uuid": "0cfdd22d-85dd-4f48-8f0f-651f6e1657f3", "comment": "Malware payload (Kaiji)", "value": "047180266dd064a61970766e88c9f476e8a42df443e5c747edfaaa0d447a455e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759459, "uuid": "9fa348f2-8b88-40a3-8e5c-0bd30502a2b3", "comment": "Malware payload (Kaiji)", "value": "9d9c348118a7290ec0c0673a0f7991bbaba25930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759459, "uuid": "0671d3af-5861-4bbb-aace-072c40490c3b", "comment": "Malware payload (Kaiji)", "value": "5325560d367264ccb1a9a537bb6d20f3da1646d0f5ddd3a48dd17498103b46b7a82c1228b60b30bb05b448b555d95333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759459, "uuid": "54852a07-bceb-490e-816b-6da116dc961b", "value": "T14C955B85BC9DA912E9C97EB56F2502D07225FC4D9F81C7177A00BBAE6DF23588F21360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759459, "uuid": "6c90fd2f-9512-40de-a61b-116c6d4737df", "value": "24576:/wRmgu8dG9qDQtfTBmW0NREmCNPCp98U4TprOEa6QWgrz1v:/euCG9qE5BS5AUrz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759459, "uuid": "10eeb93a-7263-4e8b-b896-02799b9ac771", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759459, "uuid": "16f0e7b9-9006-40cb-9225-f1be61abb5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759459, "uuid": "1f664c04-84e8-481e-9045-18d66eb385b6", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f957bc38-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738819, "uuid": "c24c9406-ce49-4927-b192-e3ba531763fc", "comment": "Malware payload (Gafgyt)", "value": "3a4fd1a83229df479d6019b8a5a28b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738819, "uuid": "9399fea2-2a3f-49b9-a534-f9bbc4400ce8", "comment": "Malware payload (Gafgyt)", "value": "05e0a9fb985b54d2336d7e1500150a8a389705c4eea8a2633289db88430af0f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738819, "uuid": "81f38706-d712-42da-bcba-c0eaffd09e86", "comment": "Malware payload (Gafgyt)", "value": "a43bb18cf5c74c575e3229bdbf4a91b767ab1c15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738819, "uuid": "990621c3-25e9-464f-92d3-d8d610bd3a13", "comment": "Malware payload (Gafgyt)", "value": "5029f0f850d0729da64312006057a5af78c269004e2e5234aae25bbb53d5c349887872bbb4f96a10180c25e95a51f983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738819, "uuid": "55c0fb75-f7bc-4d2b-aa1b-4d730dfa6aac", "value": "T1A0C3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738819, "uuid": "de121bc9-9eb0-4fad-8b75-b4b725ce2df2", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBebERLWfRZrmW+i:/a1UW0MZQHTB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738819, "uuid": "b341af36-27bc-42d2-874b-6a836fcb4de8", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738819, "uuid": "732fde09-d560-412b-a7ae-dd947a46157a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738819, "uuid": "1c2f3765-5d4d-476c-b626-699a8ee75ca9", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60055d-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766153, "uuid": "30f79dc3-878b-4cba-b2e3-1a61840da65f", "comment": "Malware payload", "value": "aaa695b55d950dccf9a52b1ae4008e44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766153, "uuid": "45e0fcf9-0d07-444a-89d2-5e177940c573", "comment": "Malware payload", "value": "05f4a3463d07d04808a54828b835f4a173bdaae26cf549f9978f3e3ef2459ee5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766153, "uuid": "89993769-44a0-4b4d-8f0e-1b865f8059f2", "comment": "Malware payload", "value": "3deb4cca51ff93d6b47063e4fbf672f3fb778228", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766153, "uuid": "5d018e3e-a9d6-4f91-8c6f-4dd5244b7157", "comment": "Malware payload", "value": "9a92a9fab4820578c2b5ca2e2c4e5b1d9b731bed36ae552766ee7179602899b1e400eadd649838a713a4037ac5d41707", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766153, "uuid": "b57565c9-8fc0-4d00-8392-15f1312137fc", "value": "T11612D37125F14C332A20AA80F3772BA2ABB6D95345E7318C35DE2D265F86F12B1BF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766153, "uuid": "c96bebbb-8ce0-4cb5-922b-09e0a31da4de", "value": "96:cRu3k0B6DsDzacxwxmkStgFIblbT/+Q9y9U9YIBVIBxIBmIBVIBhIBk:cRu0g6DjUpP//wy2CmJeev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766153, "uuid": "8261d80e-a9a9-4546-9f68-03cd38988498", "value": 9049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766153, "uuid": "73485a94-5caf-434f-98e8-ec8bc07e0d26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766153, "uuid": "35a4e010-e38d-4f02-b887-4420a060775c", "value": "05f4a3463d07d04808a54828b835f4a173bdaae26cf549f9978f3e3ef2459ee5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7cdd0c-100e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778798, "uuid": "ee7543ed-1f78-4447-afee-846bf7cbbd63", "comment": "Malware payload (Mirai)", "value": "e3e678c64791af37e9707357360ce930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778798, "uuid": "e73bf0cc-07d6-4be2-9a52-b5597cf645fe", "comment": "Malware payload (Mirai)", "value": "0611c0fd4aa3562f54d5364eaf5545ca2e4d00d86ffb51d1399deafa7ab887bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778798, "uuid": "dafc0f8f-26e7-4994-976c-897935de41a1", "comment": "Malware payload (Mirai)", "value": "94f49309b87c8988a20ee6c451abee1094c06a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778798, "uuid": "cbb48e84-5157-431a-9f60-c4c36bbb87d5", "comment": "Malware payload (Mirai)", "value": "a720f2e6f3441e84d33f311f73af4f42644619756d5adba29da5a72ed47d57850e7bfe8d9f7bce61024ac50b307ce2f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778798, "uuid": "fa890e1a-260c-4405-bc84-47a529d007c7", "value": "T113E32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778798, "uuid": "1306102a-3bf5-4999-a801-a26e17134a77", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzUX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduGrX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778798, "uuid": "de8db0be-bd64-4ba9-bd0a-0af33542bdd1", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778798, "uuid": "4dd6ed6d-4075-4f3a-972a-00b9f6e5c232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778798, "uuid": "9fb44f61-4ea0-44d4-be04-3e58fdc2c4ee", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fda62d-0fea-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1771763327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763327, "uuid": "718d374a-a85f-46f8-a7e4-c585059d5cdf", "comment": "Malware payload (Efimer)", "value": "adbbd801874c45f63e594f0d2302911d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763327, "uuid": "bc881a62-1318-4413-b874-77dcae043d11", "comment": "Malware payload (Efimer)", "value": "06184d61a88fb8be7ac56b1f936554b8bd236f76fbaeb1a6caabe693194e5b3c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763327, "uuid": "fa591d79-dbf8-4cc6-8e9c-a785808fe036", "comment": "Malware payload (Efimer)", "value": "63097303ef0dad26e9c8a17ce38cd23bea6b0709", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763327, "uuid": "3626196f-906c-450e-84f1-c189236a34ec", "comment": "Malware payload (Efimer)", "value": "b1936dde5834004c7e03d2daca7c3d46b42ab12603b51e38f6559baf5dbe39210f270024839e34600705f7a8b873512d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763327, "uuid": "a0535c8b-9706-47e0-b27b-1a84e80bafd9", "value": "T1B0D6331CAAD121EDD776D0B0FAE427F4F438746613B6C8AB9A2CC7B13C5B4A0851D85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763327, "uuid": "41bf52ae-fba2-47a9-b88c-1a24ece420bb", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763327, "uuid": "de157721-d570-410d-9802-ca5e88053981", "value": "393216:BuuuKX4strDBOXMCHWUjXicuI3/PGTAI:BudKkXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763327, "uuid": "4099d2f4-1567-4089-ad37-4e171fa662ae", "value": 12617397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763327, "uuid": "11b04259-c7f6-4da1-9a54-775c0b56f9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763327, "uuid": "28df0eea-682b-452f-ac25-6d24cf3a8510", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3241dc-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750394, "uuid": "da09a74f-6e1a-48ea-bc2c-9481023c6626", "comment": "Malware payload (Mirai)", "value": "7feaf527095ce0527e2fdf62646951aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750394, "uuid": "0bf7879a-70ea-4e56-a256-6052dcda09cc", "comment": "Malware payload (Mirai)", "value": "064aeb691ac598dcf05ba13636573b5227330c8dd703e8c2a71acf8e8a3ad43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750394, "uuid": "974403e5-f3cd-4662-a47b-26980763d40c", "comment": "Malware payload (Mirai)", "value": "bfd51bdd0d4f46da66c61f7ea69eef1c055bf1a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750394, "uuid": "1daa292d-2341-4a14-8135-52785a8192d5", "comment": "Malware payload (Mirai)", "value": "69ccf694c331681bfc6837b445f7cac9c58931528d50fd9f1a724b60e17b2fc1c99dea237c9c2a19956518473bd07143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750394, "uuid": "5aad0752-4cff-4dbc-b0df-271ba043563d", "value": "T17BC36CC6D787C0F6E92601B42077E7370A72D9398036DA86CB747D36AC16A02E71B76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750394, "uuid": "0a1be69c-09ed-49f7-a6b2-f97f768317f3", "value": "3072:vqTvTVckCuB+1qkJjGKcKP1cUyjnl4cUrAC:vqSkC8iIjx5XUrAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750394, "uuid": "c72b3fe7-1a53-49f0-9ea7-1b7c1b43d0f6", "value": 121256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750394, "uuid": "dcc6f521-f5d6-4b7a-9641-67b7e8b8a81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750394, "uuid": "888af32e-733a-4dfe-ac54-8edc3dafcb8e", "value": "x86_32.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cd83b9-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768717, "uuid": "e6bdcc46-eda4-4997-a41c-40f620401e7b", "comment": "Malware payload (Mirai)", "value": "28f67a9d00aa9a907689ee9aaa04fb0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768717, "uuid": "71d672eb-186f-402e-8cba-a390dec5f591", "comment": "Malware payload (Mirai)", "value": "06777c3166d134e69e39bc24fa08a708cc118417a1b952d464f7c8308cb83ec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768717, "uuid": "3ec7318d-ddc4-4d87-b60f-c74ee97b9b9f", "comment": "Malware payload (Mirai)", "value": "f3f2364cdfe0c54b5a793d0909d21affcc1439eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768717, "uuid": "513793d0-12d0-4702-8e57-8498d6973c4d", "comment": "Malware payload (Mirai)", "value": "1673607b60a1c04c5f36e73be77dbeadaad4b5231f915d221586763798e53c83ff4ecab220a1382b6130ee75b7c474bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768717, "uuid": "11e2ba02-9987-4937-9c59-ebb20b3fb87d", "value": "T14EC39E32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768717, "uuid": "4cbf0244-75a3-45a8-b9ee-db54b665aaa3", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzww3:if5Z5Z98XdmVMJa5aX7biySQHrMwEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768717, "uuid": "9ae5a521-62c5-4149-b8e1-9ebdec8bb7d3", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768717, "uuid": "98b09648-5248-437e-ad34-17129f6ebce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768717, "uuid": "17ad79bb-e81d-4f07-8807-4d7afc1a8002", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc1140b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766341, "uuid": "49225535-1272-4841-ab13-f179b58aad47", "comment": "Malware payload", "value": "3f5f207f1a673423c5b20395ec2e6f10", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766341, "uuid": "8984596e-dd38-468d-be3a-3db28fbedb30", "comment": "Malware payload", "value": "06da57a6d7da2c70c3a718a3f1dde712a1512ae12c2e7deedbd175cb7eea09f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766341, "uuid": "aab6f63c-0b97-4b60-8d5d-a8ae8ff02a59", "comment": "Malware payload", "value": "b03f3991b4b55ab7062c7fe40bd629a101abd1d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766341, "uuid": "95618abd-9a6a-4703-99e7-dcaf544d7157", "comment": "Malware payload", "value": "48dd399f1c14fc3a23a7a2fc22eaf04e158815d45b2ed9221e813ecd3d1fe8fb4bbae6daed53ff7e59b9fdfff2742b3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766341, "uuid": "361813cb-0fea-4f90-b09d-929fb793428d", "value": "T13241277015F048732A216644B3372BA5AB77EC474A93628C38DE2E396F93B42A1AF011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766341, "uuid": "27c24f23-4de4-47f6-b591-b6d0e2b181cf", "value": "48:chRu9Rp9nB6geSqylrm/SE69lr8JU/EFl/F:cLu7B6eqwgJ6fxIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766341, "uuid": "8d7ddc69-906a-41a6-becc-0248c2457146", "value": 1911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766341, "uuid": "e4017dbd-3421-49c4-9447-53d68c6af15b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766341, "uuid": "0e1b039f-841e-447f-baf7-26c71ff23c69", "value": "06da57a6d7da2c70c3a718a3f1dde712a1512ae12c2e7deedbd175cb7eea09f4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e636a4e-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784113, "uuid": "4f9cc042-94fc-419e-b536-0a38bb9767fb", "comment": "Malware payload", "value": "be0efa4c2c6e815b49749a21186f6660", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784113, "uuid": "5f5d9527-c9d2-42f8-b52d-834c6020881d", "comment": "Malware payload", "value": "071207d36467fe346209d513ffa7366491479b6af4592d5ed43efdbf6007dbbe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784113, "uuid": "4971b820-c363-4444-b8c8-0e866e4b2682", "comment": "Malware payload", "value": "f821158b7b9ffe88e9c5e55c910b5bf45609093f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784113, "uuid": "25700219-95ff-4e4a-95e9-4257d8a70068", "comment": "Malware payload", "value": "e90f5992a6686e7aa4747f1024d143f146cfa1825f58a58cda584b673fb9482a7a973b97f9b2db59795aa9df6fdb501b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784113, "uuid": "3f9e8c05-874d-4b8e-874b-a2062ec6b0e2", "value": "T127F2E12596DE5531C387B37B20466D8CF5079E27D2EDB96B36E052CC8D16CA25303747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784113, "uuid": "f9bebcd6-3b96-4745-8933-1324084daf2d", "value": "768:2/QP+NAiJQucR7gWUU/410g/OLh2FHtize1o2H3Crpc:2K+WqQuctgdXmgIkFNizOXClc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784113, "uuid": "cfc40f7e-38fe-4b48-9606-e338aef0e8ca", "value": 35211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784113, "uuid": "a9dda0ae-32d6-4a43-8cb9-b557ce33ec33", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784113, "uuid": "69e5f4a4-0ef2-4ff9-a399-375ec6a3d680", "value": "phish_final.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be01a9f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766392, "uuid": "ef7c7edc-cf8c-4e95-a79f-8b6956a794e3", "comment": "Malware payload", "value": "1800848a7b6bda958a96396741d0ecd7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766392, "uuid": "dad4e5cb-22a5-43f5-aa54-fee087a7c51b", "comment": "Malware payload", "value": "07383e16aa59c1473b555d189bc13751e9afb87849ec1fa528de82d5b5c13fd3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766392, "uuid": "8f8e48b0-4f62-4869-bd64-653a9faf8ee8", "comment": "Malware payload", "value": "189a2caba161096cfb99695381b5513138c60885", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766392, "uuid": "2f6d191c-a89d-4e50-946b-15854064a776", "comment": "Malware payload", "value": "8bf3336c3cd4a49f20f44ede07b12caea5fdc0ea509b1c1182b14db6e1bfd83a62d281738fb0647e6516df56d6752ab0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766392, "uuid": "09707d92-ed3a-4e8b-b587-8dbe5c4eff85", "value": "T10812692B21F08B32D3C460CA53A65A610EB1A70F452614B5F4FE932AAF3C90735E3F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766392, "uuid": "9c18020f-09d9-440b-85d1-281fbdcc677b", "value": "96:cCuosht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjYXVTUESXxITgj+:cCul4hvZ5mrFoKNpivMXVAESXxITh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766392, "uuid": "dc81464d-b1b7-417c-a954-cc63e2da5aee", "value": 9613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766392, "uuid": "8f2adfb8-61bb-4899-bd8e-b9649c915814", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766392, "uuid": "2939269e-beec-4b5f-9529-cb22aef0913b", "value": "07383e16aa59c1473b555d189bc13751e9afb87849ec1fa528de82d5b5c13fd3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcda27e-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766338, "uuid": "84aa852d-4f6e-4083-b747-73f180ef2849", "comment": "Malware payload", "value": "02787ba58747de945b875d262b157334", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766338, "uuid": "871343c5-1063-4951-915a-b8da6f3f0d7e", "comment": "Malware payload", "value": "073b3cda4f9e45892f6d94f1bd8c1c5c3295abbeb557e5c2e1c516f64c8f7438", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766338, "uuid": "1dbdcb98-4bf4-429d-8b25-3cda28fe76db", "comment": "Malware payload", "value": "a0a41aead4b5c0405b01d52c193269c62cee063c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766338, "uuid": "34218f8e-17d3-42bb-9fcc-415c0443899a", "comment": "Malware payload", "value": "355dce8843d84e98ca699e43933d51aca58dabdfe6a9da622cd8b2d79db17623c28b6ce5f5d83aa1206be65a6ca64d4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766338, "uuid": "a4b1fe7f-d8de-4a58-93a4-fa16092e4476", "value": "T1BF327B3B21F08B32D3D410D953661AA54F72A70B492614B5F4BFA339AF2DA0374E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766338, "uuid": "5fb267a9-63c4-4c73-bd85-03f897077963", "value": "96:c5ujB6msht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj4Q6fm6fC6fpAAb:c5u96L4hvZ5mN9oKNpivcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766338, "uuid": "bef23378-fbfd-4abc-8705-ab8f3df892ff", "value": 11184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766338, "uuid": "f5ff3b62-51b6-4ab8-a3e1-448dcb7ed51d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766338, "uuid": "e49fde0f-6b0d-4fec-b8ef-cca23eb55459", "value": "073b3cda4f9e45892f6d94f1bd8c1c5c3295abbeb557e5c2e1c516f64c8f7438.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf65ed1-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738822, "uuid": "8ef60b8d-7658-4aaa-976b-80684c907a70", "comment": "Malware payload (Gafgyt)", "value": "b457d2492b1e4fc92a443df173a0d9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738822, "uuid": "25ed3ecf-9724-4584-8261-cf0b20ff62ae", "comment": "Malware payload (Gafgyt)", "value": "074baf38b71f0b13d75f89effe613e6e86c81787b1f516d1ab3f676db43c78cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738822, "uuid": "9bbf5c54-0e2a-4428-a17c-e3030be8ff19", "comment": "Malware payload (Gafgyt)", "value": "cb709a9a24c200aac27360b55e4d69fa0b2f0e6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738822, "uuid": "ae8426e4-69e6-402d-9bd8-f9427cf2e79c", "comment": "Malware payload (Gafgyt)", "value": "69a020b3a108a0d5006bf43b9a84b42b3ca7cdf94ab64b7d4e3277e1a9f1c028cd4066494f20499c952dcd6d6badaeb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738822, "uuid": "6b7f31b4-b006-4f5d-94a8-49df0940ca7e", "value": "T196A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738822, "uuid": "76e1c2bd-ecc6-45a8-ae80-df41ee54359e", "value": "3072:1Sd+e6mKaGP0NxD3PpShtKmZuqQ4DPwXXtse:C6mxGP0xD3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738822, "uuid": "e64c1f4c-4bb1-4e30-8b17-9fa0da49494d", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738822, "uuid": "2f88a874-cee8-41bc-8f4b-4d6308d74c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738822, "uuid": "1a5ae546-21b0-484a-8c0d-3dac90d2d0fa", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17622b1c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766357, "uuid": "bc1c523c-bed6-418d-8140-06c2f79409be", "comment": "Malware payload", "value": "8d03aa89849eae389e9495d86b7e2503", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766357, "uuid": "c3c3e65a-8bbb-42f3-82e0-0573d88157cc", "comment": "Malware payload", "value": "079eeeb6a8c7c72876669f12fdefd507c36572a8c9688ca74f429985dc7f2b7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766357, "uuid": "7f275383-468c-4778-a2ae-1579fe8d4497", "comment": "Malware payload", "value": "f6dc8a75142be6c3550644246dd6c3a8a3f12190", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766357, "uuid": "37bde92e-1ce0-464a-932b-220e491c440b", "comment": "Malware payload", "value": "88e4a3d494e6d40a5c36e25c6dc4f324c9cd74564cf703437ea5fcfe07806b7aefe343fbf58c99b21d46d10427a9e844", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766357, "uuid": "0c26e555-9f37-4cca-9a3e-c7eabae1b433", "value": "T1E5D118B025F04C736E601684F3772BA6AB77D85389E3618C35DE1E296F87B42B5AF011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766357, "uuid": "94bce681-373b-4b8a-b291-5868bbd44eb1", "value": "96:cRuOB6/rqBi+8u56fm6fexCUxCafCqEKEVdENE0tEAEpgEFElxc+:cRuC6zclZ5v8MFxp+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766357, "uuid": "f001b5aa-2983-4f12-a20f-c9a2ad5c2225", "value": 6319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766357, "uuid": "b7a820b2-10f5-4229-b3ba-0138d1121fb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766357, "uuid": "b96b981a-547e-4177-8011-282d60f673a5", "value": "079eeeb6a8c7c72876669f12fdefd507c36572a8c9688ca74f429985dc7f2b7a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d551f7-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753119, "uuid": "fefc6b7f-2f94-4e9f-a000-2bab3e484e7f", "comment": "Malware payload (Mirai)", "value": "b85b78a79993841bf99ae79918c51d04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753119, "uuid": "0cef0f9f-83e3-4d5f-bef8-c850c1e960b8", "comment": "Malware payload (Mirai)", "value": "083db28108a340a40465ff88e4824cdba1c01e19c581604688a90e347173f41d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753119, "uuid": "89be5ca8-d4e1-4358-9721-4629b152384c", "comment": "Malware payload (Mirai)", "value": "0b7e5b3d1b6d9187d3b70aa7a7ba9c73cae8e3d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753119, "uuid": "4a02ab42-c7d8-43fa-9e36-ab204f44756b", "comment": "Malware payload (Mirai)", "value": "d93ab63819d8f5783af83721fafe452e962388499112363450cba260a9d1de8c27534a18ea80443ecf43756110a46bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753119, "uuid": "91f409a4-a598-4584-aed6-b15cf4786ff0", "value": "T1BAC3AE97FB8718A1C8A206F003C74BAD2E536121CE5FE8E7AD1D663B5A7A4DB05163C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753119, "uuid": "a63fa023-a759-4bbc-8583-88edc25f325b", "value": "1536:TXAOfbzCSysnKDQyEpz17WD3AfosKRF5l15HzJjgixMZQgs66Ef/LWC:rHbzCSysuipzxyu+RF5NHzJjgIgsKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753119, "uuid": "53fcde83-3507-4508-85f4-0408b7fb2517", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753119, "uuid": "a95fa089-1d25-4de5-93fb-b38507a73443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753119, "uuid": "e3b90d81-84de-4956-8af5-cac0c7e0a806", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3141c597-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766401, "uuid": "2b2b8b5c-9dd9-4051-94ce-f74b3ed53333", "comment": "Malware payload", "value": "f0eded97ea419439563819f147d87ed4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766401, "uuid": "c51dbe23-06f2-43d6-a056-61f9c29e627c", "comment": "Malware payload", "value": "0892f5f430a26e8d8d0d174940a4c06046725283ef85241acecc76a753f48c96", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766401, "uuid": "d0b8992d-a7d1-48a6-8acf-5ae915eb9a43", "comment": "Malware payload", "value": "7adbd0dc3dbec76c6c7d2f6bc2e2d744563841ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766401, "uuid": "c1977ded-b773-4bb3-aed6-0ea357462035", "comment": "Malware payload", "value": "2ec69309cbf91cf9b52f5587ffd636e57ca8bf65e100163ec4a1846d879d0877db8c4f5bb6dd60fffafbddb9f37e6d3c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766401, "uuid": "102ccd2d-2bc0-4e11-9771-f0032cfb25af", "value": "T167914C7025F14C732E206A80F2372BA5ABB7D90745E7218C35DD2D356F97B52A5BF012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766401, "uuid": "8be13c87-a10a-4c13-8af1-6147f0473ceb", "value": "48:cnRu9RPdvnSfranB6/OLqlwnmdW9lwn8spklwniPJIrlrE2JIrlr+eE69lrM9E6X:cRuTk0B6qjCdoIBlIBA6fL6fnp05pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766401, "uuid": "b4a9c8e9-39f8-41b6-a982-16e36b787132", "value": 4525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766401, "uuid": "8ee60a28-d4b5-4327-9dce-6635bf6bd8ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766401, "uuid": "a63fcc7e-b033-4ea2-9d5c-9a6452c4890e", "value": "0892f5f430a26e8d8d0d174940a4c06046725283ef85241acecc76a753f48c96.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c194c95-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766446, "uuid": "3b78e2bc-a7e0-41c5-ae2e-ee10f64dc882", "comment": "Malware payload", "value": "f7b77c58137d7ee08f0b857ca2ddcfba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766446, "uuid": "8d35dfc4-d0f6-4ad8-9141-0316175cc019", "comment": "Malware payload", "value": "09173dc4aeefe28202f860e7fe9ac283f23522907c96a8cca84a87fd2d7f52fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766446, "uuid": "8db54ccc-aafd-4d2f-bc84-86c4652c2b4f", "comment": "Malware payload", "value": "db8857c676dc31f952c46cfc4c57e1a47be9363b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766446, "uuid": "aa036c25-2677-4e59-92f7-a0f92514fde9", "comment": "Malware payload", "value": "42f918ef8c42ffbc125c1c01ccfc76fd76ed14145119df9b00d26c742afcba9df7a48e7ef249d30b65b4be4610c6d353", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766446, "uuid": "855f504a-010d-4594-934d-3dcf3aef1adf", "value": "T14C91C77435F14C732E245580F3772BA5ABB7D84349E3318C35DE2E296F86B02A5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766446, "uuid": "d3531c8b-6c7f-46cf-8310-d6b582a7f6cd", "value": "48:cnRu9+19nB6g3ijlwnmQpklwn80pklwni8pklwnEoC5pklwn+i+1l3MT+1l3idT1:cRu6B67sdfpZC1CbTbhblobF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766446, "uuid": "b3981cb0-56d5-47b1-bd9c-ff9ac4770504", "value": 4281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766446, "uuid": "ac530240-07cd-4fea-b70b-12e4e85aa51f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766446, "uuid": "87a572ba-70dc-47f4-b762-ccc306a4167f", "value": "09173dc4aeefe28202f860e7fe9ac283f23522907c96a8cca84a87fd2d7f52fc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f86150c-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776840, "uuid": "8601f6f2-f604-4617-aa8b-73bce2bb8396", "comment": "Malware payload", "value": "c5cc9df568b2c04ecdfe53712e399a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776840, "uuid": "0c07bc67-9f60-46b7-8339-35fd9504bf73", "comment": "Malware payload", "value": "091f405ff4e58b727a91c7c46f58549469c9dd1cad0ed02ba87ddbf04f034c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776840, "uuid": "49a18a57-b50c-4a02-9d8e-4f3b294b773c", "comment": "Malware payload", "value": "5f5036d1de6b46bb20760a4da7751265a52447e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776840, "uuid": "284329b0-5963-4324-9fb2-8e21a292a551", "comment": "Malware payload", "value": "9e811f0bce183ec6fa22b129452303557040e7a002ca3c3f8c5b71db7d00f15eed9cd50c8c99ddb59962816a22484c75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776840, "uuid": "ecce3a2d-aee8-439b-b6f8-606ef5f462d9", "value": "T14ED3F154F080EB73C6E016BDF69D260C734347B8E2DA73498D259E3627E665B4E36E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776840, "uuid": "5e095677-23f5-4678-836d-43e37927f449", "value": "3072:7D0ownSrawTbO3ubsh//NSXcWIuzqs1lGD:7xwSuwHO3uoh/lwYuzqQlGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776840, "uuid": "606a7440-2b44-4e1a-834b-9ee164a324f8", "value": 142073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776840, "uuid": "db6f4044-b5ba-4c34-9fa7-9dd5b8fa2017", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776840, "uuid": "7ddbc50a-bc67-42ed-b3aa-46d5e4cd2947", "value": "8d4n4ly8d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bfe73a-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769007, "uuid": "a2732a20-cb42-49ed-bb2f-a6dae03c03ce", "comment": "Malware payload (Mirai)", "value": "e750777f5cb2139dcd48113bed32c451", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769007, "uuid": "edd70517-6e92-4b93-b665-5a5089e0d598", "comment": "Malware payload (Mirai)", "value": "0945339f4560684d3582d653fdbfb13fbe68cfaf5b7a5df1f8307a6844660b75", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769007, "uuid": "6a642468-558f-48de-9e6e-0349df8b9ee2", "comment": "Malware payload (Mirai)", "value": "a12e20f7cc52cecda93c4e29e4bce53a8bba507a", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769007, "uuid": "04f5a3bb-4331-4368-807b-47f04d48b0d2", "comment": "Malware payload (Mirai)", "value": "cdf7780d035d7f725d8b7695469cee35ad41d98cdbb9578f0938c909574c31fccfb9f61d5f307eaa20bfcdce75558c32", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769007, "uuid": "9b5189c5-0a27-4de1-acff-959758803620", "value": "T16B430136F52367B92EE14DB45528B4827E5E3C3CC7CEF422964E9A8816C5095AA3CA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769007, "uuid": "60401336-5d31-4eb9-a32c-3ada148fe827", "value": "768:MyOuP35sdtwTQJjTFmAj9cw0cN4+vFCzzsmyjsa71lrvR3KxQtGG8aS9q3UELdTf:T5sMQTmAh8cySw2vUxGiQLNjEX29l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769007, "uuid": "0008b777-52b7-4ec2-ba04-03b1c772ca68", "value": 60524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769007, "uuid": "dec555b3-ce2f-47e8-814e-b476f3bc885b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769007, "uuid": "0b662a38-7156-4121-8849-2ce3e7009cf4", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892af696-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738631, "uuid": "ef813189-c261-4153-beb6-64926a1aab22", "comment": "Malware payload (Gafgyt)", "value": "9bcdd4f97d70d6afb787d6244408a25a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738631, "uuid": "2e4d726f-689a-46a3-a43c-0808e6ebefe0", "comment": "Malware payload (Gafgyt)", "value": "0972bc7f4bfbe64bfc5c85962d976f69d160f776cad94b4cb69ac15a2fdd05f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738631, "uuid": "0269bf1e-dc40-41f5-a163-dceba9a2f33a", "comment": "Malware payload (Gafgyt)", "value": "9d0fc8686263dd711992f66e52fefcc5ab156fae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738631, "uuid": "1dd83dc7-a2c5-4c12-bd02-a0febbac57ac", "comment": "Malware payload (Gafgyt)", "value": "f9307563b6b406ef5ad3cc0aaf999b34fc318bb5fff3232e6694b56d625a034a2fc33dc53630284a2fa7e27723ba5975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738631, "uuid": "b4014823-8184-458a-80e4-05443a9d4d44", "value": "T15CC32805D5508727C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738631, "uuid": "e4d2fc73-4cfe-4114-98ea-f854bb09a2ff", "value": "3072:WkYPgPggnAb0JWaY/VfFEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8FEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738631, "uuid": "6cb1a371-296b-456e-bb44-dc0bf98d8e0b", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738631, "uuid": "324a6ead-d900-4651-b61b-9acdd4f21541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738631, "uuid": "7b5716de-0fa8-4f73-8a70-23e87b5c8f71", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6492c02f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766487, "uuid": "7cae320a-0a18-4fc2-b2dd-fe0faa6b78d8", "comment": "Malware payload", "value": "ba112f4abbdcdb500b7f3df0a85af0a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766487, "uuid": "b70411a5-0682-4020-96e4-9e02c91bed97", "comment": "Malware payload", "value": "09769b2b27799fa1c081ce187679681f374b558a6be79aa496ebde77368fcb61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766487, "uuid": "dc63623b-bc83-46d2-be7d-2cfa7ecdc90f", "comment": "Malware payload", "value": "0569f3e21e5b7bf3e2c714b7d448256b02632869", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766487, "uuid": "275a4772-9d8a-41fc-8dcd-4df80aad2dcf", "comment": "Malware payload", "value": "55bf987a607669a9ebb051561e6b1b835f2f2455e76ef030947af5666839471540f3e3a9440bdc7cbf55df90de824ed6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766487, "uuid": "0675ac4a-3d64-4f5d-ae6e-665d08055289", "value": "T1FD412DB025F148732A611540B3371BA67BB3D8474593228C38DE1F396F97B06A1EF422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766487, "uuid": "ceb9f4dc-edf4-4113-b0b3-b4d43576530c", "value": "48:csRu9RLsnB6gtCznlwnm52H9lwn8zU/ol/i1UEl/C:cCu/mB6tzQqnsLoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766487, "uuid": "f468c7fb-8ecf-4891-a65b-1fca849e6434", "value": 2307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766487, "uuid": "404c7373-f58e-4dd0-9fe9-4df171304290", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766487, "uuid": "b4baa623-f829-4c1f-897f-3044a34ffa77", "value": "09769b2b27799fa1c081ce187679681f374b558a6be79aa496ebde77368fcb61.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2005d585-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766372, "uuid": "dde5f110-c7f0-47f9-90bf-e9b6461ff70f", "comment": "Malware payload", "value": "65f5675096b2cbf37c72e623b1b04155", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766372, "uuid": "70d494a6-2748-4927-8051-8ecc6edeb9d4", "comment": "Malware payload", "value": "09e736d5b70cf63735d5645d83044408b5de70c431aa41610c1366bf77df5220", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766372, "uuid": "85dafb61-4198-46aa-bdb8-54e7ec015206", "comment": "Malware payload", "value": "99bcda938173d89ee47592383c5e888d2a8712c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766372, "uuid": "c2026c56-b800-4bee-9c4a-62ec8f272d3b", "comment": "Malware payload", "value": "143a0c77cbaf885d71f3dec327412a6e63f89dc81bf8fd600e46bd0925be134dd153ff0f40486e02ce9e0ae382373742", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766372, "uuid": "133430ab-ddba-4ff7-b166-4b0bb0d807d4", "value": "T19B42893B21F08B32E3D050C963A61A614E72A70B456614B5F4FE673AAF2DD0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766372, "uuid": "8a37dfcf-a103-4e28-86a0-d095492ec1ce", "value": "192:cCul4hvZ5m5FG4j4HKNphv7fOQ4lVSPPffVITOe:a4hvZ5m5FGGoKNphvh4l8PPffVITOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766372, "uuid": "214d9e6e-65dc-460c-8805-6e1ec8b59787", "value": 12097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766372, "uuid": "a988a6c3-4bb2-4765-bd63-2811499d4050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766372, "uuid": "50c5f3cb-6cf4-44da-a4de-81bb6ce83926", "value": "09e736d5b70cf63735d5645d83044408b5de70c431aa41610c1366bf77df5220.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8694484-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752937, "uuid": "16ee30ae-f183-4aa5-bb06-29c1903b5fef", "comment": "Malware payload (Mirai)", "value": "f920063cfd42b4ca2badd9baf78a2a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752937, "uuid": "d686d49d-56fe-4694-807f-b6125f4e87ee", "comment": "Malware payload (Mirai)", "value": "09fc8ac73267bc1f7cf0004ab4c976f406437b90e9eff622beddd6ce9dfbdac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752937, "uuid": "929883cd-8e5c-46e8-84b7-fa04dbb1cc07", "comment": "Malware payload (Mirai)", "value": "0eea9f1ffbb92fa8c74de9e02384ca2299d799b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752937, "uuid": "47f975ed-886b-4a74-ba53-2a03df55b73f", "comment": "Malware payload (Mirai)", "value": "784c8e9bacbd66011ce1ac6898949e62658552022117b0b629ed19665b205884d35a0cfc75c7b7e4a89047f39bb8fb6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752937, "uuid": "f2e5ea77-3002-42f4-82dd-a123ea603064", "value": "T10CA33A92FD815A12C6D112B7FB6E428D372713A8D2EE7203DD295F21338795B0E7B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752937, "uuid": "0705ee4d-a52a-4b5f-b0a7-c1e6c7364a67", "value": "1536:s+gt2b86szR79w/BDr/FOPTQSqpQ9w4JovcnevMe6JdhEkvA3r:s+a2tsz9WoTQSqG9DovkNtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752937, "uuid": "bbd4f33c-b4a1-470e-bb43-aac04a7acf6f", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752937, "uuid": "8d78dd7b-b3a9-4b45-848a-00654e278b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752937, "uuid": "65c02f5f-06e1-4b19-8e26-13d96656cbee", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cac5db2-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766152, "uuid": "9f64c545-a2c0-4cf5-9bcb-6b20cacb7a86", "comment": "Malware payload", "value": "892a9aa71618036b6c29ba655eef4095", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766152, "uuid": "a93c9ced-1fe8-41ac-bc0b-154c22ea8bd4", "comment": "Malware payload", "value": "0a63590f5314fe26184e38c61552e6fecee109f762d74c3ef174a8ce0db5deca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766152, "uuid": "bc3af9f4-1ccf-475f-a903-59728c42cf2c", "comment": "Malware payload", "value": "65089549d2f180127813d96da42118af6f1aabec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766152, "uuid": "9a47ebad-3579-457a-92d8-b2e8bc94355e", "comment": "Malware payload", "value": "b55220f3995d8b55794642a891b7b980ca9d35facf591a8c6257e71c43d915297b941c099424ade6937174e775dbd410", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766152, "uuid": "5a04d89b-9abb-4578-961f-5a2f1c740c4a", "value": "T1AA12B57525F208333A706944B3772BA2AB76D95345E3218C35CE2E266F87F02B5AE811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766152, "uuid": "3a7d8823-3f5c-4dc7-99e8-782c56629229", "value": "96:cLu/mB6wNEexE+cBhxnCGHoSISogV3uvJv56f9/k:cLu/K6QlHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766152, "uuid": "8a2da430-42e4-485b-a847-7eb52f0b52b3", "value": 9334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766152, "uuid": "fc786d2c-53a0-4c40-bf9b-a758f34ebf63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766152, "uuid": "4f6c6c99-b126-4c8b-ae5f-c0980a5be481", "value": "0a63590f5314fe26184e38c61552e6fecee109f762d74c3ef174a8ce0db5deca.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0959ab69-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759462, "uuid": "0db4047c-1c87-41fe-a837-7456e7f09346", "comment": "Malware payload (Kaiji)", "value": "451374308f49c3b0f54d27f25490cbb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759462, "uuid": "09d5d44b-c81f-4e75-bb7c-642561d604e0", "comment": "Malware payload (Kaiji)", "value": "0a70d7699c8e0629597dcc03b1aef0beebec03ae0580f2c070fb2bfd2fd89a71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759462, "uuid": "45db8b8a-c597-4032-ac5e-07b530accd26", "comment": "Malware payload (Kaiji)", "value": "eb41e5c6564dcd6119fa0ba6ab98d0f8eae16307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759462, "uuid": "7a30e10c-9f8a-4b3c-95c6-7f3c7127b73f", "comment": "Malware payload (Kaiji)", "value": "a64378a910c964f7d96a0bd3605b8dd5c152a849d14bac1ee3eaa54295bb0a164f51e7d11729e99a290cc851ec603409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759462, "uuid": "9245c7e7-225b-4042-af97-8865a2ca9dae", "value": "T186952847B89156A9C0AAE234CA664252B761BC991F3163D73F10B3F82F33BD45E39358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759462, "uuid": "337337b6-79d6-4b48-aa25-72a341b1aa73", "value": "49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38k4B+g2vUqHOErz1:tPXZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759462, "uuid": "9863d06c-3ab0-41b8-b0b0-8c7283b18b9b", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759462, "uuid": "c197b463-d459-42a1-8e80-055e0a394adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759462, "uuid": "169e18ca-fa5b-43e1-922a-20e469e639e5", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785dfcac-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790572, "uuid": "d990c576-8f9c-4970-a622-3d85a0e30893", "comment": "Malware payload (Mirai)", "value": "2537895afba6678dac38b7bf29f12859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790572, "uuid": "dc6aa934-f84d-4827-87d1-d06bf3ba221b", "comment": "Malware payload (Mirai)", "value": "0a9477d5c4cb49bdc815ba7374c72e1fd0c0e563233624155e4193b11214dc1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790572, "uuid": "2a5ec019-4331-4030-a031-9f836e7ab0d1", "comment": "Malware payload (Mirai)", "value": "6d4ad906082ef9e007d58bcce33045cd7c4f63aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790572, "uuid": "1dcf1d9c-eff9-4dc9-bad7-57af9d58c4b8", "comment": "Malware payload (Mirai)", "value": "14a12e17ffe33b5e5591cdbd4637fb04871b3608d8987f64f105f5a0947f70e7007c55291d3a3276a027a21bd5826f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790572, "uuid": "4e2ae5e2-4d3b-42bc-88c4-27fd27595d72", "value": "T1B763C4CFDA3D0A43C4E745B23D2737E48F7CA53612A421C59106AFC506BA9B65132FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790572, "uuid": "cdb2cede-b4cc-49a3-bb00-5da61ad93fc2", "value": "1536:dJV80ilfkjlY4DupASBCQZyFMr+DAeaKUtXG:a8jgsQZlztW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790572, "uuid": "8ec44945-d59d-439a-91f7-72b529274aaf", "value": 72996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790572, "uuid": "14ae86e0-c782-4464-9635-cef0e5f3d946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790572, "uuid": "a2c9c4dd-841e-4e6f-a19a-80a21bfac3f3", "value": "kt8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a21a633-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771752591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752591, "uuid": "28776a5a-a799-4704-a104-a4f5700541ec", "comment": "Malware payload", "value": "2be8d539e569a66bb48b8f654182f9af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752591, "uuid": "ba77eacd-707b-488c-bd63-c7430ada8395", "comment": "Malware payload", "value": "0bdaf57008155d86386be211659052e0a86f2108abf2d3368b3693bc256e2e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752591, "uuid": "1a36a217-b42c-4396-8b8d-d1d420c72d47", "comment": "Malware payload", "value": "060ea7aa1d17335caf085d115908c4f920c7ee28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752591, "uuid": "31c8bf93-de77-4435-943f-89e88b64bfbb", "comment": "Malware payload", "value": "73faab811236e37646c2284706ae9b113fe13d9ab0ec3f416442e377aebaaf5b5b0a16a3fe2b97f7fa8e97afbb4d89ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752591, "uuid": "e05b3161-68a6-4a6d-a1b1-d2fcb8590c8b", "value": "T18A711AC7490870A5F71316FA02DB1102F07A06F48393874E9A90B0386983E85D4EEEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752591, "uuid": "049b34ed-3452-4565-a779-2a80fa597d85", "value": "48:edPJDdE7TaOx0JnPCOkdk+SiY+Bo89kgooepE4nBNCqxonKuM6DWb5:sDdE7mO0N7yjooGbfCquy6DWb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752591, "uuid": "8c605489-53bf-436a-b434-27e3a4f47e85", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752591, "uuid": "f604e334-146b-4791-a60b-0b6368209709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752591, "uuid": "536b8d33-f20f-4f47-a015-6df0b4270515", "value": "winsvchost32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42f2450-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778727, "uuid": "863274a1-85c1-4866-a155-a22742be4743", "comment": "Malware payload (Mirai)", "value": "ce3c4b5da5802efb970deda6a7b4f86f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778727, "uuid": "50132ce7-b462-4894-8e81-e8f8df427efe", "comment": "Malware payload (Mirai)", "value": "0c46a5d80d77f82b32299d00973094fb5c48ac4f2c408ca452c9837b1e01fed6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778727, "uuid": "4afc3e50-847a-40d7-b9d1-692826af9d5d", "comment": "Malware payload (Mirai)", "value": "f9bad4e85b322f99fceb49c155dcfcd87ea6323b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778727, "uuid": "0dd6b8b4-2a0c-4678-8fa6-d2540b15d6d9", "comment": "Malware payload (Mirai)", "value": "e1f96d944df9a9b243c582aed2052ef8b7e404e5bafd69ece96bafc6b626d141a9330794d60ee3cde9da7908cb582576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778727, "uuid": "a8a98387-6790-4f1e-abed-1d97911d9b71", "value": "T1E47423F4F5D60CE7E14B08B4C60A1E379F8E1A7E448C1A097ADDC4EBED391AD18951CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778727, "uuid": "124a69b4-9499-4379-87ba-57f436fd7264", "value": "6144:wPrNuNXglH1+qQ1K3mipl8fLSFplOIV+UusPSoJWllvn5CoAciWYk9NsN:m0qEK3mipmj0pl/PnJE5CoAcqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778727, "uuid": "9cb2b546-a5b9-4915-af58-acbd3aad7033", "value": 349324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778727, "uuid": "6af67fb3-ddb6-4b95-bd05-30be2eac18d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778727, "uuid": "40000a18-cd27-43bf-8024-678120f821a9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7b68c9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766339, "uuid": "3301c1ed-8e31-4135-b943-e26ad29cecad", "comment": "Malware payload", "value": "bb248828fd73a606323b64158bdadd83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766339, "uuid": "71a97770-66e5-44bd-82d7-d228c1233a58", "comment": "Malware payload", "value": "0c707152ed75da5c509646adeb522166e6812019e4b65cd3146cd7005369c89b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766339, "uuid": "2b8619c8-5682-4ade-ac86-861f340cb779", "comment": "Malware payload", "value": "9d9796bffb930566c9c5535a930bd926cca58be8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766339, "uuid": "3ea392dc-263a-4586-9248-3db4b3810ce8", "comment": "Malware payload", "value": "71e1f4746beedf18a67ba4e188e994ca75b1b0531f6ee1c3733cb414e121f1350539846e6c53b702a550eed4c2df7388", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766339, "uuid": "4479b7d1-3216-462d-9d97-dd72a143d534", "value": "T17B12353B21F08732D3C450D953A65A614E72A70B892614B5F4BEA33AAF2C90731E3F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766339, "uuid": "08cd9bed-7464-4cb9-9055-7c9aa81def52", "value": "96:c5uTmB6msht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjWUArs:c5uTK6L4hvZ5mN9oKNpivlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766339, "uuid": "c5934eae-c00b-4b8f-af5b-5bba84b7584e", "value": 9649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766339, "uuid": "afa70c32-d1fd-4aff-8ece-ccc7c6575c51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766339, "uuid": "daac8840-906b-4e35-b5dd-a2b6b7dc1ab9", "value": "0c707152ed75da5c509646adeb522166e6812019e4b65cd3146cd7005369c89b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f8611a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766375, "uuid": "8a4228a9-e985-48e7-81a8-ce5bb99745ed", "comment": "Malware payload", "value": "1711d855370d0dda74e4c0121452e4ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766375, "uuid": "821a947e-8d1c-48be-95b2-4ae1983e2eb7", "comment": "Malware payload", "value": "0cf1d5a734c1a89018c86462d3a2202fbaf4c5b831dcd11222671dccfbb87602", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766375, "uuid": "6349c5ad-55d7-4d01-9c5d-0b76dca20ef0", "comment": "Malware payload", "value": "78f06d30c89294bcdc71e760dd3979d2ec3b6117", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766375, "uuid": "83e00baf-e31b-4303-b02b-a7601241bb53", "comment": "Malware payload", "value": "a34e0c98e9ac64f9413d68324455e896e472f6d252fdbaaf2a54b472fcd745efdf0646a670bded40bce9a54ac1ebea90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766375, "uuid": "497e97b3-c069-4bf1-9e57-fa12acb9c4d7", "value": "T1BA92917620F08A335A9055C4B3772BA15F72965745A320A8B4FE2F359F59B03B0FFA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766375, "uuid": "b965a6e9-ffbe-49d5-a9e1-befc86f82fca", "value": "192:cCuDg6p4hvZ5m5FG4j4HKNpiv7YSdAiyfEsUzUGf:Mbp4hvZ5m5FGGoKNpiv7YSdAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766375, "uuid": "519384fe-dfec-4b22-bce7-79a7b3f2a318", "value": 20936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766375, "uuid": "8ff7ecd1-519d-423f-8d8f-78ca452fb4de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766375, "uuid": "c6d84c18-cbcc-4edb-93ec-8e14327a798f", "value": "0cf1d5a734c1a89018c86462d3a2202fbaf4c5b831dcd11222671dccfbb87602.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbe8d7a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766418, "uuid": "729708a5-7739-4c01-bc13-7a361ca22d1c", "comment": "Malware payload", "value": "037da4c79c62c69b3d4e6ab07f7acfb2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766418, "uuid": "e2b06975-4f3a-4c65-a04d-ad84b3bfb331", "comment": "Malware payload", "value": "0d166fe13b91f1ce39ed8a5b046ee1b9428b880a432ac7948cbd005aed23b1a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766418, "uuid": "26145d8d-86f3-4234-8554-10c057176a85", "comment": "Malware payload", "value": "dfe03b016ddd1bcdd93a1ee5d1559f73eaad30de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766418, "uuid": "5c7838dc-9728-473a-a8cf-83951f31c4e0", "comment": "Malware payload", "value": "9595cc38656d110cc3d376242bb5314972864ab3b776028aa3db635cef7b89ef88abc7dd47541c96bf9ecd77741c3300", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766418, "uuid": "27c23f16-e703-42c2-8b7b-b39c876b7efd", "value": "T16B12332B21F08B32D3C450D953A65A614E72A70B492614B5F4BEA33AAF2C90735E3F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766418, "uuid": "213f0fe5-9e1c-445f-ab3b-7415fe7cb1af", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjUPZqzxs:cCuYK6p4hvZ5mN9oKNpiv2Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766418, "uuid": "fd56ca57-9db8-4e83-95aa-da2eb646b1b7", "value": 9570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766418, "uuid": "bbfe0768-3ff2-4e8a-a4ad-18c870c19097", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766418, "uuid": "95530d14-9336-427d-b400-44b9bdbed0cb", "value": "0d166fe13b91f1ce39ed8a5b046ee1b9428b880a432ac7948cbd005aed23b1a1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a86771-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771864, "uuid": "713851ec-06a5-439d-8ee0-1843c997fc5d", "comment": "Malware payload (Mirai)", "value": "46201cd6d2e1492bba4a57a069e34b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771864, "uuid": "82104ba9-caa6-4b11-a7b6-b4eecd7fbf5a", "comment": "Malware payload (Mirai)", "value": "0d4e356ac4585ab465563bc08d9d4bd237f55aa663556783c346d4a4b1c7ab0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771864, "uuid": "5305ea91-2dab-47df-9830-fdddbd094b82", "comment": "Malware payload (Mirai)", "value": "d977407ed31251a450b57b7f1614313599cb0d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771864, "uuid": "d69deb6a-5ab9-4ab7-a5ee-8a98d7191b41", "comment": "Malware payload (Mirai)", "value": "197af694f7d8f80ff485d00ed4433cd8d84dde4d1f1fc3c1b7c1406738253d7161765f960861ce2e4324993a47d79647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771864, "uuid": "ce6a390c-e191-453a-8cbf-9b4c85480646", "value": "T1FB736BC2B643D0F0E92606722277FB324773E13E0069DE43D7AA9836ED52641E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771864, "uuid": "7d949d9c-8683-4c0c-8698-9d42eed2aeaa", "value": "1536:mKBYOT1n4SLczHljOzxfEVa5QR3f9T2ZA9rEZsS4BRSi9LXB9:mqN4SYpjIcVeQR3YZAJgtYLXB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771864, "uuid": "5bfe4391-0a7c-4ab7-a26c-0ccb50897ba4", "value": 80272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771864, "uuid": "1ccf7db8-387a-4db8-9e85-6d7d721be9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771864, "uuid": "68bc6822-a4f7-4599-9563-6d974a39f9e0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0375f8-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768732, "uuid": "91a2772c-7e79-4c7c-8413-118ae1523f3a", "comment": "Malware payload (Mirai)", "value": "0a367555b8b2e49d468b62cc524f2fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768732, "uuid": "4fed870d-f0b1-48c8-9fa9-a095245d9c89", "comment": "Malware payload (Mirai)", "value": "0d57cd50f315f036da675f47b4ad921236d2c6be5372d723b3dd17d58c22d111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768732, "uuid": "4f23d92a-5731-4874-9561-7fe2ecd6005a", "comment": "Malware payload (Mirai)", "value": "4b2d8502f5d6e607b055b62daf21d18edca99fb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768732, "uuid": "43d44b6f-cc91-4dcb-a350-55a39ad0eef6", "comment": "Malware payload (Mirai)", "value": "9b43d3e84fef9a6733ea3102f140d2a286cff9d0a778943ec96430f5e243582e8c0ece2bef0cf3e4deb25ad2f75952d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768732, "uuid": "67b3c603-2666-4263-b3b5-b9db39e83f32", "value": "T146E35D9AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A61D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768732, "uuid": "f002086a-e9f3-48c6-878f-f6e026f3f360", "value": "3072:huWypdcGShA/ETn605TCFdsU3rXl9BzrTyT7P:sCGShAMNTt4Xl9lyT7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768732, "uuid": "64fcc972-201a-403e-b43d-e4ee9f870e17", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768732, "uuid": "e3774ce7-8aa6-442c-be4b-d8440e135980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768732, "uuid": "cc15fd53-6869-47fb-839b-b02d69951582", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f227e4b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766478, "uuid": "f10afa3d-df23-4fc6-be18-3d9037debcac", "comment": "Malware payload", "value": "70170b4aa18740d03b679963e8bdd04b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766478, "uuid": "3d6c2204-d828-4040-ab23-43bafea00c8a", "comment": "Malware payload", "value": "0da95b4a63e5d59dde47c6d1f290089356e04b9145dd97cbb7d3d45eded8d366", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766478, "uuid": "90260508-c9fc-4ae7-87f8-f2eaa61acef8", "comment": "Malware payload", "value": "079af8fe01701b15bb67b70fb9719be4b600ef8b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766478, "uuid": "9dc698f0-3f4a-4059-a97a-6c33def317e7", "comment": "Malware payload", "value": "191f64a285c3afd55c4f7fd431bc8dd9c49fa15965f037c7c1b863fd764809a50435ad7a1c9f9f8fa3615479409bd85e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766478, "uuid": "8ec98b11-ac39-4dea-90b8-3453de0bd13f", "value": "T12221917490F25E73298C744466F317846F73CB17815213E876EE9FA64F8AA43626B820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766478, "uuid": "57c29c29-258c-46d8-a9d4-65cf58c8f184", "value": "24:cniRHRURCxO0tbmN2M1sLo/iPdFHjeef5uZW5FkXdflUlc9HHveN:cniRxuGRys0/iPdFHPwWYclwn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766478, "uuid": "7e86fb40-3cbf-4ca0-8617-2b461d2fc411", "value": 1388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766478, "uuid": "4d482660-e9e9-489c-9687-e78c7199f17c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766478, "uuid": "ccd609fc-65db-4d7d-aa35-f481fffab0ec", "value": "0da95b4a63e5d59dde47c6d1f290089356e04b9145dd97cbb7d3d45eded8d366.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4e6161-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768731, "uuid": "d6431683-fc34-4157-b744-07e7a51ceaa0", "comment": "Malware payload (Mirai)", "value": "84c61f5a2ac9350beb7dec27163f563c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768731, "uuid": "c2b0118e-a7d8-4e74-a7d3-e253cffa8e8d", "comment": "Malware payload (Mirai)", "value": "0df5b8b377a003a3ac67df0b25e00a118065e49bd0113e24f654216465622499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768731, "uuid": "948abc27-c043-438c-883c-5f98b79d3e4f", "comment": "Malware payload (Mirai)", "value": "2ae6d7b45c153cd0201071e15b00530b5c69fc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768731, "uuid": "635367dc-8cd9-428b-a84d-97f195f080a0", "comment": "Malware payload (Mirai)", "value": "66e20df2e26beba76a61c8fddb616aa353ff8ebd300482be5dfff9c23852b38533568cf7dcfa9dffa88530a66cc76a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768731, "uuid": "5ea1de1e-15c6-42a6-8ffd-a0ab7e4daab9", "value": "T17BD35C0673180E17D5A349B02A3F1BE083FED5D021F4BA89691F9B6A8676D3B1485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768731, "uuid": "e659a896-a056-4df7-bb01-22717cff26f6", "value": "3072:CV0zui1ZhMHJ6A+qrxfbOUm3+Q2Mc9Fkrn:LP1YO8dbOUmuQ2Mc3krn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768731, "uuid": "dec0bd8f-0cb6-4408-bdef-a7c2e2e426a2", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768731, "uuid": "0cdb6635-ed6c-4582-aa3c-081f195dceb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768731, "uuid": "e8f05e49-8c07-4870-abb9-4bee97b703cd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1608a1a0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766355, "uuid": "b5e0f863-58a7-4a0f-be5c-d65504bb88a1", "comment": "Malware payload", "value": "174208bdbd56a5a5efa27249dbf1b4d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766355, "uuid": "679f8493-f3f7-43ac-9c7b-cad3fc6cf600", "comment": "Malware payload", "value": "0dfcd9f9e197545af7e95ade72fe4990c46082bc1cd2ca3e8d0104b71574bc8d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766355, "uuid": "594b39be-430b-4a3a-8169-7e8c624497b3", "comment": "Malware payload", "value": "9fe5f4897bdc2329163f800fc5b54da5863a463d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766355, "uuid": "d67a8627-309b-45bc-980d-d6c5c2b47cde", "comment": "Malware payload", "value": "5351dac09edc246c49190adf009a955b4cd3aafc9a3dbe5d2c2a662d7ad182ed50295febc932ae82312b47b9a6c4041d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766355, "uuid": "13dfcca5-f2d0-4a5c-aa22-86f243de8f59", "value": "T191A1C8B424F00C332E615680F2772BE66BB6D95355E3658C34DD1F396F8AB13A1AF421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766355, "uuid": "361089ec-dca5-432d-9d5b-496b78fcf521", "value": "48:cnRI9RnnB68wUblr8LUblriLUblr46UblrXGUblr+fUblrM9UblrioUelrXs3lwg:cRIbB6Exbx5x+xjxPxBxWUJ/vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766355, "uuid": "6582c61e-2155-4005-8271-9c5b4ec8527e", "value": 4810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766355, "uuid": "4c3722ec-654f-4fde-a693-ae22b1c86054", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766355, "uuid": "bc278c6d-8ed0-4fb0-87fc-6af13636725d", "value": "0dfcd9f9e197545af7e95ade72fe4990c46082bc1cd2ca3e8d0104b71574bc8d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f63fdd-1022-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787566, "uuid": "8f8d35ae-b93a-4af9-bf4d-0e92412e502d", "comment": "Malware payload (Mirai)", "value": "0e5224b6465e5f411ad19da279d98893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787566, "uuid": "04bcb088-8755-42ca-825a-9e0e3a817650", "comment": "Malware payload (Mirai)", "value": "0e6de6071cb36c368a316086b776f145882796e6440130abf16f58c4e817db61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787566, "uuid": "036b3ced-9924-499b-bdca-3fcd863c167e", "comment": "Malware payload (Mirai)", "value": "457197f975b8b7003a46147304cf173d10ce7154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787566, "uuid": "64663a91-ea11-4496-bdde-c0632100d698", "comment": "Malware payload (Mirai)", "value": "3b103f4a065daafaa4cce18688023f500f3c06049bc1e0a83716c8a6cdfaad8b1155727fe7b7af359de26d2bff6d91af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787566, "uuid": "65649da5-d43c-42e0-a80d-a3fd7c4aa7b0", "value": "T188C3AE83F78B14A0C4A206F007C74BBE2B93A121CE5F98E37D5DB53B5A7A4DB0916395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787566, "uuid": "f94a6cd6-63f7-4746-94e8-b5db639ca07e", "value": "1536:VKy2Ztnejju0QNEVQVCWxZQWaOcOQijlkPhJSqzYjxIRKQig4RQMQ/LWM:YHtejjuNkQcWZ3eOQOYhIqzYCigOQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787566, "uuid": "90bc7b93-184a-4a1c-8e5c-262a8b52d16b", "value": 124704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787566, "uuid": "f18e085f-6c63-45ec-b1ff-207b28195c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787566, "uuid": "8afa294f-ea61-4d4e-9876-b3b3b2ce8bf2", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c03967-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784152, "uuid": "56e27a16-4b5b-4eb6-84e2-64080cb6a1a7", "comment": "Malware payload", "value": "ff5aba648966325499c17beb1d52e0fd", "object_relation": "md5", "Tag": [ { "name": "odt", "colour": "#C94F45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784152, "uuid": "6046f116-7501-4e6c-b0e5-06c426406183", "comment": "Malware payload", "value": "0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb", "object_relation": "sha256", "Tag": [ { "name": "odt", "colour": "#C94F45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784152, "uuid": "f4ebe284-ca34-4425-921a-c1ccea5f6706", "comment": "Malware payload", "value": "5011995c88318389ce8bf956e157dadf79dd792c", "object_relation": "sha1", "Tag": [ { "name": "odt", "colour": "#C94F45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784152, "uuid": "00aa4a84-89c8-472c-b9d5-b42b37c3d62b", "comment": "Malware payload", "value": "d00244ce71852f5d7781cdf3b243d43f9f1e5c5189185965eae58ab4d729e24e45fa3279d8294702acfc3b8fc0b20792", "object_relation": "sha3-384", "Tag": [ { "name": "odt", "colour": "#C94F45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784152, "uuid": "af2299d1-891c-441b-9cc0-558a9766540f", "value": "T14941B6315C05C746F372B3B694AA99C2E40E22F1EB1C6B23B0F4E1786DDBDC40A2135A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784152, "uuid": "d4c588cb-f1ef-47ed-9a14-5958c90539cf", "value": "48:90q9mLBbAIiSKXsulXvvGskoQoOqL4E6W+zwwB4emGKwk:GqkjiStEOs8eL4E6WSHy1wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784152, "uuid": "7c4c1e59-5456-4dcf-91de-6ac113bc41c4", "value": 2358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784152, "uuid": "726336ee-f8e5-40a6-b5d9-01c0ae839d34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784152, "uuid": "0b062e66-b18a-4d30-9fef-5d4afade8fb9", "value": "rev5555.odt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e355f0-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784073, "uuid": "57c16339-a83a-47d2-9922-2f2e31719812", "comment": "Malware payload", "value": "db9d6f2434e960b380c4a6073cb85b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784073, "uuid": "75fc1aae-b4c5-47b5-8cc4-38b552cb5403", "comment": "Malware payload", "value": "0e7d48636d29a59361c13d60dcc16aff14a0e0b16f8a1dd346825a8b139e0ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784073, "uuid": "caf23b6c-7daa-4d7d-8db9-c42bf2883b22", "comment": "Malware payload", "value": "98e6cc80191a4cbb324a3bceecb7689274ed3ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784073, "uuid": "27e4ddef-52a3-428b-8ac3-1780935f7dc2", "comment": "Malware payload", "value": "43c6dbb1dc2b26fa3f55c6559c88422048250c1de30cf62281bb832b29ef468f241bebdafcda5b965ad3d046b76561ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784073, "uuid": "f6593c15-9911-416a-8231-2442e49bf4d0", "value": "T14E834236E6B3C4ADC05BC634AB8394B7B9F07C5C463475194781A6223B5FE386BBE580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784073, "uuid": "cb1f5476-1315-4add-8ee3-5e6cd6de0639", "value": "6b133001594cf90aafbcc38997fd46e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784073, "uuid": "9dca379b-5f9f-4868-8340-9f0054988ad2", "value": "1536:jv5DkpcQqa1hAGH2GAd/SUcNQI+fNbm1M4V5R1RHZljA6d0tp1OHFkkN:jv5DfSQ0RNTEJtpo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784073, "uuid": "c6afdd10-7f18-4981-91b1-cd9d3afc8e1e", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784073, "uuid": "1abd254a-143b-43fa-a5d6-bec0d83dc269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784073, "uuid": "483a98ec-bb52-4163-8a73-b1c1fa09a58c", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf9e701-102c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771791759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791759, "uuid": "74bd1507-9832-453c-ba04-21f6766ef984", "comment": "Malware payload (Mirai)", "value": "1e293018c820bb93b5791f94f165aa10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791759, "uuid": "782dc25a-78cd-48dc-89c9-fcaf9ea96afb", "comment": "Malware payload (Mirai)", "value": "0ec26ae22f7e59f91a4a86c8465d501018aa870f2e45c4459a5fec0f6ad41978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791759, "uuid": "9a1b1477-e9fa-4d76-b039-f93d5a1b74fe", "comment": "Malware payload (Mirai)", "value": "cee325e0ffb7d23f7778bd8ce9cdc2c09e7f3869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791759, "uuid": "b4378b9a-5247-4c85-8a2b-3be654a8c230", "comment": "Malware payload (Mirai)", "value": "93030330835435f0c38301ceecd24f2341833cf80e6dcb5b87be1ab3580a02ebbb7d7bf49da72bfcf88ae6fe8a1fabcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791759, "uuid": "75ed6213-5958-40d0-abde-6a449da35fe2", "value": "T11E430271C13026C1D098E7A9212EC912BA456FBD85DFF8A34740567CEFF1C56AF2A24B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791759, "uuid": "a386d7fc-e8fe-4c11-af44-063197279913", "value": "1536:RsnKBf1x2CazGWT+DLTGs7YSO1lEbfjkFsqLkjEX2MgW/87c:ZNs/iDn9ESO1lIfjAvL92y+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791759, "uuid": "488438aa-d674-4732-a533-44c4098d0b2e", "value": 60472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791759, "uuid": "01d01cd7-f883-40fd-9c27-3936015f338c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791759, "uuid": "b3f97bf0-7e33-4c76-9985-8d4f76149c59", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e91a4-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788142, "uuid": "995cae54-d88f-4256-81ad-9866c0bf1bb4", "comment": "Malware payload (Mirai)", "value": "0325f451047000a1fea12ce4d1b21292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788142, "uuid": "675d88a4-57ec-425a-8062-b56978bfd8e6", "comment": "Malware payload (Mirai)", "value": "0eec04233cf52edce02af4afa4fc1a3e7aa5e7467000b01098a137f2c35581b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788142, "uuid": "026350ee-1d3e-4d01-9323-4df084b5e1b4", "comment": "Malware payload (Mirai)", "value": "20c39e7d385e777dfb47ba453d0ccdd03ebcdd68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788142, "uuid": "2212b3ba-17e5-462d-b2a1-b5e303f60165", "comment": "Malware payload (Mirai)", "value": "fae1f671001dccee3e92e75664fa3c4deb028455552fb01bed2a4eed12e4be0dc68371ea37dddbe6643e7e33225a0208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788142, "uuid": "166049cf-a418-427d-a405-b627391fcf6b", "value": "T168D3E80AAB614FFBE86FCD3706E9070525CC651722A87B7A3634D828F64B14B19E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788142, "uuid": "fafc1a48-898c-498a-994f-c3c7eeae8937", "value": "1536:B7Jl2o/Wl5zyvSU+eosfH/MeCHvT4bnA0kJGXpHrYe3ZsqsAxdVs3YURdEc20ejD:VJl2o/Ws+Hs3copHEe3FsA9UAdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788142, "uuid": "f73effbe-6771-42ae-8ebf-784dbec1074d", "value": 130720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788142, "uuid": "fbe6ce30-f6ca-461a-adce-dab4eebdd13a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788142, "uuid": "d03da356-58df-4023-87da-9782cae51a07", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314142a3-0f99-11f1-a769-42010a9c0008", "comment": "Malware payload (Pony)", "timestamp": 1771728605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771728605, "uuid": "6d636cf4-c1f1-4839-9ca3-785263f455a1", "comment": "Malware payload (Pony)", "value": "26d95adcf918117801020378bf6dbbfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771728605, "uuid": "4862c8bc-faa0-41aa-a935-80d99e082729", "comment": "Malware payload (Pony)", "value": "0f0f59593cfae8f5fb3d1ab9af840348c2866a8bddf95be8f98cb7e8874b1138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771728605, "uuid": "9d2bb54a-cba4-464e-ab39-d0df350d6127", "comment": "Malware payload (Pony)", "value": "4ede98e788e7cd89eaa2c52ee9de75cc42036598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771728605, "uuid": "070d5b99-7c13-40a6-8d5a-4614dbdef4b0", "comment": "Malware payload (Pony)", "value": "105fb6d4038472c1e5aada22cfc36bcaca66aef32b42822f41bbe12b364bc6123a529b627e10b6b976e5626ac77dee68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771728605, "uuid": "289e582a-4ff1-4655-8b1a-5a4950e71c79", "value": "T11C84022FE582E199C39421F94F97039E96B42F34A0709C172E04575E2676FED24A32EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771728605, "uuid": "b6442d46-486d-4fae-837d-85255abd83ad", "value": "a69cee316ac14d0a647ba8f31b9c8aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771728605, "uuid": "11a77ea7-aa25-4519-9a56-27a3142871c3", "value": "6144:vQiT9i3Ecvl2wJzTQkTL14Dpr3BpBqmj9ZqmL97kQn9dVgWugqSAC52r:v1TWQmTJLe50mF9QQhYgqSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771728605, "uuid": "3bea9fe4-5947-460a-9abe-d662328403ce", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771728605, "uuid": "e7fe05c0-c9aa-4473-94bf-f7036f8e0e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771728605, "uuid": "10a93733-a870-4649-92ba-1bc8ef760e5e", "value": "26D95ADCF918117801020378BF6DBBFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b499e750-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784231, "uuid": "7db29ced-4c28-4f5f-a972-84b6bb8a608d", "comment": "Malware payload", "value": "6a5c5c5325024b73fb6189ac0fd668d9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784231, "uuid": "173d87cd-1fac-4d8e-aa6b-d65c66744e3d", "comment": "Malware payload", "value": "0f188a5741c7753b90d4e51b6096541e018abfb3db33d502d718ccc29f89e98b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784231, "uuid": "625e50a7-b51f-44c3-acf1-3b94f900d3a4", "comment": "Malware payload", "value": "0222c54bdf99491e82451c6d48bb5bb5233c9888", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784231, "uuid": "e2555cff-a306-4758-91d5-e98bf22c277e", "comment": "Malware payload", "value": "2a305cb5d7ffad153447d5f27f919273c6460563f5be4950ac877857ecce02afa38ddecef8c625c108820cee42560d65", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784231, "uuid": "0b9d3903-3fdb-454b-badd-f23779bd5a78", "value": "T1FDF2D029EBCA6621C347B37E20475D8CF51B9A1BD1DFB56736E492CC8D12861C603A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784231, "uuid": "1c27d6c4-9811-4265-a8e1-7c318ced6ce8", "value": "768:uBQP+NAiJQucR7gWUU/G10SVOLtk+iOyztite1o2H3CrpE:uk+WqQuctgdlmSCWXZitOXClE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784231, "uuid": "0977f74c-4d30-49db-b5aa-3a2836e0b8e6", "value": 34664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784231, "uuid": "bbac5d46-7151-4ad4-85db-8f0279848168", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784231, "uuid": "1d50ce4b-2332-46c3-8115-fc0bae9ec040", "value": "vpn_config.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3a74ef-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752571, "uuid": "086c81b8-e324-472f-a08a-ad878ff1e775", "comment": "Malware payload (Mirai)", "value": "6cd3f6dc0be44e4d23cee01c1d952f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752571, "uuid": "69d46671-44cb-4124-8c89-8745931d492f", "comment": "Malware payload (Mirai)", "value": "0fbf2d2578aebccef1b11ff38709501607250f9bc53ddb0e4c0de43a8b73c3be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752571, "uuid": "0ee73e68-b24c-4452-b809-35c0a6b687de", "comment": "Malware payload (Mirai)", "value": "454b497047e91001dbadec70c78cbcbfd06260e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752571, "uuid": "a60869e3-cdc3-47d0-b388-3067356c368d", "comment": "Malware payload (Mirai)", "value": "59755f7f44bc8b56a040eab64ab0bf6b756a6b263ffd4aca10c505b66cc0121600700378c44411ef9a02ef041ad57778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752571, "uuid": "62ddf913-0627-422d-aec3-e33e2a1e0154", "value": "T1E5F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752571, "uuid": "00d71c49-6ea3-46c0-bee2-46396dd61720", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHXfam:9FJMgWPZr8IaCWReS1WpPeQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752571, "uuid": "34fd2a61-d7fa-4f8e-9af5-7f83259dc4cc", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752571, "uuid": "835b7c63-d1b3-4b39-ae98-8be984cc7944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752571, "uuid": "88f68a6e-0dab-479b-8a2e-1c2b0003978d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad0612-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766460, "uuid": "dceecc0a-2264-4c37-a172-c720e7794d1d", "comment": "Malware payload", "value": "61215f2e85bfc72a02737cf724f5f210", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766460, "uuid": "463af8f3-fbe5-4eb7-9e25-76750c62ad41", "comment": "Malware payload", "value": "0fd7bde011092256cc619c6c4aa6c473c26c85d8f7137a24080f2bf125322c84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766460, "uuid": "659e7cb6-7661-4682-bd7f-5717c671481b", "comment": "Malware payload", "value": "b06b31f07aa61399b50ebf22d6493fe898e171a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766460, "uuid": "fffeffd9-95d2-4c5d-b095-1dcf4fec1ea4", "comment": "Malware payload", "value": "4742b24ebd664b837c71375989760a1f07a02d0c13febfcfd828ded2b2fd37cb7f9928be6b3634839806c5f14263253d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766460, "uuid": "c3c362af-8626-4b3c-906c-0844c15bfaba", "value": "T1A722937035F14C732E256980F37727A66BB6A85349E3318C35DE1E29AF87B02A5BF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766460, "uuid": "c044cda7-4574-4b9b-bbc6-2ed8b771a72a", "value": "96:cRu4B6sVOEvQU5QAeoIeYm2hZBsgUqDF56dmbjlFlAAb:cRuk6m32pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766460, "uuid": "7bbe92c4-92f0-4fc3-8a1c-a5857aca6c32", "value": 10378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766460, "uuid": "022f704d-37ce-4294-9937-0240c8eeadc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766460, "uuid": "abd7f270-1b0d-45e9-ab54-3635eec6690f", "value": "0fd7bde011092256cc619c6c4aa6c473c26c85d8f7137a24080f2bf125322c84.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d060d4-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776844, "uuid": "29a4f5a9-373f-47d0-99f7-35130f0fbda7", "comment": "Malware payload", "value": "92c181c581bfb971b79177ffabc1faa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776844, "uuid": "9994beab-cf80-4c18-b681-bfdfa0211000", "comment": "Malware payload", "value": "0fd9976f9e007f88d15391ea777df3f42f0f68f2a928c387685fc1ddcaf111da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776844, "uuid": "26df1469-8191-4bdf-b4dc-dce8d27e08ee", "comment": "Malware payload", "value": "0f9653a8dfe301c44db1b386d982fd82f45fcc31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776844, "uuid": "9ca28c0f-d1df-4d26-83e2-a3aec3deee13", "comment": "Malware payload", "value": "c4862c6304092e00420bc85e02740eeb7284f3fcfebb7fc753d146da600eb7c7ecc3667461d512e3732021d8e8e69879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776844, "uuid": "49dcadcc-14c9-47ec-8ff5-6693d3e23728", "value": "T1A404F151FF0D0463DA526FF56E7B0B62D72D4CB224ABD124240A7AA61BB377B82077C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776844, "uuid": "d05a971c-db90-417b-9eb6-bc081ebce8c5", "value": "3072:ozdurayQy5HEcMf3odZIDJE3aSpCGkXP/wxqBMUzfC/e7532ZklMTQzL290:ozdurafekcMwd6DJqHpCZjMEC/C5mZOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776844, "uuid": "d665f1a0-4806-45a0-9579-75ea8adaa330", "value": 186172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776844, "uuid": "3f0f999c-7345-48d1-984c-e217c3348eba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776844, "uuid": "e5e63537-62de-4d9f-badd-42960bc9a5eb", "value": "20e0astr21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacd346d-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778711, "uuid": "9b2cb844-2e62-48a1-b4e8-5e94ec0c1904", "comment": "Malware payload (Mirai)", "value": "c35d879ec1f2698110df2c1625ed111a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778711, "uuid": "2cc7bbc6-b309-4d2d-8e73-782ca5213cce", "comment": "Malware payload (Mirai)", "value": "101dac9544a8b1a7bec88d7a269a233fc8771e3c5b1839556c29d44a4e38f3b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778711, "uuid": "5fc51111-0fe2-4427-b92a-b696a7932a64", "comment": "Malware payload (Mirai)", "value": "e9f78d1ef6c7826126a7fb3a1be73e7a6605f4ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778711, "uuid": "ad541f81-cb27-4dc8-834e-ed42f6588c72", "comment": "Malware payload (Mirai)", "value": "802f864526e3b4b2cf1a66e7504b49cbca9962bedda93dc3ada50804ad2ab39f6d80ca3ad14614a78137cdcc60ab72f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778711, "uuid": "c2e4a20b-8419-4267-a77c-bc85839e9e98", "value": "T1E0C2E1A260F9CE03C4F343775D3C15A661606435A35DED1E37699BC937460E4663ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778711, "uuid": "9168047a-7c25-44d7-93f7-d1c1f55099fa", "value": "768:+5+Kcrb9VDJee2KTgdTHOBcK5ZCAySlKK:xlrb9veKTg9QB5V5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778711, "uuid": "5fca49fe-b05c-4869-a395-c9aefbac8e64", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778711, "uuid": "a3680b24-d8b4-4a6e-93b1-08c23d588c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778711, "uuid": "1e351700-b839-4cf0-8233-151f591258b1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d4ef2d-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752925, "uuid": "3aa339f1-d4f9-48ea-80b9-47e338bd2fbe", "comment": "Malware payload (Mirai)", "value": "bb2d2b199a5b2a16118ad3c1718dff21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752925, "uuid": "5b929dfa-40e5-4e79-8e3c-329f3654e782", "comment": "Malware payload (Mirai)", "value": "10305ca8c52cd6b3ee54fc495a0a4531097d394c9e7104caf693762bb82ff49b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752925, "uuid": "7fd7df84-4414-4e21-b573-c2176cb2694a", "comment": "Malware payload (Mirai)", "value": "72e1b55325629a524c842782b19b054357fc62e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752925, "uuid": "17fa113f-5175-45f0-8868-5322dd519b58", "comment": "Malware payload (Mirai)", "value": "2ff7577efb372cde4b973a4d5a5b9d8f89f0863dafd3151868c70bee6716c2f7655cafac46702f193ddaf420068b0bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752925, "uuid": "7daa331c-c3fe-47ac-ab23-b54b6b773dfd", "value": "T142C3C60D6E219F7DF768833047B38F25939823D636E1D685E26DDA041E6034E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752925, "uuid": "12046722-2fa4-48a5-88ca-384b05cc9553", "value": "1536:6BWxiVT91m22TZBVL1ae1vZKX1iBfB/D0L2M3dGj3hEPrevOlHTjTfSRb:yVTU7VL1arXgBOKM3dGtEPVT/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752925, "uuid": "feefa659-66f6-4a01-8b75-6b1d3cd58700", "value": 126616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752925, "uuid": "5737ae6c-e2ca-4982-a027-a18e0e43eaa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752925, "uuid": "e641d843-6572-47a8-96a2-800543df94f9", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c2a5b5-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766427, "uuid": "409b0f04-9ff1-4202-b3a8-04578a730434", "comment": "Malware payload", "value": "775f1321dec670d4417c741d4de69965", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766427, "uuid": "692249ac-0d3f-42b9-b88c-fc85ae69541f", "comment": "Malware payload", "value": "104fa416d9ce6ba2902d3611c6d6f15d4b912e26f672218d83c2852e87de70d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766427, "uuid": "6105cf41-f809-46d4-a7ab-a1e7a4e45141", "comment": "Malware payload", "value": "f97b064e9b41f412fb271887f1ba5d3b55fd2f9c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766427, "uuid": "af11f81e-54bf-4b93-bc9d-0147f1118201", "comment": "Malware payload", "value": "f8b4fb7d189b17e5b888679261276170ac5060ffed1d36f94bbf4e136b44d90bd5106d2d03354773a7b1531762a896f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766427, "uuid": "969da5f0-fa27-4c9e-9b9f-f2e453a86bcc", "value": "T1E2315D7431F218732A615680B3331B667F72DC4749E3218C35DE2E29AF97F12B5AB412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766427, "uuid": "441976a3-188a-4f0c-8987-82e19584d4d5", "value": "24:csnRUR8fAR25Wt09HHIuCzCRpYdZedSXGL/H/+HrJZwlDHESkZ2sg9lDHRkeN:csRu9RL4nB6gdSXc/mHrJilr8Z279lrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766427, "uuid": "8cbf36b3-61a3-45b6-bc1e-a580a15b1238", "value": 1870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766427, "uuid": "90bcc14e-7d50-43af-b15c-9d94497842fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766427, "uuid": "ff1ad16b-fac7-4e1b-8dd7-e9801efd9388", "value": "104fa416d9ce6ba2902d3611c6d6f15d4b912e26f672218d83c2852e87de70d5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30870de9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766400, "uuid": "e4c2c98e-f6f0-43e4-a692-718ddc9bfc9d", "comment": "Malware payload", "value": "6efa0e61e1a77459205b8435f004769f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766400, "uuid": "22bf5f68-3265-4d52-93b8-dc46644e8104", "comment": "Malware payload", "value": "1068ec2a570a06056b79550ffe5f90073ca917bc520ff18dcf28f15d77e60e9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766400, "uuid": "2a1c9753-efcb-4635-a458-97f63f86b4a6", "comment": "Malware payload", "value": "e369ececf3aba7a0b278df271fe15d5a979943f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766400, "uuid": "0a2b72a1-0f26-44c0-a460-6589c5ff61a9", "comment": "Malware payload", "value": "54820eb8ac46f70ef01b1438252e751fa1012ef0cd6f47ab55cbbe9b82b78047c94f19cb77296faf92ba0de891c759ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766400, "uuid": "81f80815-e3ed-47e5-9c68-6a90959cf8bd", "value": "T151313B7421F198732E901940F33327A5AB73945B45E3218C75DE2F35AF97B46A5FE012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766400, "uuid": "17a9d305-e825-4c8f-835f-5f30d32c2034", "value": "24:cni+HRURCxO0tbmN2M1/mslm9lc9HHYxtNuPl/Ha+76UyeZjl/HVeN:cni+xuGRy/vM9lwnYxaPl/BOU/dl/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766400, "uuid": "e2393a43-2e22-4761-9b63-e309833e6847", "value": 1697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766400, "uuid": "bde7ef22-f74e-4320-9f45-c23b7f46c9b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766400, "uuid": "ebd15da1-fd48-491b-89f9-0dc3e1fdaa3f", "value": "1068ec2a570a06056b79550ffe5f90073ca917bc520ff18dcf28f15d77e60e9d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cfcbbe-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766330, "uuid": "6a650f25-a0d6-485f-af27-c733899049ff", "comment": "Malware payload", "value": "60f507b5c134034158f1da893a24271b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766330, "uuid": "d277c167-09eb-4e6b-8b56-828243b4f5b8", "comment": "Malware payload", "value": "10a216ebe4844c23f619757d471adb83b6e48c0cd4006503734a97b1fabedc85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766330, "uuid": "fa44ce5b-525a-4dc4-a5d1-5d4440fd63f4", "comment": "Malware payload", "value": "87de14562b3747527238bb7cab1b4fb174b53996", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766330, "uuid": "71664397-6d85-4c5d-8ea4-26db95972971", "comment": "Malware payload", "value": "efd31c397ef38e0343c4caff2ed302f14dafbc74c6f541fb2dddd9292a05a7491f69bf8f01f0ae26a1557cf315a6076b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766330, "uuid": "b4f62c36-bde4-4e19-839f-186401101bda", "value": "T15882AD7221F04A339B9015C4B3771BA54F77961B456720B8F4BE2B359F5AB03B0EBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766330, "uuid": "832c8d3f-1abe-4c93-80ba-5ad28e3b3b66", "value": "192:cCuiZ6p4hvZ5m5FG4j4HKNpiv9vAMVxt+W:+p4hvZ5m5FGGoKNpivT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766330, "uuid": "564c94bc-5a0e-460b-a4f7-fb75607b3731", "value": 18743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766330, "uuid": "b774bacf-5ef3-4de6-9397-2743029bbbe8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766330, "uuid": "446350eb-71ab-4bea-a067-698276f8e3b5", "value": "10a216ebe4844c23f619757d471adb83b6e48c0cd4006503734a97b1fabedc85.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a281eac-0fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1771745961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771745961, "uuid": "9c144435-5d0b-48fa-ba16-47c22a5a9ccf", "comment": "Malware payload (Hajime)", "value": "3176d08b3ec7422274fb80635d7ebe2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771745961, "uuid": "ba3be6f5-fcfd-4bd2-8f36-22a302d6029a", "comment": "Malware payload (Hajime)", "value": "10ba901eea6044acb21d5c4a5127480e3e42b1d7c7d00d5df3ff7aa11cb54778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771745961, "uuid": "5d3c1ac4-9337-4bb1-9051-3462d0f5a78e", "comment": "Malware payload (Hajime)", "value": "44e263df7c77459c7a5adea62a70612826b341b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771745961, "uuid": "22d3793d-8e34-4ab1-8c94-8c545e8c654c", "comment": "Malware payload (Hajime)", "value": "b2fa85ff4eaf036c19538c965831fcf5c9873b848c29c45fe63343712c214697bec1a561002e960a44d12d84e64f61e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771745961, "uuid": "ae458dbe-6abf-47fd-9a3d-10c0c8dcaef9", "value": "T191D2E0C323843B13E15255F8E2BDAECA61163D649FBE142B94513622707321E599D86B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771745961, "uuid": "33748115-1c86-411b-9e34-cdb4f584e165", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqp:yYI0ARqw1qAEW67UIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771745961, "uuid": "10b0ec4a-c6e1-483d-b599-18fefd106b9f", "value": 29656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771745961, "uuid": "92bf971d-793c-4779-8a9e-d0d287623145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771745961, "uuid": "edb89a22-59ff-4a4c-bd8c-d8a45e3d593e", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9512a4a4-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768716, "uuid": "77d2fcb8-9a3c-461a-b06c-5b6102984f8e", "comment": "Malware payload (Mirai)", "value": "04a52dbd50374930a2928a474cbe1545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768716, "uuid": "91714dc2-ac44-4860-bd20-c8db451a6267", "comment": "Malware payload (Mirai)", "value": "111a1b07c0860daf6ec6279e5a49d8f4f723c2c715a19ea550b66561de04098c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768716, "uuid": "d7d406e7-312f-430a-a980-04e63525ccfe", "comment": "Malware payload (Mirai)", "value": "16d29acc41e5bf3016a2b32932b7ce2475fd3ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768716, "uuid": "17ac8c6e-c6d1-4da8-bc7b-84cc2e40ffd7", "comment": "Malware payload (Mirai)", "value": "e06079d47f1ee5e1817e6f9ee12e2d831c5fdc9d2d9461ad28c2f2af8484037faf07cf1c18ad3e5967b40aa370008dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768716, "uuid": "06f18b3d-a1f0-4793-8208-b0829550ad31", "value": "T15393E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768716, "uuid": "835ff92a-81bf-47a0-9a09-ebd0e0fddc95", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNGY2LYgh3:PO+d8zBWLac0yMNGFlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768716, "uuid": "67e79b08-d449-4978-a90e-c599d612ae56", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768716, "uuid": "9eb7dd42-57ec-4b2c-92b7-620d02b1c9d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768716, "uuid": "d1fbdf0d-7770-4d36-a0eb-01fbc414b4da", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee911663-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778744, "uuid": "e1c97584-6f23-4191-a759-d02dc3e676ba", "comment": "Malware payload (Mirai)", "value": "c723a6f527d58d773ad7512d51d8e6e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778744, "uuid": "a9d80e93-a547-4e92-b9cf-8b50822b077b", "comment": "Malware payload (Mirai)", "value": "115c4ba19c7bb0ee9b49bedd1fa4933c04f51e63d038f11b96f582e4accf1064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778744, "uuid": "7d1d91be-69e0-46b1-aea4-0696623b80c9", "comment": "Malware payload (Mirai)", "value": "712de84585e2249999587d9339a3098a5452c9f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778744, "uuid": "017151b9-19b1-49da-84de-805932a06974", "comment": "Malware payload (Mirai)", "value": "6f430a8660c000890a787b354315206b832bc5ecfb4303eef0faf40e96db56a8cd9016cb1874a18df745e34fac948a75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778744, "uuid": "34cbd51d-c480-43c9-af52-8533ff622b15", "value": "T1AD634B02B31C0947D1675DB02A3F27E193BEA9D121F8FA89651FDB869271E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778744, "uuid": "2b786bd1-e120-4e9d-b313-ad27083e7652", "value": "1536:v7AFs5xxqicm8EWbS1yMUmdnIYWrdIBctCfhGs/Bb:v8mC8rFlnIvr9gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778744, "uuid": "b6b5428d-3c6e-467b-9e4c-6374d67c46dc", "value": 71396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778744, "uuid": "9d3d7fd5-4c60-4933-a34a-ec9d6afeb646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778744, "uuid": "581b8801-5d87-428b-8043-864d49f8ff7e", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c565e8-102d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771792094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792094, "uuid": "15769885-7866-40f6-b50e-0df7225e15ba", "comment": "Malware payload", "value": "c0fe5df62613c784cfd3358e1ba8e54f", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792094, "uuid": "74523c81-fb4f-4a3b-bb04-8c1d18c9f62c", "comment": "Malware payload", "value": "118973020c38730648f03b12de4ed51289a7bbedd82fb4ad1ae0acf7feaae466", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792094, "uuid": "7ce55787-dc9d-428c-b106-6cc9ec9af2f0", "comment": "Malware payload", "value": "7621c61041f8ffe92fc0a954a92bf6213b747060", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792094, "uuid": "ca1c384e-36c2-4657-a89d-66cf4414caf1", "comment": "Malware payload", "value": "b9d0023e55a4a8e81bb1a5ec100da4c501e6281644ffee6f0e8e66e8db127791b915d5daa50c3fd39bbd5d5a8b36804a", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792094, "uuid": "46be4242-82e8-4ee5-8877-484bd5c64f44", "value": "T1E6F533AA5DE4F76DF478B6EE4AF03C080FBE46E3901640617B2C9253E7B55CB469A007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792094, "uuid": "026aba01-3733-43f7-835c-360f52a5b807", "value": "98304:SJA8p4MW1+mYXF3zyRtYyfbDBY/BIdt/Q0c/Qwh6wxVx:T8pzXFDyRtJfbuZIdt/Jc/Qwh6wLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771792094, "uuid": "a38c745a-7ee8-4d86-8b1b-981b5a245f29", "value": 3394361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771792094, "uuid": "e8cb97e7-4147-4837-a4cc-6f7cb78bcb41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792094, "uuid": "3cc1108b-fe0e-4a27-9359-68f676ba5fed", "value": "infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1c34ef-100e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779148, "uuid": "c6f6b202-4815-48b2-86f8-754cc46dabb3", "comment": "Malware payload", "value": "cef4eb76c55cec6a28aad1ce08dbf61c", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779148, "uuid": "5c1ce9e1-f55c-426c-8ce9-a20c8e9bca21", "comment": "Malware payload", "value": "11dee89c0ea7cb7142d3edd87bf1888f3d559ab6752f0762b123e60bbb0cdac9", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779148, "uuid": "5632b959-e57c-4c2f-9a60-4f5f8c3c9a71", "comment": "Malware payload", "value": "acf710f210e01a9162fd69b668205c898892d948", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779148, "uuid": "38b8e663-5bb6-4e97-8669-dd76e05313d0", "comment": "Malware payload", "value": "c91bee04747319ca30675c2c70dc427f4f36ed8586c3a0303ed75e223df2b50b0ecbb8d070a45487e73bf3e673265db7", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779148, "uuid": "bdb6337a-da60-446e-8e30-d3a07cd1493f", "value": "T1D7269D292B924262C3513738CC76A6A425796F131F18D4766EB42D4D7D3228EFC13EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779148, "uuid": "f22d4531-e13c-4e8f-83e0-1059cb10d888", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779148, "uuid": "4d96b81e-6d85-44d2-8056-783c6a5a4439", "value": "98304:ensmtk2aPskDP1dOcd6cy2LkZkkd0sAon:gLYOMy2LkZ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779148, "uuid": "458ae9d8-6d4f-4d1a-ab48-c585d1c7095a", "value": 4445696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779148, "uuid": "7fcd2c93-f3fe-4b8c-acd4-4492cd8df061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779148, "uuid": "5b67e669-03d9-42bb-a7bb-8d63b7baab3b", "value": "libcef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8f61c7-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766314, "uuid": "a968b96f-5282-4bda-b8df-a1d38c60a723", "comment": "Malware payload", "value": "bab90e673371da8bfcc8f791b2fee7ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766314, "uuid": "865b98a3-e9ab-49d6-8ecb-e85cc9d4dd71", "comment": "Malware payload", "value": "12117b25694ad5e96d5e14c2f55f84549fa0b32b6f3c955faefe4d4cd7167538", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766314, "uuid": "48ce0f20-9f86-4826-be19-79acf1ef01fe", "comment": "Malware payload", "value": "9a5031f85c07627d861714a5421cc78eac4ca2d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766314, "uuid": "7000ef1e-9817-43d1-bdc9-1a8e7cd177e9", "comment": "Malware payload", "value": "98463f3c116c08efee3a94b9fad3af792efcdfec39e47213e0f7c72ca98e715ed5a1ec1a79878626fb656127aaf95b36", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766314, "uuid": "92113d1c-60ac-4236-bb4b-3702b53bdf09", "value": "T169D1D77025F00C732E642944F3772BA5ABB7E81749A7318C359E2E296F87B42B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766314, "uuid": "8830b299-6f20-4c67-b07c-a50dc77914a0", "value": "96:cRu7B64VxT0Bjs/6fZ6fZ6fr6fx6flENE0IEFElp9s:cRul6ACMQ+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766314, "uuid": "2b8221ea-ec2b-414a-b64b-e0f006514dc6", "value": 6496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766314, "uuid": "5516fb61-b468-4dcd-a7f9-677f42d55a37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766314, "uuid": "95d2e99d-3a07-4250-95c5-34ba6ddbbdac", "value": "12117b25694ad5e96d5e14c2f55f84549fa0b32b6f3c955faefe4d4cd7167538.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526d83e4-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766456, "uuid": "5521cf28-f040-4a9a-b1ab-74601baf1a0e", "comment": "Malware payload", "value": "82f79b5838058953c8206dfe7169a83d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766456, "uuid": "878af277-3116-4fca-8b38-28f825cd7b6c", "comment": "Malware payload", "value": "13f165eefedc909b31fb5aea55037a34c2219b4e41e7c576b3e59b6a3f546a2e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766456, "uuid": "ad663a2b-92c0-4bbb-88f6-da0b4fbb9d3d", "comment": "Malware payload", "value": "b7a44b290bf4baadb6adea45595f25ed0f9aec6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766456, "uuid": "34df1ea2-6928-4165-adf7-9361bddf2aa6", "comment": "Malware payload", "value": "6a8c3dab8ceeabadeb6396aaf1d0807e2a39fbfd665318d112398d8a913b2e6f454a211061064ea922275abf4b671d89", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766456, "uuid": "4bee5853-51f9-456b-9500-a214958971e3", "value": "T108310AB121F218331251954073321FD6FFB1DCD39DD26E4CB49D1B362B65A03E256D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766456, "uuid": "bc9eff24-7595-4e9f-a8e5-c4d5362f19de", "value": "48:csRu9Ri764l4Ui4n4U34f7V4Ui4n4UNpZnjsrQnjwanB6g51lwnX:cCuA64l474n4U34jV474n4UDZnjsMnjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766456, "uuid": "ba76d956-dadb-49e0-b2bd-28624fd1d8b1", "value": 1544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766456, "uuid": "ab1c2fcc-21ce-469b-a597-197fd372e76b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766456, "uuid": "083584c5-2801-4bc1-802e-31e511f5b5bf", "value": "13f165eefedc909b31fb5aea55037a34c2219b4e41e7c576b3e59b6a3f546a2e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b542c7-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766469, "uuid": "bf517a09-9ed4-4386-92d6-1d98e230daa3", "comment": "Malware payload", "value": "1d8a495143372e26800c5d6d973225d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766469, "uuid": "8f34bb69-91fc-4a2f-bd8c-c827fbaaacfc", "comment": "Malware payload", "value": "1459e201b652f6c057e32b9e4f0589f666ffa0619aab2e223f7fb52dd682fc29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766469, "uuid": "66b86b61-54de-47bd-84fd-9f58077435e3", "comment": "Malware payload", "value": "b1ac1e72cdc93f788e92153edc19ac9541969ed9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766469, "uuid": "a21624b1-fcae-41e5-858e-551d6b9a9d16", "comment": "Malware payload", "value": "711b3594ac42c661ff416386c1f872b8df04adfebd4b344c066af9013348cd5025971439804fb50fd133b3baaec7ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766469, "uuid": "9d5ccd5b-c45b-4418-8886-810d830902fa", "value": "T1F701A47401F515132214669461739F057B32EC87596206CD38EFAA696F96F476297042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766469, "uuid": "987c437b-ef85-4eeb-8060-118cc9c52837", "value": "12:cHsuFy8RfMR8VNxOvGHfQx5GOeXXrKKLE1OdTX9A6HFmjRMmjUMmjRprMEYZ+KeN:cnnRUR8fA+W5gXrKKLX9HHIuCzCRpYdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766469, "uuid": "ecb3ce90-414d-4f43-9983-a9847d28cc2d", "value": 688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766469, "uuid": "aa881afe-0a1f-4865-8878-e63cd3d7a34d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766469, "uuid": "6069fc5b-1740-461f-a549-578cc0b8d139", "value": "1459e201b652f6c057e32b9e4f0589f666ffa0619aab2e223f7fb52dd682fc29.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560a7443-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766463, "uuid": "c19fb48d-458f-4de9-a1ff-5588deaa32e6", "comment": "Malware payload", "value": "af9abb16d9589d6ff4be50ace706db22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766463, "uuid": "7ca5945e-35e7-4b60-a6bf-25574d3e8d2d", "comment": "Malware payload", "value": "145cf8ef440897fd75f3c65bff1eda64ad5d80d01998dd2be8261e33178608ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766463, "uuid": "520bd812-1cf5-44c2-919f-fabec9f7890e", "comment": "Malware payload", "value": "e3064cdf0a4434e20c8f58243562ae8c30ebf69e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766463, "uuid": "b393da9a-dc79-47fc-8ed4-5e74210b2bb7", "comment": "Malware payload", "value": "5ad9decbc7e0136c34e35ac85a214b7541f352f9919704bd8bbd64f3d30721830d5090332ddefc26e4f04029e13ccdb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766463, "uuid": "fe468cff-3376-4ad0-af24-099e1811b860", "value": "T1B3A1C3B424F10C332E24A980F2772B95ABB7D95345A372CC75DE1E355F8AB02B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766463, "uuid": "642d8169-643f-4f04-b21c-b618b54add07", "value": "48:cnR29RyMRnB6g5/iPdFHPwWYclwngralri9alrG9VlrG9Vlre9Vlre9VlrDsIVlJ:cR2JB6yioVFf00MMAWpWg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766463, "uuid": "24c07690-d20e-49c1-a08a-65c166b556ea", "value": 4731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766463, "uuid": "8358c8a0-f809-4cb0-9923-40fe9e434bde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766463, "uuid": "aed7223f-9575-480a-926a-2175141353fb", "value": "145cf8ef440897fd75f3c65bff1eda64ad5d80d01998dd2be8261e33178608ee.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44274e9-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753306, "uuid": "d6480a25-b9d2-4aee-b2cd-9c456e452b65", "comment": "Malware payload (Mirai)", "value": "ce0116c5bf7306da8bf5fa6e196a9f26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753306, "uuid": "53299bda-6e5f-4574-bd7a-a856e006f18f", "comment": "Malware payload (Mirai)", "value": "1476e80fd7c72624b7889c3271f5f44bda51075983c3f8f3d52a56f22a3b7c3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753306, "uuid": "d3acd5c5-ab83-42a7-a9c9-e406576ea88b", "comment": "Malware payload (Mirai)", "value": "d08293bf234b04282962f02190aa80d6252ca26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753306, "uuid": "a676e2c3-dd75-4631-80ce-3357c2c99230", "comment": "Malware payload (Mirai)", "value": "e4686b01bde62340458bc5dff4bc9499396d611b365ccc4db9784ef698e5482602b639b2d979912ab6b177969cb8eed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753306, "uuid": "8dab9f53-52b7-480b-bee4-24184e42f9b5", "value": "T1A0E34A02B30C0A47D2632EF03A3F2BD1D3EF959221E4F681756F9A8991B1D361586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753306, "uuid": "0d791780-6dfd-4a0d-b704-e2a75f537388", "value": "3072:G6ky5OxEco4YccEmJYuokNTalKHV6hh1TTM/:G6ksOxEcsccEmJYZUTwHM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753306, "uuid": "2f0ec919-1805-4e5f-a87c-935ef0cb119b", "value": 153884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753306, "uuid": "9b10021c-fc28-4258-8731-14da81ee67aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753306, "uuid": "d63c0bc8-799a-4a9a-9a3d-3933ec015990", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09f3e1e-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752548, "uuid": "2a54b547-0249-4af0-a466-691595746ee2", "comment": "Malware payload (Mirai)", "value": "573f432d3bcf368cbd126e03529c9d01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752548, "uuid": "0a991b82-d4dd-41b9-8c28-2587a8a9bdc7", "comment": "Malware payload (Mirai)", "value": "14cf31ce705b31c722cb5b394ff0847127745c0de7c1615d5bacf993666bd273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752548, "uuid": "df2f2482-49da-42de-8484-ac4c526b4ee0", "comment": "Malware payload (Mirai)", "value": "b239b6a1e2bbc0719419674c6f0f3aa0ec33e3ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752548, "uuid": "a7cb634d-51b1-4132-a030-85291ae450d0", "comment": "Malware payload (Mirai)", "value": "de8606b4e6c327894febb110a5da5fe1a7df48b21a0ba66d3013aaaa97c34ee27c798c73f35a48ba941e51f2734781be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752548, "uuid": "2993215e-2f17-443f-98ef-60adf9c98fed", "value": "T1C0D3C021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752548, "uuid": "670a6add-5b57-4819-8eb9-287cc8646cae", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xW:PiySSGp+PMmT7zMplw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752548, "uuid": "fc367124-dbe2-4502-94da-cb0467d99733", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752548, "uuid": "c2696371-bff4-4cd0-ae53-83cac07b6d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752548, "uuid": "5f58a2b5-aea4-4fe8-a46d-8fb967a8948c", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8419f1d-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769177, "uuid": "d4d59ceb-5586-4c6d-8827-499b37384696", "comment": "Malware payload (Mirai)", "value": "21e8793bbe9f620f42f8f4544ee90af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769177, "uuid": "c94568cf-537d-488b-8671-96252ce937b7", "comment": "Malware payload (Mirai)", "value": "154ae8d18b6a1008ff12ea09daca4bec23df15c3ab804e232a12db1f4b32ab1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769177, "uuid": "c998caad-4f11-470a-ba71-a1b44ea35b64", "comment": "Malware payload (Mirai)", "value": "098e2a7ec86ef1ceaf52c5d8903149a9d2996a1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769177, "uuid": "79cc456c-0365-4b31-9c70-aa7b5ba8fe10", "comment": "Malware payload (Mirai)", "value": "50abb834441d22fd8fa2cd4854de977104a5ee0b0d13e2a46f7273cc34af8a625104f520bb876ced32cb1b365c2b5f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769177, "uuid": "e987831a-6552-4594-bff8-a71722dd6c79", "value": "T1B6832B56F9818B22C5D512BAFA1E128E332317F8E3DE72129E205F2477C692B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769177, "uuid": "ce764993-4be6-49f4-af7e-d23425be2e43", "value": "1536:0on3rmUINNJzQRQ7Jc1jpslkuYaaiAa5CxnuMTiSI+TUe5vYMEn:LmU6lQRBPuYaaiuI+Ye15E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769177, "uuid": "43b8a525-2902-4652-9591-67eaf6c68ef8", "value": 84540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769177, "uuid": "c4c7f512-fc4c-437f-b3c3-374051248416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769177, "uuid": "0928ff0a-597c-492e-8fa8-79e9b62d4472", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef11eb0-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784221, "uuid": "1c76ce93-4755-4021-92a2-7137fd442440", "comment": "Malware payload", "value": "a467a21d9d2b2482f5f6508a1b9080db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784221, "uuid": "2f320ba4-5c89-48fc-857c-50ecaef4657f", "comment": "Malware payload", "value": "158d62312ab502f4f574f151ca10559880bbc5f5d9ec3b981b32cb2e4ab0efa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784221, "uuid": "5bf22dcd-befd-41f0-a971-b6acf872e8bd", "comment": "Malware payload", "value": "a46767e7ce351159db3a4f4ada936a5028ecf3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784221, "uuid": "53f7373d-3601-4752-90b8-57c64f0eb15a", "comment": "Malware payload", "value": "55817cd50434d32fc114266a2b6a616312b0036f809e22e29422c5a9404efeaba67218d871c9cee8067357655e4cba36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784221, "uuid": "8a267d5e-70bf-41c7-b9cf-1752f1827383", "value": "T1BD564B03EC9555E5C0AEE6318A22D213BBB17C485B3063D72BA0F7682F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784221, "uuid": "7814b733-9387-415b-96cd-fba6e8fe8590", "value": "49152:4hgMBbLBHudHhZJYjHH0WIGx3KQ7GjyQV7ZWhveyo1fVtEn6aKzUw/YTibEoT51j:4GkvNR77GTZcqaQ5HwBYyuEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784221, "uuid": "bf591167-8732-46e3-a84a-a14028ca84a4", "value": 6410424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784221, "uuid": "5494bb47-cc72-449e-8ce9-93e7b10dad7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784221, "uuid": "0c02780e-a183-43c7-ab42-d10c13d89785", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532f171a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766458, "uuid": "bddf0063-1931-41e9-9f02-d112ace96c3b", "comment": "Malware payload", "value": "2b08599e65fd0895b805569fcf3421d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766458, "uuid": "42cd6540-a3bf-446c-92f0-0725045c6d55", "comment": "Malware payload", "value": "1616abe23d26930b436cc3b69145d95050688364d956ddf56b0f27063ed6ab85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766458, "uuid": "e3042a4f-8232-4305-8716-b85f4ed8ea57", "comment": "Malware payload", "value": "12513533d5c000bedd09d909875fa9c328b1abf9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766458, "uuid": "666be0e6-7f3f-424c-8aed-3bdbe2b8d254", "comment": "Malware payload", "value": "1972a6c05f6453e00ff020320de1176be53dd6b401308f9d154c0ad42cab64f0f17147ac6612217de3db026ee6ff7e26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766458, "uuid": "91288135-30d3-4a5e-ad7c-b3667b7fede2", "value": "T1EF515D7420F15C732E186540B2772795BF73DE5345A322CC35DE2F29AF9AB03A1AB421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766458, "uuid": "9c893650-4b2b-4fd5-9b36-99904bb4f743", "value": "48:chRu9RUhnB6gO/iPdFHPwWYcdl/m037/8ZalribgOPl/C:cLuYVB65ioW57QpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766458, "uuid": "b7822ff9-8d2c-464a-be7e-014c2cb0c8bf", "value": 2651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766458, "uuid": "0006f581-ba1c-4937-910c-ea10c615e45e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766458, "uuid": "0fec91e6-b986-4fca-bffb-5138f2dbd35b", "value": "1616abe23d26930b436cc3b69145d95050688364d956ddf56b0f27063ed6ab85.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45d616c-1025-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771789008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789008, "uuid": "8017e66e-1a5d-4b42-a7b9-245fecc2effb", "comment": "Malware payload", "value": "495c2a1035324a57f11fd1b11acde0e1", "object_relation": "md5", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789008, "uuid": "f5ef082b-896d-44bc-81dc-e3a63bb0c543", "comment": "Malware payload", "value": "161f2a6ecf64dcbbc1616d536cb2ed2e53afc5a4f5deca810b0f55cc82a6b447", "object_relation": "sha256", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789008, "uuid": "3bbf3a71-4804-4b0d-babd-531e8cddc318", "comment": "Malware payload", "value": "d8430a40de6988c8f63f1f55ce5cf3f578d5501b", "object_relation": "sha1", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789008, "uuid": "45a1e0e0-9f8f-4569-a679-0f86a91f0dfc", "comment": "Malware payload", "value": "c54e1825630b7cd564f7a5e80c15a355169fb3e7d383a8aaf3a2f5fcd937b2aba6c42182890a298981e680a3241d487d", "object_relation": "sha3-384", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789008, "uuid": "866af928-a599-448d-8c0a-f74952ddff40", "value": "T160E42323EF1EFA15D7502F72B95DF09F429B3E22C1945B7939552C87260EC8E82B244E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789008, "uuid": "ce8bc432-ba96-4b2a-bc71-d3bb9c6b066c", "value": "12288:TtQISFr/nFVdNhC/yHCnZjYMVOTciHe9nlAl7MWIvb7pWqElaXeVHc1:pFQr9VJEywZjpVaJe9nliMWipWqE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789008, "uuid": "737c3458-4284-4697-9f69-9e8e2eb17abe", "value": 699870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789008, "uuid": "7fde45c3-8115-4b69-ab2f-b5633d36dee5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789008, "uuid": "d047762c-ab74-487f-84a3-3f1618f49e56", "value": "24312264055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c59906-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755882, "uuid": "15a1a5c3-7020-42d4-bd7b-6b2f0ebea098", "comment": "Malware payload", "value": "2e55ddc8aba7b3ad5efa1767e76155b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755882, "uuid": "bb142313-dd2a-487f-a79f-6e40aca965e0", "comment": "Malware payload", "value": "163f1b65891e6886a4d9020d59ce722fd6f853bc18107fa49ebd1d4adf8c84d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755882, "uuid": "8cd3b310-b47d-46fc-a00c-955db2e4351f", "comment": "Malware payload", "value": "fb1314e2e36aa6f9ce616d3bce68eab243d7fb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755882, "uuid": "d2157fa5-e9fa-48d4-9397-1db951516c53", "comment": "Malware payload", "value": "f5534ecb2f2d7c8eb84354ec0e9c63a329c221f16db3e8510228898a3873837f2597d2be5dd66d1541c1ad79b0db30ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755882, "uuid": "1d7fd0a2-3260-466a-9182-70ef8fa45f3d", "value": "T177D2C04342B2276EF85A82B8280747BE5AB97C1256D8CB6EC97601DE3D51FE78C34374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755882, "uuid": "31372a0b-1a78-4d9f-8269-3a4d6e26a146", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755882, "uuid": "0c430626-5608-4235-8813-6f5ac1ff79e2", "value": "768:Sxwmq9h9EFp7NV8kNAriKIBoT+8iBtAzZyiN/MU819saJ:S42Fp5V8kirgBoT+ptAxNU9199J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755882, "uuid": "d3ec5c26-4260-4b5d-b1b8-491ccc83648f", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755882, "uuid": "dae7a004-3091-4643-ac3c-698f6e077271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755882, "uuid": "81d13aa3-0d22-4b29-ac73-983e02f0c702", "value": "SecuriteInfo.com.FileRepMalware.11236992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0582ddf4-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766327, "uuid": "37bc9cc2-22b6-4dd0-8031-43a536288bfe", "comment": "Malware payload", "value": "7d75833369a8b4ce9fff122a91aab71b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766327, "uuid": "1c724332-d955-4897-a9af-ca1f3ce50dd5", "comment": "Malware payload", "value": "173952fede5f8c317c479ce9217f64c4ba92a815ba015022634843d53346f97c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766327, "uuid": "9a303517-ee6a-478f-8ceb-a7b4f0d85307", "comment": "Malware payload", "value": "53f21357fec9a665daef79950d54df8055df9f82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766327, "uuid": "2f728f20-1654-4e44-9381-9a18016dbabc", "comment": "Malware payload", "value": "1748b4837bf1376ef920f8c877462d59712d083bf00629149b77f2e17923b87d3b9fd20d51271c0e40a6339e96a9d1ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766327, "uuid": "bff498bc-ab33-4cb1-ae68-a648a5987b10", "value": "T1B3C1D87024F14D732E25A680B3372BA6ABB6D95345A3318C35DE2D266F87B12B1BF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766327, "uuid": "d1669b80-0d8b-4208-bfbf-41073d1bf38b", "value": "96:cRuek0B6oNseNuN7IWHHvIBlIBtIB4IBL+s:cRutg6vW6TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766327, "uuid": "ed1984f9-3f77-4823-bed9-94e8e9de3270", "value": 6084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766327, "uuid": "921c7502-87cf-4ab6-9c51-3e0936754886", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766327, "uuid": "b3e7f36c-0a51-4b95-b531-3da62ff5df4b", "value": "173952fede5f8c317c479ce9217f64c4ba92a815ba015022634843d53346f97c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c633fa4a-1025-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788985, "uuid": "7974134a-f9c2-473a-a262-5030023b8afd", "comment": "Malware payload (Mirai)", "value": "f23c4a40623fdcf504aa02631d38b2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788985, "uuid": "160a5aaf-0ad9-4584-bf43-5f61d2ae56ee", "comment": "Malware payload (Mirai)", "value": "186e7a8dff0e6f4247a986a0881bb6acd29576d77fa574a0d4f9a662768aa60d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788985, "uuid": "6c446b9e-d12e-412a-8291-6cf75012e8b2", "comment": "Malware payload (Mirai)", "value": "9992e02ad02d7da002b59820a960e993485b6867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788985, "uuid": "ee1c40dd-ed89-4cc0-90ed-e8ed53529bd7", "comment": "Malware payload (Mirai)", "value": "9c7847de5f004cbce1669a316bd944413af7b93b1ab0af74a15b73ec4922991f92b6639177ee3e961510f3d62ada880e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788985, "uuid": "a4bcd375-c31b-4633-8271-eda129cf7cfa", "value": "T1F99317C1BA4B80F6D8574870412BF33FCB32E5394065E25EEF5ADE29DA776426217388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788985, "uuid": "2c3c3467-636e-4052-9650-aff1394a1c2f", "value": "1536:jR5aFvqCWUHDlHgiobCiyFSN6t1Xl38yZWdq6TZRcn5HmiKnTcwvf8e7N:F5a5qqHBHJoJ+S8t1+9kEZRcn5HmiKnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788985, "uuid": "5f760b50-1f06-4b92-a373-55aa658ae71f", "value": 92016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788985, "uuid": "9e8cc58f-787f-4360-b07a-74d0695797ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788985, "uuid": "0b999ca9-8910-4ae0-a9cf-9a0a4b0046bf", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36efd44c-102a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790892, "uuid": "ee5cf83e-d421-4642-9ea7-7620acdec06c", "comment": "Malware payload (Mirai)", "value": "87d323bf90d74f82e51513a1acd720d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790892, "uuid": "6abb43e2-610c-4c8f-8736-0f8fe46451f3", "comment": "Malware payload (Mirai)", "value": "1926c6dad51e888b82bed17824017f56dbd166c28fb2537e9d068302d1d66358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790892, "uuid": "a0e1aecc-903b-4007-811e-e53204891ee9", "comment": "Malware payload (Mirai)", "value": "66ff5f4ff829a6d859c8b1aeac91732978140937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790892, "uuid": "9416190a-0814-4991-bd4d-ff5f38f81140", "comment": "Malware payload (Mirai)", "value": "67b54660deadbff364a5fb264859589a33aeb61cc2ce7e11e3b1a636105a60618771c12e3051ceb5d53c3a7de19c46cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790892, "uuid": "648f1b0d-1743-4519-b7c5-e9d082fc77db", "value": "T198B3E085B210AE55C02672FCB1870A9093B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790892, "uuid": "bf30795f-6dea-4fa5-9dfc-a5d538520555", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuv:as5zqhr5Nzy7w8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790892, "uuid": "993cc709-0f1c-4601-bd96-396951cf94ca", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790892, "uuid": "aa0f09e3-2a52-4845-8d57-d96ee91da1c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790892, "uuid": "08d4ef96-f5d9-4dba-a6cc-8e40a8b07550", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c42c6e-102c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771791801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791801, "uuid": "5c05da3e-ed78-41a1-b605-d9920a52e51b", "comment": "Malware payload (Mirai)", "value": "78a7e7bf09b3102260a12217eabdb897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791801, "uuid": "066a7aa4-f9d7-47e2-87e8-9daa620cf82c", "comment": "Malware payload (Mirai)", "value": "1975233a0feb93d3c04dcf438203e7d8583cc5f39b9535a2000e3e70fb550ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791801, "uuid": "f9d10a96-ae90-4a79-908c-c66b35059ebf", "comment": "Malware payload (Mirai)", "value": "1709100767b74bedbbe3103a6a34a8cd87b97715", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791801, "uuid": "7d83277f-3d88-4dee-99d0-71aba9da1773", "comment": "Malware payload (Mirai)", "value": "6c4e895566ffeeec99a119ab9e3b6a2d54c39cf841bd01d447773099133880769d2247bdcb9a84c72ff0d6d3f93d561e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791801, "uuid": "074d6b47-080b-4556-ba5c-054cd2806120", "value": "T13EF32B56EB418B53C0D6177ABADF42453323A7A4D3DB730699286FB43F8279E0D23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791801, "uuid": "9a62af95-609f-4adf-9eba-ac86de3b844d", "value": "3072:1Xk6rDmNYrM1ZBatylVnoLsUcZMTIixRfLwJUM/9xbt:tk6rDYYrejatylVnooUMR6RfLwmM/9xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791801, "uuid": "729039c5-c020-449b-a37e-6630c7c068d9", "value": 157460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791801, "uuid": "c4102b0c-9bd0-41a9-8520-f6d71e2e536b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791801, "uuid": "3566fb9c-3378-4910-a433-5d6d4274e7e4", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff589cf5-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752573, "uuid": "56487094-9e1c-41cb-936f-98c82c442755", "comment": "Malware payload (Mirai)", "value": "6ad7d25d6a0b8f2af28f54d06d0264a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752573, "uuid": "2fe8cbc2-0f5c-437b-b413-08a75e06a382", "comment": "Malware payload (Mirai)", "value": "198d0457edc1303a40a85d3fb12c1ddc5d5c2696a48d06a79129b844939883d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752573, "uuid": "6c9244cd-3144-48f1-bac9-4612deb08086", "comment": "Malware payload (Mirai)", "value": "321a5164b552768e3d592d1a773fb07d448174c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752573, "uuid": "5c7ec569-73e4-4dfb-9220-2d62228a3acb", "comment": "Malware payload (Mirai)", "value": "7ad26b6a2cdd218629f7956ff008f670edf5a0f2cb9a1382158f9365eebe5bc408007fa2a40a5c51edf8f4e73aa235b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752573, "uuid": "aa9dc500-40dd-47ef-a252-46ae3ad860bd", "value": "T198F34C0BB7108FA1C329D67009B38B67A6E7269216E19985E76DDD107B3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752573, "uuid": "759358bd-a3ca-4cb6-8384-744122c87150", "value": "3072:cRJdS3HLZE7w/FyoTQlNnIkV/Q/qdTPDAhKhxpO3/qzx/KfarA:EJE3rW80ocLnX/Q/sa+pOSmuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752573, "uuid": "67d182b9-e74d-4b03-9811-0e05bec48feb", "value": 170708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752573, "uuid": "ce4fa852-d39b-4a5e-a528-142fef479620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752573, "uuid": "4949c423-6c90-43e5-a97e-afc84ec50bb0", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85cc0d9-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784210, "uuid": "8eaaa613-2074-4e02-9656-fed66ea5345c", "comment": "Malware payload", "value": "169c629f5c3d88484c39b01b9e4b07b7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784210, "uuid": "cb0debeb-348f-4bf1-8e8e-e36484d82e5d", "comment": "Malware payload", "value": "1a13844fde7e03e38b594ed0fb6c9aa99143e3d6c2ddf266b6969e1f2661121f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784210, "uuid": "c40a77b0-8473-448e-b5ca-9660ddf00dfc", "comment": "Malware payload", "value": "3814ec1531d8c5cd3d962edc44739d253fbd90a0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784210, "uuid": "c08f2a85-d254-4e95-bbcc-244a8782a156", "comment": "Malware payload", "value": "e880b2cb2fbc185b30b7361ecb39915e220c0db0f729cecf2ae2cef2b91bbbbf2827761a6d823805ad673e23ada43d68", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784210, "uuid": "0e32f092-c588-471b-ab10-a3fdbf8ecac8", "value": "T1C6316DBDC836F8E4079E719094723D4520E8AA27C7744FBCFE4209AA5A147E4DF2998C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784210, "uuid": "7d0e43fe-e4a3-4a35-b037-af1a2e740440", "value": "48:R5fPU//hhPAEjTlRMLtiUfG5ZSjHAUIq7hNp0w/:b8nhhPAEjRREgU+PSjHHbhNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784210, "uuid": "718e2d91-cec5-449b-8d18-cb3861b7896c", "value": 1559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784210, "uuid": "3db184c8-8143-47b8-b1bc-a5948cbf7c95", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784210, "uuid": "646fe4af-3ab7-42a7-965e-183ea59c703c", "value": "revshell.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c919edb-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784083, "uuid": "70b83000-2590-4170-a21e-9071d5378b76", "comment": "Malware payload", "value": "a58c5c6de5ec12bcc109958d5f969254", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784083, "uuid": "830279b5-1321-4c66-a61a-9300906f0130", "comment": "Malware payload", "value": "1a3623c8927fb1bb741fe9ed51ab6fe989d6dc84cdf7358b7d4cc09816677229", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784083, "uuid": "e9eab7da-c0fa-4019-a00b-d9c8b8a5c6a7", "comment": "Malware payload", "value": "f3fc1687c3d6c86c4317ec1572e935179947f97c", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784083, "uuid": "da30b928-d404-420d-a82d-61d66036a55b", "comment": "Malware payload", "value": "427e98c328f18a61e96d9d81b9f7a860a9926e7e192d8d1d6dd623f122bd6e66f805b49182c68e512ce808547599f6bb", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784083, "uuid": "7d0de76d-87e5-4653-94f3-618e26dafabd", "value": "T16C115856E3869B6C03571F97A167F824F1912437962556B3638CC1889DC0F74A50C377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784083, "uuid": "ab4fb1ae-8c4a-45b6-b86f-843360d542ba", "value": "24:JK8acgzx6HMp5mozTq5BxbneXKwlCn2xT++AWxjJ6:JK8KlqMOo8njtwlA2xS+Asl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784083, "uuid": "ab20e8c2-6d11-4e98-8247-b3f57c5c636c", "value": 985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784083, "uuid": "255181f4-59cd-45b0-954d-32ce3b3d172e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784083, "uuid": "f1869a78-f87c-45af-bbd3-6ea342f87867", "value": "create_doc.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e5f61d-0fb7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771741546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741546, "uuid": "6228a65e-8b50-42d8-8465-6d9618e812cd", "comment": "Malware payload (AsyncRAT)", "value": "646052e9d66f3cdf80e718b13010004c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741546, "uuid": "9239a2e4-7c7a-4706-abb2-b59affc47db4", "comment": "Malware payload (AsyncRAT)", "value": "1a450e29a8be35a90cdf439ac50c0b6017a30067aa040ec6c06631470fe4f40a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741546, "uuid": "12d29c70-df24-49f5-91e5-c61d0685ab34", "comment": "Malware payload (AsyncRAT)", "value": "f37fd5af151b571edb4edfd36678103d7709b777", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741546, "uuid": "2dd3aef6-3d02-4213-add3-1b1794da96a0", "comment": "Malware payload (AsyncRAT)", "value": "ca6f1f77f3149dda519686de453250df7bae3ae228dfd5b368bad9fddfe299d42964066851ec4c885f5b68ff730bc7a9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741546, "uuid": "649125b4-b824-4245-8e29-61c64429c374", "value": "T10DD23A08B3D48562E1FD56B94C7293048775EA4BA973DB9E1FC440AE2623B88DF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741546, "uuid": "454ed5b7-f75c-4371-9a93-c284947c5cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741546, "uuid": "20c56bbd-d6c8-4651-8d41-d46218f2b4de", "value": "768:e8fRXNsH9aOQg/cIRGqo2/Rb7fB/dTa/+:5fRXGH9aOJ1iIRbN/g/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771741546, "uuid": "98e10024-267c-46da-a2a6-14f642cc9764", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771741546, "uuid": "a2ace87b-a686-4151-ad83-a88648e2a9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741546, "uuid": "fa787c17-bcda-47ab-86c1-abe24094ab84", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d8a95e-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779399, "uuid": "870f0f3d-c9f5-4649-8041-ef367e38f201", "comment": "Malware payload (Mirai)", "value": "67efd66a08b7997d69e22991ccefdab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779399, "uuid": "557f2428-69a1-429f-90f9-797fb3b703f8", "comment": "Malware payload (Mirai)", "value": "1a45238b5098bda177b61d7aeaa92c2eac5af331e218abba837599aac5b26d3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779399, "uuid": "d73f8ec2-c4bf-44cb-9852-9c92705ae86a", "comment": "Malware payload (Mirai)", "value": "2554be98cc1e139b33dd043e1c3cfc35eb9a057b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779399, "uuid": "d3532015-296b-41a4-852f-b9d297bc479e", "comment": "Malware payload (Mirai)", "value": "c4d431950cbdef2c8f936a8ec9d76d62123d71b52dab6c4feff787fd251c25dbd7831d2d013983349fd2f6a7a51d18c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779399, "uuid": "0063e18c-e554-4ebd-a479-72860a9dd557", "value": "T1C5C2E16E45952C10C0F05CF2EA78C3467ADDA7A9C3F0367315C617E82A872A76271FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779399, "uuid": "9881edea-35f0-48b1-aad4-2f8a410377a4", "value": "768:7ie78GZSdAyRmJZjMEHW12h9pbJGs3Uozc:7idGZ3M+97zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779399, "uuid": "fc1299c0-8481-4dbc-880f-99dfbc231543", "value": 25724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779399, "uuid": "f7ade0c6-d9e4-45ae-a1a0-a8beb6dac496", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779399, "uuid": "19e84324-c3bf-4d24-b1e5-3140f4ffaa72", "value": "purves.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a399be3-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800078, "uuid": "7f4ab9f2-f4cc-4aa9-b633-83758a7d3c79", "comment": "Malware payload (SalatStealer)", "value": "df4883b8071f8593d80900bbc947a797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800078, "uuid": "f5c04b00-0e0b-494c-8a63-d0d2ba81341e", "comment": "Malware payload (SalatStealer)", "value": "1b40eaa834087262ede9dcff35ab28fd2f99c34429185cbe884c4b2745b27529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800078, "uuid": "1021905a-e4b6-4fe4-9a75-40d47124b11d", "comment": "Malware payload (SalatStealer)", "value": "673b773708fc4cbd1bdd395aa8db1a7717a10a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800078, "uuid": "35a1e363-3eb3-4896-9aae-c2974eed8b17", "comment": "Malware payload (SalatStealer)", "value": "d0487964df04a2e6b0bd6c3dffa985deb062c15df156c6219c5e3592a74f023e18fb611b0eedd04720a7d961160dd071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800078, "uuid": "ac7b81e1-39cf-46ba-9ad2-896c19f5d174", "value": "T104E533A94F603416EB5ED738B2C8124EFA3D56745C6013F84E96B94973CDCA387E08B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800078, "uuid": "81b709fd-f9da-4311-ab76-67e6883b1562", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800078, "uuid": "ff6f68ef-22d4-4dc9-be6c-6fddcd69a728", "value": "98304:MCnz6gDumkCfokC2MZqdu3G6wTf/KvNcbi319oiDQBZt:3DyXCfokYqjTc3NMBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800078, "uuid": "b9d6774f-a27b-4b30-ad58-141e446ab063", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800078, "uuid": "af4e3d63-bb23-428e-9399-5083b6d30158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800078, "uuid": "a9c1993f-0884-4027-8746-db5cc790854c", "value": "1231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9788d83-1007-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771776159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776159, "uuid": "9e317823-8897-4dba-9008-556aa4af32cd", "comment": "Malware payload (Mirai)", "value": "49e46ae67e4f502c72e8adfb01d2394a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776159, "uuid": "50e214d4-1645-4be7-91cd-d2e01b2da393", "comment": "Malware payload (Mirai)", "value": "1b508ca223c4ed4d8c3df925ce36f8a27b529e65023c6f7805c3c4124c58e6a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776159, "uuid": "62d44e9d-975e-4ccd-8829-5175adfbcc71", "comment": "Malware payload (Mirai)", "value": "bbecf76974abd5b36ab1c788517a789a35e7aaf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776159, "uuid": "1f9038ea-c6a3-4bbf-b863-d28829240f9c", "comment": "Malware payload (Mirai)", "value": "90966987ebed24759904575a008637d09e2737867712f192184c473d6d5ee712cdbc1b657bc1e6ca33b22da642cfb301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776159, "uuid": "a76852f9-9b6f-4aeb-a7ee-1f57c9d19c3c", "value": "T1C214D71AAF520EBBD8AFDD3302E90B0139CC555722A47B363674D528F54A54F4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776159, "uuid": "59973df3-cd07-4d30-b900-304b53afdc1e", "value": "3072:x8ntMibJebE0IEJVxqGMPLOh33Mjk2E61A88B6hh16nK:xICibJKDIexlELOpgc2A8on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776159, "uuid": "62ad0624-b013-4960-a853-7073a4dc61af", "value": 201184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776159, "uuid": "c155889f-1d20-4a5a-9078-a00096dc262c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776159, "uuid": "3a953a1f-c64e-4f0d-8f76-cf8dc58d4ed0", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d0cba-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766411, "uuid": "c7c87ff0-c2ce-4dfc-ae7b-aaa711af8ad7", "comment": "Malware payload", "value": "5d8de7f38d39e3fb77f90e68de7e692a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766411, "uuid": "cfb88232-98e7-45bf-bdfd-12a3ce730465", "comment": "Malware payload", "value": "1bedd8513497f54a366f976b4c61cec605e4e7f5272dce8b6f588db6c470d6b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766411, "uuid": "203bfc43-c1fe-4e3e-a77d-37de300c51c0", "comment": "Malware payload", "value": "aea94a643b300e61a0c2f405d3b2b7a46beff451", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766411, "uuid": "b2d10aaa-5718-4e54-8638-119035dd8a05", "comment": "Malware payload", "value": "5f36883fb6cf9d549bed7990a53b305d63e6837a82e89d7ff73b6367e059fe52dac43f3cfe92e136572729162a954122", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766411, "uuid": "e8f2215a-22ba-4543-9a8d-51171730310a", "value": "T1FA314B7440F21D732A0CA59066B32B857F73DF574A5213DC35EF5FAA5F8AA03624B460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766411, "uuid": "6f5d0363-5c37-4811-9e91-d0b67a93f674", "value": "24:cnnRUR8fARW5b9HHIuCzCRpYdZel/iPdFHjeef5uZW5FkXdflUlc9HHUeN:cnRu9RUnB6gl/iPdFHPwWYclwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766411, "uuid": "cb274423-8599-4fb9-be66-f89045dc0f61", "value": 1568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766411, "uuid": "4b879bd1-4b10-42e5-ae93-1ea44fbc7751", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766411, "uuid": "c745a85c-a649-440c-a504-576644e6e0c1", "value": "1bedd8513497f54a366f976b4c61cec605e4e7f5272dce8b6f588db6c470d6b9.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62c2656-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779482, "uuid": "49c49f9f-a6d3-4bcc-9af2-4471dc5cf793", "comment": "Malware payload (Mirai)", "value": "20f36484b28ad45906e18b52d6af3113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779482, "uuid": "c98a449b-fdf8-4971-b26a-477d3434caa1", "comment": "Malware payload (Mirai)", "value": "1bf49bb8266b0f186d30a14beb0691e6ddc00626fc2ac2b4d2f75fd88b920351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779482, "uuid": "dfec5621-6aa5-4cc6-8347-51a871ca01b8", "comment": "Malware payload (Mirai)", "value": "53e84fd3487660007f904f92bfe41e56206e47cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779482, "uuid": "5082839a-55c4-4b83-901b-ba9924750d8d", "comment": "Malware payload (Mirai)", "value": "8fbbe34190ff604d8a163693dc8e569b66783df7647098b03a4b20b4842275214185530410f3446683391585275edc5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779482, "uuid": "844d8332-b4c9-41a6-bbce-338a65068a6f", "value": "T14C4307817C90EA25CBC05677FE5F118E3715AB9CE1EA73438C181FA1768B81F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779482, "uuid": "7c7b1687-ba7d-4b7a-85b1-75f006c3c3a7", "value": "768:KNjkRL3rbSMHwK5hlChwmrLcl2BbDUVEEtI28goOYQHiLwCVy/Jx+5H8hG1rmCde:6jkRzrXHhlC4ObPEtlopJeZWSIzeMLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779482, "uuid": "b1240651-3eed-4560-8c10-35cfabff7e8a", "value": 58184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779482, "uuid": "69f69544-c664-4d9e-ba39-15293bdfe738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779482, "uuid": "6bd31535-967b-49e9-b0ee-77c8a4a2dc62", "value": "purves.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654744d9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766488, "uuid": "b6b4bdf5-2de1-465f-88d9-95e4f02ec90f", "comment": "Malware payload", "value": "6f1906756cf7c7440c74548b189a3259", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766488, "uuid": "d90342ee-4643-4403-b4b3-b85f7ade5c33", "comment": "Malware payload", "value": "1bfe11abe577bb56a8b8d2bb98a9d244721d3da75660ae78ca5b0b941e4497bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766488, "uuid": "b237e8c1-2792-4b9a-8d77-2712ae580dea", "comment": "Malware payload", "value": "1c1f7858fe248297a78a311c159e1361f4396c0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766488, "uuid": "09bcd0ba-abce-4388-b6cf-996aee579ae6", "comment": "Malware payload", "value": "c5732f8ddc99e0e447ca383db3e92942d02d4765aaca954ec6b368be0f4684b6455b5192484f5469a2993c5dd7878f17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766488, "uuid": "18aaec9f-876e-4350-9e26-52a83be8c3f7", "value": "T17302827125F20C333A705984B2772BA6AB76D95385E3318C35DE2E366F86F02B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766488, "uuid": "7a04c334-ecfa-40c9-9e10-7b391a9a63c9", "value": "48:cnRu9RZnB6/a9lwnmtAlwn8qAlwni+JYlrEJ0/hE/x/alr+1JYlrMBsJYlriSJY+:cRuhB6BKlmlVkxafdYx36HISISVYidkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766488, "uuid": "0d9b8758-3f69-4fd7-93e6-3e0b9152e649", "value": 8329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766488, "uuid": "e582ebd3-e64a-4042-afa1-c417cd4e134b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766488, "uuid": "3f23a577-b5ed-4db2-bf21-68667d06ff41", "value": "1bfe11abe577bb56a8b8d2bb98a9d244721d3da75660ae78ca5b0b941e4497bd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee05059-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750291, "uuid": "5c3ef8c8-cf6c-4185-9398-eff41c4f7758", "comment": "Malware payload (Mirai)", "value": "a70c60d52deadb02d43f83aba13e58ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750291, "uuid": "3440ead2-62e1-4905-9a6e-60e934d60498", "comment": "Malware payload (Mirai)", "value": "1c3f751ebcc3b3120ed9bfe25055f3c4783d5201528d6a977e921413ab8d564e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750291, "uuid": "f13d284c-c4b7-448d-a84a-cf6ac46e74f6", "comment": "Malware payload (Mirai)", "value": "c0bc8cc19ce36970a6e686dac94dfe759167425d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750291, "uuid": "3fe51c4c-fce0-4f18-9fdb-d9edfdd6f1e2", "comment": "Malware payload (Mirai)", "value": "5a2e4ac0ed8ddbeaed94d1392dd4350646885335e88438ca748bcbffcd4110564cb5c069000b4465824151cd5e7c1bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750291, "uuid": "50c9c026-97c5-4257-bd27-b828953dba30", "value": "T18B034B2789769B1BC6D4637701D383A1D0FF1B8412441B4FBD0B4C5EFEB63406AA679A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750291, "uuid": "1350031a-5757-4ee7-a55f-0a91b764e43d", "value": "384:RlypfUI44QXJTHncrL9yiCH7yWC8MGVNnHr+DCvkLl33Bv6J8G1zvr0VyoCFHf7i:DzjXJTHwLkPGEGCvMlHBvrgzAGFHhU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750291, "uuid": "bc35b56f-6f3a-45d6-be35-f808ad635bcc", "value": 38532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750291, "uuid": "c482afb5-eb50-40ed-85a4-9fb3240ad475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750291, "uuid": "3afbfa14-1d9d-4478-83da-e2a03c1c257a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f507c66d-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752556, "uuid": "4999c352-850c-4f3d-89af-d94eea969ba3", "comment": "Malware payload (Mirai)", "value": "0fa3641ab93a7c4db137991a1c959ce7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752556, "uuid": "2154cd96-20f0-49f6-9d2b-9c67f05c241d", "comment": "Malware payload (Mirai)", "value": "1c82d472f9c9b5b67b1418fb9fee2f71e4b8a62ee7a5151b23bec18f5b5e1585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752556, "uuid": "83753a15-fb1c-494a-97c2-d1444a946fc1", "comment": "Malware payload (Mirai)", "value": "e5363b2d95bea60ba3a0bee1a46540668134bc75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752556, "uuid": "ba094c8d-db11-4cdd-b777-256c75181dc7", "comment": "Malware payload (Mirai)", "value": "a65114693874b94d7289dd35904c4870c1cf4e70c29a25dc97d1dd5ec76494c789db093e753242babf603610b356cf0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752556, "uuid": "739cb217-a124-43a6-a160-2f548922f44c", "value": "T1B4631297FFDC1F9DE8D91BF807AA75CA27629035807242B40CE6588A815FDB2109BCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752556, "uuid": "fe71fdd0-4fd9-4e75-8439-58cad1b042d5", "value": "1536:JK7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgglrPT:A7Mbp2L+Xqdfoz2sfrPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752556, "uuid": "aaf8815a-3e78-4f58-98d6-8df78c8dae2c", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752556, "uuid": "8c1d9210-1668-418c-85e2-09f589071d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752556, "uuid": "592f57ff-318b-4782-a010-c5afd48d8a5a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ad0d77-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784239, "uuid": "0cfa4d3e-47be-411d-b0f6-0debccd55040", "comment": "Malware payload", "value": "a7dde5c63ee3f1b66a4a15af5390acb9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784239, "uuid": "15c84ab8-4b9c-4648-b8ca-4f7d4fa96ac6", "comment": "Malware payload", "value": "1c8e8efb28bc86ddce2049fbedf4a76b5c3a50f63ae49066f4e8d9efa5d8bbac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784239, "uuid": "831d5fb1-3666-4639-a5f4-4366a59edbba", "comment": "Malware payload", "value": "2306d004b3953ee790e2d4d6226345680d4e1b77", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784239, "uuid": "e88e33b4-fc29-432d-b3e8-855a02a88b52", "comment": "Malware payload", "value": "092e70536ac0b58ec1b0f262795f5094b3dcdf2ee226ea725aa36e04ad5994bff9efa0770f36e27f334413d2a60acbff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784239, "uuid": "4387420c-9970-4385-8b92-5ce366787d44", "value": "T193F2E14EDA225430EAC343F0A596261DDE47D70DB18F9AA23D5375ECB0B7ACA1380BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784239, "uuid": "9157d99a-786d-46d5-82bb-126705dabbb1", "value": "768:q0HqguJBZ4Gb6NDOrnk9Vr1Wf8zIzbwvDiMl:znuJEZOLkb68UzEZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784239, "uuid": "42a2133b-34c5-48ab-9173-de7e3983df68", "value": 35038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784239, "uuid": "6bb8328f-1906-4c96-bb3a-324188cf02da", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784239, "uuid": "55b8fc0f-f3d0-4f33-9f85-7dd49e4a8c71", "value": "x64_payload.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fcb533-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769036, "uuid": "8cc0549a-09de-497b-99dd-90bcb256e7f7", "comment": "Malware payload (Mirai)", "value": "60144d30b4cfd0ea9a08d19cda54706d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769036, "uuid": "5b2b9d4d-e273-4a82-83ad-b8c1d0088f85", "comment": "Malware payload (Mirai)", "value": "1ca2010aee618f540e8a5c12fef537d9860b0f72ea2bd429653490cabab90267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769036, "uuid": "02e7f9af-41f2-4fef-b032-89bd56c73661", "comment": "Malware payload (Mirai)", "value": "bb00836b3c4429538f005810afa77b558108f568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769036, "uuid": "63988caa-78e5-4488-8f4a-22baad022368", "comment": "Malware payload (Mirai)", "value": "479ff3d57b041b91b63aadbf8493521b05c9939706627d8fb409fe854ae73b5ba71315e6bfb17cf3943a01a161833846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769036, "uuid": "04f96b2f-55d1-4f2e-bff9-2bf4de500b8e", "value": "T144435AC4AA83D8F7FD5700750133E7B746B2F4351129DA97C7A9DA22F852A01EA2729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769036, "uuid": "66d59d12-6309-410e-9666-19c25802d3de", "value": "1536:neG9qPt/0+NvmIL9M6/S6sBDsGseeVRdlWKga2a9flKS8:neG4l/0+Ne+LK6FeaRLW3ZaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769036, "uuid": "8a97d14b-cd60-4272-b618-90a835746c9e", "value": 58928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769036, "uuid": "6ce5bd91-a7a7-4380-9094-a7d1bdb839d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769036, "uuid": "73893b49-5567-4c14-8984-1a78964b6552", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67abc985-1026-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789255, "uuid": "c98ab30d-4d43-4cbc-bc09-246695740c29", "comment": "Malware payload (Mirai)", "value": "4669d25cafc5a7e86b0ab73c64b6daa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789255, "uuid": "d13aa9b7-b96f-472c-a18f-f6c071ec20aa", "comment": "Malware payload (Mirai)", "value": "1ca58351368d16fcd26e6fc87a3999cccb52e239086d0cc678492d842363bd18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789255, "uuid": "e68112cd-34c3-4527-89aa-92ef2673a4e3", "comment": "Malware payload (Mirai)", "value": "b3cb6995a1c50eb1f9911df5fdcce31c4669ac03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789255, "uuid": "0136a7a2-58d4-4509-8c84-8a2465c92171", "comment": "Malware payload (Mirai)", "value": "f2f8e43d0e8ecd6242ed1556e7c3055caef63c92c9eca2aeead2a6b32768e75e7b9df03a54292a76dc1cf42ac57fb7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789255, "uuid": "af37bfe9-5f33-4a12-b96a-9aebe2d5d719", "value": "T123631242FEDC1F9CECD91BB803AB61DA2351D035A47341B508EA5C8991ABDB162DECCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789255, "uuid": "d07a72fb-e8af-4203-9ce2-a737c8f79dc8", "value": "1536:x7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgA3nrPK:x7Mbp2L+Xqdfoz2sZ3nrPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789255, "uuid": "2eba1110-18ff-4a86-bfdb-6b944697c90d", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789255, "uuid": "b3eb23d2-2d35-4831-a169-0970d4a239c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789255, "uuid": "464e2c31-ac67-46b8-bce9-30f29d5bacbf", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b0044d-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769195, "uuid": "8e1508cf-32cd-4f38-adb5-8d440f11ff45", "comment": "Malware payload (Mirai)", "value": "65b725322eb411fcfbe886b92728a80b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769195, "uuid": "d04aa058-f86a-4b5e-a2fb-302c5675a823", "comment": "Malware payload (Mirai)", "value": "1cc9cfd9ac41f4b5c5450de7d25b8cf5e25b4d4da17ad5469b8a8252012a373f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769195, "uuid": "54bc7991-ef52-4988-bccf-86a7ff821648", "comment": "Malware payload (Mirai)", "value": "a4a82e17166075786ed652fbf3eb781cb4d87e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769195, "uuid": "cdb20caf-aaff-4447-9097-77880f69ceaa", "comment": "Malware payload (Mirai)", "value": "49d89f2e8ca85b2438969abeea17c2878289de281908f15d65e9314a8fed93f6c5bbdbf9acac5042ccb9f4bc162febb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769195, "uuid": "21aa3f96-99e9-4b51-aaf4-6378acc864c1", "value": "T161533AC5F643D4F5EC070570217BEB335B32F1FA0229E907E7E99A62EC52A029516ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769195, "uuid": "6aeb6e0f-871f-40bc-9479-9dcb5ae89298", "value": "1536:KEFWr1oIluwfBjovgehYYr1IJJlScGAKPHIMS5V:KEFWr1oQuwfdooeuYr1ITSHnfIfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769195, "uuid": "37232ff6-5012-4542-83db-fed523efa7ba", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769195, "uuid": "2e9ec4cd-b555-49fb-ba25-0485378ae956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769195, "uuid": "0fb02340-ce83-433f-b2c5-058ef27dfea7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff552616-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771901, "uuid": "493a68e8-9c37-4e93-bc75-0ddc1a4eca82", "comment": "Malware payload (Mirai)", "value": "510c027b9453c3f85dbfa2772533516e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771901, "uuid": "9391b1ab-1bc4-439e-a92e-7b769cfbc7cd", "comment": "Malware payload (Mirai)", "value": "1e0d363d57e1d62849a787b222b79330d902da630293f23e3e28361fb8f4aac8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771901, "uuid": "e6a83720-a235-46ba-92ee-ff8f065dcdc0", "comment": "Malware payload (Mirai)", "value": "4bdd2aa21f632a02a928a7e20bd001790237cd57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771901, "uuid": "b8e0837f-330e-4279-b960-52791584510e", "comment": "Malware payload (Mirai)", "value": "a593c4ffb1da148b52ed010ea0287c0db7d91e3e2804ee53cb0087222ee54eda0ccaabbd773f74a21987787268e42699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771901, "uuid": "fe36d94e-8f1d-4d08-9829-ef63e82a98e6", "value": "T1DCA32A56F9818B21D6C112BAFA1E118E3313177CE2EF72129D246F2477CB96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771901, "uuid": "75af12d2-c48e-463e-a500-40eedf98e65c", "value": "1536:ovnkgVcjRZd/rFt+rUs95p6n1+akGIAKCNDmiprFvweBo7w/p5iY17HLv:kVchTFUnT6n1+akOrFvweBoE/pIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771901, "uuid": "3e2ad98e-496f-440d-a4c9-3a0795fc6771", "value": 100128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771901, "uuid": "5c1d87ad-0d7d-4143-a64f-b332cc455a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771901, "uuid": "6d95fcf8-bed0-4b41-9b27-07d475959ae0", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ddf9d0-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753302, "uuid": "cca8d6a7-0312-40c6-90ca-38bd795c1fcf", "comment": "Malware payload (Mirai)", "value": "9935952f2146f8ddac27785fdb95a895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753302, "uuid": "b0fc66aa-6016-4b31-8171-195ea428bb8f", "comment": "Malware payload (Mirai)", "value": "1eb7b53d6cb732ef77ace905de14e65211465231e598c1b5f9a324b82fb256ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753302, "uuid": "4537b911-8919-4514-b479-f43e878ed67f", "comment": "Malware payload (Mirai)", "value": "590045ed45dd6ea1471f7adf1dc7595e7ea512d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753302, "uuid": "8940aec9-4f02-46fc-a342-5214f28cd390", "comment": "Malware payload (Mirai)", "value": "b1900e3cd93de2b565ca24198a5ab1ee5d5863219072d3724ab78d7d9b0e7833ce8df47bfb4f57618ef7afd5bbacec47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753302, "uuid": "8b04886d-0f6d-4f3e-95bf-b563b858ae58", "value": "T199F31A56F8818B16D5C211BAFE1E124E37131B7CE3DE7213AD246B707B8A86F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753302, "uuid": "709714ee-0629-41af-8e03-ce3b0edf9b61", "value": "3072:+LhJ7HLgZQvlA3dXfo3rOMaiWuxc9+VdMVnLmxEYC1P6hh1Z0u:+LHLU0lEXfOHaxO7VdMtmxhYY0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753302, "uuid": "a6481899-d4a5-425a-9ec4-2fb697fc66e0", "value": 164636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753302, "uuid": "7fb25056-8b9c-442b-8536-56c771de759b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753302, "uuid": "0e39fa69-0ad4-4020-8dfc-afef076cf4f8", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4cd4a4-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779381, "uuid": "b8d5b379-cc38-4bb6-9a54-e1e75a21d485", "comment": "Malware payload (Mirai)", "value": "dda3ee2955cdd908c6b3e1ee6a352a70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779381, "uuid": "81bba9a7-bcf1-4177-bb16-9a7ecdcee290", "comment": "Malware payload (Mirai)", "value": "1ed6989a100ba1e42eb231e0f67aed4e8612b2aa0e60e51647b905e9e2cbff2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779381, "uuid": "a2dbd34c-3017-433c-95d1-c533a1e0cd61", "comment": "Malware payload (Mirai)", "value": "efbf8731c4c2b929a5d5df0e65138076b73ad28a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779381, "uuid": "4f7dd11b-993b-49c7-b264-d8a8984de4ef", "comment": "Malware payload (Mirai)", "value": "8832eb2cbf1d98e1fd3da35fdc2de1b2674e743668fe622ca445b084970913a86f7b971df63a5ede65428641cb612825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779381, "uuid": "397a479c-b8d1-4fc3-85ea-30b0e967b5b8", "value": "T155C2D0B0F8C1BDF2DEFEAD78881185D03BE61E5837D28DDA208CED115212D3796A8A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779381, "uuid": "0e8e6025-06cb-4b7c-8852-cd3a48af4ed5", "value": "768:7KnqLiChP7gI5gBZw+LajRJ74uVcqgw09u:7KqL1h4Zwa6374u+qgw09u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779381, "uuid": "f25849b9-5e98-4f2f-b468-4f59e3d527f2", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779381, "uuid": "53bed52f-5a29-4b75-95a6-6454809901d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779381, "uuid": "618af620-627f-4e57-accb-078a4ce90c53", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6284793b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766483, "uuid": "a4e6d888-93ea-4466-bbff-75aed7f528aa", "comment": "Malware payload", "value": "f9355e0ca1fcc3e305e6d53388b4ab66", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766483, "uuid": "93dfd7ef-013c-4ef0-b909-48aeab269f50", "comment": "Malware payload", "value": "1ef3f07316a9d6e1a0eb3e800cf700221dd2eb9e052ae7279e379babeb7c3669", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766483, "uuid": "3ca4e801-1d8c-4857-94cf-e6e30f629cad", "comment": "Malware payload", "value": "51471eea12e701e01b518c85350a3002632bb2c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766483, "uuid": "f8ecbb1e-b833-4f9e-ba87-17338c5ae325", "comment": "Malware payload", "value": "96c6bcc3b81bf08b2d62b3b3bab475217d2c5fb6018baab076ea55ddf5dea3e54190470194e01956b6e7ed9e0765a8e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766483, "uuid": "f30c9308-cbde-4363-ad59-0fe734104520", "value": "T1A2411B7011F18D332A21A680B3772B55AFB2ED4349A7618C35DE1D266F92B12A1EF011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766483, "uuid": "d62506f8-21ca-499a-b01c-3574b466358a", "value": "48:chRu9Rp9nB6g+JIrlrm9JIrlr8qGlrAvn8:cLu7B6pIBmIBUe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766483, "uuid": "a14afc4b-8e07-4de8-86eb-77ca96e453e7", "value": 1972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766483, "uuid": "190cd560-5e30-468c-93f7-a6c6dcf23063", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766483, "uuid": "19f1a19e-8002-41ea-9291-2d829ddaa84e", "value": "1ef3f07316a9d6e1a0eb3e800cf700221dd2eb9e052ae7279e379babeb7c3669.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc748299-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752917, "uuid": "c238820d-5c65-4e25-887d-81bf8fbf539d", "comment": "Malware payload (Mirai)", "value": "eb49f90c28ff1a25d0eb9e7fbe01fdee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752917, "uuid": "52632dd6-d698-42fa-afb9-d3de170b03b5", "comment": "Malware payload (Mirai)", "value": "1f2ae3461a20228370543cb57585a0aec46216658815df0a2a1357108267c396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752917, "uuid": "bcb99715-e0ce-43f7-91a0-a9997ccf1a79", "comment": "Malware payload (Mirai)", "value": "a4de404d04da8ef1bc9390c450c3dc627403bd2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752917, "uuid": "264f3817-c412-4318-98e2-ef46c844645a", "comment": "Malware payload (Mirai)", "value": "ab2a71d334c44866d4cea66809159d9b1e1f43f0bf31f9577c96d8c7788403690ef211085f9966ee5ab48033a37f1559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752917, "uuid": "e2a2feef-9af7-4528-ac94-26c0b111dc70", "value": "T15FC33B46E6418B13C4D61775BAEF42453323E794A3DB73069928AFB43F8279F4E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752917, "uuid": "61d6da6c-95a4-4a6e-9255-737a00865e53", "value": "3072:B4lg/8Zz7CzlQ/bDaY25ezKEUCRcGM/9wkE:B4u/8RilQ/bDvCezUCRxM/9bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752917, "uuid": "a472e3c8-b558-4178-8bca-446ef1c66662", "value": 121034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752917, "uuid": "c18689c2-5c17-4c59-8c49-d73e20c29bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752917, "uuid": "88c58790-610e-4638-bb24-bbd651d411b4", "value": "bin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93271fc4-0fcc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771750674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750674, "uuid": "9df92678-a235-44b6-867f-26ca16661246", "comment": "Malware payload", "value": "d5f7322a28beccaa4e0c9c00229ec56b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750674, "uuid": "9fc212cf-05e0-42c7-95b6-2f8e999fcdfe", "comment": "Malware payload", "value": "1f442f574b1b87ab1083f47474ea7e9e51611ba75be89d21365e053a9ef72ff4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750674, "uuid": "c1444eec-f6b0-41c7-8921-beb45625a778", "comment": "Malware payload", "value": "86ddd034e4d4e48177380e6c052e2b616a1ec0f4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750674, "uuid": "b3f43b01-4e78-417f-825f-92b1f28a1763", "comment": "Malware payload", "value": "02b0187324b18901e087f8de01d41cab766f6d3ce92c8c2d426b4427039d231faa1681ca9091355620300a6e587a3792", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750674, "uuid": "0e44bed8-fbd7-4949-953c-60801761fb1f", "value": "T1B8E1BF07F90D27BBC62592B1EC4B88CD3C2C62162322801F8D6A9A55F0C165C7BEEC4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750674, "uuid": "b9c601c1-958a-4383-bb61-2e3b3f38d7b4", "value": "192:BUavFhbcnn3vnFwwEtuin3yZdGRkepsi15GELwTIzJaM:BXv/c3vgniex15GELwAJaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750674, "uuid": "94676d3b-58ea-4e2f-be80-6126b279a2a4", "value": 7420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750674, "uuid": "8537fe22-8899-44c8-a7a8-f054cd97d6ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750674, "uuid": "76dc9064-64f2-4919-b34e-9d56db942eb8", "value": "CH - ULT Group Anti Fraud Agreement.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98183af-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766307, "uuid": "32f659c0-c28e-4e37-9f1a-17df30a1cc86", "comment": "Malware payload", "value": "a8ff3716b508387f7923dad504ba6989", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766307, "uuid": "40873990-70fb-4ad9-8c56-ba120268e147", "comment": "Malware payload", "value": "1f58e3dfecb266259ac3ca0845cc435cf0864e214488fb2a98fe8518c5a9d81b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766307, "uuid": "b6cebf0c-afb2-4fa9-bc4f-93706ebb2f9b", "comment": "Malware payload", "value": "5d13f99f63f081388b926e289fa24b5a1324ad25", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766307, "uuid": "296b3510-9337-4385-9b6f-340371bbbc4f", "comment": "Malware payload", "value": "ebc013f94910ee85c711b3a434875ce8a873da6b332dc4ae0646e5715f3e3c99ee82168f9d31694799b0716a88473a47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766307, "uuid": "85b10d78-4b0d-439d-8d82-4dd3b1db8acd", "value": "T147813C7026F04C736E316644F2772BA5ABB7E8074997718C349E1D396F83B82B5AE411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766307, "uuid": "cadf6389-d57e-4cbb-a1d6-3d40fc548a3c", "value": "48:cnRu9RrXnB6gt+1l3m0o+ol3861E69lriFE69lrENE69lr+9E69lrMLE69lrJ:cRuP3B6/b33m26fP6f56fr6fR6fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766307, "uuid": "6480fa2e-ddb4-41c5-abb2-a5c103324b39", "value": 3829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766307, "uuid": "de142fcc-b27b-4ff3-a95e-00fa78f97f47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766307, "uuid": "d9f73b06-7b64-4ee4-aa65-9757d1dbf9d3", "value": "1f58e3dfecb266259ac3ca0845cc435cf0864e214488fb2a98fe8518c5a9d81b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bb4ac9-1024-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788445, "uuid": "f31f48fa-0b30-41ca-9afd-ed0c03b1a5f0", "comment": "Malware payload (Mirai)", "value": "144b43a088fc27e7920250076f0fd09b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788445, "uuid": "657dcca6-7fe7-45f7-8a67-cf0706db2603", "comment": "Malware payload (Mirai)", "value": "20a6a74053688b4ad2fa6f8e388bb9ba38a2ecf3dbbbd56a7c6acc8cbf505952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788445, "uuid": "06a1dfbb-4f84-425a-bb25-9455b8556d22", "comment": "Malware payload (Mirai)", "value": "dd9ecf46319943026f846dac82680e3e34cd796b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788445, "uuid": "a8d35634-b703-45c3-9d1e-73dec1c9e854", "comment": "Malware payload (Mirai)", "value": "0c3781c5a4b9854990bad1d2c28fd26f9d826fe8351a53f907df93d107f4e2bf8aa52de1c0668e3619d1f551aa3d046c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788445, "uuid": "0cbe3944-0026-4ff3-bd3d-79d365d58af7", "value": "T151148D68FE4F68D2D2C7E37DAE4A0FA2312779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788445, "uuid": "171be5a8-fcb8-4bfb-a115-fe4476dcd609", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPx9:bOVfbEdxm4iubj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788445, "uuid": "cdee9ef5-ff1d-4b56-81cd-18d290fa9033", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788445, "uuid": "edccb020-4574-48d2-beba-ea1cbbf57bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788445, "uuid": "db84d09f-4d61-455d-aec3-dd0cdc1404fb", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31727498-0fe9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1771762965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762965, "uuid": "61e136ee-4d7d-4169-831b-9c24b2e8a329", "comment": "Malware payload (ACRStealer)", "value": "5046f70f2d9bb79ee1f49f7b030eb729", "object_relation": "md5", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762965, "uuid": "6fbc5fbb-b9f4-421e-9945-1eb92ecbd772", "comment": "Malware payload (ACRStealer)", "value": "20dc4bfb59d29c2968ffd6c9077b90c273bec5c114df5df9c741632f6d190b70", "object_relation": "sha256", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762965, "uuid": "0f463148-6c0f-4ca1-bee7-11625af9bfb5", "comment": "Malware payload (ACRStealer)", "value": "95c9475995ba2c713a9faba8ef35639fc95940bc", "object_relation": "sha1", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762965, "uuid": "0050ab42-b1b3-406b-97a8-be5d805bc6b2", "comment": "Malware payload (ACRStealer)", "value": "7d90f2539df9c1cf7c428c6f77deccfc9481cbf38fa3cf11ea17d184f782df65396b13edbca080f9d6380f039cab6d3e", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762965, "uuid": "de9869f0-db5c-4381-8f77-5e107d016809", "value": "T1F7673351CB4A976BF498B776BD02D313B40183F08B359D4AE79D83D68BC0BF95390A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762965, "uuid": "1e2f5589-179e-4788-bc52-05e3fc20d9b9", "value": "786432:r5c8qepWkWb2sK68e/3zlckA6C+sFFFzLMCTxnIRH:r5tqepa2O/xckDC+UlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762965, "uuid": "f4583e9f-484f-485c-9492-cd4bbd3be3c2", "value": 31722183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762965, "uuid": "466a8275-dadb-4f72-9dfe-d840cf48d8b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762965, "uuid": "f8fc4e3e-ddf6-41ea-ae9e-61f790e7ec51", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4709b88-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750300, "uuid": "ce4d9c5b-8be1-4c81-86cc-75dc0d4aeb82", "comment": "Malware payload (Mirai)", "value": "4b18657de1fe748c5a8aa13a0efb33aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750300, "uuid": "b8131c3f-2302-4580-b429-afe3de473294", "comment": "Malware payload (Mirai)", "value": "210fef0b7498cf8883987ed45e45b7cc2b679ea556da2e632df82c77cbfb1012", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750300, "uuid": "d653d3f0-d406-46e8-a85d-6f9a38ad9df4", "comment": "Malware payload (Mirai)", "value": "8ad8207e1fa02ad063ef4a66aa2c665280fbab37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750300, "uuid": "18947d27-648d-4ecd-8322-eea5404c5062", "comment": "Malware payload (Mirai)", "value": "46e788a490c8376c820ce45a8785972f4a00e845c55322c036f47465714999e7b906aca04c590756636d2f706b7ab430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750300, "uuid": "c42d3017-5919-47a4-bbdf-b830ed97fdb6", "value": "T173E3F649ED41AB00D5D536FAFE4F428973534B6CE3FA7102DA245B2123CAA6F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750300, "uuid": "42f5fdb6-9e30-4775-9f55-ea157f19a1cb", "value": "3072:F7Yinkzc6QgeTRyyJijT4I+xp82WZZUGabudiGV8wGzl2Uh7z+om1tUiBI6:VYinkzc6mTRyyJS4hp8HyGab4iGV8wGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750300, "uuid": "41ce2a24-b8b8-4b93-9a22-307a18210e31", "value": 145128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750300, "uuid": "ebe523c2-aec6-4623-8728-13dc072bbc9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750300, "uuid": "79812e69-d44d-4c90-be77-324157744ca8", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef0d464-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766316, "uuid": "3be6915d-8534-404e-8123-70618e6bbc37", "comment": "Malware payload", "value": "f3a4e53cb81be22bf99e9c3552502ce2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766316, "uuid": "62c92a37-07f6-4cd6-bcd3-72b37fb52d6b", "comment": "Malware payload", "value": "211b9a247ea5604328eb6453c45d6164d06ebf33ed06158234e2e915beb15ab5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766316, "uuid": "28fbdfce-1f07-454b-90b2-b9cbcca436ef", "comment": "Malware payload", "value": "8c5802311cb5fa51cfb4f18eecc4bb59d3884531", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766316, "uuid": "1a33516a-d4b3-4a09-85f3-3e9b88e13a7d", "comment": "Malware payload", "value": "cbc442cea87c42199e455b75d6f17de2570fae5cf59fb73866d5841601ffddf25a3fdbc2c7e5ccdf380459cbfb00d597", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766316, "uuid": "78f87aa0-ffb8-461d-a74f-9d9823c0af0c", "value": "T1C8F1E67025F18C732E24AA40F2372BA5ABB6E91745E7318C35CE2D265F97B41A0FF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766316, "uuid": "058a862f-62ac-4e33-aa74-3d086364bf15", "value": "96:cLu7B65NGr+QC+wN909VM9tQIBvIB6IBDIB7I5Xp6fX6fi6f46fm6f9:cLul6jYRCv+cnQ4fcQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766316, "uuid": "4b08f468-d9e0-4662-91c4-5a3340c3132e", "value": 7989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766316, "uuid": "fe3489cc-c629-45e4-ba20-dc68af855ffb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766316, "uuid": "cbfa0b31-880c-4a3e-875c-ed70f178be4b", "value": "211b9a247ea5604328eb6453c45d6164d06ebf33ed06158234e2e915beb15ab5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5edcb8-101a-11f1-a769-42010a9c0008", "comment": "Malware payload (Rubeus)", "timestamp": 1771784059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784059, "uuid": "726760d2-5ea7-45da-b3b3-ee8120dd9c14", "comment": "Malware payload (Rubeus)", "value": "43626499c9a56ae80c64a066c717767e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784059, "uuid": "36c1c09b-e2f2-49d4-83f8-bb4c2c3ec975", "comment": "Malware payload (Rubeus)", "value": "214be0aae0079be975055752faa13143c003d70655b8c5917fb84ca8f7ad9837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784059, "uuid": "0ab70150-b619-4adf-a9ea-2a053e54281e", "comment": "Malware payload (Rubeus)", "value": "0519812f05f44a4951244d09876b80f59eac6b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784059, "uuid": "cfccef2f-bfac-45fe-a767-999ec57d2f53", "comment": "Malware payload (Rubeus)", "value": "3ea590b356e5cfed9057b5c873a6c5f8c58b6ec966e78f5b510e2dcc5370a51da7bec02134b3343bf892b51b12899a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784059, "uuid": "70774be9-b62c-4041-97e8-6766f976dcaa", "value": "T1279429252BEC4704F2BF1B35E8B152448AFBF806A83AD75E0958549E1B73741CD21BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784059, "uuid": "80ee224c-9aad-4133-957a-75a411612e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784059, "uuid": "dd9a69ad-41a5-49ed-8eb9-1b35890a8c64", "value": "6144:NWtgFKmx00rpfw9Z/MGStNh7+8tpBgGUv1bvuoHBSyz2c0MS:NzK+GUH/4GI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784059, "uuid": "572d889e-e771-4bff-86f8-31a1203867ff", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784059, "uuid": "dabc7a8a-20e0-405d-b5ae-52cdd4c3b7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784059, "uuid": "1fd91072-6f2b-49f7-97ce-e00131c1fe56", "value": "Rubeus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b2d92-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771766415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766415, "uuid": "5737d967-9ae0-4221-b6a9-d1a38831f246", "comment": "Malware payload (Vidar)", "value": "ba497479c013ae0f4ee19def8fe43eac", "object_relation": "md5", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766415, "uuid": "3ed6a2ab-9038-43c4-9401-7e14ae5d95a5", "comment": "Malware payload (Vidar)", "value": "215ef74bce9aa7fc765191c3e165a87c3e649ab2fe1dde74baa71c7d253fbf5b", "object_relation": "sha256", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766415, "uuid": "d6528282-de92-491b-b5b6-25de6178955d", "comment": "Malware payload (Vidar)", "value": "90cedbd57600c10c3fa524111df93280009350ef", "object_relation": "sha1", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766415, "uuid": "2a00d04f-ed11-4b8b-b8ea-988f472b4f9d", "comment": "Malware payload (Vidar)", "value": "3f7a6833dedaa48870f9105f9ad973dbbdf48e281c53c902d8ff5ba5332dc7f65c0dff236065a1641f4d3a4353491c94", "object_relation": "sha3-384", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766415, "uuid": "8c5e0ec7-5d5d-4f1f-869e-febd96590077", "value": "T1F6E7336ADA0D4209E3D6DDFBF8425B699833D446D320FA1E96D10240AC932FB4B5E71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766415, "uuid": "b7468052-9bee-4166-b0e6-91f2a646f3fb", "value": "1572864:CRNmdA0Vbpio45oBbOqNCGgBAXM21Edz/cOWmWYg6C+bUtmmUvkyuD0AhleO:XA40ohfCGgBsM8OxbknD0AhleO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766415, "uuid": "4a390d2f-4f20-4371-bcee-de069ca83666", "value": 69058267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766415, "uuid": "20c4c287-e7d3-408b-95cb-cbf634d2c007", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766415, "uuid": "f8ba1f8d-26d8-446e-8f4e-2e8f3e9cdaa4", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b258262e-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750297, "uuid": "7a64b1af-70e4-405d-b419-efe00c67796b", "comment": "Malware payload (Mirai)", "value": "fc2739947a90f3ab1ddcbe8af6787be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750297, "uuid": "d4afee36-19f8-4b82-9709-f507c8893f5c", "comment": "Malware payload (Mirai)", "value": "21d8b4b092cef625032a9fdc22317954a1641f348fdf0c7da90416ca7a459b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750297, "uuid": "9f3a2402-dbb7-4c1c-bd1f-e898232bacee", "comment": "Malware payload (Mirai)", "value": "60f328b81ad6f6ae8fe8df81c12472d5145b09de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750297, "uuid": "2953674d-b331-4f3d-b2e0-6dd7094234df", "comment": "Malware payload (Mirai)", "value": "caf8a8a6055f2dd37f295a999d78dd6dee76d419a38cea68e06d05cc9dbada57fdf2098031bde27f24492e9cf0deadf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750297, "uuid": "2f34eb1d-56c3-47bc-98a1-ead16fab013b", "value": "T165934D49F753E1F0DD4606B0116FB73D9674EE224024DE69DB94BEB7EC32A02A21B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750297, "uuid": "9cc8b050-60ce-4de1-b6cb-7dbbb787f720", "value": "1536:63+jK3iahFJQ2AKausTZlM5DCypOkn/OhdtIGDT9Yjr6gUf31IiyvCEr:PYLU2xtIlM5DnOksvTyiSi0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750297, "uuid": "c433f56b-245c-4e96-a84e-702dd71c1919", "value": 96680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750297, "uuid": "441f0c3a-4581-4267-b742-165eea715111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750297, "uuid": "ed08413d-f66c-40b8-bd75-68f51ba2b332", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69347907-1026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771789258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789258, "uuid": "c729feee-9222-4a70-948d-ddcfe808bc7e", "comment": "Malware payload", "value": "9684b69e4ffbe63463210871347e3caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789258, "uuid": "ffdf14f3-c8cb-495d-8f7c-fb4dd8066202", "comment": "Malware payload", "value": "21f8530cfd01e083a7e054f903c27920766d3ddb6d1b0030673da8b56047d73d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789258, "uuid": "88e1a3f4-58c6-4aa3-88b6-b514d2eb16e3", "comment": "Malware payload", "value": "1a448b7a10ab10dc7450a606ae305ebad4b24cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789258, "uuid": "4f2188f4-9eda-4415-ba95-a3be1d7b9ef6", "comment": "Malware payload", "value": "3aba99a753bea7b26ca202297c197b4c0302918844320d8eab1e262776999b4b6a876b99024dfee62a49fe3a8bae531a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789258, "uuid": "fc03866c-d4f3-41e2-9397-325c7042eef1", "value": "T1FE934B02B71C0A43E0531DF03A3F17E1C3AAA6A121E9FA89790E9F45D6B1D325957ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789258, "uuid": "a6e3884c-f18d-4cce-bd5f-061e255399f2", "value": "1536:0BV+k9nO3tutj4CPIS0MRhK3bHKAIiXN7rRhss2aQIf3MreQT/5QMnBjpwY:XkVBj70Mz8HJIW7p2alMreQWEwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789258, "uuid": "85399539-d89d-435d-b161-b5f2b299c0b9", "value": 96168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789258, "uuid": "189c9d98-6361-47ed-b79f-477c17ed25cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789258, "uuid": "13193e54-6b2c-40dc-8db9-d9b3ad118b88", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dab39b-103f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771800131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800131, "uuid": "d3fb7361-32b6-4f8a-a8ab-861f97c19f53", "comment": "Malware payload", "value": "e9733831819fe58edd5da5ca17735b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800131, "uuid": "bdb9d63d-d952-4e22-9ecc-9786d697f2ec", "comment": "Malware payload", "value": "2211e585af0adb02b8702ba911ab114fae280ba07ac40fcf8d2f22908ba90d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800131, "uuid": "66ffc949-a79e-470d-96e2-6d6a3c367574", "comment": "Malware payload", "value": "5cef4858020ed392bc4f8c8f75aa1e1c82df3983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800131, "uuid": "1a586edd-fade-4815-aa88-8191ce2cebc3", "comment": "Malware payload", "value": "73cd8741db32205f5d27da440d744b924c91ec649adda1766b0ac2fdf45d50903819fbdcf92e8644efcef9a6d69a17a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800131, "uuid": "9cbfb252-721d-4780-8fd4-089835decb90", "value": "T11DA72312D2E550B8C076CB79CDD34591EB7275224F727BCB2B508AAB1F266CC8E79B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800131, "uuid": "0bb99e0a-c970-4644-b9f4-a691fb402c8c", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800131, "uuid": "81857954-7aed-4656-ae7e-36a6204029db", "value": "98304:sKeYC13gUdMlvFdcYvluPwd41FWKtu4UOjI:sxJtgUC1FJvlpoF1tnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800131, "uuid": "6e18a740-5c36-45f6-9b72-4ae7e9c40b2e", "value": 47185920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800131, "uuid": "197e291b-59fe-4288-bd36-5c672ef4e629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800131, "uuid": "ada92389-212f-4e5c-8e64-c0dc452d9c75", "value": "AegisInjector.vir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb8be6d-102c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771791760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791760, "uuid": "866ddf77-0993-4614-9b4b-6a7dd5a32458", "comment": "Malware payload (Mirai)", "value": "d26b2aa282ead7fbac42f46eb330b3ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791760, "uuid": "f2190a6f-b847-44c6-95e1-696a8cc66e42", "comment": "Malware payload (Mirai)", "value": "2304c404a33679c03874ea7ed50497060bc49d7f83666e8d1b18a2864030ad20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791760, "uuid": "422edd91-587f-4b8a-afaa-bfc0b3593c86", "comment": "Malware payload (Mirai)", "value": "01e85c1d903dbaec88ec38092995373ac2633a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791760, "uuid": "c7d2d030-68d9-49b5-81e5-a6149e7ada45", "comment": "Malware payload (Mirai)", "value": "07962e7b5bdfac71d705effc677ad402f4f1ef157b091da3fb3755ee15d4402c7b9ca5fdbd5d9436cc65b581fdfebc01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791760, "uuid": "b9d6ab4e-407c-479f-a80a-36673b25b662", "value": "T1BB146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791760, "uuid": "a8fc1acd-441f-4bea-ab2f-a1ccfaa43051", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtF:BZAyFzQSdS7Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791760, "uuid": "13bf6ebf-cb1d-47f8-af32-4aeacd7d49bd", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791760, "uuid": "364db6f8-457e-4392-960e-698b7457d003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791760, "uuid": "47b32d63-aa62-4cfd-b7a5-52dbc1820caf", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8acf9d0-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779486, "uuid": "0bf622bf-56dc-4add-bcfa-8e6a1f573734", "comment": "Malware payload (Mirai)", "value": "8c00642742f7bc1af98b0405788138fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779486, "uuid": "c2477347-fef0-4892-91a1-6075f49a9bfe", "comment": "Malware payload (Mirai)", "value": "234dab6f76c53ba1704f0d4fadc9374b71a87c3da0065873ffbde5aadef78901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779486, "uuid": "cd1e709b-26de-405d-a155-9c347c06ccb9", "comment": "Malware payload (Mirai)", "value": "992d94f31f05a1d3fdde97cb624d6d4fe4ad702f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779486, "uuid": "6fc0c836-b22b-4d18-9969-7c4abdc0de19", "comment": "Malware payload (Mirai)", "value": "95f68f47f5653068fae4873935cebbff85f4a291c0253abd00678a0b87d515ecb644613ec4acc01d20afabebd6b200b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779486, "uuid": "33092826-9757-4a1f-b053-87adda9e8dc5", "value": "T1F173910AAFA14FB7F8AFEC370AD91B45249D5417209D3F69B974D814F21A20F1AE3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779486, "uuid": "0925710d-ed8e-4283-ba48-d4d24b5f899e", "value": "1536:g8ZzMV+ts8m4efD5ws2QwPJG+cfD2L5LoDqZG:fZzMVvlfDiFFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779486, "uuid": "c6a66adf-b053-409c-a613-b849052cfc9c", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779486, "uuid": "987084c2-7248-490d-8dc4-f99bd5cc9f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779486, "uuid": "5e2bce24-0348-4d8e-9dcd-aedfc1456e65", "value": "purves.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e87357-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771799, "uuid": "667765a2-813c-44d7-a1e3-0e230285c211", "comment": "Malware payload (Mirai)", "value": "aad5febd612abd25b39e8aee68d96156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771799, "uuid": "cdf2d610-917e-45f2-9a7a-21b898f15133", "comment": "Malware payload (Mirai)", "value": "234e296e7f319dba55ea49467e8c3be28425a1ddd7d4343498e76ee684e5d0af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771799, "uuid": "46f001c4-05dc-4571-89ee-bfa3145b05c2", "comment": "Malware payload (Mirai)", "value": "9b1bcf9963d18ce02543a538799942a3369e6ad1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771799, "uuid": "03a710ff-b0bb-4fa7-9822-068641b53d68", "comment": "Malware payload (Mirai)", "value": "c98cb6b94e977ec720881354db0fc2b0663bea22574d02543c5ccedaa2107e1d0c32f0f20073ba279ebe8832f6ae1814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771799, "uuid": "c43309ac-a870-4ef1-b543-ea99ec4c9574", "value": "T1C46302BDB9282AC5A5315058EDEA0B8B176F3736717E9F913A152B3C92C3162A06D0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771799, "uuid": "ec5faa5e-c45c-4f42-ab7f-169285b9d572", "value": "1536:QVEWVnm6zBOpwwFH7cpoKseLQWLqdFisFYRLCR:QV9FwpwqH7cpouLJ4laR+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771799, "uuid": "b4ea92e2-afbc-4c8e-a5dd-fa6a3e6791a3", "value": 67036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771799, "uuid": "ec432f84-e925-4e63-9a67-c889521f2553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771799, "uuid": "634a3e58-a7b3-4d8c-9ce9-2702b72996dd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503bde87-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784062, "uuid": "17c97d59-6d4e-4410-8a16-9f61771a97c0", "comment": "Malware payload", "value": "288e3ae4f3a8e68c65db570d0f6de218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784062, "uuid": "1c5cb9d8-b214-4b32-9fff-e05282ad481a", "comment": "Malware payload", "value": "237e360ee95e03d3d287c1efda0abcb8557b897336f6abe7863015642a985e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784062, "uuid": "44445176-0936-4920-9800-794bdb49bda5", "comment": "Malware payload", "value": "4e31a5493b7d75d064caf6d713cc79ac38d178de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784062, "uuid": "9d13af7d-a74f-41d6-b533-a1a03b94e972", "comment": "Malware payload", "value": "7311c8987431c39411bd8d4faed579fdac917c300fa53d796a6642806549ba6d78557166727dbfc82520d743a65cfc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784062, "uuid": "3d3a8900-bf7e-4496-809a-29cf26c87f8f", "value": "T168641210B78408AADE7F0BB9ADF6D148876F75066653CCD90D80A6FDCA303D17C16B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784062, "uuid": "2659f5a2-c894-49b7-8942-4804122b4304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784062, "uuid": "f5b44236-6662-47e7-b716-dc6f4efd9961", "value": "6144:q0OYu9hI5yJ34fX61TDYP40xIGh2qKKKZGxP:aHCqJa40CQ2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784062, "uuid": "7916cf4b-43d9-4ddc-acf8-3f77345bea25", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784062, "uuid": "5214cdaf-cf6e-490c-afa6-d08278ca0531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784062, "uuid": "0f2a9ba8-af9a-43ea-a0b5-c1186bb10ea5", "value": "SharpRDP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbc5f70-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768734, "uuid": "af9cf7f7-cd0e-4941-acf9-f0cd0b6a9812", "comment": "Malware payload (Mirai)", "value": "a37ef6260f111bfdf84c8a27df5d2855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768734, "uuid": "98114bd6-025e-40b7-a39b-6e52749e2489", "comment": "Malware payload (Mirai)", "value": "244626fb56c67fffd595bf9bc4b1bda671a55b02bf3cdbd06e61ec7741bb12a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768734, "uuid": "eb40102f-7915-40a8-b0a8-21426306f267", "comment": "Malware payload (Mirai)", "value": "d31dec8f8dbdac2a901af97726bbd2da342de2a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768734, "uuid": "4793f3ce-8282-4e15-8ef6-b0a606e1e4c5", "comment": "Malware payload (Mirai)", "value": "4dddbfc02680233150b2ec8c42e02c2441d92c00ee537b1ed3e49268068b85fbbafe90cbb3f612185625d40d2312e241", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768734, "uuid": "4761f166-d8b2-428c-ac31-cab3f52ab022", "value": "T153C32802F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768734, "uuid": "57502539-755e-4bbb-8803-c9ac657e781d", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BAP1upmzQUAdojgaR/uN:eH3TghM/1weZbcnITeyosFAIxnJdhgJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768734, "uuid": "8d01e001-3aee-405c-8132-ec5c1946dd9a", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768734, "uuid": "3a939eb5-27b7-4af0-a472-2c8770a1addf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768734, "uuid": "e1788120-f9b1-4307-a2f9-34648f5d95cd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5782565e-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766465, "uuid": "bf4fa98f-a3a2-423c-b11c-8239ad585fba", "comment": "Malware payload", "value": "84bc6d1185a3199ead82c27f597cf895", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766465, "uuid": "7ff55424-3c5a-49b0-b0ff-e58e4f5a5639", "comment": "Malware payload", "value": "2455571f08d2abe396594ee7f6b5a6d2c4e69dc455a09ee0774f90aa6686faa2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766465, "uuid": "b4ab2f81-8ee5-40b8-b8f7-994c8247b3d8", "comment": "Malware payload", "value": "d2709fe38c9410ea978bd8cbd6806459e96d507a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766465, "uuid": "5f98ce4f-532a-4bcf-9712-c1b2dad4fa76", "comment": "Malware payload", "value": "83972c76272a0a3983d4c996f56fa3dd0b162f7bed3a66ef146b0d735eb64bafc2b73a1d5360d4cafab15343e45ba5ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766465, "uuid": "ddb4a780-2db4-4876-80cf-c10daeb893e7", "value": "T14A516B7830F31C732E556580B27327A57F73DA5349A322CC35DE1E29AF9BB02A5AB410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766465, "uuid": "7d3f0e1a-864f-4fe1-8cf2-dbed47617765", "value": "48:chRu9+BnB6gR/iPdFHPwWYclwnmZLlr8ZLlriZElrEZElrb:cLuWB6wioV8i35b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766465, "uuid": "90e44eba-4b28-40f7-a854-6d011bd657c7", "value": 3078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766465, "uuid": "ba69f58b-1271-4e7f-b5da-49585ec14a22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766465, "uuid": "ba61f4b4-efd0-4d29-afea-8945844b5ac4", "value": "2455571f08d2abe396594ee7f6b5a6d2c4e69dc455a09ee0774f90aa6686faa2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561b45bf-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800393, "uuid": "1215338a-77b0-4de4-93c4-b1bbac5d149c", "comment": "Malware payload (SalatStealer)", "value": "215cfc80bec05082c3ff00333986f4c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800393, "uuid": "4f121b81-bdd3-4e65-90db-a2d4b36ce819", "comment": "Malware payload (SalatStealer)", "value": "2465bed844358af7061d4be23ef2411c80b40ac4d176bcbd5cf42d9491c7e40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800393, "uuid": "1b7aac64-7746-4cb8-9c16-c4be8b37b3db", "comment": "Malware payload (SalatStealer)", "value": "909c276d8e0eea37294b6246045e0f7865eb1310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800393, "uuid": "c4794ca9-db68-4f33-b299-320e2038ef03", "comment": "Malware payload (SalatStealer)", "value": "aa5f1b12b4433536d1d69432a2ac65d65bf82c29d22f6bd978b8cc0c8f87792d2e6f98ae48e066c01da43bbcadbfcff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800393, "uuid": "0741bdf3-4481-40c2-9ca5-e191e18887f3", "value": "T1C9C65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800393, "uuid": "2c9fce8b-6d25-4622-82f8-8221c118acaa", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800393, "uuid": "2d03fa6b-648a-4412-9e44-fb52a02ba6db", "value": "49152:GtxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wPw:aCtkFllZflv0R+C3eqvi/pmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800393, "uuid": "e0f315f3-7ebb-49a5-b9cd-51a18d84022a", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800393, "uuid": "29d224d4-1e8e-41f3-82f4-a21737326804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800393, "uuid": "70900cd1-d586-417a-9ce6-d19a699e2f24", "value": "SELIWAREEXECUTOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99aa8c80-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766146, "uuid": "f2612e91-4969-4626-bf7d-8d8606b2af78", "comment": "Malware payload", "value": "23a0173a38ea91eb3d7640884a3d4e18", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766146, "uuid": "5eccfe89-f962-4b8e-bb56-b13e2bcb27ed", "comment": "Malware payload", "value": "247bc7b4c84be6fb0841a5e0007c20b9c8bacdfd2facacb2df0367b6ff83ce14", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766146, "uuid": "97faed62-35c3-45b5-94e1-6375d6021db9", "comment": "Malware payload", "value": "c51225778f2dc67734abde8ea09cd2802bab69f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766146, "uuid": "85fc7b41-baab-4dbe-abd8-f30fd7b92b4a", "comment": "Malware payload", "value": "fc0bcca19f6a8850c542caaccc36a64e43811feb79adc9f4ffd0f85999ed912a1d53f5534c2a95afe1116d962b43f2eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766146, "uuid": "1cf02f6a-a0fe-44cb-b1b8-d616999f2431", "value": "T136E1037435F20C732E611680F23727A5ABB6A45749E3708C35DE2D29EF9BB16A5BF001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766146, "uuid": "d8d827e0-6048-4b7c-a768-0ca4f2374fa0", "value": "48:cnRu9R1V6ylwnmu1lwndeP9lwnh+E69lrimE69lrBZLlrMZLlriZLlrXZLlrWZLG:cRuXGmn36fI6fdSITMcckkEE6pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766146, "uuid": "f6a83b21-28ee-498c-bd39-bd28ee88486f", "value": 6950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766146, "uuid": "80032f1e-ad53-4c4f-9545-ddf62e0ccd06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766146, "uuid": "ee1e11ec-741c-4fdd-92d6-fc125e94d731", "value": "247bc7b4c84be6fb0841a5e0007c20b9c8bacdfd2facacb2df0367b6ff83ce14.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3821e55-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752526, "uuid": "6c0590ac-8690-4c8f-b38a-cebe46a32093", "comment": "Malware payload (Mirai)", "value": "3bd948edbcb792c3bd46eed18dff34dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752526, "uuid": "95305537-09aa-434d-9f3d-4d63c26a4d5f", "comment": "Malware payload (Mirai)", "value": "251f154195e4b55fcc4e145efeb5e46a737bb6e5df4ebfd8a4df40e327bc4fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752526, "uuid": "b4b22c55-1787-4ff5-8d1a-a0d7adff9f89", "comment": "Malware payload (Mirai)", "value": "4283d2eee3e624118e8df63830d6f5978460dce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752526, "uuid": "fdcc12fc-4329-4e4c-ba32-fca259505ae9", "comment": "Malware payload (Mirai)", "value": "7982464c53be577b50a3f25bf8359ec464d8235faac6c8fbbb775a72a59462bafdf9c78d9c3073f7337427fb334815aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752526, "uuid": "9f332a16-346d-4211-8db8-b92fe19299b9", "value": "T1C0B3F185B610EBA5C02632FCB4420980E3B25EBE5B5A15174063F9B46DBCCE43F1BED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752526, "uuid": "c3918ebe-3478-4e84-9f13-02f9ada96b28", "value": "1536:Pdt7k7UF9CRkLL/Dgoyqj77N1AckLIS+dUNrx75EepFQZJn8bkhlTS6pp1prwgFS:HpF9jXgobN1AgdUJx75P0H8bwd1pwuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752526, "uuid": "72a4f596-6a23-4d99-9ae5-e1539b065b46", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752526, "uuid": "3889c905-330d-461b-acf7-38a3776ee106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752526, "uuid": "d74bafd0-4777-4428-8fac-e03c0ce3dd27", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24cc1af-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778724, "uuid": "08b7d39a-6596-4210-a213-8356b986145d", "comment": "Malware payload (Mirai)", "value": "4a6930dd6c6d9d571a6abae77cf30612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778724, "uuid": "8859a58e-e8fc-4b5e-b0a0-7622270ba57e", "comment": "Malware payload (Mirai)", "value": "255540511d60f705c9130859e02853e3a4b444fe1f7b41b6fd2dd1baf39e77ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778724, "uuid": "8df83460-3b29-4d00-8210-2b42829795b0", "comment": "Malware payload (Mirai)", "value": "d2bab1bb3c5e485a68d6cc4289030febad69a3ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778724, "uuid": "a4597c80-3ddc-45c9-aa99-8c064c9577c5", "comment": "Malware payload (Mirai)", "value": "a17c84f2658492dcaedacdf21cecf19743a24dbb6e4c6a6e1bfdf2f1e6dfc46ccb7d05358a5d9e27cc8ea0ece4ff7e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778724, "uuid": "83a8c561-04aa-487b-8d18-5f66f9e9495f", "value": "T1F1330113B719FDA2DE751D79B2F98C8E3148426ED0EC682239C8696163C2157FBD48D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778724, "uuid": "298807c6-2e00-4633-98e9-81ee5be07ddf", "value": "768:SfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbZlQ749q3UEL2qEK5J6OAsNTGjf2tl8c:dPtQjiZVcykHRDZUL15J6RN2tAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778724, "uuid": "120cec6f-5ef9-492e-a461-7b88aa7538e9", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778724, "uuid": "155d1205-9050-4c95-98e6-9a2c11ae40df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778724, "uuid": "d17df539-3279-4428-9586-d6e16b91a590", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdb5f00-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766313, "uuid": "bcb3b28d-af6c-43c2-974f-bfe69dee1eb2", "comment": "Malware payload", "value": "edc074855a4923027957714752a1113c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766313, "uuid": "ea7c1df8-d035-400b-8478-19ff78f693c9", "comment": "Malware payload", "value": "257726614c6326fe088f417235e7d8dac1323717473baa5bcda3a777b9743db2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766313, "uuid": "c414a549-13d5-4022-9adf-daba0ce0ceca", "comment": "Malware payload", "value": "2f672f0cd2c472187ea49ab4234044c030c7ca99", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766313, "uuid": "4715e78f-5a6c-4fdb-ba7e-3fca8e828b1d", "comment": "Malware payload", "value": "26b844c077056874371c256f2a5b51133bd59ba43a2a6063ca9f4f92b1ca61c0b9d4a73973a6ed2e876a542f5ea98a3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766313, "uuid": "54a672de-812b-4e3b-8c14-03731119ec77", "value": "T1E9712E7026F04C736E206544F2372FA5ABB7E8170697618C349E1D396F93F42B5AF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766313, "uuid": "3593f64b-968d-4c6e-9eb8-13575e8bce7b", "value": "48:csRu9RJ9nB6gSIlrmCKZmDl27lwn880/kE69lripE69lrE/E69lr+rE69lrMRgOL:cCu7B66KZqzs36fT6fN6fB6fspJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766313, "uuid": "87290dca-7398-462c-b765-938635676f34", "value": 3806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766313, "uuid": "7f25b6a6-e6fa-49e6-835d-ede9e7384628", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766313, "uuid": "0c005598-d5a1-4327-8aa5-4275fd23d051", "value": "257726614c6326fe088f417235e7d8dac1323717473baa5bcda3a777b9743db2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a108dd48-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768736, "uuid": "379ef851-691e-49b2-a6c9-848f676e55ea", "comment": "Malware payload (Mirai)", "value": "061b99d4177590ca9e229839589d4482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768736, "uuid": "b12f8be8-67e9-4375-ac01-9e60340540c8", "comment": "Malware payload (Mirai)", "value": "25f2649712ece51ae7da8abfbfa3a53e60cbbe8b677a98b6127e6e82631cb900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768736, "uuid": "9aa58af7-1d62-4e8e-a9ef-161d8e718f9a", "comment": "Malware payload (Mirai)", "value": "8a3c51f781bf94d68699dc69afcd7742d552d9eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768736, "uuid": "a240048b-4e61-426e-9965-2becf03515ea", "comment": "Malware payload (Mirai)", "value": "a9bc978524ed3bf60bdc8f2cad45838b7e6633eb8faeb01e6dad691d09e55a865747ece729db4b4051917167456ae347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768736, "uuid": "40a1b23e-a6ac-4e89-8b1c-11aa656cdc38", "value": "T152F3B50E6E198F7CF79987345BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768736, "uuid": "cc37d1e4-76d4-4ec3-856b-75963ae3ec48", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiw1:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768736, "uuid": "8333f84d-a12e-4143-bb94-031dba0bf6c9", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768736, "uuid": "c3050c1f-8c29-4829-903b-03f4723ca48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768736, "uuid": "f687742d-5748-4ca0-a927-a0871b1b559a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8698d6c9-0ff2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766973, "uuid": "367ee473-4c89-4906-b23e-cb42959b048f", "comment": "Malware payload (Mirai)", "value": "b2186c84849bcc8e1e1143f366332c9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766973, "uuid": "1c3920d9-dc13-4d95-b793-d7314a061abe", "comment": "Malware payload (Mirai)", "value": "26426f0ef36e3b7c3a5e40a904cb3040e9a832d3877e84870494ba3af367822d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766973, "uuid": "19c29e38-8b38-48e3-bdbc-edd37ca6e0fc", "comment": "Malware payload (Mirai)", "value": "4129ff2ef6034f3f5b9b1c0b9461095f4069a90d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766973, "uuid": "3a9f29b2-916d-48dd-b13c-834e04b7172e", "comment": "Malware payload (Mirai)", "value": "54a83a1f976079e996a6573b00be2aeb7d9b75261b2e618c7faeca4c7ee64ded2ca8f0740925435ee0355b14a479ab66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766973, "uuid": "6e2cf97e-7e40-4262-9c97-18d31758a9e2", "value": "T1C5D33A17B5D184FDC499C2744FAAF13BAE32F5591238B26B2BC4AA172E8DE305F5D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766973, "uuid": "8518f890-21e2-439d-a4a5-2d05b85e5a8d", "value": "3072:XNFsFEDahDToQ4coXGDHcz/hnHpIHgQhUCuFlH5Nbf0TG:dFsFEDahDToQ4RXJqHE1wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766973, "uuid": "cf4e6374-e5c6-4726-ad8d-933073f4164c", "value": 142696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766973, "uuid": "2f64405f-af77-4e06-9cf8-f26aacf9d02e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766973, "uuid": "5b7332a9-7689-41e9-8458-dc7b427eb77c", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269b7bc8-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766383, "uuid": "8428da76-078e-4a5c-89ec-ab5571c83b4f", "comment": "Malware payload", "value": "dc946cf593d473467e9ed93bc9a4ddfa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766383, "uuid": "dd7af7e6-cfb5-499d-8020-9dff3b83f4f2", "comment": "Malware payload", "value": "27203c1d6ef6b974db0199885189f7e82a538928c5c9d8729243c90aca4e7c4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766383, "uuid": "9ca7bfcd-5701-4f44-848d-9d17cfa060f8", "comment": "Malware payload", "value": "fcbb3f2d4435794f63f4c7bbf4189500fe2c4848", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766383, "uuid": "f704e585-cdad-4914-a503-92ee20e41cab", "comment": "Malware payload", "value": "3523ac13c8ed4a8854bf7e09ff8637b848974092ecc47d6fd9595fabb2e918d21dc9f62ca9212975fd5f401073aba599", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766383, "uuid": "f64ffd39-8baf-419d-be35-2ed30241af8a", "value": "T15462473721F14A33A6D054C8A2771BA15F72D617856720B8F4BE26369F5DE0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766383, "uuid": "ca862df6-9057-4a9d-9a74-c0da9a533364", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6Ml6fz7+kxBhz:cCuhK6p4hvZ5m5FG4j4HKNphvIjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766383, "uuid": "741e9734-0d57-4de5-9715-a180c4c5f57c", "value": 15325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766383, "uuid": "e7c67acb-e1d9-4b2a-9d9b-c364f1273d1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766383, "uuid": "04a5d284-fe42-469e-b665-4b770c5380a4", "value": "27203c1d6ef6b974db0199885189f7e82a538928c5c9d8729243c90aca4e7c4c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb75b6a-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778718, "uuid": "6dc1c43d-d1cc-4eb5-9f7d-e003ffa1e681", "comment": "Malware payload (Mirai)", "value": "ec17b9fbb1911e9d2e095f69da6d7c33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778718, "uuid": "3fed4741-1699-4200-92c7-a1a64f153686", "comment": "Malware payload (Mirai)", "value": "273fa53f3311a6efa02d584d7ce920d4cfffd848dafb075e2df3157ea1d04287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778718, "uuid": "baf6fb9a-d84f-4611-a008-1da13e12e25f", "comment": "Malware payload (Mirai)", "value": "27ec9138ef170130c8da3e25bbe8d22eb55c38a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778718, "uuid": "1b02b451-03b6-48c3-8836-bb83190c90be", "comment": "Malware payload (Mirai)", "value": "20378a59ed39b30d531de6df187468330d4beb5f9b0f4bbfbc73966eea0c1c7aedd35d10712c3e6b6dc3bb5d07c0610a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778718, "uuid": "9bbfd898-e933-4fa9-a632-f42d8f74446d", "value": "T1AB5423FE1C6207EBC7689FF3B52A7254A28013C7018D458E5B6AD9B0F547326C854FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778718, "uuid": "b7157d01-988c-49d6-b131-55863fc85b8d", "value": "6144:7j7xkeCaXWJ4tgClKnHtFFLyntGRabhy05+3LNE4G9BM78jBjoe4:7HBXWJ6bYtFFmntGRabw3RMy6jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778718, "uuid": "027631cf-0780-4d92-8c9c-1150aedfa6c5", "value": 299932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778718, "uuid": "ac56bd8b-94fd-4332-8914-0a30f2a97a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778718, "uuid": "21d42364-8d0f-4c7a-ac06-1febca61ab3e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3142c0e-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771853, "uuid": "50308107-c1ab-4cac-9cfb-9ae5a604a2f6", "comment": "Malware payload (Mirai)", "value": "134368394ce526be3f1e67275b0895c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771853, "uuid": "a3c60bab-add6-4f2d-ae07-2d422dcf27fc", "comment": "Malware payload (Mirai)", "value": "27c817179c22e4688d9d6f81638bde82e91ac76463ab81c06438bfc2899ecf03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771853, "uuid": "cc187053-23a5-4f2a-84e1-4e585e3b8189", "comment": "Malware payload (Mirai)", "value": "506f6c13df02932df8a74b89e2e24104f7dba787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771853, "uuid": "5bfee9aa-e89c-485a-941a-349ca49c0ccc", "comment": "Malware payload (Mirai)", "value": "e99ab1d555f3e42c25c4b65975714deeb8b5d1d3693b0c237bd10196a0e958cfde0a91e694a1893ae18ce4db6d905e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771853, "uuid": "add6cc2a-05eb-407c-a2c6-dcb87343fd08", "value": "T1D33308A2FC82859AC5C057B2A76E568A73A263A5D1DF3313CC580F1077C961F4E77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771853, "uuid": "d5b5efd8-d3a1-4403-8bb8-8a89298c22e1", "value": "1536:XZ/VRqPTJM47lJFs3X+PWt0d8DO503dD:p/VRq7JMm8Sd8Du0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771853, "uuid": "90ba8b38-9b25-44d3-8616-0e7eaa584f3f", "value": 53856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771853, "uuid": "0ec1ed68-a57c-4831-a3da-ddd604088ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771853, "uuid": "00efdd02-0114-4ea0-8e93-92b2383a839e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e897c1-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766385, "uuid": "322b4f35-394c-4d71-a3ca-6f0ac7a304ce", "comment": "Malware payload", "value": "9d1454b9a15f370949412d301cdde4ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766385, "uuid": "39434bc0-d24a-4e5e-a7dd-de5693333111", "comment": "Malware payload", "value": "27d91a2346b523180eb7b8172dc9787525c7e9feed529a2d2815c1d097377c83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766385, "uuid": "7be63182-d098-492e-b4ed-12d7bd202ba6", "comment": "Malware payload", "value": "70d364c868244463fb64b6fbc5f0f32f4193a141", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766385, "uuid": "25886749-e5e6-4454-9bc1-535a843e1a3d", "comment": "Malware payload", "value": "ee4110fe042c32af165da6004495e14ebf4dd54adcdec1d20606692475cd87d8c6680744ecd2e5fb5da02e8f35f61e2b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766385, "uuid": "e978eafa-549a-4e89-bba8-9e598001e0f8", "value": "T18E51D77020F08D332D606684F3731B666FB2E9174593218879DE1E296F97B42A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766385, "uuid": "cce2ec83-919c-4718-a899-f7f805824957", "value": "48:cniRxuGRys0Cj5Z3aorlwnaejQejZimMUq/lpNQA/y8NzbNir+s+u7c3mIi7c38p:cWu4fL3aoUv5ZHCTdIKpFVxBUSpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766385, "uuid": "8aa4d3ae-7502-4566-ba01-05d6b3535603", "value": 2978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766385, "uuid": "3bc6e389-6a6e-4404-aab3-1a20c1ac90a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766385, "uuid": "d20e435a-d382-4a9e-9365-1736ad01aa7a", "value": "27d91a2346b523180eb7b8172dc9787525c7e9feed529a2d2815c1d097377c83.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2e8df0-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752543, "uuid": "145d3212-d323-486b-977d-f64156100d71", "comment": "Malware payload (Mirai)", "value": "22e731aa42033d447213a7dc93188707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752543, "uuid": "460aa424-1aa0-44d4-8148-7e85752ab57b", "comment": "Malware payload (Mirai)", "value": "2862bed1d422e3da4b3c91e78e83d2b18b6c9c6f2df941a8a1930e807dc7ec88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752543, "uuid": "01c83537-e0c1-4dee-8439-d28c2898a83e", "comment": "Malware payload (Mirai)", "value": "893957885889e65cdf958ad3ae89756afcd271ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752543, "uuid": "02b8167d-a816-490c-895a-1282a56af730", "comment": "Malware payload (Mirai)", "value": "b18ed465ec011ece759f5a4ae0737ce1545e53ecbc2569a9648b4d4a3411ec33db84e146148f4b74e0411864fb1919f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752543, "uuid": "60b81336-4ca6-486b-addb-0221cf96fe15", "value": "T18A5301F871D0F7D4C655E735A82B12352E11929E3A86807093C66183BBEFBB8F74E520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752543, "uuid": "2891ee17-d753-402d-a883-15c693e85eca", "value": "1536:wxsK35jx34Vpj73QxC0Qi00e+46LI2K56ztF1AqVquIzqVT4//Lkg4azHD:wKK/IVpHwzQit46LJKszVqecnLGazHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752543, "uuid": "a36f1977-ccbb-40cc-a9ad-7e450b37b811", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752543, "uuid": "9c110b90-3fd2-44b8-b5a4-ef595c60d59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752543, "uuid": "7da70e89-96ac-46b5-b98e-b93c2508fe2d", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ebcb76-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784068, "uuid": "626df344-1534-4971-9a14-b702384a5a20", "comment": "Malware payload", "value": "f03a17b69f4c60629ba9b9981c89deb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784068, "uuid": "80d17cfa-0d92-401c-98f8-98903a34be61", "comment": "Malware payload", "value": "287f87db7206d01932a38c7971c3b658e5e2fc932dff378c18bff88e215338b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784068, "uuid": "25617190-0379-49fe-9498-ed97c9f87a24", "comment": "Malware payload", "value": "5ad186b8cec195383de1d368aa53158cb1145120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784068, "uuid": "b7262903-19d7-4ee1-926d-c35d8932dc38", "comment": "Malware payload", "value": "28615fafd79025f124f394c7c9dff790f89c70f78fd2a8767aad40efaad56e6df5f16e9783b072ef25e6b2be57de261d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784068, "uuid": "45c7f8fc-e397-4e19-a9dd-95ba6cd7abfa", "value": "T1C315F1122BAC4B52EEEE17B8E871204567FFD500609FF38F2E94E5AE664FB104945363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784068, "uuid": "6426fc91-b1cd-4c9a-8637-8f72a2d8be66", "value": "24576:Hdc8cY5G1FOPjWcjL8TxNYqEv0rODHZ/lpWUmJKfplz7XWu9q:H5cY56OaccTtsWIZ/GUm0fpB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784068, "uuid": "1bc0ecf2-020b-409d-864f-54fb1aaf8579", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784068, "uuid": "dc5bea78-7c07-4d7f-955a-eb792070a4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784068, "uuid": "87255b40-d027-4f5e-ba52-b5bdf4e560af", "value": "SweetPotato.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7d8bbc-1000-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771773023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773023, "uuid": "28d32df5-99d1-4ae2-8a7d-01cb2b6c16d0", "comment": "Malware payload", "value": "f3090da14f0f68b71714a7bb7f162e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773023, "uuid": "8c3def69-49f8-4ad2-a782-409c4d3c9b31", "comment": "Malware payload", "value": "28cc12c092e331809e92dd20604ee1f646cbb96f8426f3944214605f590fe7df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773023, "uuid": "9528e92a-47a2-45e4-b3af-d586545b1e8c", "comment": "Malware payload", "value": "dfc3ca34f774915d167c43cd8c499df4cf7c8a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773023, "uuid": "620ce6cb-a622-429e-9552-bfc247bfa372", "comment": "Malware payload", "value": "2291fdcf608ccdfc1cee7b78fabea205d2cb1c3cc3ce3d636effcbf7b9bbe9cc265136cf4b6870c2110a9b1f4cc346c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773023, "uuid": "aff15e6e-2fea-4043-b4e0-126ef3467920", "value": "T1E1871256E2F900E8E97BC0B8C6575517EBB1344517309BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773023, "uuid": "01e899d5-50fd-49be-8ea4-34e799341bc1", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773023, "uuid": "5690a6de-8ba4-43e2-bb70-ca70b16d428d", "value": "786432:65/OhtzhWNsKpjGct8To61nEPwd49C880XsCh/:2OhtzEnpjGi8T1nEPtw8z8Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771773023, "uuid": "32cb2855-87b8-4bd0-8606-6006e0357fff", "value": 36214096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771773023, "uuid": "254f0f97-c761-4cf7-b311-922046f825a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773023, "uuid": "eb41d61d-8f0d-4a1e-a36d-23e7cff02b5b", "value": "Soft_ConnectAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f153208b-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752550, "uuid": "425e7c9c-b57a-42f7-98d1-c1a942ade9c5", "comment": "Malware payload (Mirai)", "value": "737a83806a5bc3e9bf24d6c44daff3f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752550, "uuid": "8890c685-4a94-41d2-9594-049569b73e15", "comment": "Malware payload (Mirai)", "value": "28f258264926456740937f72be9730aa91016b75a0fad8c59f442af615d4cbd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752550, "uuid": "38d1deae-a78b-4167-9ab8-87d845da9d65", "comment": "Malware payload (Mirai)", "value": "f67ba31009b217604440ca569595c19af17b256e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752550, "uuid": "8a2c2506-7101-4f62-8636-dda44c1176af", "comment": "Malware payload (Mirai)", "value": "cc7e35f418e37375b78a48970ce5b84755f13b1f94ce6147daf929ea46aa8ba4092435492eaac5334a1d5320d984002a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752550, "uuid": "d940f6f1-b711-4914-87c7-74fe54443963", "value": "T1A8631255E7E85F92FDA0787292000BCF8289861E90DFE363C6628D5B71FD3A46BA145C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752550, "uuid": "dcf6071d-ea4a-44de-a7fb-fddfd52a35f7", "value": "1536:9n7ZEOA5ZDC6WmaQECYPTEJFEpAnUpR7/cDcwrPd:97ZEOAkJfCSTseyUz//wrPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752550, "uuid": "4cc758f2-783e-448f-8fb5-bf69cf7d5b6b", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752550, "uuid": "f4697b79-a889-4ccc-98bf-486db7c1d8ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752550, "uuid": "76505e5c-9487-4742-9415-a4c56e6d1b35", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5216df89-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800386, "uuid": "c7d18504-a156-44dd-883f-90a84ed2623f", "comment": "Malware payload (SalatStealer)", "value": "ab43101ec3d32cb7d4446eab085dc8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800386, "uuid": "a5f5774e-5b41-414c-9b77-bee7abd86096", "comment": "Malware payload (SalatStealer)", "value": "290cc89cbf19973bf8335783657e72f80c6ab906012c8348918655de3c7ee6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800386, "uuid": "e052369f-c3b7-45df-b5fb-ac2c7c7364dd", "comment": "Malware payload (SalatStealer)", "value": "52f1f7e41c0a7b384327d8d7412b2b47186208a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800386, "uuid": "841d3c31-47c7-4bf5-916a-893867d9daad", "comment": "Malware payload (SalatStealer)", "value": "9869b0f7ce42cb4529962992a7e3ca12917fd244b61ffd40b41e91a80c324acfb6f9007b932b2d79bbd973c690d5d225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800386, "uuid": "56b2c5d0-0a63-4717-a259-4cf9a35ccb9a", "value": "T103C65B45FA8B98F5E9031835406BB23F63315D049B28DBDBFB543F6AFC7B6821926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800386, "uuid": "25c35c02-ff4d-4e62-9d9f-ea6c08fffc86", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800386, "uuid": "93de59d6-7af3-4a89-81d5-0720c6ca8f32", "value": "49152:lUBqSKpfLzdv6jBBlcr02ur4l1PHhidVYDdtkMj/VTNzavsNATk0E5gnJcO7L/as:GgSKpl6M5hj/DavTQonNXC9Y3kjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800386, "uuid": "f8781212-db1f-4aaf-853a-8ec6b02bde6c", "value": 11673088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800386, "uuid": "e8a3943f-3b3f-4a90-8fa3-170033d7fcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800386, "uuid": "2cc43010-d7c3-4312-a228-557580a83ed3", "value": "RapidLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8742fd-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779389, "uuid": "e29076c9-c4b4-47b1-ab5f-0e02c6b5b3c1", "comment": "Malware payload (Mirai)", "value": "0afa727096ad88ca1bd95d125183b2db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779389, "uuid": "9746cb85-16d4-4243-aaf9-8f60e023d51f", "comment": "Malware payload (Mirai)", "value": "2977d628b784429f0f7337c489ebd20602a2e434320778388db5a0777eb70186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779389, "uuid": "7f9fbc63-8cb3-4480-aa3e-a4711b721a32", "comment": "Malware payload (Mirai)", "value": "fc9f4f5cbb11e2b6089305d10e2ab0e55fe393db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779389, "uuid": "4c9fb3bb-2df4-4688-9f61-69c3f203553f", "comment": "Malware payload (Mirai)", "value": "1bfee3143460f0778bea19c411e73d8984c206a821d592f82e9bf6092a0a07bc228881edabedf1b9dec69da065d9333d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779389, "uuid": "6ec8ae2f-b543-4c40-8b67-68fe8112ae84", "value": "T172F2E0274626EAF8C539F4731F646A94E665FC152530C3CB85C82BEEED5E6C02E14B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779389, "uuid": "2d54144e-c0d1-4441-9063-a448e9ad2162", "value": "768:IyJre0nn8Z456pD0U1bAk3xmFOQFXnaVz7VKyb/PpruBxPh/5G+dj+Lv:IyJpnJSYNXnaLKMuBxPh/B+Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779389, "uuid": "1a1b00c8-bf83-486b-8b4b-0ab7b7c5c75d", "value": 37372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779389, "uuid": "2e454a1d-5368-4194-9cd8-6b15510b6530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779389, "uuid": "ee2e7882-2ccc-4fd4-9dc9-2e8a171c22b2", "value": "px64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e76e047-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766477, "uuid": "85c2ad51-97e3-43dc-a9a9-ff63f4afb22b", "comment": "Malware payload", "value": "63692cda1e4795440268c8e73b472820", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766477, "uuid": "d52a25f1-1fd7-4656-8e1e-8ec4e6bcabf5", "comment": "Malware payload", "value": "29adf8227d1d5af3c62c6045864c95d815b84deaefb20d60fc967c28a6405e64", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766477, "uuid": "6763135a-d6c3-489d-bdcc-7ec60092615a", "comment": "Malware payload", "value": "84e6b439892ae8c22eff95f8ab16233cd97517cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766477, "uuid": "34b98ac3-313d-4819-8d26-1bb5f906786b", "comment": "Malware payload", "value": "88dbfa9f8cd7c2afc85c79f88cc4b2306694d9bff6b655e030a447ea82ce0f826a0585f8039989455afc896255366c06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766477, "uuid": "9874a39d-685d-42c8-90b7-d63b4a0e823b", "value": "T12091E67020F04C336E645984B37727A6AB76D95399A3228C34DE1F396FC6B12A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766477, "uuid": "3a373536-bbf0-4207-88de-c9ded76255f9", "value": "48:chRu9Rp9nB6gvijlwnm+pkl/8kIpkl/ij/pklrE9dpklr+dxZWk7l/MdxZWk7l/r:cLu7B6hsk1tsY1AAAWAAU3AAX3AAIpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766477, "uuid": "b6b42edc-eb18-40cd-aed6-d33cdab50285", "value": 4407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766477, "uuid": "84a37fae-9cd4-4cb7-8f8d-773fd9d9d76d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766477, "uuid": "eaf2fe53-b136-47c2-b9d9-f3ef11e94306", "value": "29adf8227d1d5af3c62c6045864c95d815b84deaefb20d60fc967c28a6405e64.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea7f5ea-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766370, "uuid": "9bb6f257-61a7-4fa8-8039-3582a1816611", "comment": "Malware payload", "value": "f6e9c74ebbfda8edf6367b20b30dc2e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766370, "uuid": "ca205607-cc4f-466c-8653-f062cbab324a", "comment": "Malware payload", "value": "2a1acca2f72d3f30a96bfe1ab58ae574b38b9e9d3f4c73667541e87da7779c93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766370, "uuid": "e15b1e4e-8f67-4692-a7a5-47e243ea595e", "comment": "Malware payload", "value": "c62b4e3ad2d898a5baf11cf6c669f0c9397098dc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766370, "uuid": "5db6e3b0-b221-47f2-b2ae-9fa7dcf27756", "comment": "Malware payload", "value": "6b7193ac490e6e4f1969cdd2c98b28a886f3b6df7b2262a005831fa8e4f61d955aa6700164dae7352dc3e4a4b3c005cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766370, "uuid": "2f92cb6b-b8df-43a6-82be-95083ae39db9", "value": "T1BC42553B21F08B32D3D410C9A2A61A654F72A70B452614B5F4BE6736AF2D90375E7F60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766370, "uuid": "045499c7-497c-472b-9b47-d05d7b8aea56", "value": "96:cCuNsht+O+v1fsn+h4+tIiKqCTyOygyzYtujtuHKNpUj4waHvjTUkf06fG6fo6fC:cCuk4hvZ5m5F/r4j4HKNphva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766370, "uuid": "965e0831-bdb0-4132-8bcc-ef0de9d69464", "value": 12207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766370, "uuid": "31b4eb16-502a-4776-8771-bd775cf10ab2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766370, "uuid": "0d6b7a06-82f1-47e0-b5b4-4edb03ee1d48", "value": "2a1acca2f72d3f30a96bfe1ab58ae574b38b9e9d3f4c73667541e87da7779c93.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bafd82-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771753116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753116, "uuid": "ade9a0de-c9c4-4dc9-b74d-b6c952e157ec", "comment": "Malware payload", "value": "e70aae845ef4abc271847ede124e288e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753116, "uuid": "887fb5ff-aa11-4879-a3e6-9ea373db7c4f", "comment": "Malware payload", "value": "2a524d34444ac42795ea75d0c93d130790d17f536aebe06a27a120bd52401248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753116, "uuid": "ba3580d1-ec68-4dc0-86aa-5b8ee9160a5d", "comment": "Malware payload", "value": "fc7455ee2821237f281901b98267684add0d1a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753116, "uuid": "d667dfc2-cc77-49ce-bc81-3daef62808bd", "comment": "Malware payload", "value": "e9b35e135e2b58e670934cfaa0066028dab1c02cf87b5d0374bd90a012f4d66451ed58c45b1f9c8c9d48f9b441687814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753116, "uuid": "da3e64c2-2c66-47c5-b427-14c7afefd514", "value": "T1A9A36C8AFB47E0F0E90509B0116BF73986319D361024DEEBEB94FE72AD32643951A65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753116, "uuid": "4b1d7d00-3edb-4905-853d-d6441973d5ae", "value": "1536:nbSvfl+95AJ85w5AI8G86YqoIgXR75Uu31QsHPrQ3/er:nkfl+O85wqx7IYue8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753116, "uuid": "8954d277-6cfa-4f34-8659-2a1b9fe25dad", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753116, "uuid": "c615cdbd-2a7a-437b-9685-19ad83bd0290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753116, "uuid": "d1f66989-ddc4-40e4-9aff-95fe02ef394a", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72585788-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790562, "uuid": "28541800-fca9-4e83-a1b7-57a6f3ec1c34", "comment": "Malware payload (Mirai)", "value": "778ebdd357394354139768abb0cc4d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790562, "uuid": "72eb5fe0-91fd-42ae-8df3-32e79605bda1", "comment": "Malware payload (Mirai)", "value": "2a5fed5f385a2e35259962e2256e356f9e5af44e9db242c4c31081359beda3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790562, "uuid": "c3254685-e794-476e-b752-0206174532bd", "comment": "Malware payload (Mirai)", "value": "31317719d915db099f7d6a9517b9abc63e94d640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790562, "uuid": "0319b269-cd56-4222-a5d4-96a79affea94", "comment": "Malware payload (Mirai)", "value": "e4121712f5c466fced66563cd8d964216a127055fdb8229b42369c7d49244b33fa0544a3589fad471b00f825f9d83078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790562, "uuid": "cdc5de3f-11bf-4f69-8cdc-b3761911be50", "value": "T14CB39C8BF28745A0C86286F007CB0BDE6D2322C25F67E5E37D6A26395E750DF0A05BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790562, "uuid": "a86045ab-2138-48f8-bc92-00de4c3cd7a2", "value": "1536:AmpzaTiE3s+FoTjpOewVmlNF4+S65LgGX/LWyo:ASAT7oTj85Vmp4+SmgGXqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790562, "uuid": "de8c0d69-aa0e-46d6-8b79-e2a68ea585cb", "value": 116072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790562, "uuid": "57eb08e4-7903-4775-86b8-381f293a2572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790562, "uuid": "f501b0ae-16b3-4456-8f2a-20492cdb5afe", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aa4b5c-0ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767782, "uuid": "809a82e9-f7b2-4372-8e57-8c3ce92e0429", "comment": "Malware payload (Mirai)", "value": "199512e6d437f7f990fc00ac67d84173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767782, "uuid": "f5014b82-8710-441b-b803-c74e841bfa38", "comment": "Malware payload (Mirai)", "value": "2a903c33153268a8eab458ccb345c0ed4f6ac449e2627ed81b1972fdf5144956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767782, "uuid": "a8a708dc-d1ea-49aa-abea-69b440f52250", "comment": "Malware payload (Mirai)", "value": "3804d5b1d6a3d92b5e56bf3f82429f7112efc21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767782, "uuid": "1b0b4e9d-284b-4180-b5db-d1f7302677f2", "comment": "Malware payload (Mirai)", "value": "bd49fe394795c88720943f55aaa7179a49bc83088b172ccd3cff21a1f7671e36140f22edd0b13c4dfd303aa987642917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767782, "uuid": "e224d9d0-74eb-4bd3-87ee-4998eb3464a3", "value": "T189837DC6BA43C0F4ED2704712177F7325673E53E006AEE43D769A972ED52642A32A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767782, "uuid": "c2381006-3fea-4485-8f5c-841651a4ae47", "value": "1536:H1XEXC4tzIZGy4+K936ktG6iH3LVoOtqLEXcXpV/f:HcNzI/3K936QiH3JoOILB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767782, "uuid": "5fe5abef-9776-45bb-98b1-173571d69200", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767782, "uuid": "1d03bee7-e5e5-456c-a209-e2015009b440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767782, "uuid": "147d791d-bf9e-45fd-ba24-28e96f55de6c", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa537e2-0fd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771755016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755016, "uuid": "c7a9bcc6-5b6e-4600-9b5c-adec4736d07c", "comment": "Malware payload (Mirai)", "value": "97893cd0cd46bedc00a0d1205fa61a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755016, "uuid": "a8308c62-8a84-446d-adb8-62cea75014df", "comment": "Malware payload (Mirai)", "value": "2aa157dfc3ebc3f5a5d6619857097164d1f5f846066785b8fb8632316d6beaa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755016, "uuid": "f8103888-9ab3-4365-ab30-2502a3203f6c", "comment": "Malware payload (Mirai)", "value": "2037916b16acafb7ba8242264ff4037cb39fb0d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755016, "uuid": "c1415f39-5a82-457a-9a16-86da53bf5bb1", "comment": "Malware payload (Mirai)", "value": "b7aebc2d43aae79e392852d9ad70efad7b0331a765b2324d9f358df9ca4e956a7640b33dbd1fcc5e8f57392c9b1c1a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755016, "uuid": "3d56bbb7-f029-49c0-bd56-9288e84b2b11", "value": "T1FE434A03A9BC2A2BD5D4A23311B343A3F1E71B9951C4D68FBD260E4F9E553501AA7BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755016, "uuid": "dee734fe-6d64-4217-9132-cd4f029cfd48", "value": "1536:44BsWzAL85j575hRvpE/m3DNrGqG69bCOLrLgQssW:DOQDVC01hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755016, "uuid": "a837e4be-8d3a-4e09-bf57-5a1b7ffcf803", "value": 60072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755016, "uuid": "bfa79d7d-71f2-401e-9f13-a7775978b9c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755016, "uuid": "d7e6a06e-1b71-445f-88f3-c78d459fa1b3", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7be4b51-0ffa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771770599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770599, "uuid": "d29d8a09-e611-4fae-8660-79901c2cda03", "comment": "Malware payload", "value": "733bcd0b49f7b12591bcec7d8e433482", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770599, "uuid": "62dd6065-baee-47df-aca6-67429e366132", "comment": "Malware payload", "value": "2b371dd96fb5a588e40a9d79fdb80e2c5eee9a240e9c3795da447943a51803ed", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770599, "uuid": "23266209-c9df-4d5a-90cd-2d43c88e084b", "comment": "Malware payload", "value": "08907fc6657820682efe4c935582e1d6b421752e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770599, "uuid": "d8ab96c3-c210-4f1e-851c-aa55694873af", "comment": "Malware payload", "value": "be868e7a06b3c911f0487f370745337f3068c5b0a7006144c5e3242f1c92c93133f179c860b9615f0569c02320d7a06e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770599, "uuid": "f76955bd-0b16-45e3-90f3-7ffcb6597272", "value": "T18457235AEB0CA42FD9F770B9CF798253A129F1440281C79BAC14952EADC76C48F5AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770599, "uuid": "1b0e3f4b-2945-4a49-a6c3-bde92d645f52", "value": "393216:pPLgXLODW0xHXAi8P8V9rZR77HpbSxhDvvBcco2/uKM8Q2+YgX1FDEw/p2iBheY6:NLfDfxwNkbrXPGBScP2KM8QuDiWXTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770599, "uuid": "0e0272af-d989-47bc-8f95-e7c5b11d411a", "value": 27443580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770599, "uuid": "7d875565-64f5-4735-932e-892136ee3791", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770599, "uuid": "bebba069-10d9-4069-b5e7-9ef5ffc75682", "value": "Useful+Clean_1.0.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33caadf-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752499, "uuid": "7d189b44-987d-46ba-b5da-8d748df80a4f", "comment": "Malware payload (Mirai)", "value": "02efd4a7a85325577d1a5e7b6f8e15d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752499, "uuid": "200c7d2d-e397-4dbb-a607-ea9f78284955", "comment": "Malware payload (Mirai)", "value": "2bf64fc0c94bc256c22d32eb6341cf7f38d7c3f5623ac09f5508684b636416da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752499, "uuid": "a83aef96-6e71-4cea-8a28-0ffc3ea6f729", "comment": "Malware payload (Mirai)", "value": "de8460d9f095d6f4857fab1dcbbd096c52e1a093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752499, "uuid": "b1be5f0e-a1e5-4281-a25c-0742bf3caf4f", "comment": "Malware payload (Mirai)", "value": "185add2806ac2af37afea1bfce51e74c9c076d7460e9c710a8d7aea1ae831d37916b95af1c25195a42c7d0df4c31d726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752499, "uuid": "e44978f2-ae43-4c77-8d5a-d3c506e0dd3b", "value": "T17ED35C0A78D274FCC687D170926E9F61E63A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752499, "uuid": "aff6f027-d168-4e59-a64c-e4aaf65ac194", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQx:yIRfe3xvvSrlvZZ7Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752499, "uuid": "f17184f9-3ad7-4bb4-a843-5a43626f7661", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752499, "uuid": "ee978908-3a17-4ed8-9059-f11b1ae445ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752499, "uuid": "535b281b-2f36-444f-9ac3-e1e71e018a78", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273f164b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766384, "uuid": "99cec2b7-ee0a-4809-9ad5-00d4b74f8f3a", "comment": "Malware payload", "value": "ab61c9780781be1888e6cbf67710d7bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766384, "uuid": "46460e65-a3c7-4719-848f-11b1cf050183", "comment": "Malware payload", "value": "2c63053ff6bb464b38a1526675d361474354f89fa3c9351af2adbeea75cd1af9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766384, "uuid": "a8aba0c0-9b21-4075-a61e-57ecbde8cc26", "comment": "Malware payload", "value": "44e1345d88eeb963296e7d4b1d96c92343618170", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766384, "uuid": "cda824a4-3b01-4561-afb0-a56f82635aa5", "comment": "Malware payload", "value": "5731921fba8fce597154d8582e32f8b4629d70c01d87d38ee8cdb9f4fc96dd36205cbfb9279e3c11f3199db852a844e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766384, "uuid": "0ca1a521-6792-40e1-a9ab-2eaa425bf086", "value": "T13322692B10F08B32D3C450D952A65A610EB2A71F452614F5F4FEA32AAF2C90735D7F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766384, "uuid": "50a0e0bf-fc0d-4b37-a8e9-d9029c63450a", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjGVTLKfccITQioVB0:cCu34hvZ5m5FG4j4HKNpivqVyfccITQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766384, "uuid": "e19bd1cf-deee-4c69-83fc-a60706726509", "value": 10842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766384, "uuid": "a27be856-1088-4ee1-bab7-ceec891a1e73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766384, "uuid": "e4822cd7-3b4a-4b4e-83c5-c037379501c1", "value": "2c63053ff6bb464b38a1526675d361474354f89fa3c9351af2adbeea75cd1af9.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0efa692-0fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1771747395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771747395, "uuid": "452ee439-a843-4c7f-a721-c10094a5c25e", "comment": "Malware payload (Stealc)", "value": "0bd9b8a5e643d1778d7866d1b5f5d97e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771747395, "uuid": "670bddbb-8ba4-49b2-a07b-bbd58b645078", "comment": "Malware payload (Stealc)", "value": "2c9bda6108de3a34226a97dad68c0b227610f9e569f312b38246607aadcaf2a4", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771747395, "uuid": "beb3321f-dcb5-4d78-b446-4af21e48204b", "comment": "Malware payload (Stealc)", "value": "1a1203498a2f5ddd5dd5e0e4cf73a8f289edff6e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771747395, "uuid": "9496aa3e-4ca7-411f-8e6f-1456ebbc36e0", "comment": "Malware payload (Stealc)", "value": "8bf036ed2a327604f386a631487e8d78630262ed7c1c5d799a9d7ecd51086da632b1f1def188a3a98d23ed7a9c22e25c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771747395, "uuid": "39b86df2-b19f-499f-8f78-0770a5dc612b", "value": "T17EF56C136DD1C8A4D0AAF335E567A196B625FC0C073137D31E61EEB16E317D0AA3AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771747395, "uuid": "d0e2af21-8cba-4f62-b8fe-821ef756e0a6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771747395, "uuid": "8cc92edb-9c4b-42a3-8344-5b87ce77ab52", "value": "24576:toA8NXB5g+GonlUEDQRoFgv1cPFCvWMu8FUt2LGS4YvzYdbMUSAchelet29mqn6z:toAyx5EonlcoFgv1cIWMFzY1DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771747395, "uuid": "9ebee88a-e2bc-402d-a649-4e3eb730e4cf", "value": 3363840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771747395, "uuid": "fb64618e-576c-4a1c-863d-92ca1ff3503d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771747395, "uuid": "9a936e80-0fd8-4ade-8bb3-d13fa48a13b7", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dd5e24-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778731, "uuid": "5ba5ac05-102b-4862-a70b-3bc8638872c9", "comment": "Malware payload", "value": "7f90e2e9aa6eea34a8fde56c039bde78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778731, "uuid": "08c16685-867a-4375-a448-af5604a42eae", "comment": "Malware payload", "value": "2c9f02d0471e80c86359a8515afc6a1a9f3d634cec98461e5583864b3d68a760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778731, "uuid": "74fc8a3f-47e6-4d28-9aef-e02deb7024ec", "comment": "Malware payload", "value": "4df2fc081e8bc8996140f7be68360a318ba14a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778731, "uuid": "142ee481-7b0d-4050-bc59-2ae36a74309b", "comment": "Malware payload", "value": "9682e388994e6823bac3ae4a3d458a0296edb22d52d0962a99eefaff399abd9c133eea3406982760c887c53d3781923e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778731, "uuid": "769a8e59-4033-43b6-b7a2-c04eb2e3f2b5", "value": "T1D86627136A68EB0FC21832345CB1CAA467691C8542DB9917B395F31DE9F20EC9D6ECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778731, "uuid": "cff3931c-39f8-4a4d-b780-160309ae5e20", "value": "49152:JOawbsmSZcQzGaij1hZvuXknNpRTlC7/E9FBnj4oQBwOEItQwEt+W7f8+HHEt5Ey:ynyyNQS7wMpnEjEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778731, "uuid": "48872441-7793-42b0-a437-84a94dcaa113", "value": 6553815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778731, "uuid": "829cb4a2-7fb6-43bd-a169-eb6aafd60ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778731, "uuid": "e16f67ff-cef9-439c-a07e-00b9076d285e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46015f87-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766436, "uuid": "9dab7f19-f0f3-4af5-94c4-36838eb22ab4", "comment": "Malware payload", "value": "7b3ecd466fbd66f0624acb84721e5f04", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766436, "uuid": "3f80117a-d7e7-4204-9c26-920a9dc9b751", "comment": "Malware payload", "value": "2cae7d56c3063a8d27c5a3b5792cca771560ee844f82da521c49bb64c88252f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766436, "uuid": "f57376ec-045c-4045-b7a7-0f52ce0e6749", "comment": "Malware payload", "value": "f450f7edd284edf37bda6f1dbc40189afb1b1cf6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766436, "uuid": "ab00a1fd-72c1-4cde-bd68-cc696bd61fb0", "comment": "Malware payload", "value": "fbdcb4aa0f28557c30978fd18f5bc7dadee3fe0e92ecd2b766b4f414860864f473c14a7ae5c9e4bde56565e101089f86", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766436, "uuid": "755f6b8c-f9ea-43ca-aadf-74a558e128b5", "value": "T1B6E1C57121F14C336D605984B3772BA6ABB6D95389E3218C35DE2E356F96F02B0BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766436, "uuid": "9599b5bb-70a4-4f02-a2c3-c155d5665186", "value": "96:cCu7B6wNEOSwxkEgUEKEVqEorlrypEpjpPFsgX:cCul6axvhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766436, "uuid": "98757bd1-f2de-472f-9f16-96890f6e1fb7", "value": 7016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766436, "uuid": "05bc6491-0def-4f69-8104-7f801cf85d5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766436, "uuid": "ed345e1d-542d-4fd9-86a5-5dae46a25d07", "value": "2cae7d56c3063a8d27c5a3b5792cca771560ee844f82da521c49bb64c88252f0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaa4cc4-102c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771792059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792059, "uuid": "f06538d0-1c0e-4d08-b8b6-28a75a534b14", "comment": "Malware payload (Mirai)", "value": "2c9bf4ddcc413eadef6adfa9c6360e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792059, "uuid": "4524c3b1-e70d-498c-b83e-4e37c230583b", "comment": "Malware payload (Mirai)", "value": "2cb6dd261e1925bf9605abc8fe68078f7237e904fe3a3b7e8920013d41fd12ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792059, "uuid": "58aeb88f-1cd5-4732-a4c4-96cd28f315b0", "comment": "Malware payload (Mirai)", "value": "1c55e1a2780ddaa14dc1e7e0eb1dd4e7eff1d145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792059, "uuid": "4482b1fa-9c4c-4e77-8d6a-b4f813ad2b5b", "comment": "Malware payload (Mirai)", "value": "03448956109a5c9a63de5f624641878f7357a73c66bf4775cb90f067fdbf037c034b82f3b57fee17d1003855f3a30346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792059, "uuid": "b676a7f1-5139-4b34-b613-a688fb9c1bb3", "value": "T13173026221B6DEA2D1B2443273837D5A7D238876037492FEBC79A66FB486E105C0C85E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792059, "uuid": "310d7214-6199-4bd8-b8bc-2dd26a6a279f", "value": "1536:E8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWm1tQJorM:LzRnwP0bMQ2RijvDZZ1rYGhG133QJSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771792059, "uuid": "6bf8378e-724e-4a3e-a158-ca6562a6df8e", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771792059, "uuid": "e35230f4-b68c-4c28-abb9-9016ec2a672a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792059, "uuid": "c618b576-7f45-4d08-8d70-6cf33a6d3638", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779accda-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779404, "uuid": "82812fd4-a68a-4d1f-bd0d-d41c3b3310a6", "comment": "Malware payload (Mirai)", "value": "1f502d5e01900055e5e7e8f06a94ff9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779404, "uuid": "cb85e430-4076-4044-9534-1a4c24be03d3", "comment": "Malware payload (Mirai)", "value": "2ccc768b112959c27d4155228d427853c845a4a85e60a0dc0cd116ce510c4209", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779404, "uuid": "636aeb2d-5707-4b06-96fa-90cae4442f4e", "comment": "Malware payload (Mirai)", "value": "aecb8cee9e2d665745ff0ea1f71f72843f8fcdf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779404, "uuid": "1e4e4820-077c-47ab-82e2-b3ddd9413fa9", "comment": "Malware payload (Mirai)", "value": "1dd3d5e4c0fc0e408aabe97c0e7895e47b777a1050ce46b73cdf817ece34679c0080c09aabac129c3598f72c2b31ba29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779404, "uuid": "083078c8-d7d1-4292-9bdf-d1816c3c23f2", "value": "T1B2535C34ED792E27C0D8B27B52F78225F5EA130E24709A5D3CB90F8EBF1464468572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779404, "uuid": "e5d8fb50-4f7b-40d8-80cc-deb9956d8151", "value": "768:C7CwbSpWoXRtsLbSsY+YR1cBjDCl6WsFQi4hudG7IiSWgp3O+lh725FE84v8:Ozb8WszsLbecdDCl6vFUP8rluFx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779404, "uuid": "d3ffce49-d215-4ab3-aed8-15ef0bf201be", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779404, "uuid": "afe5a72d-2ecf-4586-a95c-e1f4b1c9b95e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779404, "uuid": "54a61902-60b7-47a7-b34a-4eabc8a11914", "value": "purves.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081e075c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766332, "uuid": "57bd1519-e119-41fa-acfa-a7aaad9dd910", "comment": "Malware payload", "value": "fad59741f6b41ec85accc813aca27164", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766332, "uuid": "1479df65-d1b7-4f05-837c-2045dd8700ec", "comment": "Malware payload", "value": "2cfa102b049968a1d9be003095ac74432f491975b1f7af8b57d690003289e2b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766332, "uuid": "b2029c02-c3fb-4128-bd21-43f489dcfdbf", "comment": "Malware payload", "value": "8915dec5c78c2ba4cd88926d66842632861eb50d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766332, "uuid": "a8e46de2-70f0-4fc7-bcc7-65b03e9538f1", "comment": "Malware payload", "value": "328d5bf18a3370fec567e10ea7270a255e001e5fb6533b13d6f7e344ece29daac69ab5ab008f67831ba081052d182ecf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766332, "uuid": "e81e84de-4f7c-4a82-8418-58c2bbb3448f", "value": "T10D315B7441F11D63260C644062B31B857F73DF53865213DC35DF5FAA5F8AA03628B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766332, "uuid": "c2dbb2e5-25bb-45e2-99b5-cc7b3bc42a1f", "value": "24:csnRUR8fAR25ha9HHIuCzCRpYdZeFc/iPdFHjeef5uZW5FkXdflU1Dlc9HHUeN:csRu9RHnB6gFc/iPdFHPwWYcdlwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766332, "uuid": "07485b51-5f4f-46b2-b116-e60b6d4f0ed9", "value": 1617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766332, "uuid": "5b7f40e2-766a-4954-8b96-52f418b568c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766332, "uuid": "9260369f-612b-40a0-8952-330ea249a45a", "value": "2cfa102b049968a1d9be003095ac74432f491975b1f7af8b57d690003289e2b6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8695a3-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750392, "uuid": "f1cf7531-c2a3-4def-a8c0-6c1805105159", "comment": "Malware payload (Mirai)", "value": "609f53dda21e66dbabd275fde421c71f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750392, "uuid": "877d9c64-fbef-4f79-b45f-fbc74fad563b", "comment": "Malware payload (Mirai)", "value": "2d1890cf8bbcd143ba3105d016842a8ca7710364de6e84592eb0a5c729fc32db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750392, "uuid": "84546260-dc27-436d-9225-db3e2befee6e", "comment": "Malware payload (Mirai)", "value": "f4d077adb04942fd113839c565e7a4c30574ce74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750392, "uuid": "54e932ed-ce1f-49e3-9cdf-5006fd7399b7", "comment": "Malware payload (Mirai)", "value": "20e0d784c35de8b91e428232869d9e3024673872d2d313ef2f1fcf9861d0de5c63a5d6997445950ffc4001fc81bb0195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750392, "uuid": "0d4e6e39-a27c-4c0b-b143-f0e70d44189f", "value": "T132F32B56F992DF01D5C725BAFA6E418933135FF8D3FA3112CD20AF61238A59B0E7A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750392, "uuid": "14ad3fd4-8ddd-4d0e-9cc6-9f00e7386317", "value": "3072:QPCHMk6iccG+CXJbTQnjjOkhawTPR+YRiARc4U8wgrc6OSC9Hb1MqsP:QPEhDGTXJbMNhawrR+YRiARJU8zcvSCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750392, "uuid": "57a4fa13-a7c6-4051-b314-7694428fe7a6", "value": 169440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750392, "uuid": "bb23fcc4-3c8d-44b2-b3b2-52f8b7640730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750392, "uuid": "105769ec-bf67-43a3-8fbe-f39f22c7da4d", "value": "arm7.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa9d823-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771753111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753111, "uuid": "c4e8e2f6-4ad9-4e88-8987-ca0dfd3362e2", "comment": "Malware payload", "value": "412d6f5527934e1c5ad35a3859c23f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753111, "uuid": "25ff18a5-7f21-4f8e-8624-aa770decfb66", "comment": "Malware payload", "value": "2d6850f200260c9ee778ce71cef56166fbe1eefd290a6727e629bf0c95bb3aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753111, "uuid": "fb2a3fbf-dfe2-4228-9b7a-69f513db90c0", "comment": "Malware payload", "value": "9925f67f08788322b2d2d011830e6cc9cd8b8deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753111, "uuid": "0cee0c47-f822-49db-ad7b-a2bc9343de2c", "comment": "Malware payload", "value": "00b0b52bee38136823a06606b6177425c80c8708d31e48806b326fc18483f5879c359adc2926f2e5e4055e8dddd5997e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753111, "uuid": "b3cbbaf1-eb02-4809-b712-1e23fe2eb3bd", "value": "T1B8934B02B70D0E43D1671EF02A3F27D1D3AEA6E021E4FA89691F9745D1B1E361986ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753111, "uuid": "5931c3d8-65f5-46b3-8e13-f98277c8a213", "value": "1536:TxnLvOu1RTQlrU7iD1mSYdkWvIwRvLQn/pMtz6CkAsNCxEJTi:dnzhTw+SyIw9mMcC0Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753111, "uuid": "9863371b-d584-4eeb-a52c-697836acc519", "value": 96440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753111, "uuid": "dfe22a53-0692-41e3-8a20-3e786fe4f65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753111, "uuid": "119639d4-511f-4447-80aa-b61ee97a261c", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaa19fe-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784140, "uuid": "72df817d-4853-47fe-9ff0-765e91b4bb47", "comment": "Malware payload", "value": "f4806b9e14179490e4e5bb452c2d0175", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784140, "uuid": "8a397d44-12ac-4d1f-97ad-3384b8e9ed72", "comment": "Malware payload", "value": "2e119708b87f8ce7ea54dac6b87a5f6dceb9566d2edaaf5805bfce4ec0df85ff", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784140, "uuid": "8e9ff79a-538b-41f4-8c88-18211e21d275", "comment": "Malware payload", "value": "d1ea74ae8eb4c9d55edf3f7f669ddbc10f26c45a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784140, "uuid": "9320e160-b088-4b37-944d-26f5d1230c52", "comment": "Malware payload", "value": "cf233e3267a9c4f1d717245aa73fab6f56e61f1f6d5dee23c745f23b837a65f64f0ddf9368b524016fdd4820bf342204", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784140, "uuid": "f3dc98b1-8541-43ce-8aeb-d43a8f252485", "value": "T108E02018B3C2FE59454446875141AC95F2740C05551CB6D343CEC4ED54A59C6B2041B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784140, "uuid": "3deabd79-cb62-4319-a53a-f78f964d2f37", "value": "6:5RwmoNRhSx2SYbEB4bIpHKAnIfhBKIMX5rVyl3mmdyQ4nXemNOPmA3B+3+u:YmoNRc7VBBpHbnehBKwlnt4nXm3B+3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784140, "uuid": "a31676e8-b8d4-48cb-b8d3-d72e5803c151", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784140, "uuid": "555b6625-cd49-4e13-8897-d83a83d98999", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784140, "uuid": "28df5ec5-637e-4ec6-bcf8-26207f1ddd62", "value": "rev.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f941ac31-1004-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771774897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774897, "uuid": "4fa7a31f-b3f2-403f-bc32-1b24ee79c167", "comment": "Malware payload (Mirai)", "value": "c01a6c5f75c7cdc6291818c7a2596add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774897, "uuid": "7c2569ff-0007-402c-baed-80c6d1ddc0ac", "comment": "Malware payload (Mirai)", "value": "2e882071aaff08463538f1f829477e7cbd9b10548b11c3cdc881cea06c746850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774897, "uuid": "20e04ef3-28dc-4092-8b98-25e6d7f3714a", "comment": "Malware payload (Mirai)", "value": "bd30f662e9a38b50592a8933769f28947196d3a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774897, "uuid": "73e91a24-9eda-40e8-a155-14411d35632a", "comment": "Malware payload (Mirai)", "value": "86243b1f780b73652671ebf76647efda7525c56fc9cde98207e5faa07a8feeaa0b3ec40adf65a202a9fcf815a489e2c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774897, "uuid": "6a38c588-3000-4296-9bd7-b993eef371dd", "value": "T12CB36CC2F743C0F6D85304B1507BAF369E33D4BA5025DB42E7689A71DCA2A05D71ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774897, "uuid": "99b83089-cd5e-479f-b95f-b45653b695db", "value": "3072:EPian1DTJGm4EgPw55RP2V2Zsv1hIB18ee:Eqan9mCukZsvoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774897, "uuid": "546dcd12-ed76-4dd6-9cdf-c342423a4f9c", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774897, "uuid": "394e206e-a689-49ca-86e2-c7fd35e1da6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774897, "uuid": "ef1021b0-1884-4152-a56d-e352c176b6f4", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0eec28-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771873, "uuid": "61e23324-a720-42b3-aa3c-9e06532d7df1", "comment": "Malware payload (Mirai)", "value": "44df12ad40c9fa959cc1b9a6db720d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771873, "uuid": "138e89e1-4706-4d3a-b8d5-113f0241e9c9", "comment": "Malware payload (Mirai)", "value": "2f0d17ac39d05354045b64c5b15e615356e164c141598d08495695eb961d5e8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771873, "uuid": "260f67cd-0dd8-4f72-99ad-f1ab5fa64a6c", "comment": "Malware payload (Mirai)", "value": "1a6c7f1c166216c2909b481ae191a96507422bc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771873, "uuid": "5b598a75-f4c3-47da-b4a2-33951c884673", "comment": "Malware payload (Mirai)", "value": "a912f03f80997e4904296aaf55cfb908415c347e54b36133c75866d0f383aff418cc702568c7cbc88963c2e1645e8683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771873, "uuid": "85d7d7f5-c694-4beb-b030-947a0dd8ce2b", "value": "T1B5934C02B70C0E47D1575EB03A3F27D1D3EF9EA120E4F684651EBA8591B6E321686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771873, "uuid": "4fc85118-416c-4ff3-8f17-5b414d866840", "value": "1536:cpwUxdVXYbTLGrHxqSrGmBzOCUl2G1V+Ft+CxzVZpq86aQGQTFL1Gk:cptBITiVwVKXZZ6Fik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771873, "uuid": "3fd3ac9a-1ddf-4de6-998f-bb5ba7703018", "value": 89560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771873, "uuid": "63376ac5-37e1-4107-bede-20b4dbdaec32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771873, "uuid": "c2e8ba7d-6147-44fa-84cd-244ea05bb313", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2304b74-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771798, "uuid": "607c44e1-be35-40d0-ac32-a6421831728f", "comment": "Malware payload (Mirai)", "value": "83463239f1857ab8b9360a43d52efc2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771798, "uuid": "ff09440c-dcee-46ea-b70f-2a27a4bd0b3c", "comment": "Malware payload (Mirai)", "value": "2f1b2de9011fe4a9090ce869ee971ffbed76a92221bed34f918fef7736e6213f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771798, "uuid": "1e22d37b-cf27-48d4-b9fb-130ca28f344b", "comment": "Malware payload (Mirai)", "value": "31a665ca624f2ab7192062f5d00c98140aa3eb57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771798, "uuid": "b667f9a7-e6c7-4bbe-ab08-40618fe1bd96", "comment": "Malware payload (Mirai)", "value": "045b22e962c3b7395e3565b9a923a295d5a07cc8b6c328944b1979dc2ed7d7d99b3701e7b386d327f4ffd148919f8b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771798, "uuid": "fd28d565-eebf-4100-bac7-ff05a8d3b656", "value": "T114F43A45F8809F62C6D12576F75F826C731747B9D3EBB20699288B343BD792B0B3A640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771798, "uuid": "f4c25191-9ce9-43d7-b56d-ddf11513be10", "value": "12288:/6sAyyIsmq29JGF2n0GLxhbsXoz+2AsDP93Qojl8p3PacRf3AvaAFvS:CsAyyIj9JGonfLxhbKoq2An1a63ACAFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771798, "uuid": "69f0d9c7-4ff2-416f-854c-ddad875016b4", "value": 730176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771798, "uuid": "f383c821-b949-4211-aae1-07ced8cf98cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771798, "uuid": "7adbebec-8f9d-423e-bb55-4e3b629576ef", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967faf79-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768718, "uuid": "f6005ad8-05f2-4629-bae9-2908d98e1cea", "comment": "Malware payload (Mirai)", "value": "4727421ed6b480561ab17d283b269578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768718, "uuid": "4f70ff9f-8cee-4457-a1c6-93fc4244526d", "comment": "Malware payload (Mirai)", "value": "2fb39303fcd45d26b7881829dadbdb39315b34a0afb3ee00cc05734d56ecd694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768718, "uuid": "16feda95-6827-41c9-a07d-84efc0c50231", "comment": "Malware payload (Mirai)", "value": "c4852bdae2c1a00f2bba1452712157de39cad72a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768718, "uuid": "ebec8b2a-1443-4bb7-89e1-ad19dccae8bb", "comment": "Malware payload (Mirai)", "value": "5669ba8a61ce24534a939ff0de12a390817e60b0c670b418e4067a2a64cf58a7378e8ad9d1b2c19bc744e7fbdaf5be96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768718, "uuid": "e4b7e2ac-0ec0-4a45-a722-74207f1580c1", "value": "T11493D551BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B217B8551F0C63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768718, "uuid": "1c47d67f-3d82-44a6-b976-83868d48de9a", "value": "1536:Ud+d+6yn9H/NTzULgW4W2luLaN5q00brz9ikZcxew+7YY1:++dAn9eL6w0ecxetd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768718, "uuid": "cfeb7348-476a-49af-91db-c17255e857f7", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768718, "uuid": "de843e45-7a47-41ab-822a-16fb2a732618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768718, "uuid": "d57b5d30-12ed-4282-bac7-ca9d738aa358", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a950bf-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766373, "uuid": "8200076c-e541-49e1-8bf4-c5596bf7fa13", "comment": "Malware payload", "value": "5f9ef53b357a5b1bbcbd46d12e5296ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766373, "uuid": "a8cf1cde-7332-442c-b27a-6407fe34a987", "comment": "Malware payload", "value": "303361f16329cb940b1bb993097d3671b7c1881aefb49d8e19cb8cba9fa64f2c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766373, "uuid": "ef0d6595-130c-42aa-8533-bc216b43546e", "comment": "Malware payload", "value": "af476701aadd4521caeb5556acba3102fbba175d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766373, "uuid": "9ba82c94-c98b-4701-b723-7fd69bee28e6", "comment": "Malware payload", "value": "cd1749fbe6977f117f8cceff211c6f05d8ceda82677267069bfae40a28bb601ebd0ed6b6715a0f230454af574d55573e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766373, "uuid": "e4bfcbfe-1495-47ef-9003-a6508865209f", "value": "T119315BB421F1583326642680B3372F567FB6DC03499311CC34EE6A396F87F02A5BB412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766373, "uuid": "6d147ab6-a864-4fab-9449-5d11252cbfcf", "value": "24:chnRUR8fAR25xifqM9HHIuCzCRpYdZeda56KLUlc9HH/+vLSifqVlc9HHVeN:chRu9RF3nB6gdaqlwnmvLlKlwns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766373, "uuid": "a3121659-e652-4ed0-b8bc-9705e91e8c96", "value": 1554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766373, "uuid": "a4f0145b-490b-4a01-9bf6-bc0adec77769", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766373, "uuid": "518c04ba-deb2-46e5-bb85-b7fa8a3529f1", "value": "303361f16329cb940b1bb993097d3671b7c1881aefb49d8e19cb8cba9fa64f2c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2133e5e-1021-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771787260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787260, "uuid": "08e5a9c2-e855-4551-915c-d3dacd7e774d", "comment": "Malware payload", "value": "1089c006c43146eabf553fdae89b8d5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787260, "uuid": "f8941be4-1e94-4353-917b-5378171328b0", "comment": "Malware payload", "value": "3110c95070f2acad1f9a1fbc46fca9df71a0528351e47fd44a9b177ab36635ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787260, "uuid": "25c8f2d4-34a9-447e-92e0-2aa69b8d89f6", "comment": "Malware payload", "value": "d65df60eb6c549c6be86399cbf3c5df16d9d1c15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787260, "uuid": "9e89ee39-3e6f-44dc-b83b-c63292a07a9a", "comment": "Malware payload", "value": "254cc8d1e7ab69f9ea39b72720e0bb7d4f5ec690bf36358d385d7a7f770fac5f68c7a07d4837a82b540fac45e02c62be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787260, "uuid": "5415aa23-ae24-4991-bdd6-f6d57a2a8cbe", "value": "T129934C02B71C0E43D1635DF03E3F27D1D3EEA6A421F4F689691E9A45D2B2D322586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787260, "uuid": "f5f2f320-94c5-4583-89c8-64a87054854b", "value": "1536:bnIy489hsxTnyrnRDXSTY+sMJDsfrfPOGqOLj7Xa9psY7oSrTIJ0WpQ1:i8kTe6sMFeXr9LXa0YVTGQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787260, "uuid": "628c4d87-221a-4633-99ab-c40d2173bae6", "value": 96168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787260, "uuid": "ca211209-41a2-4f66-bc70-3895723e20bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787260, "uuid": "55d430ab-0a41-4f98-a241-a441625bdf5a", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e571f767-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778729, "uuid": "befd597e-d61c-4774-b531-a86916fc33b8", "comment": "Malware payload", "value": "d06658fcf82330d11b077e15b6db26fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778729, "uuid": "484c5dcf-f063-480c-bd7b-0d953c84c044", "comment": "Malware payload", "value": "316df36ec18564ca9ce4d71a3829f6f2299df57d5438f345dfccfb037e65a69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778729, "uuid": "3732af57-5a5f-44fb-a716-5bbc5a045cb3", "comment": "Malware payload", "value": "76211ab415122811f684fcf663698218c8b9a5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778729, "uuid": "84219ba3-88d8-4d14-b995-a3083c2a0fcd", "comment": "Malware payload", "value": "1513311e33769ec52ed07b9e8d3ae4f1f082b51ddbba7da0a730e50b0b5e91a051a9a41dc58ddee2380ebfc5de83bbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778729, "uuid": "e01a6772-37af-4295-aec5-66d88239d8a2", "value": "T1C2462851FECB54F6EA031A3111BBA26F63315D058F24EBD7EA407F2AF97B6910832119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778729, "uuid": "af78bc71-79d7-4ef3-b650-b61687488c08", "value": "49152:eI8f7VkSr+GrS13GTP28DDMPBpRb/gMw9S7ztpVSbFoX5cTG5E8:5k7x+G213SP7Ktboa8W/E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778729, "uuid": "d593de42-8d1d-4b91-afdc-7d8f9a391c98", "value": 5705912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778729, "uuid": "8c6fadd2-5be5-4a23-b68d-897e49526fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778729, "uuid": "8115c35a-999e-4563-be66-f31a7105f946", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df5b02e-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787870, "uuid": "b823e6bf-c1a8-42a6-9a65-1cd7e65243fd", "comment": "Malware payload (Mirai)", "value": "d1c165c4c27f01f78e06d8dc9152adb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787870, "uuid": "8d6059d9-66b0-44a6-af75-b4380ce97c0f", "comment": "Malware payload (Mirai)", "value": "318c1fad7311d8dde84736044bdf4b9f4c06c4cc4e1761dd1e6190103ce1bad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787870, "uuid": "6ef4ae7f-5041-41e1-8f61-299865c91049", "comment": "Malware payload (Mirai)", "value": "0dc06f9f02eeb329b72b64f5ca2966136b9c2367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787870, "uuid": "5c8396b8-43cb-4c18-9141-e062671b2aa5", "comment": "Malware payload (Mirai)", "value": "1eae811073144b3142623e5c86ad4987744900532e1d6de952953186aaa9d5b031b0d2204af196df4c4103e73eb86204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787870, "uuid": "643a5cdf-3f12-4ecc-95ad-69d9cce25452", "value": "T110C3F809AB610FFBE86FCD3706E90B0525CC551722A87B7A7574D828F64B64B4AE3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787870, "uuid": "fed45fe7-21f4-46ae-86ac-f38b5cf13340", "value": "1536:4vmc6psqg5FzGgerzyfNhNg1LiZ2DWNmf2rFdLmKiLhda5QBXGUNZKSqJkphf+Z9:4vmc6ps5er2u7+QXNYV/Zq4NaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787870, "uuid": "57c68097-d447-4781-8dbb-a42234470f8a", "value": 126636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787870, "uuid": "641e42ce-2e0f-4543-8b21-59f0a9647080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787870, "uuid": "53a65ea3-74b1-4baa-bfa3-125e6fdf7dfd", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2368f19-0fef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771765839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765839, "uuid": "fe078f7e-71be-461f-bcfd-4df55b3018c2", "comment": "Malware payload", "value": "d9559024ff8f16e72c36edc0d12fed1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765839, "uuid": "0a2c5c0b-0682-4f6a-9f1a-dfda401ea870", "comment": "Malware payload", "value": "3197ab416853afa1cde6920f57a20e63342b7b5f4681f50e38e5dd78eebaf919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765839, "uuid": "ff48c214-86e9-45e6-8a87-6092d6052222", "comment": "Malware payload", "value": "4642a9655ac5905ab8e546682e4eb5e6a4277ea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765839, "uuid": "dff24446-7961-4a29-819d-b24bad572831", "comment": "Malware payload", "value": "bec8060088b991bb68ca24ed23ad6d94a9d113d85faf4a7aa14e6aab183668d69c6b94bb140cab0054eaa17ea994f869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765839, "uuid": "b11953d0-6e87-40e1-8ed5-4b45ce2d714b", "value": "T134934D02770D0A43E1671DF03A3F17E1C3AE66E120E4FA496A0EDA4996B1E365947ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765839, "uuid": "821822f7-1f0d-4ee7-8b22-9e48e429906d", "value": "1536:ljL753I0mneuFTJ+X90rUfqWQGZzP6bl+24u0lJBrBebmQz9T/:N75422oyWhZL24LBrrS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765839, "uuid": "5df698f7-9618-4781-81ec-3b1661841b8d", "value": 96488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765839, "uuid": "192a1c81-b947-409d-961a-a82eae526952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765839, "uuid": "3a17062a-1450-4862-8e54-1449a836db0b", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f800677-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766156, "uuid": "53b5ca60-d5c5-4756-aec6-87df6ac1ca69", "comment": "Malware payload", "value": "9c24b6998d37a57d3f490b34e5e7dfa6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766156, "uuid": "ffc53841-c033-4215-8a5d-15baf04792f5", "comment": "Malware payload", "value": "31ae07eeeafd2a6c1d5158ae22d4fe28c749cf03c85c642a2d3d4fec920008c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766156, "uuid": "35c68823-c1b4-42cb-a891-6aedad641c53", "comment": "Malware payload", "value": "1238a702b8e6bacdcc28dad97159fd253e79f6bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766156, "uuid": "eba91699-34c3-482a-ba92-a7102d43710a", "comment": "Malware payload", "value": "810417684c27f7a2a2a56ff45f9cacf1642411241824f183e55f9f8d79a576533edd71fd6396fd53bd6966d1f597a082", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766156, "uuid": "5e9db9d6-7f17-46fd-9abd-85ca8281ffeb", "value": "T17742773B21F08B32D7C011C9A3661A614FB2A70B456724B4F4FE6725AF2DA0375E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766156, "uuid": "7136ba33-116f-4081-9cc3-94ba227216f4", "value": "96:cCu7sht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6EDjT2TZIT57dpIJc:cCuC4hvZ5m5FG4j4HKNphvrP6TZITRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766156, "uuid": "2c9f1600-5d59-4b15-adde-f827c480bc51", "value": 12672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766156, "uuid": "88da3643-ca6e-47a9-9686-f82c14e45f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766156, "uuid": "6d0a99bc-3185-43ee-bd1f-589e410dfbf5", "value": "31ae07eeeafd2a6c1d5158ae22d4fe28c749cf03c85c642a2d3d4fec920008c1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2df411e-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752552, "uuid": "eab38118-9a34-4edd-8c61-b9b12bb2b539", "comment": "Malware payload (Mirai)", "value": "da5908bc70eff85027cfe503c6fd0c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752552, "uuid": "ea302b6c-bcee-481a-8ab1-9075ae0311c6", "comment": "Malware payload (Mirai)", "value": "31eba9c0c952854faaa5da836f9928c06af31266daf7709f80212a50422b98de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752552, "uuid": "b9d9479d-36a4-4a4c-baee-a9eb6a1ef379", "comment": "Malware payload (Mirai)", "value": "66c5dc12ff579fa87d82ba282e5bd57ad6fdb5e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752552, "uuid": "f3915322-8230-48b1-b94a-273eb8decee2", "comment": "Malware payload (Mirai)", "value": "5ce801c00327cf62f005d64fe0b2b56939f5e94a8f86b94972123469c90476da4d3cf058b29879a993a0da5b0bf4a1a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752552, "uuid": "12dfefcf-fb6c-4356-9edb-f7451e74bb2b", "value": "T1E7147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752552, "uuid": "23693069-0155-4a16-86ab-9c8242ef0d41", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRNUKG:IcY5JpMByVs9jSgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752552, "uuid": "47f65792-0964-475a-912f-8a7ee90e0aff", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752552, "uuid": "b181311b-5b86-429c-b9f0-9846e652e085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752552, "uuid": "80b8f705-7ecc-4320-b89f-e3d65f829ceb", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5886ab-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752914, "uuid": "53b7b2a1-5426-4cad-842a-905efe054f10", "comment": "Malware payload (Mirai)", "value": "eecf5620f485de0819a5e5493dd705bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752914, "uuid": "a3a89b1a-e8a8-48d9-8490-63fb962862cf", "comment": "Malware payload (Mirai)", "value": "32a58d35ab0aefdfca2ed20730025adfa309bcb00533da0817b59601f2c86c0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752914, "uuid": "0a393ff1-5ec3-48ae-a19f-410903bd2659", "comment": "Malware payload (Mirai)", "value": "19542360b916f0c696d8a3de4bdb54142d09031f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752914, "uuid": "b027a219-7fe4-47fd-a44f-7e42b93aafcb", "comment": "Malware payload (Mirai)", "value": "70c3d78033e6d13a11e9f11349e03e12e68086c583323df2d3f66cd1bd22720b600504e82a5b1d8b92d7a7cca1dde310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752914, "uuid": "61a37e75-46d1-4cc5-ab96-a7a3ea6333a0", "value": "T1CE934A96FD818612C6C126B6FB5E028D372713A8D2EE7203DD256F2137CB95B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752914, "uuid": "e2421a5d-b7c8-4f73-af1a-3a515e7ce711", "value": "1536:7blk0uODHqjNrA/O2LIJtwUT4EFrZSwg3bphWjJJscNgWdBbX+pMzCCXp1:7blaODKM3LpsZSJ3bbW9JsGTbXnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752914, "uuid": "9b649437-eeb5-4cf4-b8f2-871185241c26", "value": 96044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752914, "uuid": "52f196bc-f0a2-4c5f-9457-4dac72296c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752914, "uuid": "4305d7f4-f4c8-4f89-99cc-c911a2ccb9e6", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fca5b4d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766479, "uuid": "5d45bcda-e74f-4d6b-9f3e-ec7b14e43e41", "comment": "Malware payload", "value": "0379eaabf31aaf7f523ad692d6891ab5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766479, "uuid": "77765de4-5822-4698-94a1-051c30084d5b", "comment": "Malware payload", "value": "32c1bb1e5f829f1ca14254c848c90bb29d6120c6276757107fcfaaf059fda979", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766479, "uuid": "8f60df59-1696-46ad-a0e1-e1d306d30a89", "comment": "Malware payload", "value": "cdd2cf2bed9c54bb333275a88cb2e48c774c112a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766479, "uuid": "14768f75-26de-4df0-a818-5686ded51c32", "comment": "Malware payload", "value": "698510ee8ea2ab6400c7b81c2c018da740f64706b5a86ed26929fa1097bc7c5785de773480fdc007482cb1d3b79b8ec7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766479, "uuid": "99cb8d2b-08ba-4307-bf3f-4e7a0c69be7a", "value": "T12482497721F14A33A6E054C4B2771BA15F72D61345A720A8B4FE2A365F5AF0370EBA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766479, "uuid": "bc5acd86-f653-4640-8b9f-08369a6307ee", "value": "96:cCu1k0B6msht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj4cx+cafdYxYxTFfaL:cCuSg6L4hvZ5mN9oKNpiv6LHVtZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766479, "uuid": "9b3790f9-f79a-406b-ae31-0e7ad48e4201", "value": 18721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766479, "uuid": "bd394e14-d90c-4c6d-898c-1bbc826ba2f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766479, "uuid": "d2d355ad-5b1b-47c5-b003-bf6b6886aa21", "value": "32c1bb1e5f829f1ca14254c848c90bb29d6120c6276757107fcfaaf059fda979.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc1674f-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771787, "uuid": "268881b8-8dc3-4997-9419-49ff0ae3e796", "comment": "Malware payload (Mirai)", "value": "b1ef45b6a4bcf39de13232bb66271d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771787, "uuid": "674d2b33-3835-4d66-bda9-c58cb1e364c8", "comment": "Malware payload (Mirai)", "value": "33040017d8f254824fc8ca72099977ea95d1eb0657f00fe9712ad8fe17272a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771787, "uuid": "8fcaec6e-78b1-456a-875b-b546c2b8ff1b", "comment": "Malware payload (Mirai)", "value": "b3315385e32dea89ec9705b25fa5b7bf2d8a2fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771787, "uuid": "cb85ab1f-fa7c-4dc0-bdc9-b120de686a8a", "comment": "Malware payload (Mirai)", "value": "bb83ed4c1a7e52b79e667ae12e5c71e62826f05c1cf13a2fb3f0d067dcc74620da64352692d8b39fa914545c14881bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771787, "uuid": "a9ed6359-e9d4-4082-8c7b-728ab89f6e57", "value": "T1EEF43A45F8809F62C5D02576F75F826C73174BB9D3EB720699288B343BD792B4B3A281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771787, "uuid": "e0f95b65-9cba-42ca-92c6-e750db08ebe0", "value": "12288:5i79tc23++NLS1SpDnfpz2dOVyAIKhEPU/TK8p3PKcOAh2mE36vaAFv9:Q79tcuNW1iDnfpKd2yAfKtLd36CAFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771787, "uuid": "f08b9a35-c78f-41cf-9021-56146fb0b338", "value": 725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771787, "uuid": "2b9cf8ad-9c32-4429-a4d1-d2700e2e16a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771787, "uuid": "bfb7803f-398a-4bac-a69c-d5df08fbf9f9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50366d3d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766453, "uuid": "730b28ed-c02d-4cde-b4b5-fa12675ceb5b", "comment": "Malware payload", "value": "f26adc1015ed9b4c771461f1b69bbf1d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766453, "uuid": "52f42e20-b85d-45bc-9d9d-9159a4a11543", "comment": "Malware payload", "value": "33288877b33efe7b5f8abe6376e63c57a737d131fcf1111bb99b7fdb39756a26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766453, "uuid": "d1d8d94f-7aa2-4805-8a5e-bd2c7c45126a", "comment": "Malware payload", "value": "ffe466353188d3d80ed55a7be3b8994f2327f4d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766453, "uuid": "c12b3722-412c-4d22-ac03-b066923da050", "comment": "Malware payload", "value": "78de9d951c331685049a4ffcb458afa5384059ab5fb1f7c7e780e74ca58a23fd4e9501ba3a20e854a51ba52cebed5235", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766453, "uuid": "1f747d27-9a01-4bcc-889d-093c1f29f458", "value": "T13A726A3721F08B33A69065C4A3772BA15F72D60745A720B8F5FE1A269F59B0370EBB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766453, "uuid": "0a75c9a2-693e-4d94-af09-fef0ce9270b1", "value": "96:cCumlB6csht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjv4xJ5iu+SEgpIBeIBc:cCug6p4hvZ5mrFoKNpivfvaRo+XwQju0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766453, "uuid": "da5261cb-59d9-428f-bf3f-6e532fc188ae", "value": 17163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766453, "uuid": "f7446687-6133-42bc-8218-64268a2bcc6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766453, "uuid": "560b4589-2890-41e5-857d-05c568e07edd", "value": "33288877b33efe7b5f8abe6376e63c57a737d131fcf1111bb99b7fdb39756a26.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52a5800-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750301, "uuid": "90a42f8e-ebe0-4f04-b4dc-a1fd1c7a089f", "comment": "Malware payload (Mirai)", "value": "528b321237537ed72455f185ddba7813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750301, "uuid": "efec5f24-ffaf-4901-a8b3-9dd6f6dbb807", "comment": "Malware payload (Mirai)", "value": "336826db561250198b6bf289998ac94c504929984f5f2b80406307dd240d2a08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750301, "uuid": "74221975-ccba-4790-8bf2-e9dc7fffb37c", "comment": "Malware payload (Mirai)", "value": "a02292a4fb0821423739c20779eb039f6d6021ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750301, "uuid": "8f745793-72b7-4af9-8304-5dd9a14a637a", "comment": "Malware payload (Mirai)", "value": "8a56fddba52af4638f18d8c27a16faa8c28260d0a2d36064adadf6e02de3b6a70ace403d906758aa9a6c752e3a9e1508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750301, "uuid": "75e39547-d6ab-4427-a9e3-7aa2a4d208ae", "value": "T12AF36C07B9C0D0FDC8DAC2B44BAFA126DA32F50E5134721F27C86E262E5DF216B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750301, "uuid": "39bfdc6e-f258-4566-ad3c-e69e81ba3452", "value": "3072:BF05NaD9dEou1RoM1t1kSKYpl+HpBbqPHCoNJzoSyE:IAUXJWJ6jsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750301, "uuid": "7da6b75e-bd5b-44ff-b07b-cdd5dac43376", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750301, "uuid": "931994a4-79d1-46d1-93f5-623f94c484be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750301, "uuid": "69a3a867-015c-4555-8ffd-776f3db20c19", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadaf309-0f93-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1771726232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726232, "uuid": "e432d634-5db7-47f8-bc27-af9c20a1f5fa", "comment": "Malware payload (OffLoader)", "value": "b2ab955b92a5771e2b929ffe626c08ce", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726232, "uuid": "a2b94770-4ac0-4641-b13c-361c50a45299", "comment": "Malware payload (OffLoader)", "value": "3373984400c35f758cf9ea86eba0bd87c93ae367b730b43e6df5dc5c8132b79a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726232, "uuid": "32d2c094-23fc-40f8-9bde-d32d385ca55a", "comment": "Malware payload (OffLoader)", "value": "cbe3894655147d01f0866bb1cae5d4949334d6c0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726232, "uuid": "e20e3cd8-21b2-474a-8dbb-b26f8272d126", "comment": "Malware payload (OffLoader)", "value": "9c7b4157c198541ea5a24cf4c3d8799c1075d69ce32dc74d895b8fb57e0fc4d84e451bd58c1b8fa9905868f5af4ee529", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726232, "uuid": "78e2f351-16dd-400b-a212-403edc225337", "value": "T1C1E63327A28A673EF06E5B3759B2D2105C3B2E61695A4C1B9AF43C4CDF390A01D3F257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726232, "uuid": "e7208085-2239-4c50-8107-ad9d1e2b48e4", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726232, "uuid": "365314f3-9daf-44cf-9673-8045ec5523a9", "value": "393216:gTc8l3lUjXKhnSCJydK2PbVxVVj/WeM+gyVNHANv1M:6cSl0+S1FhxVdrMN4RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771726232, "uuid": "419cee46-14af-468a-b3ea-ca998b5beac7", "value": 15253040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771726232, "uuid": "9374912c-c3b2-4f92-b1bc-927d19e6c565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726232, "uuid": "fb7f171b-bea1-43b1-99ec-0254dea9123a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3069095-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784228, "uuid": "bb330f29-38fc-446d-bdec-a9618ea5b9a7", "comment": "Malware payload", "value": "316ab7d35cc31cfcb3090e435857a7e4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784228, "uuid": "576c12c1-3a76-4ab5-8fd7-20868dcb60d2", "comment": "Malware payload", "value": "3399333d5145ba202fb5fcddad2ce46ecc9f63d357f9490d62a5d49fad112884", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784228, "uuid": "810e591f-714f-448e-868e-b4ddda985d4f", "comment": "Malware payload", "value": "9cd262fa709ad122d7d697f6947e495d8379b79a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784228, "uuid": "cd4e29ec-3631-480f-a661-c1ddb263c536", "comment": "Malware payload", "value": "12c0528fee5b65078bcba050e32242d015752ca65e41c803cd66fdc118de573dbe4ff512285d1583752b3644adc1b476", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784228, "uuid": "d9efc468-bc2c-4558-bd51-fcc5c97b7fff", "value": "T13EF2E019BBDB6520C34BB37E70065D8CF50B5E17E2DEB66636A092CC8D52D5246037CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784228, "uuid": "dbc9e9aa-ed08-4692-8411-efeff819f0fd", "value": "768:42QP+NAiJQucR7gWUU/510d4OLFBkAgptiCe1o2H3Crp+:41+WqQuctgdGmdXPNciCOXCl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784228, "uuid": "ca407130-5879-4053-8142-6884ff6be2f0", "value": 34664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784228, "uuid": "cd9ede22-2255-42ed-a62a-6e24fe2fd27d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784228, "uuid": "eeee0765-777b-4342-aa09-89628c45a199", "value": "urgent_update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15514273-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766354, "uuid": "224437ac-84d0-4fa8-ba2a-f8c99c8aa950", "comment": "Malware payload", "value": "66af8e6d3be14188d52558bafaff8643", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766354, "uuid": "b07f7c4f-ec7d-40ad-b9f4-d6d9d007173a", "comment": "Malware payload", "value": "339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766354, "uuid": "4f50dd85-dba7-4100-bda9-265d92387af5", "comment": "Malware payload", "value": "80d8befb0a04661d452a4a18a9d1874e3c30e6ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766354, "uuid": "eecd8b57-1ec3-422c-bb09-05627a8d0805", "comment": "Malware payload", "value": "6ca9b1db77402419a4902eec874fc31d44e761ce8f4c7f99cc8f40dfe892194712aeab9c1fc067aa2e15090330deb934", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766354, "uuid": "2486d98e-81bd-4967-8266-5bc6dbd727f0", "value": "T199F1D16B21F08B71D3D421C9526655A54E71A70B992A08B8F4BF973ADF2C90370E3F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766354, "uuid": "44291cec-9668-44f9-a6d7-47e204e23994", "value": "96:cCusB6n7sht+O+v1fsn+h4+tIicqbA/GsGqZ4BPOHF:cCuI6nC4hvZ5mzjHOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766354, "uuid": "6dcd036e-1e29-4b9b-a341-023c5d8de1f5", "value": 7508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766354, "uuid": "c6aa6ed9-53f9-4cef-9289-26ffd1e2a6b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766354, "uuid": "1c51fe2e-bcaa-4ffc-8e7e-2cdf5ce5fc1b", "value": "339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b0c4f-102f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771793355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771793355, "uuid": "703ece4d-a3e7-45fb-811b-fd34bb354912", "comment": "Malware payload", "value": "2fd18ccf38a998e22043905d9460ce4f", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771793355, "uuid": "21ccbf8d-4f86-4057-9f4a-2116062c2706", "comment": "Malware payload", "value": "33a98e51ccdd67b6679e571e40b990f20392c21ed1b2618e10b79c2ae4a88b23", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771793355, "uuid": "9e87b46f-c054-443a-8ef4-63fe4dde08b3", "comment": "Malware payload", "value": "525d4fdd539bebc10c5e1a444f746f8c0990e9c9", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771793355, "uuid": "27073dfa-4bb2-4136-8697-b9c917adb442", "comment": "Malware payload", "value": "62509fb49103d4b980f8611bc1f04a6b36c5c8760b1fb65e1dae15c406b2702d97d6165062d224aa2dc4cb83722f657b", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771793355, "uuid": "b63199db-0438-49f6-82ef-998b850b959e", "value": "T106C312A7824CB7C7676C068EF4E93134BA250A1611817A93E4D965F48DF0FC78B836A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771793355, "uuid": "453fdb8b-788a-4a6e-bf23-70b9ad9b7090", "value": "3072:I7hGCXH69vP2Cp3QREUrvO65RAR5UsVvJ9mpZ:gV3WGCp3QREtuRgOGvJ9mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771793355, "uuid": "3415c67c-d98f-4715-a948-ece7416ac1b0", "value": 129942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771793355, "uuid": "2726c5e8-ccbc-46aa-9538-e473734e2c77", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771793355, "uuid": "9d31e655-652a-4cc3-a641-7a5823da5c31", "value": "AvastSvcpCP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb85bb10-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766311, "uuid": "4c69e0d5-b1ab-4803-a141-a3061c9bb93a", "comment": "Malware payload", "value": "813276c3540a9d1ee272707fdd0f76d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766311, "uuid": "de0bfb45-9e98-42da-9179-8cf4d06b828c", "comment": "Malware payload", "value": "33deec1211994c31889c89c9f35e4b5d572c7bfdb885203c20c422fa354b5c7e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766311, "uuid": "9e201cab-4db9-49e9-9eee-bf3e9ab7dbe8", "comment": "Malware payload", "value": "be229ad0867d86021a969343702e5555bb0a4b7c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766311, "uuid": "5cb38c3a-2432-4fa3-b3d4-9a5ffaca0b2e", "comment": "Malware payload", "value": "9a5c11b01861154b9579377960f1ca8739d1d04c74f3ff11cc14448a481b3cf253f010ed7a145c066f61f8f4f9252a3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766311, "uuid": "823762c8-01d7-4832-97d6-bd0ff6206722", "value": "T1A852453721F08B3297D065C4A2771BA14F72960B456720B8F4FE1A269F6DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766311, "uuid": "317b8bad-68e1-40f7-a80c-e5a3359a5201", "value": "96:c5uQsht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj1bUMTQiIBXIBYIB7IBrIB7:c5u94hvZ5mN9oKNpivJVYjwQQIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766311, "uuid": "e5f72785-4bca-4772-90ac-2a9cf2696a7e", "value": 13854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766311, "uuid": "8383b3ca-fb7b-4826-babf-dfd21ae0e0ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766311, "uuid": "1de9ef4b-6655-4f16-9e75-554078a1ddcc", "value": "33deec1211994c31889c89c9f35e4b5d572c7bfdb885203c20c422fa354b5c7e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492de03d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766441, "uuid": "06969225-f855-4e88-aefb-8578567eaa14", "comment": "Malware payload", "value": "dd1f5bcba7fcabd8b861c2fb4f6c9934", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766441, "uuid": "bffa8b0f-c28b-4c4f-9934-d40b8f921f32", "comment": "Malware payload", "value": "34168c7c9b7971f46f884dec30c84bbcc8492728139e4ca95047bfdd6c8982a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766441, "uuid": "141a10ed-1658-4c7d-8b5f-b86b5a5a2b4c", "comment": "Malware payload", "value": "45ccf3f0f5f47a0cbc34ede36c523ab79536d24d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766441, "uuid": "e97ea860-1055-4e24-aafb-478af38b5733", "comment": "Malware payload", "value": "0dd443e729ab91b564d112ecf3cf40e40149adda1ee4cfca70bbc25c4d230c02d76c9a079f4a1a3c95a54fad45bd0a98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766441, "uuid": "a42654a7-6f2f-451e-af51-ec2f599753f7", "value": "T12991E37025F08D732E25AA80B3372BA6ABB6951345E732CC35CD2D265F87B12A0FF515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766441, "uuid": "a6735eb5-339c-46d2-b362-15ec1b9dc6fa", "value": "48:cniRxuGRys0Uh7lwnEUpElrm9pElr8PspElriGpElrEapElr+MpElrMPJIrlriZ9:cWu4FS7+C+7+n+d+p+OIBcP7IBQgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766441, "uuid": "01f6a230-59ac-4864-9060-fbbe8396f447", "value": 4584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766441, "uuid": "13c3a454-68ff-4665-899f-4c5d5f68eba2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766441, "uuid": "ce200ecb-3380-457c-80aa-350363aa260a", "value": "34168c7c9b7971f46f884dec30c84bbcc8492728139e4ca95047bfdd6c8982a7.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d051ae-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768771, "uuid": "89a50e9c-9c8d-448b-88bd-7a38a1f6ecd0", "comment": "Malware payload (Mirai)", "value": "6651031184b5d6eb8fca00c241228f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768771, "uuid": "1e2f3a8f-9e9b-4a5d-ada1-cca7bd303c92", "comment": "Malware payload (Mirai)", "value": "341b4f7e5781ceb1b66a1dd3002e2e05617964278d00bf74bf6b6959d8d07481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768771, "uuid": "523dcda6-860b-4435-8e30-9e3a4440bd76", "comment": "Malware payload (Mirai)", "value": "72975568cabc5b0c89f8a9a0a1ea6f161d0173fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768771, "uuid": "4dffc23b-f8b8-41e4-83cc-fa68741f2fb5", "comment": "Malware payload (Mirai)", "value": "7bb37199107fdbd0dc0bc9e09d9938aebb597eb4894a968a14db4576f8285dd992dc317d8e49b0026db3756333e59473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768771, "uuid": "91dd6f0a-5887-4c0d-902b-35f5b6bac714", "value": "T1ABE32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768771, "uuid": "0b7d5eab-b061-4b32-b69c-301504349d4f", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzkX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduGfX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768771, "uuid": "6116389b-4a52-46cc-b0fa-3d46ee34c0ce", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768771, "uuid": "423cc608-c5ef-430e-ab6f-9f5326ebd3ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768771, "uuid": "c2f390aa-7272-4b3a-8f1f-ed63de698dae", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b105420-1022-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787570, "uuid": "f3ad0859-7a3e-4d0c-89b5-776193a3d1ae", "comment": "Malware payload (Mirai)", "value": "9cc8895db62d2593be829a653c76a6b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787570, "uuid": "100efc84-c045-43c5-b995-6c9ffd56a4ba", "comment": "Malware payload (Mirai)", "value": "34cb362558033cd6b0567813408a8b8089d405986f158276f82fa8a852b45e7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787570, "uuid": "f99541e2-212e-48d8-bc54-2e53a4db8891", "comment": "Malware payload (Mirai)", "value": "3fbf528f48a4c7d028dea2f2f5bde7993c02ad4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787570, "uuid": "fb982022-2eec-4e14-969e-05849b7cdf28", "comment": "Malware payload (Mirai)", "value": "a4efd90618d3ce4675c1d9b44766a40c5560554ab3e77f3c2971d44f02ed4c810e522f51a1f6be7c745ff41ae2633015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787570, "uuid": "3449d14b-f11b-40fc-b261-93499cc28f6c", "value": "T1EB431A56BD92467AC5D053FABB5A938A33A323B5C2EF7303CD080B52668A60F4D77D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787570, "uuid": "0a637d80-600c-46fe-ac58-9fb29ee17bb7", "value": "768:x7MRMnz8Ifau8yxDJ9A9khytAivcmjC7G1ePlOeCvPcCqzFp0nGzDJ:hAM4Mau8yxw9khaAiUmjCC1ePld/zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787570, "uuid": "07356869-6be3-4906-87fd-83cab7116761", "value": 60468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787570, "uuid": "9bbd1ebb-1aae-4d07-b16a-2a5e82e71d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787570, "uuid": "1357f3ce-341a-4da5-892b-1733d192c074", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdca646-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770801, "uuid": "2ff9e8cd-758f-4e27-8a80-d1cdf9833849", "comment": "Malware payload (Mirai)", "value": "2deb41043c5f45ab6b0c829af89c530e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770801, "uuid": "4f7bfed8-5f95-4dbe-8511-1414811e8009", "comment": "Malware payload (Mirai)", "value": "36167ac355780f9c29874a847bf59cfa4a54de3a9170e5d122f2781ae8a66f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770801, "uuid": "c63109b8-ef89-4dbb-8181-c58725ebc1c8", "comment": "Malware payload (Mirai)", "value": "4b5b191d01b6e7d8d490c69ad15f86e6dc72287e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770801, "uuid": "e8abb96d-4b23-4ebf-b86c-7c45210af4d8", "comment": "Malware payload (Mirai)", "value": "df2679983488135054682e2b896507ff9f0652d99c9de5ef7a71848b5cfbb49b45bdaffcbe565354b7fd1a1fb018f700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770801, "uuid": "77813659-d43d-4acf-98de-422f7f08eae5", "value": "T1E44308817881A626C7D05377FE6F018D3315A798E1EA33539C291FA47BCAC1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770801, "uuid": "3c728836-bc3c-42d1-8829-28c77357c4b2", "value": "768:GeI1ekFMSpevMSzscSlgUeXt1vSJdcmC4XAFPAFE2pGltryoZaLwCVy/Jx+5H8ha:w1vZkMm0dc7rZltryqweZW34UHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770801, "uuid": "aa14f360-b4f0-44bc-8515-acb2f3685ea8", "value": 55708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770801, "uuid": "cd596209-8d90-457e-8ace-930b0bc93728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770801, "uuid": "875fad78-848c-4470-b92f-44a2bd09bb5d", "value": "3atoNational.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747fd932-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769091, "uuid": "8f6f9266-5d1f-4175-b2e7-7b64191b8ad5", "comment": "Malware payload (Mirai)", "value": "aa03443aac822f9bb1b107587f777ce1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769091, "uuid": "8729edce-15c4-4bef-8a00-556b68207b37", "comment": "Malware payload (Mirai)", "value": "3648a12abace40853d978355045c841a667c5ba047cea1968b53a31df8e66a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769091, "uuid": "bb8dad8c-9494-4be3-8fed-147c36887b3e", "comment": "Malware payload (Mirai)", "value": "58a26ce7d635a7b7e804c1835925aea254ed9935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769091, "uuid": "4a7dddbf-b120-4c02-b162-99026be8ccf8", "comment": "Malware payload (Mirai)", "value": "c81eae7bd7fe511b5d1b938f556f6d878367b5b49546010de09a0f8e4cf5c77d5880bf1fcdc6f353619a80fcbd6dee29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769091, "uuid": "a1c66112-4d81-4597-827a-4f53ebd8debc", "value": "T12E23F792BD829767C1D022BAB6AE968D377163E9E2CB7217D8204B107BC554F0D73F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769091, "uuid": "e6665597-68c0-4b1a-9a29-f6bdd389d3a3", "value": "768:LSumRXSAwdK5e2HYLWS45UrLDbqiNqo+DGCPN0VhJsUAyoh24w8:l1dgeTLDWiNqo+KC10nadGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769091, "uuid": "b755d17c-1d45-4e35-9513-03a9793b2312", "value": 48992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769091, "uuid": "3e0e9c26-d0b3-439f-b62e-6582ef01b5f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769091, "uuid": "beebdcd9-1fa5-4ea9-83a2-768471f3c96b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa609a07-0ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767463, "uuid": "0d185c89-12d6-4754-aa54-c499be8763e8", "comment": "Malware payload (Mirai)", "value": "a154d1964c982125247f42dcbbaae149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767463, "uuid": "8425dca6-1c50-4842-b118-b028d7e9e604", "comment": "Malware payload (Mirai)", "value": "3663758c855abe296c8459bca6e4c3e3fada26ef9525ed287f917a89c575c48d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767463, "uuid": "1c029336-a308-43b7-bbd8-3cf381fd0492", "comment": "Malware payload (Mirai)", "value": "4e77b124a04300f47b743e63e75f479e6e802be0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767463, "uuid": "e60da494-7c16-47f6-890d-23ea199b62cc", "comment": "Malware payload (Mirai)", "value": "e37a31007e1172c0d6cdcfa7b3cd1524e382d7751c129e015bc377f6c6d2a9a07f750e7eb3776399cd4fe776fda4a7e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767463, "uuid": "3064211e-db82-4906-94e2-4411b0153dfa", "value": "T1ABC3E70AAF614EFBE86FCD370AE9070525CC651722A83F7A7574D828F64A14B59E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767463, "uuid": "2ee76a92-8000-4eb2-b5b9-a2117de1481c", "value": "1536:Bit7X8d359PuniY2K+1GSet7kzAwPA50HCWKEW42ZgwBECES8k1o65KkBvwNrz:Bit7X8d3w2Z1rNKEL23BbFxqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767463, "uuid": "1ed13fbc-ff3e-4d46-9509-8a8eaaea6c8a", "value": 126612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767463, "uuid": "840c633b-f3ad-456a-a844-cdd56ebfe3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767463, "uuid": "fa8c7a38-9c49-444b-af27-250360a4fd56", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719790c0-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790561, "uuid": "a0e0eeab-5a80-4091-b87d-acd756ec10e5", "comment": "Malware payload (Mirai)", "value": "1febf5bd18cf86df63c3d96a5b43b29a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790561, "uuid": "be798d46-21ba-44c2-b1d8-ad02a8b42fca", "comment": "Malware payload (Mirai)", "value": "370b62cf0403ebc4bf314d6e1410051e5c5f9cf6bda1a7d08dec65d20883823a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790561, "uuid": "e310e5c1-5f55-477b-a714-8897a3818e3b", "comment": "Malware payload (Mirai)", "value": "08e668c46fca6b55bff5506ba87ed188bfed98e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790561, "uuid": "1d30b065-8467-4814-bc67-8b50661a60c9", "comment": "Malware payload (Mirai)", "value": "7f840be86d64d0e306e25d74372a2a7ea2aaf8f4e29f92615ad2da7613ced6353dba67988a6b31c21f0248b50e421c64", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790561, "uuid": "cbbdf745-e129-4c3e-b2ea-07b7e960367e", "value": "T1F701F5862178197036EED8E64B72AC6834C598563F961CF8BEE9A4C784E5C00B7864A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790561, "uuid": "a036adf5-7ae8-4af5-972a-3b4d5f815326", "value": "12:YkF1kcClZF70S5x0HFjx0HFwx0HFWeYRBFSGa5FM5gFTZeYRBFSwa5FMDgFTBA1B:ZDkH/Fb5+HFj+HFw+HFWHRBF+FM5gF1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790561, "uuid": "9dd5b339-48d5-489c-b972-366a222d448a", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790561, "uuid": "d52f9c9b-ac24-45d8-9f32-3d32ad947e64", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790561, "uuid": "da5cced2-3935-4ebe-bb92-951ebe8dbe6a", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09831c43-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766334, "uuid": "82e0c0ae-1d9d-4143-96c6-8579b3f363fa", "comment": "Malware payload", "value": "2c67fda26f07925bc8a4a0bfbeeb234f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766334, "uuid": "8d1063f4-4f24-4aba-a3aa-f7124152b243", "comment": "Malware payload", "value": "38ace0b4e62a23fc66d0e80746c0e5b4e6890693d92bb39d57186691b8b11eb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766334, "uuid": "53c7067b-30d0-4c2c-acbd-8fe6b0f995c9", "comment": "Malware payload", "value": "b06e9944260e0d818c73c28498d843ea949077c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766334, "uuid": "b161c24c-cd13-4529-9a50-071b95e919f8", "comment": "Malware payload", "value": "5ad2e085b3ec4d1ed23cb6b5eda035cdcf3c771cb4816f2a3669b54f2ff5d63966627fe6c6d94125f898d8f4e8c6ccea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766334, "uuid": "8fc4ef9e-63b3-41fe-ab3b-bd0e58870292", "value": "T132626B3721F08B3397D065C4A2771BA14F729607456720B8F4FE1A269F6DA0370EBB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766334, "uuid": "8f9c76de-ce58-4724-8d7d-9db93b55211a", "value": "96:cCuRsht+O+v1fsn+h4+tIiKVC1ymyPuKNpUj4waYvjtVnkQFn+3+ZIBhIBrIBIIe:cCuo4hvZ5mu9bKNpivLkEEq2sPiEaGI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766334, "uuid": "e0e24835-1eca-4a51-b75f-d810727c5817", "value": 14923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766334, "uuid": "99c86b29-a6b0-4612-bb34-9412dd2915e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766334, "uuid": "f7dc6e12-cb88-4827-9828-d40ac0473adc", "value": "38ace0b4e62a23fc66d0e80746c0e5b4e6890693d92bb39d57186691b8b11eb4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b0ff7e-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759457, "uuid": "7965d1c4-78c0-4a73-b2b8-347a799da3f4", "comment": "Malware payload (Kaiji)", "value": "da149c6fa2bc595bb1324667c77c2261", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759457, "uuid": "4ab7b4f9-5563-40f5-80ca-a8f3b7c8ae78", "comment": "Malware payload (Kaiji)", "value": "38bdf739a7cef90a31077fef06b7b18b005a7b334ad2df785a5e086ef976e7b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759457, "uuid": "e9136e21-ca8d-4f81-9711-bee7a603a7b3", "comment": "Malware payload (Kaiji)", "value": "e02cb6eeac40b6edee99cdc1f20def38e0ea91d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759457, "uuid": "76238c68-e483-43f0-8c88-b9d764d8662c", "comment": "Malware payload (Kaiji)", "value": "accf24d542e3488642a0db01448e5381c00ae56f283c8257b0c6e6d29cda91a04d6f5320cbfd530054acd9ac855a31d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759457, "uuid": "f0fa9eb0-9f3b-4743-b447-69b984bba642", "value": "T110B53A137F28D70EC71521344DB2CB94676A6C8A07D6A517BB81F319B8B20AC4E6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759457, "uuid": "1c20ab3d-cdc1-4138-a633-b2c9047aadc3", "value": "24576:cdz8hxtvZ8T0p+gpvRYvyVW1Z0lWJ/RVXbwqel9OFI+TcR:TFpWJgqelga+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759457, "uuid": "bd9d547c-0633-4696-aee1-25b58087d0b0", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759457, "uuid": "43518994-245b-488d-b972-99d1b43da1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759457, "uuid": "89c2694b-00b7-470a-85af-7a682691d2b7", "value": "linux_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e6e50a-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752928, "uuid": "8b6aef5f-fabf-4b8c-9094-b8d99e6b74cc", "comment": "Malware payload (Mirai)", "value": "26939aa9aea443f72f20a2c6e48fefb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752928, "uuid": "48a1295d-eeba-4bae-bd9a-827c45d0770b", "comment": "Malware payload (Mirai)", "value": "390dcb4ace35dbefa2ac0ebfb552fd8254507f40f3a88e5b1d5c9ad41e783960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752928, "uuid": "72dc0bfd-f30b-4f2a-b695-9ae61709d50b", "comment": "Malware payload (Mirai)", "value": "9b53a047517b42ff1238754cebf91eda4761870b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752928, "uuid": "ac72c952-3d07-4392-b8bd-f98b1ad8304c", "comment": "Malware payload (Mirai)", "value": "3fdfdf3b7ae631ab84767b0e656928abb5c4da555c13a72493ce05ad4801f9e981651be2dad58013c47b69519f06f38c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752928, "uuid": "aa4745c8-bb22-4be2-9c3d-f3e2284d0e10", "value": "T1C4A34AD7B406CDBDF84AD77740571906B530E36209831F2A72ABB997BD351A90933F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752928, "uuid": "42f80adf-e68a-4a53-a888-4c15696da3e0", "value": "1536:aWQnztSdi1ht19gq8Adly+SAYpI68r3+H3YzXJ3UH6YGKznBRrBBufZb7l4:+tsq80xSAYpIqA3UaYdZBufZni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752928, "uuid": "02edf4b1-f9c2-4187-ac8a-0dd95959e108", "value": 104184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752928, "uuid": "91ebe853-996c-43e7-8c03-312b6ef22118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752928, "uuid": "e5c4b37f-57d1-49ee-a38a-588ebb07ace7", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ed6509-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766378, "uuid": "c9463e2b-fefc-44c5-b44d-d9bc5e27a06d", "comment": "Malware payload", "value": "078ceb23b0b5b1a864222e3a501116bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766378, "uuid": "dfa089e9-d561-42e7-b99e-c75b2ff80151", "comment": "Malware payload", "value": "39424b8b1b429bc0c46266738da9647d54fc14a6eb49a0edeecf399a549f341e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766378, "uuid": "b66ea0e5-15b3-467c-a248-dc0c50d7df2a", "comment": "Malware payload", "value": "86887a6e84afe00d4c82d7d13c7426c5479e4dcd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766378, "uuid": "3387b197-6033-434a-857a-7cd16641cb00", "comment": "Malware payload", "value": "e3a8b42dc957c3cfd0a02565327b4b488abcd957ea5d4670af66c848be3254b064cd853e6d4d2fd32bc07a7ad2c63c6a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766378, "uuid": "f00cc296-5e69-43d7-ab01-76ee7b817b11", "value": "T1D122472B21F08B32D3C461D953A65A610E71AB0F452614B5F4FEA32AAF2C90735E3F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766378, "uuid": "8a39986f-cace-4370-b0eb-f0543c43d026", "value": "96:cCuENiB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjDiXMTyXpITziX:cCu6W6p4hvZ5m5FoKNpivniXMGXpITzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766378, "uuid": "cce453be-e816-448b-8472-46b3e5423f08", "value": 10030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766378, "uuid": "82d2c0f0-5d96-46f1-8848-f7f6af0976f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766378, "uuid": "881e49ad-a3ed-496a-b5ca-609ff52b8757", "value": "39424b8b1b429bc0c46266738da9647d54fc14a6eb49a0edeecf399a549f341e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63eacc9b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766486, "uuid": "c2dab65e-755e-4210-98e3-dd1472ad9b3b", "comment": "Malware payload", "value": "da9808c18c76faa4571265247fa3de8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766486, "uuid": "7f6dff9d-be3c-41a3-bdcd-1ea290674cbb", "comment": "Malware payload", "value": "397d65fd58bbca6a86d140274c18d037887999160e274ee8d469e003f73e0dd0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766486, "uuid": "024f4536-8ac4-4d01-a193-5f63a9fa7ec8", "comment": "Malware payload", "value": "aa4fdfec1f96f8c62a40b2e9437f20d7361f424f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766486, "uuid": "f6cf9b22-9351-4730-80c6-0571e8aa33f9", "comment": "Malware payload", "value": "77e5ad07ed8647c1a39673b4a67d5691ee1ae2f34acdeabc0dd3c3a95fd9fd549fb9dbe31cc648890fe075504be3fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766486, "uuid": "39273124-900c-4919-9149-c6de94115148", "value": "T1E91172B221B20C335651E544B3721BD6EE72EC93DCC27E48F46D073627B9503E229D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766486, "uuid": "bfe4dabf-9851-4724-9ad6-b5c2adfd1983", "value": "24:chnRUR8fARVmpC764l4Ui4gi4UlV4f7V4Ui4gi4UNpZncieVrQnciw7lc9HHUeN:chRu9RV2C764l4Ui4n4U34f7V4Ui4n4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766486, "uuid": "454bf4ec-296b-438d-8a4f-4cb2f4e60b70", "value": 1059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766486, "uuid": "ed0f6410-78bd-4df1-97c2-a4f278d77ba6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766486, "uuid": "a8620652-6a2f-4969-b1cd-9ebaaf5abe4b", "value": "397d65fd58bbca6a86d140274c18d037887999160e274ee8d469e003f73e0dd0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5c9d7e-1022-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787569, "uuid": "8d3bdfc6-105f-4dfd-8edb-71144e00d1cd", "comment": "Malware payload (Mirai)", "value": "3cb917c849d3f42c7eb927ec79b58fd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787569, "uuid": "ed036372-da35-4abf-b6e5-0666dafe470e", "comment": "Malware payload (Mirai)", "value": "398dfe1bc558f822cb15b732c9e81d91900929250fb13e6b8a30c685ac097502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787569, "uuid": "71b3879c-ab6e-436d-abe7-2288785d0418", "comment": "Malware payload (Mirai)", "value": "26c48f0ead7ba8b7800e46050a0d7a3aedad6b60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787569, "uuid": "767425b3-db14-4ed3-a086-a682f614a5bd", "comment": "Malware payload (Mirai)", "value": "7dd91548012eb2916b59f14834f3c1eba70d35a5e94d3caa1178a636e0adea112578bbc82c533ee4c7ebfa8c7f0bbc89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787569, "uuid": "c7b1bced-c4b5-45c2-b59b-9fc73633eaac", "value": "T1EB838C23C92A1E94D04889B071A4CF388723F51581972FF7596AC7A9D843ECEF64A7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787569, "uuid": "251b07a5-862c-4a60-956f-8eda0c6f1aac", "value": "1536:yv5/FxOVHaK6hDvAgkg3+WKhgrp8R7hu4CaXmHfNkd:yR/FxrBATu+phHR7hu4p6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787569, "uuid": "06948f1a-e285-4c3d-9342-ab07d8a50150", "value": 87960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787569, "uuid": "eae43c7b-b589-4bab-80e0-7520626f945c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787569, "uuid": "d734e742-3dce-4ce5-baf1-e009f9a98e16", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2a7058-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771847, "uuid": "6889f7c6-01ff-4895-ad38-921dbfc4e1d4", "comment": "Malware payload (Mirai)", "value": "8e1c025cf06e393acf2af1f8ea72f36c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771847, "uuid": "fd410f59-b5ca-4804-a97c-54a7c9a6d3b2", "comment": "Malware payload (Mirai)", "value": "3993c4541e0753384dd166199b85eee7aa16c348553433b6d27935b30e50e16f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771847, "uuid": "8a39c59f-251f-4825-a4f0-8bdfcb3b5f56", "comment": "Malware payload (Mirai)", "value": "fe0e09d2dadab98242729adfc437adb80e940845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771847, "uuid": "155aeeef-6df0-4858-8b76-e0458feba80b", "comment": "Malware payload (Mirai)", "value": "02f2df01b54a00d1396e8d039c944ac47a9c2c425ad180d98326f69eba7e1d7c3b17b881c1c754b0f381871b108406a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771847, "uuid": "fa0152fb-3a0f-4ecb-b8de-60369292e58e", "value": "T14D834A0375C0C0FDC899C17557AFB636C863B07E1239B15A27D8EE26BD8DE502E6A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771847, "uuid": "3bc78334-6448-458c-a198-2ac32c65143b", "value": "1536:QsbaijvT9kcRT9r0B3g8/Y91GS32SgVN6kgYEzYcXNO:ldjvTZRT9r2xc1GS32tN6kgtHXNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771847, "uuid": "68b61cb1-a78b-4c2b-9a81-70535d411f42", "value": 85792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771847, "uuid": "050f0868-120c-4a2c-b676-0a0c605035a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771847, "uuid": "879c673b-3fb6-4120-96b2-63712ffc84bd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e7715a-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771766137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766137, "uuid": "4ad42ae6-9575-4380-97b7-932594da6983", "comment": "Malware payload (AsyncRAT)", "value": "282a402cae7028c737a09374887372d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766137, "uuid": "e03f1796-099a-4e2b-a14c-7bb5f46e6fb9", "comment": "Malware payload (AsyncRAT)", "value": "3a5fdf247fbc11a2f3229f56ab7b5215be9baf8b1de7d995b2f8207a1be71a15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766137, "uuid": "d10d83c2-9a98-4201-8ae6-b4830b58b620", "comment": "Malware payload (AsyncRAT)", "value": "0302d0cd10985de0fa585b237a3f46ac7492399c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766137, "uuid": "1df7305b-b936-443f-803a-858617b07a5b", "comment": "Malware payload (AsyncRAT)", "value": "add204e6a08839e90ddacc644d11d28993c0f006157649efdaba4b61cdc7e5eb9b4f3817bee2da65e0143f61abf18999", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766137, "uuid": "9aa425cb-d89a-4328-8bb9-d209bbcf47c7", "value": "T184D24B08B3D48566E1FD56B94D7293048771EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766137, "uuid": "4a6f7c7d-b5b3-4769-8068-5acc4c9977c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766137, "uuid": "0057aee4-a764-4ea2-a475-18bdcce791b4", "value": "768:U0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dTp/+:ToRXD/qymB1iwRbN/D/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766137, "uuid": "7217429a-e28a-4d26-a442-38528638190e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766137, "uuid": "cae7d067-f6ce-4711-8c33-88060c8e0e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766137, "uuid": "0817686c-6404-487e-b493-4fa28fdc9357", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a741145-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766336, "uuid": "673a86ca-cb1e-409f-8af1-9605b74e9b08", "comment": "Malware payload", "value": "f62ab214bcbdf974cc079faa10bada17", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766336, "uuid": "9c0abe77-4125-45c6-8b09-ee7360a3ea84", "comment": "Malware payload", "value": "3af831e0b4875278ade73b8c5f1583776982fa1d89aed8c10ddef7819024c45e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766336, "uuid": "5b4a52ea-4d25-4bda-98da-fbaa0aa4cb3e", "comment": "Malware payload", "value": "fcf033e71b3eb548a6e2187b41c407de16d02499", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766336, "uuid": "ed9d7590-6c4f-44c5-ada9-5db76969a539", "comment": "Malware payload", "value": "b2a8cb3e9722e6f8e67777cf8c6d85b3c28f0f8e41506b8a27322670055e148f67c8a438bb5b051e6c5672a1256fec8f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766336, "uuid": "83ff0e51-77c2-4ec7-9e49-17787e5fce43", "value": "T13F42453721F08B3297C065C4A2771B614FB2A70B456714B8F4FE5A269F2DA0370EBB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766336, "uuid": "de11eb1a-6121-4c66-8a45-bca38831f74f", "value": "96:cCu2k0B6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwa3v+LIBJIBSIB/IBhIO:cCuFg6nC4hvZ5mzjqKNp1Y25cOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766336, "uuid": "548e1629-63f0-4f32-8b28-0150e0f9dd43", "value": 12328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766336, "uuid": "15a8ce0d-de37-467f-933f-0f7202c5ec47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766336, "uuid": "52d0f987-20b0-4951-94d9-550b597c3fd9", "value": "3af831e0b4875278ade73b8c5f1583776982fa1d89aed8c10ddef7819024c45e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac82ff1-100b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771777906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777906, "uuid": "9887dbbf-dc04-4074-92e9-a849f20863b9", "comment": "Malware payload", "value": "c0b60ce9298671d52d0b08124e8ff300", "object_relation": "md5", "Tag": [ { "name": "compliancemetrics-net", "colour": "#064CD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777906, "uuid": "3448a9e5-18e6-4a02-a38f-eb7eacf3c821", "comment": "Malware payload", "value": "3b6c2b1611cf3fe0aa70a0a9c8c21bc5619974c4cd8e24d0fe4f883ee5c0ab83", "object_relation": "sha256", "Tag": [ { "name": "compliancemetrics-net", "colour": "#064CD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777906, "uuid": "88425d79-3cbc-4de7-95c4-2d83567141c4", "comment": "Malware payload", "value": "95959b357c5794d0e7e050893a01eab7ec86f594", "object_relation": "sha1", "Tag": [ { "name": "compliancemetrics-net", "colour": "#064CD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777906, "uuid": "d8ed3bf6-e198-4e3a-bd0b-6f1a769138b2", "comment": "Malware payload", "value": "487a215528af60b16b97a01bb737471a9ef7b86b9aceb58e9c0ab9b99afd29e5abe24277aae887a76a6e412df68ee697", "object_relation": "sha3-384", "Tag": [ { "name": "compliancemetrics-net", "colour": "#064CD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777906, "uuid": "da63ba23-95e3-4158-ae2d-3b4efad747f5", "value": "T154F26B5357A1D0EFDA7249B8DAB6505BF87270542B30CEAF4390C2290FB2AD0397DB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777906, "uuid": "11f0a65d-b973-4e2d-b7d7-4737128fe2c9", "value": "78a1f90c41f1348e0b7261aea4bc6f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777906, "uuid": "20c10cc1-9fd5-4b56-8aee-5cc058f9d46e", "value": "768:BKCzikuqAz5XdXPlQn8v/cnj1N4f3fQy1WA3vQ0y:B9zC5Xd/083cnhmfoy1WqvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771777906, "uuid": "f9c6acee-71ad-4fc8-98d5-0860f36d91b1", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771777906, "uuid": "28dd1776-dc53-481f-ad2a-3a3e1143032b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777906, "uuid": "66f3660b-7362-4dc4-9b9e-804fdf17fb37", "value": "3b6c2b1611cf3fe0aa70a0a9c8c21bc5619974c4cd8e24d0fe4f883ee5c0ab83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b35cca-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766408, "uuid": "da6f5730-ab57-4b93-9dab-e817490c387a", "comment": "Malware payload", "value": "83f4d4c80ce29fe705d463001fb7a4cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766408, "uuid": "8b462e5e-758d-4550-a503-339e45f5db61", "comment": "Malware payload", "value": "3bab454a1493339b57e7df612e204b57cd3aea2f81113ce5d6802621e43339bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766408, "uuid": "18e273d4-9cc0-4b5a-b985-152ddf979fb8", "comment": "Malware payload", "value": "1434e5556a1201accae402cb55d2e47e4fce671a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766408, "uuid": "cb9ad94f-eeee-4632-b5d7-c26152b7fddf", "comment": "Malware payload", "value": "28511a92e5451e2158d365fd26a68ebaf0252b5b448eba7db356f58d8cdff14bbfe011bce0c6ee6a1bd1596a3a0ecb97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766408, "uuid": "70f62de7-c36e-46a2-806c-9f48363dbe90", "value": "T13831477411F189332A10AB80B2372B56BBB2DC4349A3268C35DE1D296F93B13A1EB011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766408, "uuid": "2a698d4a-5900-46cb-a898-5d231edea9f8", "value": "24:cnnRNR8fARW5wt9HHIuCzCRpYdZUX3PX37KMSChIrlDH/+7dSChIrlDHVeN:cnR/9RLXnB627JIrlrmRJIrlrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766408, "uuid": "6bc56f9b-38df-41af-a6d8-2566fab3b785", "value": 1548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766408, "uuid": "dc43e42f-cfbc-4b00-9799-83bd16eab799", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766408, "uuid": "878ed18f-085a-4881-a412-18907ff0dffb", "value": "3bab454a1493339b57e7df612e204b57cd3aea2f81113ce5d6802621e43339bf.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2804c7f8-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768962, "uuid": "a18eefe7-3683-4496-8080-fd86fddf0bf8", "comment": "Malware payload", "value": "259b42d13d40a8dd91674a74949dcaab", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768962, "uuid": "6a8015db-f395-49b5-b218-6eaf706afad8", "comment": "Malware payload", "value": "3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768962, "uuid": "5b16370a-9330-405c-8156-b04e9675df25", "comment": "Malware payload", "value": "523be7799476cde550b49422edc31ed43c0d5ce9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768962, "uuid": "3e2e1146-0a2c-4ec4-93d4-9103a335abaf", "comment": "Malware payload", "value": "6c5edeb2f89c76f314dd36380ebe3111e1d22e83883744195dc29d3700bb6d4a2a9b77554784c55524c3a3fced952933", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768962, "uuid": "dc921c9f-9f5c-4e0f-9964-7055fc01a45a", "value": "T1ED662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768962, "uuid": "fb525eb6-2d42-4429-b114-d3547bf01ee0", "value": "196608:flc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:drr+/tj+QITFic+MRRWRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768962, "uuid": "21a26455-9fc7-4279-b02d-0acb55e64750", "value": 7118848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768962, "uuid": "821a36ba-5cac-46ea-b984-6005c9434383", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768962, "uuid": "75008d09-9d01-4432-b9bf-f0b17efae504", "value": "Approved Document#D53LU.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661b8386-1026-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789253, "uuid": "a8a72256-2608-44ba-8399-1245cdfe17b0", "comment": "Malware payload (Mirai)", "value": "8b5f5d08091efd5a813fcbca71358bd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789253, "uuid": "a70db43b-6e46-4ad1-add1-4e446268dfda", "comment": "Malware payload (Mirai)", "value": "3bf95f5c5775d647d39599a9ff16db2144b888287e1e9dd0d4043c0d20a42105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789253, "uuid": "99b419bb-14b5-4e25-9483-a972f208fcac", "comment": "Malware payload (Mirai)", "value": "633c87094c8abd3ab84e6ca6e3671b20692801bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789253, "uuid": "28920bc0-e22f-4e39-b7e2-d3fab1088289", "comment": "Malware payload (Mirai)", "value": "c98e93b397e9d811f8ea6ca74272838f9c74fb7fc4a60f9cde76ab53639a607165ed78bbbd1c59431e68c9f642991da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789253, "uuid": "fbeb2d4d-39c2-43a5-bcb7-ae0a435acf78", "value": "T1BFC3F185BB6369D1C0A242FDA4C00AC387916E318BE317480699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789253, "uuid": "9ef3bd61-63bc-4ac0-86b8-8af2703c1044", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnc:0OCDjXG9qTWywxlxTnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789253, "uuid": "0007ef11-106e-4b12-987f-3ab299ce5bbe", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789253, "uuid": "622a314f-eca2-44cc-ae97-0471de1caa6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789253, "uuid": "ab467213-acb8-4cc9-9bf6-d38072379384", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3560f93c-102a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790889, "uuid": "5a645b3d-b28d-4471-97ef-8b68894fedcc", "comment": "Malware payload (Mirai)", "value": "271b71c411509575aef581f0bb0095f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790889, "uuid": "22a67453-0d14-4dad-a713-7ceb61077471", "comment": "Malware payload (Mirai)", "value": "3c0ffc20d9f88a1955d101cfa801fcd89be76962f1a9a50e15dc045a750e2ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790889, "uuid": "66c8ed8a-4def-4d40-a2d5-cd73e8270149", "comment": "Malware payload (Mirai)", "value": "5c1c1c55081b7390eb57ddc585fb3d593637d8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790889, "uuid": "cec00b51-5953-4fdf-9c39-bda5c3f01aa6", "comment": "Malware payload (Mirai)", "value": "b5c861915d75577972d43cd5e3dc2382ed4618b6d24db395b753bdf2acc3bec04894250050be31413a0aab458fc98ff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790889, "uuid": "80c0be49-ac9d-47af-93cc-92ae55f97a2d", "value": "T11C433A03A9BC292BD5D4A23312B34362F1E71BDD51C8E68FBD260E4FAE553501A676F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790889, "uuid": "89d968d2-6a86-4b2e-82d7-d350e39f07c6", "value": "1536:jI2KbLfi4qTVmXbOkO0D1YyqQGaUbCktB61Yd0:KqMyAe12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790889, "uuid": "5ee96da2-3429-481b-b390-8ef5416361c3", "value": 60072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790889, "uuid": "276ece2c-2730-4133-ab20-45dfd295d032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790889, "uuid": "1d78a534-eada-49b1-961a-f1b83a193730", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cae64d-103c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771798679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798679, "uuid": "d8d243ab-0b4f-4b7a-b1a1-39cc3d3f7903", "comment": "Malware payload", "value": "27e5c83de5fe54896349bbafb9322219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Malgent!MSR", "colour": "#92DABC", "exportable": true, "hide_tag": false }, { "name": "SharpShark", "colour": "#9C14E0", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.SharpShark", "colour": "#1C6591", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798679, "uuid": "4eb188a3-21f5-46c2-8e5f-b723a3c5a3f8", "comment": "Malware payload", "value": "3c107cc4bd314450d8d7ecb6cbf25cdf43eefb2fc3971ab14604c9510ec6c503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Malgent!MSR", "colour": "#92DABC", "exportable": true, "hide_tag": false }, { "name": "SharpShark", "colour": "#9C14E0", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.SharpShark", "colour": "#1C6591", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798679, "uuid": "c8956c01-590e-4e09-a65f-e1081b591528", "comment": "Malware payload", "value": "572d8da23e61885b7c3f910892c3400649aa1574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Malgent!MSR", "colour": "#92DABC", "exportable": true, "hide_tag": false }, { "name": "SharpShark", "colour": "#9C14E0", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.SharpShark", "colour": "#1C6591", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798679, "uuid": "061e1a04-b572-4ebe-83fb-d2dfae25e616", "comment": "Malware payload", "value": "faac9fc22a081d8b04cc619ba170b38b48eb0158ab3315cf801687a8ed77d8e7b72e6c3e0a2a2d0ee4dccc98a98f746f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Malgent!MSR", "colour": "#92DABC", "exportable": true, "hide_tag": false }, { "name": "SharpShark", "colour": "#9C14E0", "exportable": true, "hide_tag": false }, { "name": "Trojan.MSIL.SharpShark", "colour": "#1C6591", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798679, "uuid": "64f588fc-9fc4-49ec-a036-69eb6c3008c0", "value": "T121E1EA50E7EC9A33DDAB1F3658B297011770F2268D57DFAF29CA651A3C2630948236B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798679, "uuid": "8c3d18b2-12c8-4b06-a18e-692ee6d15fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798679, "uuid": "49616be5-6c3f-40a6-9b38-377d2ccca72a", "value": "96:pt12OlUwR8EpZpTxA/FRirKZesW1dMi2cc750zNt:ptAKp8ITxA92KZdW1dMi2ccF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771798679, "uuid": "01995ead-d9c3-4be6-b070-0c9d70589b50", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771798679, "uuid": "3076da95-2b02-4407-852b-80e1eead338f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798679, "uuid": "76a2aa4f-4fb9-43e2-8bd6-2235fabf988b", "value": "ceshi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d238fa5e-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755933, "uuid": "66673c24-5bfd-4aba-865d-bfd198a47593", "comment": "Malware payload", "value": "df6390054a7a21c069fa7b602086bd5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755933, "uuid": "c9444656-0a97-4b79-9526-f2a907b3aa28", "comment": "Malware payload", "value": "3c6dfb6d493f1a3b37ff3e0eb63685b4a18cc59651701dad697d6c5e0eb731a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755933, "uuid": "06fa2d00-aa6a-4f5a-a7c8-45508457e9f0", "comment": "Malware payload", "value": "ebdd0645f46b4b3b82b38d72e3bf6546ce49983c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755933, "uuid": "7e339b12-52f4-468e-9070-679811564e40", "comment": "Malware payload", "value": "06c40f7ef0c90a5151e6e4ca2fdafd4832943180cb9413dbaac02b417b6e5e15435c750e1316723a1603ef766ac3cf76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755933, "uuid": "76cfcfae-df66-47af-9d41-97255976cd6d", "value": "T172534C0B339348EDC116D97482EBCE329B72F8650570AF2F13E4EA312E15E716F19A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755933, "uuid": "ed3a52a2-37b3-4329-8257-d4ca1889c637", "value": "15e5009604045a6269161b15a81fc470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755933, "uuid": "0926b175-92f4-466b-9c13-950291cf8b74", "value": "768:lxv//anfZA6VpXUI/i20hHvdzVSgLXHvezlMY8+guy/MOBKVHoQj0YunByeNH6QW:niKONXihtVSgbHvOv2sVh6np6O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755933, "uuid": "bafef00e-44c3-4a09-8a45-0d73da828f4c", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755933, "uuid": "696b4046-a2b4-4d03-84ff-9ecc6097282a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755933, "uuid": "72ddc570-0054-4842-be3f-68d414e2907f", "value": "SecuriteInfo.com.Win64.Malware-gen.44351284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810671b9-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776843, "uuid": "fadad493-326b-41a0-8c50-a88c220a88db", "comment": "Malware payload", "value": "841345f8b73d98a38927eeece6c167e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776843, "uuid": "5e83aaad-8101-4f54-b80b-4a5b1af4162f", "comment": "Malware payload", "value": "3c968183d34d54807205b993be616453785c53ffb1dfe5aba1fba8a107c4f466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776843, "uuid": "88624243-9ec0-494c-b981-34c89a260bd2", "comment": "Malware payload", "value": "99372c5adbec64e4d9145f3cac75524f0b63f224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776843, "uuid": "38726786-3eeb-4168-a89d-b3f42dd9dfda", "comment": "Malware payload", "value": "104e05172a1755f0522f87f9ef5a6a90d3855bb33d1cdcf86e486ad8e4bbca5a744eecf0b020a42adc4b55a77e4d7730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776843, "uuid": "ed9fdf72-0bbe-4cb1-89bd-2fbb4d2abad0", "value": "T153D3F195F4A15A32CAE5227EF65E560DB3434778D3E97302DC148F1137AB9AB0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776843, "uuid": "f9a79ed5-a4b2-405b-b317-be994afa28ab", "value": "3072:foTTImvmBwkHiJBpV6WiMtWqaWYYt5ZmJ9yy6EIZKO+W7vDHJL:fgIwWwGiJBpOOHYmjmJroZB5DDpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776843, "uuid": "53cc5cc4-2828-4c2b-b1f8-d7a5e3462af2", "value": 142190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776843, "uuid": "0278ec60-e636-4e72-96dd-d0c644185476", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776843, "uuid": "7c3c52e9-a40a-435b-b174-d8c4942659c8", "value": "k9drx368ww", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5ff28a-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738717, "uuid": "0187f533-101c-4d69-b5df-5de6cced39f2", "comment": "Malware payload (Gafgyt)", "value": "474ffbfb5180dae7339b7e34b44f7b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738717, "uuid": "153ff96c-7829-4412-9970-976c90f388ea", "comment": "Malware payload (Gafgyt)", "value": "3cbe3459dc6360b3825f3e5e384324ad4c84bd941258565c59b31154acb22a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738717, "uuid": "19481a0f-15fb-4ec1-967b-01e9ffc35ae7", "comment": "Malware payload (Gafgyt)", "value": "68abfd3a78b4321f8441fa6350a9f3bc2a501621", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738717, "uuid": "ca718913-0be7-4ad9-a589-fab931e34587", "comment": "Malware payload (Gafgyt)", "value": "46fb6ad3a2084cccd333625021e66ee0cc12879f40d7bde7587c9ab088a28fe2115c5fad462e89fcd3a6969c05167000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738717, "uuid": "971517e8-53c3-4181-b617-3a0c710ae29f", "value": "T163B31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738717, "uuid": "b18653e6-b067-4393-9728-4b36936c57f4", "value": "3072:MSk+U6m1qW/w8BlPbiRq6AmkZrQAhPDCXFke:U6mgW/1BlPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738717, "uuid": "22a29567-26e5-4cba-8cd0-fef133d8eb34", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738717, "uuid": "ac6b07f5-1753-41ed-8efe-6aa863f1a841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738717, "uuid": "232a2cb6-a88c-42c7-87b8-8101ffc4c4db", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3e3878-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784052, "uuid": "498ec9bc-f14d-495d-811e-c258f0155c2d", "comment": "Malware payload", "value": "b6bd8ff194d22d83a123a3ad48edad62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784052, "uuid": "be49e470-115e-4190-98fb-3cbd67e6ec05", "comment": "Malware payload", "value": "3cc739bb1882fc9dbb056f39ebe4965771aeca0ceb44e85da39d1ba7dade693f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784052, "uuid": "c1a86270-faad-43a2-9d19-71c350c5cd25", "comment": "Malware payload", "value": "8291929d6f3ede6ec025c21d1559a7fe9d30a9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784052, "uuid": "f57b6b62-416e-4152-a7f5-57625c69353f", "comment": "Malware payload", "value": "fbddbfc37bdafbf5fbc3ad96a1c3a121bf82b9b4cf9264ea472e454a9f06d0c9f40f5c92f82e2abde3f8b6e32586063d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784052, "uuid": "6d693486-4ce0-49b5-9331-5fc09fdcb345", "value": "T1B4F36B4673A130F9E5778239C8625A16F772B47207709B9F07A407BA9F273906D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784052, "uuid": "e21a6913-6eec-4905-84c3-2e04bcceb623", "value": "e1742ee971d6549e8d4d81115f88f1fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784052, "uuid": "4cd0330b-4b81-4ee3-b2b5-f5a08663363b", "value": "3072:Oo3snIMKGAL4T4ulYAf+EV6ec1+a5CDOaVBC0UzL:dhcAXZAx8eS+a5OUzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784052, "uuid": "ce916169-9a4f-4591-892b-054bc50fe6d5", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784052, "uuid": "0d008bf0-b634-4f95-abd1-580ae813df26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784052, "uuid": "1d5323ac-9c2b-4208-b1e7-33aac7c4ddca", "value": "LocalPotato.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd8181-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750391, "uuid": "bd6c94c7-56b9-4e35-8f13-fa6257b24d7c", "comment": "Malware payload (Mirai)", "value": "307f6a6c48da613893fe0da22fda0ec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750391, "uuid": "76d290f0-100e-44ed-8193-e90a09e94daf", "comment": "Malware payload (Mirai)", "value": "3ce4984ff73e4d19742acbe23ebcb91075ab27770acaa5470056e36e6cb20bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750391, "uuid": "6e52d0f0-680c-426e-a0c1-94c9590af28b", "comment": "Malware payload (Mirai)", "value": "e4764d630de580e449faaf307ecb7f4a28457eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750391, "uuid": "fde33ce5-9f1e-4ba1-907a-688a1d63e275", "comment": "Malware payload (Mirai)", "value": "28475de3c2b011ea47b2260c254dee4bdeaac1d03db2288303f4881fc03ca8f27c7f0f91553dddc169d21eb7cc92dae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750391, "uuid": "066cd451-0d28-4d7e-a218-b98ca2de0b24", "value": "T125C36B02B6C0C8FDC499C278469FA2B1D862F82D1235765B5BC4FE167D4EE212B3E791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750391, "uuid": "61e57a61-f3e9-432b-a080-d43e150152a3", "value": "3072:sd1HkmZ0W1TDg2rTsKMlsLGhp1pZaz8uAtaOlj0P8X:yHk5W13hOHju9P8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750391, "uuid": "4bc023c8-c193-4cbd-96ca-9fc55cbedbcf", "value": 128776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750391, "uuid": "855d7e1c-357a-45ed-b36a-3d573aadb416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750391, "uuid": "47a49fa5-9594-4551-8229-4478c51eb916", "value": "x86_64.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2182e3c-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752551, "uuid": "e3e58ae1-6c8c-4d31-9a78-34ba79fb3f9b", "comment": "Malware payload (Mirai)", "value": "2c35e819a7fed5957698c9ffaeb518be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752551, "uuid": "e0e488cc-7471-4ce7-9ecb-6b4684213e11", "comment": "Malware payload (Mirai)", "value": "3d0c82e414977c4992746512c7303ea8fe501529b86f5575d01bba8b1a1a9bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752551, "uuid": "ad2fcaa9-e701-470c-ac77-bdf3804ed8b0", "comment": "Malware payload (Mirai)", "value": "a3783684514974cd9e41dc75b7f3b6060b17226a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752551, "uuid": "5828ee27-8045-4ddd-a467-4e47a3c28241", "comment": "Malware payload (Mirai)", "value": "87e6227024d05a833de25a93564d48c821c446d6e48f980c311b8fe4c8e18d3a8e5445996eec78110e467c5458142f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752551, "uuid": "efe686fb-23e8-4950-bb80-848760e3e52c", "value": "T1D4146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752551, "uuid": "bedf79a6-530b-4c57-97bc-b4f09bcdd4e6", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtd:BZAyFzQSdS7IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752551, "uuid": "57a9b8a9-69e4-4f70-930c-6f19ca42e78f", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752551, "uuid": "a77046e9-ba27-420f-a949-feda8a20cded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752551, "uuid": "e960424e-f3b7-45aa-9e3b-61081d1ad2ae", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cf4646-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771752534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752534, "uuid": "8932109a-3d0a-4218-8600-0c04a4ae7cae", "comment": "Malware payload", "value": "c509d7de26619037aad2b7e1ca345308", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752534, "uuid": "a77d3d0e-0320-431c-ae03-28325772c899", "comment": "Malware payload", "value": "3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752534, "uuid": "3b38e0e9-8399-461d-840d-645e338b9d75", "comment": "Malware payload", "value": "566d7d5db7f85a41f89d963d6f9e75dab7ae53a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752534, "uuid": "3b15c058-c0d0-4420-975b-732e060f3d96", "comment": "Malware payload", "value": "7ad4e68cab71d07cc0dcb76de20df009450e211c9f7aaec7c65f63d68753b86bf2ccf6fb282571edd7f7d9d769a27d99", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752534, "uuid": "27fe671e-cccf-400c-aa0b-dd4db05839dd", "value": "T1BD5151AB07045B71DA09855EB7FA3574764EE083A6DFC644E9848C2D4ED9D4C3B86F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752534, "uuid": "74772f70-feb8-45d4-b5e6-134a3b0ba7ef", "value": "24:wp2JMMibiB0vuZ/EUEnE2EhEwUSbw/UJUfTshM3k:wp2JMMibiB0vuZ//cvyISbwvshM3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752534, "uuid": "09318de3-76a5-48b9-a460-94c346ced948", "value": 2855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752534, "uuid": "ed59c1c9-ae48-48d9-a0b4-cdee3172c01e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752534, "uuid": "2073b009-2bc2-4fe1-870d-231ab0fd879a", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d7c460-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752529, "uuid": "49aa4e33-c8f1-4ef8-8fb2-539dc0032377", "comment": "Malware payload (Mirai)", "value": "d5dca33160c0695003ecf51f8bce6d5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752529, "uuid": "ce479cf5-742e-4084-a768-80f4d0783c94", "comment": "Malware payload (Mirai)", "value": "3d68f02d44bb88e0f7eeeb2b76a4d6ebbb22ce9b0456a6ec9510e6c08125fac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752529, "uuid": "b3d2e037-fe28-4e61-b9d8-c0751f0ba13a", "comment": "Malware payload (Mirai)", "value": "73ee3174873600ebeafd59d1d14bf72b057f9ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752529, "uuid": "baf5d524-55eb-4276-84ea-8ec8fddae70d", "comment": "Malware payload (Mirai)", "value": "9d6104997e32eeb449ebc8813687d4840ea9766d9438b6ea8b28fe06da4ef726e9b50514df1270f4b1a060d024f39a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752529, "uuid": "1a64a2f8-9873-422b-b5a7-32d58e7f5266", "value": "T1137302722166DDA2D2B1803253477D09BD2388BA0374A7FABCBDA75FF487E116C0C55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752529, "uuid": "0ce49bf7-51d0-4992-beab-62b2df9be1de", "value": "1536:a8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmw3vorZ:hzRnwP0bMQ2RijvDZZ1rYGhG13w/SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752529, "uuid": "539a652b-2202-46c3-90e4-52fc893131ee", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752529, "uuid": "c3b22fc0-7e97-41fd-83ef-4ea39cabe124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752529, "uuid": "5f523810-45e2-4982-bce2-ce0a45f84788", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd143ba4-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738718, "uuid": "eed254e6-c337-4e64-bc25-242899d77f01", "comment": "Malware payload (Gafgyt)", "value": "fe177da7f34631199c782dbc367cef87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738718, "uuid": "e51632fe-dfd1-412d-9059-0c09a77aa3e1", "comment": "Malware payload (Gafgyt)", "value": "3d77e84d55673eea61a5bc9ad7515618c5f333ddf0aa0c8a47df1cc30d470b2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738718, "uuid": "3b3ca0c7-5d0a-4f03-b444-dd0d2573bdb0", "comment": "Malware payload (Gafgyt)", "value": "68eb1be490c3a136f49ce48f9d648f423d4e0d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738718, "uuid": "9f70f06c-8eb5-4b46-9bf4-9deee3accf84", "comment": "Malware payload (Gafgyt)", "value": "e2a1d3db0de2d5551bec33d24ce675291841cce8eeb0cb9fd7e4080b82ef3850243c395db3de185112fb114afe38f8ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738718, "uuid": "382f05f5-1732-4272-86b4-966f401b9380", "value": "T135C39517BB618FB7D81FDE3305AA8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738718, "uuid": "0577494b-0c84-4c03-95f5-8e6d16a7cff0", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EpMyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8E+yDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738718, "uuid": "fa420990-4726-41d0-92f7-7a90ff8eb71e", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738718, "uuid": "79fbb9e8-f6b1-425d-a4ba-67f678dbf5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738718, "uuid": "560f0f3a-85b0-436a-ada8-86904728a270", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31efb35-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768739, "uuid": "789e521a-46f5-43e5-a08f-21ca3650e65e", "comment": "Malware payload (Mirai)", "value": "6cabbacc387e93a3fc745f701613ed6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768739, "uuid": "60f438b0-656b-4af2-9f38-ff8c7a2cbcb5", "comment": "Malware payload (Mirai)", "value": "3deeda72be39614686ffdd127677befb2f7676393f1b3f0b79736e49c07dd8de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768739, "uuid": "b5286927-efe4-48cc-9e7a-08dbee79c92d", "comment": "Malware payload (Mirai)", "value": "b91e354dd5f6b6f8daa479c92376d5d82eaa708e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768739, "uuid": "43a81878-9cb8-40a2-8d81-72f6e68c301a", "comment": "Malware payload (Mirai)", "value": "99704b707a8ed886475de102e68a2ff4691b71610a3173d6a588c30464ec9d66c77b64585bcabe1afa86d28bf013ece0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768739, "uuid": "c97dd963-3c02-4e79-83ae-ea85c9167c9c", "value": "T15C330223B215FD62DE761D3962FD4C8F7048416EE4ECA82239C859B162D2117FBE49D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768739, "uuid": "6bb3483e-9433-460e-9a98-6e2f0db7bec8", "value": "768:ffZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbGA9q3UEL2qEK5J6OAsNTGjf2tl8XOYh:EPtQjiZVcykHRDGJL15J6RN2tAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768739, "uuid": "9ca0b9e7-3172-4b2b-9c22-184c387fdac7", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768739, "uuid": "d3369f85-9cf8-4bcd-a87e-56fb4bb616b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768739, "uuid": "168b523a-dc99-4367-9d0b-5bae6b457e45", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf06506-1024-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788432, "uuid": "16e9eeab-98d8-4fab-bbac-b52374610f3a", "comment": "Malware payload (Mirai)", "value": "b64b3c3154ae08a3f79ee1859237302c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788432, "uuid": "a982c5f0-cd45-492f-86fc-31b45f808728", "comment": "Malware payload (Mirai)", "value": "3f36c74900047e2a3506bbeee796735b4311981499a1e562884dcf9b3bf90ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788432, "uuid": "5c38014f-5328-4051-bb4e-b4e650687c0c", "comment": "Malware payload (Mirai)", "value": "0ec35508eb9f7dada7830b86ee1b3cd6c7af8efb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788432, "uuid": "80c05312-e31a-4a68-9523-b8b461d07296", "comment": "Malware payload (Mirai)", "value": "f5d72a68e3c14741fc36d4d69b03e6dfac1c3b0f275280c76e18bbdd1aa95ccb2733efdf15b8650f4f106ebf1bbec07d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788432, "uuid": "18b3053f-77b8-4d0d-a30e-cc5661f56ee3", "value": "T14B6301CF6EB03F26D1C8A1B1703815D5D83ADDCAE683869886E2A756073943B55CCB1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788432, "uuid": "826aff7a-9da8-43d9-83de-382303529341", "value": "1536:NaxZLmYKVDNSl2y08yumeJyGYVmIMG1WZsNh:NaxZLmYKX+t08jmeJhYTg2Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788432, "uuid": "430b67ab-7274-4441-9240-e9f9e898e383", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788432, "uuid": "2c16b0c2-6f07-4c50-9420-17a0a5a2e5d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788432, "uuid": "1d42db6e-26d2-400c-b3ca-495cfa676475", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e336685d-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778725, "uuid": "fabcd4dc-74de-4d72-897e-15d14a21a48f", "comment": "Malware payload (Mirai)", "value": "a492dc8a9268127be738b885f526d47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778725, "uuid": "3d882dc6-c8ab-492e-a907-da5a5dbb44fa", "comment": "Malware payload (Mirai)", "value": "3f708d6260c0cc692ec2fb9a1c646dd268cf252f43d84db872d4b3d723f4ffc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778725, "uuid": "e840a91b-8f91-4c6a-bf48-4cd398d29f01", "comment": "Malware payload (Mirai)", "value": "36b0a71c1277931b5e6624eb3bf1a3a6294a05e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778725, "uuid": "444f99e0-0f61-4cf4-b92a-24ba7db9b222", "comment": "Malware payload (Mirai)", "value": "4c8321c3de3f8ecf43e343123f3b6624eebfae9673344492c09ad80ae60618f3d3f34533fcbb04b4172c87110693bda4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778725, "uuid": "5d110ccc-27c8-4524-9765-735480b2e55d", "value": "T1F944120896EEBA4B6D83B27D5CFB4115159205E2CAEF3D15DD2EE102D1E23280B45DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778725, "uuid": "12f49516-f4ca-474f-b28f-90d28db27a3c", "value": "6144:wbqUfq0dY5isQZOgq/loOszQ5jL5eJVE+9Bg0HKhOA/9YLF:wbviH5isTg2BhL5evbA/9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778725, "uuid": "87277d7f-8f78-45eb-b87d-9037c1ad3f86", "value": 266704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778725, "uuid": "62ba5907-1d05-4409-b405-0070c61c32ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778725, "uuid": "b1d01140-673e-43ec-9a44-bcf19df56ce8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c371ae-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771858, "uuid": "7c0994b8-01b7-4e88-9860-49cb48b7f7e1", "comment": "Malware payload (Mirai)", "value": "730dceb0b979b40dccbab835bd82e30d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771858, "uuid": "1f3c0608-9c08-421a-a618-dad91da2a6d7", "comment": "Malware payload (Mirai)", "value": "3fd6edd65bafd1edf011e975456adba0748f2618da75e832a0a0e11f28755897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771858, "uuid": "d5e78fb4-69c8-4b5b-a0e6-e93953d15a11", "comment": "Malware payload (Mirai)", "value": "e0bb6ab4ce5877ba1ea8ad20de3955dc6a12146d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771858, "uuid": "77f1dbca-a7e2-4293-adbf-1dfb0550201d", "comment": "Malware payload (Mirai)", "value": "6a2665cb7c65881ed91d096712002110d49e23e10c93acecf0dc62b4f1225e2a378f1c0876951d54b3398e9acf5f123e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771858, "uuid": "cfd64361-511e-4b72-aa46-23eef7c83244", "value": "T1E68328C1BA8BC0F5D80748305067F23FCB32E6394066D75DEF6A9E26DE376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771858, "uuid": "8ac1aaa4-469d-4021-8189-9e2c50a3c131", "value": "1536:UMpfl9OnpbStfCFx4W4SIWJawNK2oXcKQW2E/I9L:Vt9Kp2tfex46ouK7XXQZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771858, "uuid": "8f698d2d-53c0-4c86-b1bb-2de69692b579", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771858, "uuid": "979b2ca3-ee79-4599-af40-7b1c6213b319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771858, "uuid": "5597c98e-1a2e-4d6b-be6d-206c7eacf134", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f5fb1b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766489, "uuid": "e07e817d-cc33-4a23-b0ec-70d33ac2f320", "comment": "Malware payload", "value": "3d0f731a02999dd37ff89530dafbddc8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766489, "uuid": "5bb9e591-b9f8-4864-b979-6b2f2cb59258", "comment": "Malware payload", "value": "3fda8164c4484b925a55d2a066413ca0f73393aa1dfe1b924fbc9523cf3445df", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766489, "uuid": "2e319fc5-418a-4d6f-8d66-ebcc90125eaf", "comment": "Malware payload", "value": "93d41efc6ce5253265118884e551d71b94ce89fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766489, "uuid": "0032fef1-5dc0-4321-a992-26dc21038520", "comment": "Malware payload", "value": "922915c2b6467d481e7b141b523c89e6287f069dd2ad19f3e0fe3b73efc56df43456bbfafc82247c6a599788f6f08ce2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766489, "uuid": "d0fa678a-98e6-4afe-8e85-ff0d937fd616", "value": "T17C32557721F08B32D7C410C9A3B71A654E72974B856214B5F4BE6729AF2DA0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766489, "uuid": "a951fae7-6ccb-446b-8d38-1e762012b24f", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjGlPoDMEKEVzENE0v:cCu34hvZ5m5FG4j4HKNpivyRvOMdxX+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766489, "uuid": "3ce0532a-9d2b-42ae-a11e-fb4895abd69b", "value": 11913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766489, "uuid": "6b0a721f-6d1c-4753-9c04-f612dd2fe470", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766489, "uuid": "20ed9b63-a792-4625-acd4-d546998c0a47", "value": "3fda8164c4484b925a55d2a066413ca0f73393aa1dfe1b924fbc9523cf3445df.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63b4a9f-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752934, "uuid": "e9699fa7-0a9f-4685-8a82-2ab4876f28b5", "comment": "Malware payload (Mirai)", "value": "cbaa6d399dd1a009b6485d05a8dd1a21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752934, "uuid": "cbf97eda-3081-4622-8959-226207ca86c1", "comment": "Malware payload (Mirai)", "value": "40053254e6665b5f5cec627dd57309828eb1a72f89bd62cca8e691d93bb53153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752934, "uuid": "99e8e524-dfe8-449f-b4d5-0775b20d5f39", "comment": "Malware payload (Mirai)", "value": "88be142e8152507ae10b23a505a6250337903a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752934, "uuid": "0085c39c-7b51-457a-a17b-52df8c08493d", "comment": "Malware payload (Mirai)", "value": "506d57e0c3028c7fbd52eb39fefe6263427b4afe16d9a87457388af14c9cdb64b5d832a0835db959aceb1037e5b7fda8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752934, "uuid": "f89144f5-574b-40d6-937c-5a125af40d84", "value": "T171838EC67A43C4F4ED2604712077F7315673E63E0069EE83D7A9A972FC52642A72A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752934, "uuid": "366b6547-1bb0-48fa-ac92-9ee67e9888f2", "value": "1536:931cZG4Awuf4vBA61dpKbqvCnJfYG38AS9tBp0HFc72B0fC:1d4Jufkf1dpKbqv4YG38f9tD0sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752934, "uuid": "a024b36b-78cf-41d0-9d2b-a37b27abf858", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752934, "uuid": "fb949659-f3d0-4ffa-97d5-8fd76586847a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752934, "uuid": "a6ceab59-0a61-42e1-8673-f4039dc14ae5", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e981c3-1026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771789254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789254, "uuid": "f01b3142-8bfd-4629-a8ec-fbdc857b3dfa", "comment": "Malware payload", "value": "439bebbaacf5f627982a40ac20f41916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789254, "uuid": "7e72c934-8188-4270-bc2c-75c65006746d", "comment": "Malware payload", "value": "4008332f2f4a734a2a8f5d573cea3e899bb9cfd773170da44a394da1c66c1f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789254, "uuid": "e385f8c1-aa21-475e-b5b5-bfb3b4b70438", "comment": "Malware payload", "value": "02c7548db786eb094256595310588f748ff43f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789254, "uuid": "fac8cc5d-5756-4e83-abb8-bfe4012a5748", "comment": "Malware payload", "value": "ee86f105bef0b53040c41ade599403360ca696172d5206950aa4ba55e4cb2db4e371b56d3ac190b4af0d79396015a92a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789254, "uuid": "1a2fcade-00d7-461d-8a86-6c931dd54681", "value": "T14CA36C86F747E8F0E94609B0116BF7398731ED361024DEABEB94FD72AD32642901A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789254, "uuid": "a4d40ef3-491a-4488-b2a1-da7655dd3745", "value": "1536:CIFx1FswQW9xbh8/Xa5Ub88Ovx36opfAfYUm31ELd+2GwW0sr:CIR2PW9NyPa5UbFGlppGcbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789254, "uuid": "5cd252eb-982f-473c-94ae-202de1616742", "value": 103776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789254, "uuid": "a9fbdbf9-d14a-402c-948b-058293cbbf64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789254, "uuid": "cd9a4ea4-5bdf-4d66-8c37-c7ad0a54d6bb", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566497a9-1027-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789656, "uuid": "d1d94624-3844-444d-a7b4-3538d91c4689", "comment": "Malware payload (Mirai)", "value": "0bad609045b5c615b28cb4ff2f0b1622", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789656, "uuid": "1598cbaa-c8fc-4f40-ae36-db425bdec27c", "comment": "Malware payload (Mirai)", "value": "400f03319b9db77fa6a8c8c079edf65643c8620f3d3dc73d80bbdb2521c3204c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789656, "uuid": "6b232aba-e15e-4d58-b2ec-7f4558497e78", "comment": "Malware payload (Mirai)", "value": "d71b8f321ca42f314a46692125fa005736103c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789656, "uuid": "dac7f84d-0891-42bd-b656-3cb0ae707490", "comment": "Malware payload (Mirai)", "value": "991d6a4435decf751129f247f5e9a7dad53beef71c3647db763ffb59bc21735797bd2a5d6bb2dd6898b53dc1203a75a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789656, "uuid": "d5f62aee-8f9e-4198-88fe-9dd73733a3a1", "value": "T17C933A52FD958652C6C516B7FB1E028D372663A8E2EE3203DD255F2133CB91B0E77981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789656, "uuid": "978f13f3-8d0e-4686-9cf8-ec2501571f81", "value": "1536:uVDJZV1dmccgULZT6xGJ1tumsKKacwCLaI21BPUvO3jTZcg1e3AyAFE:uVNZV1dmrwgJBtKacwCeI2fKeKiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789656, "uuid": "3f0c7161-e6cf-4689-af35-083b24597078", "value": 92996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789656, "uuid": "ce06c9f5-5edb-4c9e-85f7-017e77865e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789656, "uuid": "3c8a7790-bfaa-4984-bf29-2ee59119800a", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff0a8a3-100e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778800, "uuid": "a5117f6e-5e89-412d-870a-2b47d4c4feb5", "comment": "Malware payload (Mirai)", "value": "c0dda5243f771034c8ad48c0723f4d73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778800, "uuid": "82ca6413-11b1-427c-b1c0-d2c9d3a651b7", "comment": "Malware payload (Mirai)", "value": "40be9249b575e1d009069e2c450b14c4d53e147565f6bb0e5854beeb5e67533e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778800, "uuid": "ecd3bfae-8ec7-400f-bfb4-d89d60ba045d", "comment": "Malware payload (Mirai)", "value": "183543e23d13590aea9b63eb5ca363867862949f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778800, "uuid": "0e56e441-296c-4c3f-9112-3f6089a7b788", "comment": "Malware payload (Mirai)", "value": "5dcdbf645f2574bab531e0df33aadc4f92e7bcc59789adfa5bb6923b3beebd12adcd491385982755850efc9a57da46f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778800, "uuid": "e70585be-5566-48b2-8653-702cdf1171cd", "value": "T1B3D45B16F8808F62C5D1267AF75F4268731357B9C3EBB20699188B343BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778800, "uuid": "a63ebfe1-7c1a-48f7-aace-0de667097848", "value": "12288:plyil6wu9em3mqigE+f1DCnThN91T0z8p1V5FXQpBp2qp4d3:ail6dd3BTE+NDCsCMpzp4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778800, "uuid": "8fe14e46-be53-486c-86b2-cf8c28518d77", "value": 626244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778800, "uuid": "67a1f1fb-992b-4e4a-8b05-5e60ffafbc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778800, "uuid": "173e55b4-aea3-4e88-bac4-07d43451d8fe", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43bb27c-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766298, "uuid": "40107258-d979-4d6d-bd45-d05dc6f4b21b", "comment": "Malware payload", "value": "0eab37f15046e579948b12897687cd9f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766298, "uuid": "b123373a-4565-400b-8386-cbadc2f95c61", "comment": "Malware payload", "value": "41781687cd879f9da43e1ee978902ad4aadb88ff9b751cb356e4db8ef4435f1d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766298, "uuid": "d940b103-9c43-4d3b-98db-130867c48c7c", "comment": "Malware payload", "value": "96aee1a90097647d5ec1374168ba4e54df61c137", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766298, "uuid": "632b0cbb-5c22-42fa-a3d9-4dab76bb1fec", "comment": "Malware payload", "value": "9f53c227f71736733ee8d481e926a75d53b5ef8abdab979e0aae24330ea04e7de6b98038bd4abc48f162092a41e802e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766298, "uuid": "50111afa-4063-4c32-802d-a5e55227e0f5", "value": "T1C042463B21F18B32E3D054C862A71B614E72970B456614B9F4BE6736AF2DE0370E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766298, "uuid": "a2236726-06ae-4d81-abc4-6a5cd6ba6147", "value": "96:cCuimB6msht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjv4xJ5iu+SEgL:cCuiK6L4hvZ5m5FG4j4HKNpivfv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766298, "uuid": "41a19bff-cf3a-47af-85af-a53dada025fe", "value": 12437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766298, "uuid": "a19c166d-d8d4-4f26-8e7d-3be09d948343", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766298, "uuid": "fc37d4c8-4378-4053-a241-bf6089e708d7", "value": "41781687cd879f9da43e1ee978902ad4aadb88ff9b751cb356e4db8ef4435f1d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e5f7f9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766352, "uuid": "f519ed89-348c-4cfe-88fe-6e23a07b8c4c", "comment": "Malware payload", "value": "afed654b07689fbaca1d4b65cf836c7f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766352, "uuid": "6ef278d2-27ce-4c8e-93b4-29fe96132a36", "comment": "Malware payload", "value": "417ca0ddd9398718b4f6923db99859900fae7d7e56bd3d4825c62068850bec19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766352, "uuid": "5d38e076-1e59-43a2-94ff-ed749a9f700c", "comment": "Malware payload", "value": "26f161fd9643aa8eac632d7a0ef6dd532a9a420b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766352, "uuid": "068ac81c-893e-4395-a121-e7c156a477d6", "comment": "Malware payload", "value": "2c060238112d0fa0e011c2daf83bc01eac224c7579af410a9a6dde6ecaad8a9c6069cd5ea15a54249d22dcc178d1bc71", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766352, "uuid": "7c1108be-c6cd-4b0e-9600-f461df1ca349", "value": "T13281967035F04D732E616A80F3372B96ABB6995344E3318C35DD2E265F86B12A5FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766352, "uuid": "c08e9d7a-5e10-49a9-a2b4-c28a7a899f26", "value": "48:cniRxuGRy/+DdvnSfr7lwnYJ/dl/B4Tilwn8Gs7wnizLI7wnE/+ol3+L+ol3Mt+r:cWu47kQMaXv+R1mhm/IBRIBxIBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766352, "uuid": "59cee010-8674-4a20-8988-287a2b9a4d75", "value": 3972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766352, "uuid": "9b4e96f0-0538-4ece-81c7-4f386779531c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766352, "uuid": "de280770-fd56-417d-b66d-2dc03e7236bd", "value": "417ca0ddd9398718b4f6923db99859900fae7d7e56bd3d4825c62068850bec19.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1dbcfa-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752439, "uuid": "9bd1027d-671e-425f-bd90-4cda21f1e184", "comment": "Malware payload (Mirai)", "value": "3189d806bbb06f76f3290e22960323ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752439, "uuid": "39ae16da-fcf1-4c29-b1f0-9aa1b55fb642", "comment": "Malware payload (Mirai)", "value": "42171c3dad761945b0c47c0e476d5bc41010e01551e6b6bb36f4e4cfa5c9095c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752439, "uuid": "af9affc9-ae95-4f57-b62a-ae4897d51519", "comment": "Malware payload (Mirai)", "value": "ed5f5d29db94d345852bd8a9ac588570d0f72c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752439, "uuid": "44d7b02d-9c83-4123-bc89-d1766adc531d", "comment": "Malware payload (Mirai)", "value": "6f05d8c87ae937322857a5e0da65440d93e37147be6e68ae86ec2839e977f811ac56b2eafe8bff8184ba77b23096a3ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752439, "uuid": "3039824f-83e7-41c9-a92c-154169db56c2", "value": "T123435DC4E643C9F5E80B1971213AF7375E31E1F82224EA93D764DA32BC53B41E586A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752439, "uuid": "062b3d5e-7f62-4495-af35-3e2a57085f9c", "value": "1536:xAD9SuePhT9LegvsqWSSxQshZTbJ9ghBDSDa/:KD9Su2hT9LegU9SSOshZT1OBQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752439, "uuid": "7acbc1d8-2941-4fe2-b332-1b04f4262bb8", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752439, "uuid": "f6d45fcc-b4a9-418b-838a-2843e2d678be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752439, "uuid": "9383e0f4-bb2f-4953-9785-e9ef0e1411d9", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff4dded-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769002, "uuid": "0b7b77c8-4841-40aa-8353-10bff11fb9f5", "comment": "Malware payload (Mirai)", "value": "9c95f34eba907bdc6ac0053dbab7dcf3", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769002, "uuid": "50633105-0b7a-4f54-91c6-ab8ab75c4c29", "comment": "Malware payload (Mirai)", "value": "423119812f455bbec5bbe992c7111febca743936f0883f3eaa13e15e490433d3", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769002, "uuid": "c2f0930b-61b3-4606-9b10-12fb9eaad6de", "comment": "Malware payload (Mirai)", "value": "f3f71872b520ca025beb87c029c851eb4cf99740", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769002, "uuid": "04c389cc-d71d-463f-bdb9-5ae46bbc8abd", "comment": "Malware payload (Mirai)", "value": "2f6e8f5949a3fcebff8ffca1ccc1ea8b9a76d453e138c12b21d072472d5629c96a8f0ff514b8da69038b318c0dd976c6", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769002, "uuid": "a935d562-3443-401b-ba49-ef75badd754f", "value": "T171A2D014A199A545C4309C365E3ACB82729A82B893F233393C1D1F5CBB85EDA13FD2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769002, "uuid": "8b1c4d5f-f724-4b60-aff5-208fe3fcf555", "value": "384:Q0L1Z3pW5/MO1GuvRglnj0Yn2eGIZ/qi/Z4yl6AGgQnA8RnyrU7LrhymdGUop5hq:zhqBjJgl52eG0qiNl6LgSA+yw7Lrs3UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769002, "uuid": "7580ea07-213a-44db-8655-fcfa56a9b8a8", "value": 22836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769002, "uuid": "586a4565-18e2-4089-a11a-8f81bab7f296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769002, "uuid": "b4e4e00b-cd5a-4348-ab95-ef796749be64", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc629128-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778714, "uuid": "d80fa176-9298-4582-bd7f-3b1efe6855b5", "comment": "Malware payload", "value": "3414f8a7f3468845241bce5250883b16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778714, "uuid": "0c547a8f-9493-4709-9f30-e85e5e36c94c", "comment": "Malware payload", "value": "42c305a25b61d95365a8e28f42aff6512fb12158d46310a92d8c846df164dacb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778714, "uuid": "ee2815eb-78cc-4c16-905c-acd12a261b9e", "comment": "Malware payload", "value": "9a5a0ad5bbb57a41ae550f8bcd05b2789c2aa660", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778714, "uuid": "3052f774-cf6e-441a-9ae9-de2ac4d42990", "comment": "Malware payload", "value": "e14a07e9dde1ac35d961a99333aa8193a91f0cdd0b3456bfaada79cd0b45c017216716725166061fe7f4b213b61ff528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778714, "uuid": "aafac30c-16cb-4d87-a4eb-ec49797a0d50", "value": "T105666BC9BC1D6462D5CAB7752F2312D93639BC088F42C7232614BF7DAAB23598F13661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778714, "uuid": "7f74e45a-e02d-4c97-9d58-bb976f850824", "value": "98304:JiXm443RvrhmHtGpZpPf+DH66S3TUUSrpBztEV:Jkm443RvrhwK1QBrpZ+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778714, "uuid": "c01a0ee8-e9d6-4544-ad47-e7fac1409d52", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778714, "uuid": "0b87ae0d-c700-45ba-8c56-52549d5ff827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778714, "uuid": "267dd520-3850-489b-a3d1-dccd33b913aa", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730b47d9-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769088, "uuid": "c7975d1d-8818-4cae-9810-bdea83e4cfa6", "comment": "Malware payload (Mirai)", "value": "bb0ef2c81e7d204663aa2d4f7af56ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769088, "uuid": "cf3d1cc1-d28f-4488-98f8-ac4a97f1bb36", "comment": "Malware payload (Mirai)", "value": "43270a23eeb9247684d679de7c7617f1af04fb52e5a493f6eb5b2ff965817bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769088, "uuid": "18eac5ff-9801-4ebd-b51b-98b01908fa2a", "comment": "Malware payload (Mirai)", "value": "5c22aa22e9965c54fb193a604fe6637d4b780de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769088, "uuid": "3cbbffdc-36dd-4001-80a1-a659cc2d3cee", "comment": "Malware payload (Mirai)", "value": "784f93926f14ed835e899a5278b5bccc8a3c7a3c850c4e287f4e52264d5d818bd9fec18f7cc50bb432cf2b7867b4f4d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769088, "uuid": "2f02dc64-264f-455c-a0ba-64572a436258", "value": "T1AF733A92F9825623C5D1127BFAAE428D3B2223E8E2DB7207DD215F2077C691B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769088, "uuid": "eca365c0-c4db-4a74-8896-12d96ca65ac6", "value": "1536:ZeE4OYMXSQEetKkdIu3BqYlywOGTljjh+WvIN:EE4OOT3uRqmlPIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769088, "uuid": "f9e1d1ff-74c1-4fc3-ba00-8cd04adf87e4", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769088, "uuid": "a2d17af4-5ba4-4db9-835d-c9e5dad985db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769088, "uuid": "b506c7b9-d13a-4bb6-bef6-2b7809143f9f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a8c4cd-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769192, "uuid": "38eb7f6c-bbbb-44f9-bb5f-172dff92f72e", "comment": "Malware payload (Mirai)", "value": "bcf66d5a155b2aa910352f5c9d9e857a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769192, "uuid": "30d711d2-3994-498f-8ca6-708fad8ef935", "comment": "Malware payload (Mirai)", "value": "43e73acc8dc62092b3afc1bf0c717a395c6159aae05dec7458448c9419a211b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769192, "uuid": "36a8ed3b-c2cc-4c68-a103-4eac96592ca8", "comment": "Malware payload (Mirai)", "value": "5b95540cbe22a8eab8cfd22e21bdffeea7f71d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769192, "uuid": "abc7a371-a6c0-4f94-9107-6282852b8795", "comment": "Malware payload (Mirai)", "value": "8946e4e4d6cde53b3940c845dc8b6341a7d7f5e1b4e176b5382ee7b8c0a6e00774a67e849908af07e920db5a670361be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769192, "uuid": "46e363d6-1d73-4925-91b9-a0bcfd34a0e0", "value": "T112634A02B31C0A57D0A319B0363F2BD087BFA5D221E4B785691E9B96DA71E376442FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769192, "uuid": "57e1a382-456b-4db1-a080-f970f705a365", "value": "1536:fS6iiuiETD6mT3/r09ZPH2+zsiVJRw+dAjgTMGmZBI:JGiErTeZZzl6RgYG+BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769192, "uuid": "910ec7a6-6338-4744-944f-42718c59ff86", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769192, "uuid": "0800d60d-52db-427c-b29f-5d028813a923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769192, "uuid": "b5742cac-8fb2-4358-8e5a-8edf092e1a5f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44530275-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766433, "uuid": "794fa47b-b6a0-4cee-835a-a384ae733552", "comment": "Malware payload", "value": "e78a30d7116be037595af2f8ed55a0bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766433, "uuid": "68f96cee-2dec-4417-8e22-66706cab9a3f", "comment": "Malware payload", "value": "446831822fe187cd563a14a51f3dd38ae79381d3b90084b803dc4caba37383f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766433, "uuid": "7dbde1ac-3296-43b3-a3df-04c4ebb2859e", "comment": "Malware payload", "value": "a3e374bc51822effda45134b97fe0bada4e04773", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766433, "uuid": "19c63291-6fc5-4b2d-a0e8-3581bff2ab60", "comment": "Malware payload", "value": "50d24b00186208cce465b1929ef0fed324f8e165692b0e0faad2c9585067ea0bf0066f4285fd308538833549c9beae4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766433, "uuid": "90f9d56b-f7c9-48de-96c7-cf82e159c9b9", "value": "T19B12453B21F08732D3C450D953A65A614E72A70B492614B5F4FEA33AAF2C90730E7F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766433, "uuid": "7b9c956d-6dce-460d-a622-9107b45b971a", "value": "96:cCu6sht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjxHInys:cCu/4hvZ5mrFoKNpivdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766433, "uuid": "22b6b15e-62b6-4c07-89b6-d41df84b6c27", "value": 9550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766433, "uuid": "96416daa-ba12-43ea-9676-3d5e5af7d162", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766433, "uuid": "ce64edb8-1400-46b0-badc-7067993bb597", "value": "446831822fe187cd563a14a51f3dd38ae79381d3b90084b803dc4caba37383f0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229c8763-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766376, "uuid": "c9734ad7-d515-425d-90a4-846ae9a03e15", "comment": "Malware payload", "value": "88772f032bc23e261a8c1cfded848336", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766376, "uuid": "c4708c94-4109-4e37-9fb2-cc39770d3696", "comment": "Malware payload", "value": "44cf945d299219d1e73eaba6d74624e719ad7430ee266a85f1d1b5c7c234fed0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766376, "uuid": "dab76646-631a-440e-9be6-6ea340cd740c", "comment": "Malware payload", "value": "2cf68e6c5b7963944104c8e8824da380729d8a1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766376, "uuid": "78cc27d3-b536-47e7-aac7-82aa403760f4", "comment": "Malware payload", "value": "1b3ee46bb32b9ebd32d211f9426f23f5a75133b8f8044e8101247e7bf335ad7c4ffe00869d06a4cb0c6106f055efe183", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766376, "uuid": "35829b36-64ac-4e26-9292-6f23cec3456f", "value": "T13FE1FCB424F00C332D615A80F27727E55BF2A55756D3A68C34DD1F3A2F9AB13A1AF821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766376, "uuid": "7b6b35e4-8ce1-4482-bfc9-06c8a32b4d7f", "value": "96:cRu7xIxGxAxKxzGxpxSx1Cx0x+xqxKxKxEkQ6+:cRurO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766376, "uuid": "bc4d25cf-37ea-4880-8319-c21cd68d3e05", "value": 7077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766376, "uuid": "5322fa27-a57c-48b5-8893-8eff39efec2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766376, "uuid": "98e194a6-9ee3-40e8-aa74-b5db0eb97f87", "value": "44cf945d299219d1e73eaba6d74624e719ad7430ee266a85f1d1b5c7c234fed0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be800ad1-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771792, "uuid": "c15eb935-f2a5-44d1-92f3-4a1f0be0233e", "comment": "Malware payload (Mirai)", "value": "e39e7dde0e8cda0b17fed3aed41af225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771792, "uuid": "772fa3ba-d897-4c19-b80c-b4766c6fd733", "comment": "Malware payload (Mirai)", "value": "4561aedbfca0aed412e8529f61dbe69f3d6896410d4c20c82794349a792c0838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771792, "uuid": "5c26e6f4-a3dd-4daa-b357-4ca1d8bfd1db", "comment": "Malware payload (Mirai)", "value": "30731fef53012e46bff8b827d92ba0d686404657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771792, "uuid": "423407f9-2bb7-4c0c-a268-b7bbd3ebd927", "comment": "Malware payload (Mirai)", "value": "d1fd674d0c8dabcd43bffef8758d5de61299907a48e1b1242d73ffcbc3e2e2e9f5c504de111fe9b6ba7b4f71ff7fde93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771792, "uuid": "75660b17-4097-43de-adcd-416e6d675da2", "value": "T1AC03F11CD4770880EB379CB15D855BC27BA10E0D63B9CB95A3B1B9CA4B27B11F52EAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771792, "uuid": "37140f9c-fd9b-43a1-aacf-ac53763c81ea", "value": "768:0/O6+gxrsRrDE3OaH/i0sL3XaBwiWHbX7uSTjdmsgRo4uVcqgw0IT:0agJErDVaH7suBwigTjdms0o4u+qgw0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771792, "uuid": "fde27d1f-d2f8-4b4b-88c3-908db263f515", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771792, "uuid": "e3fd70e2-8f54-414b-8380-a43050e08979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771792, "uuid": "81d60c0f-0402-4545-bfe7-48ec61cd03ab", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a357f19-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759463, "uuid": "26cbdd2e-d6b8-4312-adb7-2445285746ed", "comment": "Malware payload (Kaiji)", "value": "353f3075ff28496f57fa77cbf4350f97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759463, "uuid": "ecbb7d9a-d869-43b7-9e9b-61d86d81c44c", "comment": "Malware payload (Kaiji)", "value": "4573abdd37ca1cd203befc3843c43c9e95dbbab8e40ac9d489293ff55ab0b2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759463, "uuid": "4887976f-3ede-4c05-86d0-f95e7c44eae3", "comment": "Malware payload (Kaiji)", "value": "9cc10669c0b1154a6055eb4453f16d06b3a33531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759463, "uuid": "ae425c26-2762-4bf0-b43d-d2f9eec78a15", "comment": "Malware payload (Kaiji)", "value": "aba04862381326a943e2cc7854bbd482d96a671c7242da99df45ef54d419e6661b161ff0937cdb7a05735ee4fa2c2378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759463, "uuid": "70fca4b9-eb89-4089-b9fd-b3366a530309", "value": "T1B4A5F857B8918552C4E42637BCBE81C833635EB99B8663666D04FE3C3ABF2D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759463, "uuid": "fff843a0-0449-4a78-9841-62167df0888f", "value": "24576:J1rMILphWsdRm6vM7lUVJtq8wfe9OqbVgYQ3k48jtIMoG34yJnWVh1BPnjKqZdtX:JVfjm4Mo2T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759463, "uuid": "c6476d42-5052-4525-8630-7e0e46fcffd4", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759463, "uuid": "ff6362d8-e05e-4690-9797-415e4d5ed259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759463, "uuid": "d66a7a06-b029-4500-bf0b-24f56e63d1da", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b2a6d6-0fde-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771758456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771758456, "uuid": "80e476cb-67be-4eaf-9779-cc1ca86799eb", "comment": "Malware payload (Mirai)", "value": "164493252952eef01cec641bc0a2d57c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771758456, "uuid": "3c66d2b2-5b56-41bf-ae0a-aa8a0a90e45c", "comment": "Malware payload (Mirai)", "value": "45a132b77979688bafae99c92ed476940dbb95e0ea5f8ae225a0073132c3c0a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771758456, "uuid": "c7e45f65-e54b-4589-9df1-595b0165218d", "comment": "Malware payload (Mirai)", "value": "8599a70d44294f3011857d1bc43ecbc91bc5e7ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771758456, "uuid": "98ceaa44-b4d2-4df0-ad37-39e81ca94cce", "comment": "Malware payload (Mirai)", "value": "2ea8c7ae4eb3ac4c721983879adf5f7e7673c5d673ae71d5fca7c9033c9d1b7f9e5ffc23b08428291fca38de786d7f27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771758456, "uuid": "c4e41aea-628c-4921-9f46-19a0ae931ee3", "value": "T115D32B41F9405F23C6D512BBFB5E428D372A17A8D2EF720399256F25378796B0E37602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771758456, "uuid": "fe4257a0-0d57-4dfb-a6f5-87c2bdc1c17b", "value": "3072:omJYZsT7bjfd7Wq84o4e5+nBA1dMi/T5ip:omyybzNP84oB5+BA1dvLop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771758456, "uuid": "1ba6ceb7-da12-4a37-8651-e522882d0a55", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771758456, "uuid": "4820a5b7-3733-4286-8ebf-ae90b36902f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771758456, "uuid": "e639f138-176b-4de1-9eee-5a349e11773f", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4707eb-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752654, "uuid": "c4adcb35-17ba-42e0-89b9-64502e013513", "comment": "Malware payload (Mirai)", "value": "e7b209432a67cd958230140fbdcb33eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752654, "uuid": "10228ff7-35ba-4280-b1dc-031fef284f64", "comment": "Malware payload (Mirai)", "value": "468ef826f5c5b9440ea3c520b540568d174a8856f76d85c54f0b61b7e632d58a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752654, "uuid": "3e6c1892-6dc4-4356-86b7-8c8ae6fb2ebd", "comment": "Malware payload (Mirai)", "value": "2cb846e6b79edf7dc6c97afdd22e6786a899cff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752654, "uuid": "28f79f43-8912-4265-a4a7-2279d824bd01", "comment": "Malware payload (Mirai)", "value": "d30647fb64d7665a41dbde8e376caead2853fb2c30609d57c0fb56cb1f5b7884cea92d19ddc317455ab138d0c13122ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752654, "uuid": "f000e604-278d-4026-b61a-948a9b775698", "value": "T12A145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752654, "uuid": "da0d4d3f-e439-4424-ba76-5a28e2542fb6", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXUUaN:HZ15BTYCrYq1QDY6F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752654, "uuid": "502c8cb3-7cc4-4949-9a12-4a7b89ab64cc", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752654, "uuid": "ea478241-806a-4211-b1d5-63c44f877f30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752654, "uuid": "99c87865-34c7-42c0-9fc0-23ea69650460", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3d0d63-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766397, "uuid": "0031fc6d-5e30-4ce6-a9a6-10e880ae91de", "comment": "Malware payload", "value": "d357c647fad3f1a85fa9284f107c7a77", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766397, "uuid": "ca02d281-39e0-44c5-8cad-e8d5441130d2", "comment": "Malware payload", "value": "46ce778ed468a54095313bbbc873fbe92f908dcfe5fff0727a5197f33da63ed1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766397, "uuid": "4cfd095a-6a93-4608-8b89-439a46381e3d", "comment": "Malware payload", "value": "21439ee102410b313b5c162e6cda60da8da2b1cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766397, "uuid": "e22d36c9-d0a1-4cd0-adad-b1d78fed6272", "comment": "Malware payload", "value": "9019ab7db4e376e34c6830f68f7b4967c339e0e5943eec4d3bc3e843fce6e5a93b76157c265db0a31e358ff4a28df1e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766397, "uuid": "18e82bb4-3de3-439a-8c1a-87d49ef068da", "value": "T1D732463B21F08B32D7C410C963A61B654E72A70B852614B5F4FE6736AF2DA0771E7B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766397, "uuid": "61234ea6-74c8-4f5f-bbd1-4d008a2bc72a", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6HcQAbAAFAAFUb:cCu34hvZ5m5FG4j4HKNphv5vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766397, "uuid": "29ee4b38-3a74-4521-856e-39c65067a4d6", "value": 10978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766397, "uuid": "3b521c1d-6c0e-47c3-a82b-c29b49af6a3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766397, "uuid": "725d9896-c1e3-41a0-9c26-0e31987cbf94", "value": "46ce778ed468a54095313bbbc873fbe92f908dcfe5fff0727a5197f33da63ed1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2ee1b6-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738722, "uuid": "cd78b42f-9b69-4255-b031-21f8b6dcac81", "comment": "Malware payload (Gafgyt)", "value": "3be7f9a82679b2bc7cbcb7e56d69aa00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738722, "uuid": "735843b5-ea98-4f9a-ac6d-05939124cc1f", "comment": "Malware payload (Gafgyt)", "value": "46e10ca4db8b23b8cb727d388ec76badf030a8cb93014221f602b3eacc55404a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738722, "uuid": "2c1d5c35-dce0-43e4-b604-fe24720b9b19", "comment": "Malware payload (Gafgyt)", "value": "9f54320ef69bc653ad2654a7328609b4ced84707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738722, "uuid": "23be175b-c74a-4155-be79-29395d90fd4d", "comment": "Malware payload (Gafgyt)", "value": "8c0c2f16d96fb9827b3251d5302e5be95b179797d34ce6326e4d343fd2b829f7450f740e3e6f6073c0d321bce71adff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738722, "uuid": "42d76c13-19fd-4105-93f5-8a773e98fc85", "value": "T172F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738722, "uuid": "3489c1a7-c3ea-4611-bec7-fe9862e21ebd", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/R3qnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISanlqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738722, "uuid": "41c007d0-e4cc-4096-8091-3081f921ab87", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738722, "uuid": "01fd3659-7edd-46f1-9944-da040d003af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738722, "uuid": "785c2ebc-d1b5-4883-b56e-f4a87e757140", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d150ed1-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766474, "uuid": "43f783b1-7539-4d92-bdf9-d5da1950d9e2", "comment": "Malware payload", "value": "21f345e20f0aa65c59ffafac3d30ed32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766474, "uuid": "c92b43f2-8582-416f-bc75-5f46f1160460", "comment": "Malware payload", "value": "4710fb8da39920cd3779757b27f94e651081357c7706a74b555603bfcda9ab06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766474, "uuid": "1fbdbe4d-c0c4-442b-b474-b41296a38455", "comment": "Malware payload", "value": "202f2954c2031f918659044ac330c2caf32d3446", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766474, "uuid": "64a1136f-976c-4125-8726-1ecc3688991c", "comment": "Malware payload", "value": "46b8b0f1fd857877144cf59dc9cf6d039af9385b3735dafe2e5ac99595ebb24fe14d25fb70b1c0ce7adc99e234c972dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766474, "uuid": "5ff13472-c84c-407a-aa36-278efb7317bb", "value": "T1CD22553B21F08B32D3C450C963A65A614EB2A70B452614B5F4FE632AAF2C90735E7F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766474, "uuid": "458315a8-e932-44be-bf6a-a45c0bb6967e", "value": "192:cCu34hvZ5m5FG4j4HKNpiv3ZsdjmK0CIDs:c4hvZ5m5FGGoKNpiv3ydjmK0CIDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766474, "uuid": "da87171e-9eb2-4877-92a0-d8d1b1bcbd6c", "value": 10588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766474, "uuid": "8d1c9539-a0ea-412e-b29d-1c157284241b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766474, "uuid": "c9c5a607-5974-4108-9355-0ad1e1e5261f", "value": "4710fb8da39920cd3779757b27f94e651081357c7706a74b555603bfcda9ab06.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56d060b-1001-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771773602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773602, "uuid": "0c58f5ec-5814-414c-93ce-98537c490c00", "comment": "Malware payload", "value": "672967fa49e32ca80c61128d8e9f2b75", "object_relation": "md5", "Tag": [ { "name": "195-177-94-103", "colour": "#354379", "exportable": true, "hide_tag": false }, { "name": "cms-lmcnow-com", "colour": "#6F18D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "portaldrh-tjba-jus-br", "colour": "#5961FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773602, "uuid": "19c8fd22-18c4-47f5-bdc6-753bd2d1dfcf", "comment": "Malware payload", "value": "473a013ae706915b43a046239821356afe4572c15e621f4ee63883e766c63af6", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-103", "colour": "#354379", "exportable": true, "hide_tag": false }, { "name": "cms-lmcnow-com", "colour": "#6F18D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "portaldrh-tjba-jus-br", "colour": "#5961FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773602, "uuid": "4909e0c7-4c58-470c-a272-bb906c67455f", "comment": "Malware payload", "value": "46055b68c992f9614a43da832552c85f78a0cbf3", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-103", "colour": "#354379", "exportable": true, "hide_tag": false }, { "name": "cms-lmcnow-com", "colour": "#6F18D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "portaldrh-tjba-jus-br", "colour": "#5961FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773602, "uuid": "c9906efd-794e-45ae-bef2-a9f21320af44", "comment": "Malware payload", "value": "3336b4a81b9562d9af55eeab70a840a6658671c0d37211be1dd999cc8e34225c8ac4faa5f1f7573bab8211521099b27f", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-103", "colour": "#354379", "exportable": true, "hide_tag": false }, { "name": "cms-lmcnow-com", "colour": "#6F18D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "portaldrh-tjba-jus-br", "colour": "#5961FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773602, "uuid": "71f82fc4-84e9-4942-b37b-4b79efe9a760", "value": "T109F7333FF18F6079C0AA167635B3D420897B2961A4518C23AAECF8DCCB254715E2F6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773602, "uuid": "750c2418-64c2-4262-a636-cbf5675f1fc8", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773602, "uuid": "52944e36-1ff1-444c-9e25-19f7974c4a09", "value": "1572864:ribp32FzeZjKmqyQvJOhcnU3LODgOlhu32TZ:RFCWm4hG4U3L3Om32F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771773602, "uuid": "238a2281-aafc-4048-ba71-5cbae4f3a4b3", "value": 71689808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771773602, "uuid": "81b2aa4b-da06-4054-b2be-0c2719cca0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773602, "uuid": "75dff445-82a8-4370-9454-3bedad7b7e22", "value": "CertificadoPCAP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e735b2-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768721, "uuid": "0aed822e-5947-4ef0-9735-3cd6fd338523", "comment": "Malware payload (Mirai)", "value": "59d923aed2595804d20572683b581714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768721, "uuid": "00436d41-7ad9-4f53-a82f-0a101ea2b9f5", "comment": "Malware payload (Mirai)", "value": "478608922af336cf766c3cbc7ba7a24aa51af1a489827a98a721ece2f9efd457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768721, "uuid": "4129df69-2a8c-4b6c-b489-634e6e07f672", "comment": "Malware payload (Mirai)", "value": "b461621fe6edf3bcfea723bfc32dd2db94758ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768721, "uuid": "82d60ab0-5ee5-4e5b-8c1c-dafe73b0b1ae", "comment": "Malware payload (Mirai)", "value": "6c1faf7bb085d4c6a476cdca8c412492cce65b3831fde3fd1720dc1a56adbf6301117ea4cb5fa04ce058d71c850322b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768721, "uuid": "d6116bf2-8250-4e6f-b41c-9265b8b58c13", "value": "T10AC32802F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768721, "uuid": "2f72a8c8-bbb2-45bf-b267-3964db2d4058", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7Beyr0Ez0zQxAdojgaR/j:eH3TghM/1weZbcnITeyosFAIxnJdhgJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768721, "uuid": "2dc60cc6-4720-4283-bc84-2a0776a62b70", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768721, "uuid": "72f3709d-388b-435e-a889-9d87dd3d1bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768721, "uuid": "640861b7-6bfd-42cf-b11c-6dafe0509ce0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73413598-0fe9-11f1-a769-42010a9c0008", "comment": "Malware payload (LegionLoader)", "timestamp": 1771763076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763076, "uuid": "d1080f9e-8d3c-4930-8143-1232b3f5d9e6", "comment": "Malware payload (LegionLoader)", "value": "dce215be341ebb064525d5672b6a0fe1", "object_relation": "md5", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763076, "uuid": "2be4c199-2c63-482a-85a4-4753a27b9b23", "comment": "Malware payload (LegionLoader)", "value": "48505bcd7a4de1c1d7b9a0a5063373c47696df0ea7d04b2cb83c175070fdd1ba", "object_relation": "sha256", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763076, "uuid": "fff9697b-6361-4443-87d9-9d5d705991ed", "comment": "Malware payload (LegionLoader)", "value": "4a242889c0b409557308baf9a0611cbbc7c9d245", "object_relation": "sha1", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763076, "uuid": "716e74a9-7384-42a4-8e37-142c305b18c2", "comment": "Malware payload (LegionLoader)", "value": "b81080854ab18d57c1ed1857dae126ac912d0f73838743ffe4222337157f2f9cdc96b7a47aa5367b797d88d148a9d86c", "object_relation": "sha3-384", "Tag": [ { "name": "eroticaforfree-com", "colour": "#62000B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763076, "uuid": "d254c01f-2231-43f5-89e1-9055061e42bf", "value": "T12C157DE19761A319D209E5FDBB5F3113B01A18F746A7C2B8166A42B330A909C4D7FFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763076, "uuid": "cc59631c-f681-4b42-8506-a751fa947ae0", "value": "21d9d445b4cc90be68d2c03f9bf58df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763076, "uuid": "be3e95b9-228f-4fa7-999a-aba50ecad195", "value": "12288:x/Med+b9bvpL3hv9/e/ZmCv0JwfrkPk8E5NzkK83JsCaax4x5HdGWIpCHh+WPGqE:xZsAVoTZMBGXW4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763076, "uuid": "78db965c-d37a-4d79-806a-188687e8ce2e", "value": 921460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763076, "uuid": "4da0996a-072e-43bf-9608-f8f7e729e197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763076, "uuid": "36f779d0-b6bb-4651-8f2a-5ce116116162", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a90daa-1022-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787568, "uuid": "3d2bb688-48b9-42de-b62c-fcd80461b47c", "comment": "Malware payload (Mirai)", "value": "06371e7fca7e56dd5d1ed2537c58c6b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787568, "uuid": "cadb5828-7814-4aae-a6b5-5e15b1b5f326", "comment": "Malware payload (Mirai)", "value": "4889a0e343b88318e63e4a3893d24129b06b0ef31edb604445d5067dc7aa6627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787568, "uuid": "e56e12e3-d1b1-402b-8261-022cba87c5d6", "comment": "Malware payload (Mirai)", "value": "a1bbb1c5cd17725991d44615fffe178210df2ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787568, "uuid": "24562386-3aaa-48b9-8af9-daf6c44d6f19", "comment": "Malware payload (Mirai)", "value": "b5fb2e4668f177361e9fe6b8f0a88098ac51580c96a3e125060790cec114995dad5302fd56835c56f65033d357839f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787568, "uuid": "9ede64cb-1c92-423e-8a2a-628b041902a8", "value": "T15C835BC1B94B80F6D80748708167F33FCB32E6398065C65EEF5B9E2ADE6364166163C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787568, "uuid": "6464ae2a-5ce6-4a36-b481-e23c2097d412", "value": "1536:sbjy7bF7CJjpHYEc6SmYOhSESm5ETWiqLXLw+Yf3pEXBWRl:CjWF7Cdprc6JVhSEDZZLXLwzfYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787568, "uuid": "3b4a4ff0-ed07-482e-bea8-fc56d3c4acd7", "value": 88080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787568, "uuid": "6593986f-93a7-41cc-a196-f43e4dec1d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787568, "uuid": "6cf2c280-931c-4f22-b982-ba1fcab86d8d", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe2adc4-0fed-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771764922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771764922, "uuid": "08c2a6f0-48c4-4e6b-a0ef-f1857c393128", "comment": "Malware payload (CoinMiner)", "value": "6b53a3d1fa3f9ed9038e6a4f9ceab6cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771764922, "uuid": "e72bc214-c392-489d-92bc-744aa556a4fc", "comment": "Malware payload (CoinMiner)", "value": "48c88582ea582d1a57a786a5d76ca82fe6ac03950f652e65f28926b3b03ed1d0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771764922, "uuid": "c446e988-64e7-4e79-990c-dc453727e0d3", "comment": "Malware payload (CoinMiner)", "value": "8994d7759d73a23e536cb7da754b476372093111", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771764922, "uuid": "dc1d0471-f04b-4be6-a7af-5ac55c4387f2", "comment": "Malware payload (CoinMiner)", "value": "835ec2cafcac73384b99a3f902f5d23ca8ae9259421fd75c87c85808d28d269edcd6bc259812e84061cbb5fe9ce5f11e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771764922, "uuid": "08fadaca-d2db-4962-beb4-2289fe4cf87a", "value": "T1BEE501DB4D8142F6C26CFA3409B377BD132F8A3C6BE35E8C969B7D598739A1D8642104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771764922, "uuid": "a54f6a5c-d547-4c81-a30b-42a00b08a9ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771764922, "uuid": "334fcc18-6bb6-4450-b38b-f462d9e83254", "value": "49152:SKEGJsuo/GsqsA68lPVTGJVeIzdVA8gmSSqqrQOJWrSGOstc8vh/UMjgkAsaB2Ld:SKEKsPGdlNqxhVA8gWqaVw/OkcEAZkZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771764922, "uuid": "99a92315-0233-40e5-9346-20b948c68f10", "value": 3070464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771764922, "uuid": "46a42754-8aa4-448e-825e-3cb42bc7c747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771764922, "uuid": "b0857e7e-20b1-4f6d-9757-77c8dce793ac", "value": "SecuriteInfo.com.Trojan.MulDropNET.78.13945.31627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f12896a-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752331, "uuid": "a86da790-bac1-4933-8421-c38be4a0ddf4", "comment": "Malware payload (Mirai)", "value": "c98668fe757560110cc639de8f5a3ef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752331, "uuid": "d0cb37a0-c154-482d-8ccd-3e1a9f4e9bf5", "comment": "Malware payload (Mirai)", "value": "497d644f6ba05a6b615ca439398d284372de4ec94f34ed3f5ae70833cfa1d602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752331, "uuid": "7f42fb61-3fe5-4d5f-bb7b-43349da39e0a", "comment": "Malware payload (Mirai)", "value": "f441b0ac433f665e40813cabb295fe028843f624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752331, "uuid": "82fc552f-0805-404d-bba6-9036cf80460a", "comment": "Malware payload (Mirai)", "value": "22247ffbb6947c67b16a706b65db9434363e9c47f411ab7dafd7401f22e118e3b6393f372fdcacdb86f533e68150d772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752331, "uuid": "93e3ba01-f311-4c15-b5e1-7624a32905fc", "value": "T197431A52BC9245BAC5C057FABB1A978A33A323B9C2EF7353CD080B52668A50F4D77D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752331, "uuid": "9a81fd7a-c2a8-4031-8d3d-8aba75e014a0", "value": "768:o5YLUGrITsnbHMgTDkLAc+S0lm5em4jzuvQyeCwVBM5zFmx0nKz:o5YLvITsbHTcLAjS+m5etjzuvQ9OAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752331, "uuid": "7726548b-f845-4c04-97bf-459d1d2419a5", "value": 60376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752331, "uuid": "63d3d6f4-0ef9-4c5d-823c-2bf1524e9558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752331, "uuid": "4fdfd313-e355-47fc-9c56-30d6480a0f26", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867fa1d4-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750223, "uuid": "d951a07c-59e0-4c35-903a-6b5d1f5e8237", "comment": "Malware payload (Mirai)", "value": "fc453bc95d34da863f4c3d1cbec45df7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750223, "uuid": "e1141f0d-e5aa-4923-aa52-b56be4b00046", "comment": "Malware payload (Mirai)", "value": "49c9a1b4a3f7f5b5badaccf2e837e90c9067b207a5d5ff941f1383a2ee70ccdf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750223, "uuid": "318b53ce-94c0-4314-a0bd-ce9c9169f890", "comment": "Malware payload (Mirai)", "value": "c21182c2c66d51ad0e59d5ba159b35c186293027", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750223, "uuid": "05ba1605-868d-42af-8d86-6aefa598b548", "comment": "Malware payload (Mirai)", "value": "52712132a9ba2b03b5587cb631e76e762e26dfb36412e6066fba23642c91a2278fd0050c5a00b82c1c6bf05a510f9b95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750223, "uuid": "2857547b-9d70-4710-92dc-4ee41ea6bf1b", "value": "T114417F8EB17082C1868CCF4B71F449C67705A693F1F46A72ECC12D7A8899E48356DEB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750223, "uuid": "b366687d-9bd7-452c-b974-fbb53ba8d85c", "value": "24:fzDdl3Cw14HCnvBM/hb1m1bEZ1O2wOxx6fnZOo7PCgK+CZJwCR42C5HZ:ff3Cw14HCSBVZXMZOo7PCyCMCfCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750223, "uuid": "fd5c5c6c-611a-420e-ae4b-261c23f6513e", "value": 1887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750223, "uuid": "a77b3a98-d0bf-493a-b383-a5bd28a57d0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750223, "uuid": "dbc65e39-1c45-4480-a9fc-3ee48f2db6d6", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd3ce1d-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752332, "uuid": "f04c8b84-53b9-462b-a951-7cc91f380531", "comment": "Malware payload (Mirai)", "value": "06a07c35c745b2451938854c7d981600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752332, "uuid": "cf812477-f165-48f7-86d3-991b0269078a", "comment": "Malware payload (Mirai)", "value": "4a17e8294fa712ec340ce76ef5a53610cb67d12539cdb831c36b12c6f0638dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752332, "uuid": "77d72a1e-4391-46c8-8a77-794b4fff9e2a", "comment": "Malware payload (Mirai)", "value": "f2f0e7708aa01df80299344ce3764bec222184e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752332, "uuid": "3f3e2145-5144-4b02-92f3-0cced8545877", "comment": "Malware payload (Mirai)", "value": "7c8055de2578da5db433fdad70bc163bc429542759f1377b5ddae3af322d01384722f4569200b7d54d8cd2ddf9e2c046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752332, "uuid": "83be4106-6ca7-4d4e-977f-8b9cc9eab248", "value": "T1195302055A01D207ED96B2F36D3E5BA8933951852B3D8D01EE94B3F6C9718848AAD84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752332, "uuid": "d4052230-10f8-4f6d-9a10-db5c44ce60c6", "value": "1536:/SjaNcPNc1jOBG7Sp4wtLvYyyxQ8+/owJBg5G5PI6P2WAQJ:K7cJOISp4qAxi/owJBqIuRQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752332, "uuid": "3230d3d7-10f5-47bf-ab2c-86b3ad803182", "value": 65004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752332, "uuid": "ab96ded1-bcb3-493b-b42b-b3ff762f49ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752332, "uuid": "62aa3df7-fa20-436f-8d7d-de52056fbd39", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ee657b-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766296, "uuid": "a8e6eb98-b747-4e22-ad91-8c2d13e3e181", "comment": "Malware payload", "value": "b14917decb17129a4199c5f53b4c4832", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766296, "uuid": "546c81b4-9016-4167-9cd8-5716f340bb76", "comment": "Malware payload", "value": "4a1da07c178dc4c78e26ebfd1f0fb4a427a67370bf7af5c9ce349196f9478882", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766296, "uuid": "26f2e6bf-435c-47ea-bfe7-88fa18e5f66e", "comment": "Malware payload", "value": "c5bc6d97950b72aeb4ece2d60b2292b6dc01d427", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766296, "uuid": "e24df5a1-944a-489c-8181-afd83d24458c", "comment": "Malware payload", "value": "e83d34930f5698788a6bfa1e63f9dd691a4311a2fa51d742b3cf40d0c418c312298038ed1f37983fe3fee15b6b069fa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766296, "uuid": "dcd91c28-fd9e-4d86-8ebf-334329da86c8", "value": "T1C232697720F08B329BD021C8A27716655FB2E60B456714B8F4BE1B399F5DA0374EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766296, "uuid": "a5903f71-40b0-4d30-b3cb-2b384c92ac8a", "value": "96:cCu/mB657sht+O+v1fsn+h4+tIicqbA/GsGuTMkCxZIokpIZsMK2vJrpRpcpnX+:cCu/K65C4hvZ5mzjdwkCxZICx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766296, "uuid": "75f79643-ac7b-456b-99d0-5e35317b235e", "value": 11804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766296, "uuid": "0ca99484-a485-4ca1-aed0-ad6c42c0a450", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766296, "uuid": "e588bed6-aa2a-4b2f-9ffb-310347ba0291", "value": "4a1da07c178dc4c78e26ebfd1f0fb4a427a67370bf7af5c9ce349196f9478882.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72647dd2-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770805, "uuid": "3139634f-6643-42a7-883e-9c5afa23ea10", "comment": "Malware payload (Mirai)", "value": "0573213c01f2c00ba43d9d4e726e71d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770805, "uuid": "7b8855b4-7800-46e4-af91-aa45195b3888", "comment": "Malware payload (Mirai)", "value": "4ba1c5da6b85167b1539b374379d8676fa1787fd332e0e6565fcbbb73189ab3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770805, "uuid": "ef47cf0d-9d90-4478-ac44-a3388dde388e", "comment": "Malware payload (Mirai)", "value": "f60d249c57a66182688484aab46ebad64dc32482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770805, "uuid": "92532e90-a378-4c8e-bd87-f6a477690cd1", "comment": "Malware payload (Mirai)", "value": "d586beab2a2edc4c359e589d7397e8f5e549dd502cb1e66e264c73a45336d48636f38bfb6434e1e3f70c41d18830e257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770805, "uuid": "6dbf304b-881f-4da0-a1b9-80e1cb61de8e", "value": "T171333A42B22C4E4BF9E65EB0353F1FE083BFE95420F0B584694EEB458535E761086F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770805, "uuid": "4c865259-6d24-4442-9ef9-b3989993b87a", "value": "768:1iGBQ9j21i0M+KClRpqhGLka6NtybaEuVwk6l8jbo1OAMUF:P0j21i0Mp6kGIbyNuGlkAFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770805, "uuid": "4188754b-618b-41fd-87cd-9bcef80aa762", "value": 50588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770805, "uuid": "2ec12051-2da5-4a08-8b66-85e041690b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770805, "uuid": "2d13b2bd-de39-4f95-b287-def69a788887", "value": "3atoNational.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0b45e7-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779386, "uuid": "ba2abfad-784f-47f1-8cee-7ec95ed5a3bc", "comment": "Malware payload (Mirai)", "value": "f308cd2b8a452c79a3641e35ff885899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779386, "uuid": "541885e3-cdf4-44db-bfa0-4892e8c0c70b", "comment": "Malware payload (Mirai)", "value": "4c62e26f9707f5a0657a9dab13c4dc4a6291f23498bcce11a23440294f320665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779386, "uuid": "ebc33ff9-153e-471e-a98d-6510b8844fd5", "comment": "Malware payload (Mirai)", "value": "0e75a1f36c80d82a02bea21dae0d0b698047dea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779386, "uuid": "34d718f0-1ce0-4e01-a4de-c04271b7fd6d", "comment": "Malware payload (Mirai)", "value": "934afca3fd56ff4c011d9cdb5f434b99c752d8249d09a48f353057b672519325e6fcd63a654ddee6ba7214ed3205badd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779386, "uuid": "1fb287fc-f5b8-4275-97c7-b6f369ba3802", "value": "T1DF538D75D11DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779386, "uuid": "0134fed7-dedf-4143-a87a-c7a9a7f11ad7", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779386, "uuid": "37866d43-9357-450f-a6b2-ed6dfc15c7f9", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779386, "uuid": "4e7bb06c-ed63-4167-ae29-c52fb860342b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779386, "uuid": "74c00bea-3c78-4efe-bc0e-1213dd96984a", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d7923c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766326, "uuid": "b6bc4bfd-42c5-4611-981a-98324b9da8cf", "comment": "Malware payload", "value": "99c13ec1374a93f8045635bd8a247203", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766326, "uuid": "43bec84c-40d0-4825-8c45-3fd4dc354497", "comment": "Malware payload", "value": "4c7e928c6b433f2ad7adf7c94c164be2ce2947aa8375fca3fb5be8b2d1e35adf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766326, "uuid": "4075725b-9c71-4576-ad7c-5ab82e100cfa", "comment": "Malware payload", "value": "09def98546685602579ab632bad8a747cc30b630", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766326, "uuid": "bf0299ab-52f4-48ee-af83-355a4ec7e7be", "comment": "Malware payload", "value": "8b96cd82a2f40b25376ccc8da2963043ff3950cda6f46ab803579cd4a9b089e58ce269f26ab8eeeec12cd35492d66617", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766326, "uuid": "9afea6bf-1741-4b9a-ac88-a38ff4c112b7", "value": "T1465126B430F14C732E256580F37727A56B73A85305A3728C34DD1E396F8AB02A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766326, "uuid": "0da7a59c-d817-4347-ad57-ed5229145e63", "value": "48:cniRxu60DkLlwnIwG9lryrIpklrAZF/7lwnGCmp7lwnIOR6Llrb:cWu54K7GKYhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766326, "uuid": "79ee6ce0-1f9f-450d-a39f-2efaf571b5c8", "value": 2487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766326, "uuid": "20f9bfa1-cedf-4fc9-b73b-5233b0d8540b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766326, "uuid": "38618394-6c0c-4286-94c0-aa837e4aaae9", "value": "4c7e928c6b433f2ad7adf7c94c164be2ce2947aa8375fca3fb5be8b2d1e35adf.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5967127-1040-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771800526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800526, "uuid": "49793215-20aa-43c3-ae07-767a4f1b65f7", "comment": "Malware payload", "value": "f7204cbcc00c7f0570fcd7104f94fc02", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800526, "uuid": "f8ea4948-8839-4086-82bc-c4f840105efa", "comment": "Malware payload", "value": "4c8f61045b74fcdaeb215a550b87ab621b02a1177c615c5c337abe740d3850eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800526, "uuid": "6658e1d9-b8a1-48f2-b81d-3defe1833ab0", "comment": "Malware payload", "value": "4fc5bf61501dcaa51469febfb8c1d7e4a86cc3ea", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800526, "uuid": "a4055135-94ca-4a5c-889a-7560a41155fd", "comment": "Malware payload", "value": "71f6f85fd08350901789796095295400d86f136b8d9b36e44254701e71f5ea200c09a24474b8cc0c82e7bdbaa4db1639", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800526, "uuid": "09c79cbe-1284-492a-b85a-016624546f51", "value": "T1D26633CB7884832FC07196331E3D705A98052B57D06CBA6D2ECEB71BA81D1527EFD6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800526, "uuid": "29550dbe-471f-4718-8361-0648220ae77a", "value": "45f0b404d197612cc9f21f62dfcd882b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800526, "uuid": "a544b96c-cfb9-4448-b25d-27c844eb137e", "value": "196608:YnCvajq3SBalpj5WeADaX6qx3B5RstuJlKRqa:ijq3SBsMaXTx3BUkTZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800526, "uuid": "3a6909d9-b383-4f24-94a4-42e344295ff5", "value": 6803987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800526, "uuid": "db4e5903-2d15-42e9-9a7d-031beaf4c4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800526, "uuid": "67e4c7df-df7c-46fa-bb52-a0dd9af55d22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc851d0-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752950, "uuid": "55593113-b172-4d49-94c1-0aa35059967e", "comment": "Malware payload (Mirai)", "value": "e811a3566e2458375b721c5489168af5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752950, "uuid": "e017f1a0-dbf3-40bf-93e7-b2c82cf528b4", "comment": "Malware payload (Mirai)", "value": "4d954c25e320adeb7b44a2dfc6bf5c6936e83c8ceb2f14142fb8914edf672993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752950, "uuid": "a4988108-e608-42cc-bcba-3079a7a00897", "comment": "Malware payload (Mirai)", "value": "6bff55123ec550d1bb0e143093fb9e5d833d06c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752950, "uuid": "d1cc0216-6761-4f9b-90f7-894896a4bbe3", "comment": "Malware payload (Mirai)", "value": "8596cd488956e833d9599d8486b46b66fa706a0f0fcf8163747d419cf290493106f4251f51303da271930efd2107059b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752950, "uuid": "7bcd1f1d-3710-4d44-881f-68cd43b1a5af", "value": "T1BA430855F8818B22C5D41279F92D118E332367F8E3DFB2139E112B247B8696B0D37D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752950, "uuid": "460dbd0a-64ad-4132-b320-907aead3b4a3", "value": "1536:lJn4GSFuo4oaWPpw3d182XkUlV3kzMIyin2qwdLf:nSco4oVP4LW2qwdLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752950, "uuid": "89c98d11-61ee-41bb-a483-688bd1d0223f", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752950, "uuid": "bc2c81f7-05e2-4dc8-9757-78be74abf3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752950, "uuid": "fdc29901-bfb2-4e4f-9f7b-b873bf06b6d9", "value": "bin.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9f66e3-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776839, "uuid": "2b3b4b6a-37ee-488a-93a7-6d063593fa29", "comment": "Malware payload", "value": "ad2757938222d320d532bf75cf223d45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776839, "uuid": "80b49604-04c1-400e-856a-861570a127e4", "comment": "Malware payload", "value": "4d9a4332274f1433368583bb0890fe2ac52c2b30b55bf3bac336091cf12e4a0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776839, "uuid": "f94a61ec-7b14-4493-9cb5-ddabeab58e71", "comment": "Malware payload", "value": "58087d6c9fffed18076260291988526c8b3fa255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776839, "uuid": "6c45b41f-bd3e-4759-bbff-bffa7ca3765b", "comment": "Malware payload", "value": "481d11577097a7594d0fa89b0225d4d5ba233831376730ff2c0cf77ba93cd679adf4ccd42d4aeaa6877ee4ce7fae18b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776839, "uuid": "7b52e698-ad42-49d5-bf22-3ff48be05569", "value": "T13004E045BEA10FDBC05FDD744A6F031B55EC86ED86E2A33A21BCC898B1D921646E7D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776839, "uuid": "ddb19be3-d6b8-4a76-80af-0aff11b48e54", "value": "3072:oDTIzc663gm1A4DnAxGyjmPfsqKzobbNI6tHDgxDBLwCJg+RjD:rzR63rCWAxGy+EcJcx1LtJgwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776839, "uuid": "03dae43d-730d-49b4-a080-c1fd2cdd6d99", "value": 180215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776839, "uuid": "c78b1e34-37f1-42a5-8fb7-b87097a07d27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776839, "uuid": "3bdfd53e-85a0-411d-9950-eaff4fbae78f", "value": "y2aplewk0h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9057e5ce-101a-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1771784170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784170, "uuid": "c8d04594-c5cd-4f6f-ac00-86cb505b9a31", "comment": "Malware payload (Meterpreter)", "value": "5ad25e17489ec64e9757480d78b9ea87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784170, "uuid": "1920f6a6-843b-4b0c-911b-ccf50c253372", "comment": "Malware payload (Meterpreter)", "value": "4da6fe90bd0c2ba8f7bf419991cc1f86762c9a23fb9bc24f581b9d8050320a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784170, "uuid": "7bd5f64a-3498-4bfb-8a10-d76e5b9a9034", "comment": "Malware payload (Meterpreter)", "value": "638ce7730211163c47571eea0827c4c87489c05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784170, "uuid": "7c61020b-5947-4edb-9152-90be7223f29e", "comment": "Malware payload (Meterpreter)", "value": "b2db2455e5c86baec00ffae693a9a88ec706ba5e298f2e19c7f9b07312d563a06c74e92480343dbf6cf81c156a1fc030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784170, "uuid": "03094371-e6cf-4dcf-b481-bc2ca85c8c0e", "value": "T1B9F132D6731128A7FA3C1BBF8283DAA766FD7A3072B7075A065400196681D7A7521B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784170, "uuid": "2d972b46-0eac-43a2-87c9-bc1fcd7a6719", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784170, "uuid": "f3127ac5-c492-4bc2-bd0a-7a795811c5a7", "value": "24:eFGSGCfpFKknehtht6dp5raKq9K9qXeNDJSqUmZEWdXCI2vp:iGCfvnehthEdTE95SDoqUjWZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784170, "uuid": "b83d8843-a2ad-4f87-adda-dd9cb99f46b8", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784170, "uuid": "7cff2a4c-ed2a-4a3e-81eb-d325bc407138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784170, "uuid": "c670e305-ab87-4747-ad4e-1e3f1bed452d", "value": "rev64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efea4d86-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752547, "uuid": "6ba31a09-3844-43d3-8e01-f3c61ee7e352", "comment": "Malware payload (Mirai)", "value": "c445e995e4ccb76cab565f6985da305f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752547, "uuid": "265cea40-100d-4888-a869-899d7c157ab0", "comment": "Malware payload (Mirai)", "value": "4dfcab8636c6c466f65a9db27b48c5e68d85619cd9fcdbfc34ffff0c1e9e1de9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752547, "uuid": "dc9c3951-45ad-468b-88f5-ee66514be6df", "comment": "Malware payload (Mirai)", "value": "78af790b220213f6f54c031f4737517f01a70fd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752547, "uuid": "e231d9ea-7343-4dbc-91d7-3bb8de0cfc97", "comment": "Malware payload (Mirai)", "value": "328745e91fd4d27487d76e8a878ccb28f8c721d69ed68055163784d8dfa2e962fe450bb669be07a1222dd2296600b42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752547, "uuid": "ab66c2d5-cfcf-459c-a6a7-0ab4a0d64551", "value": "T161148160FA0663B1CC730A38A7992E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752547, "uuid": "aa59bede-d4fe-464d-8a85-644a368223ec", "value": "3072:bY2SDxkrWstW9w3ioqMwnKrp7xLsvKm/l4l7t/UKd:bVw9YiPMLLsymQ2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752547, "uuid": "61de23f4-c043-4d45-a0f8-c3ee15591941", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752547, "uuid": "f3348cf8-268e-4121-a350-5ec1d9e64f49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752547, "uuid": "7ecd171e-f23c-4908-91e0-e73b231d1909", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f78727-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771804, "uuid": "256ef6b6-f1f3-40af-a303-f0f21dcc9c48", "comment": "Malware payload (Mirai)", "value": "a3cb2fa1461ef604099a184a971016b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771804, "uuid": "16fd91a3-21de-4519-92e1-478eff3ad317", "comment": "Malware payload (Mirai)", "value": "4e2a2a63f6d4206ea52688df473548e19b360ce9170a7aabea227a2a5d05d0f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771804, "uuid": "19e3d4b3-025c-4410-8c8a-95d872cab6b7", "comment": "Malware payload (Mirai)", "value": "73de68ab5674d3aeb084d09835967766075e06a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771804, "uuid": "e8aaa50c-97c1-4fd4-bea9-7fef3c3225e5", "comment": "Malware payload (Mirai)", "value": "4fbfb0efd5e0bf06290ecdb37aa21fcb24b999a1291e5afd1cd163a6b167a8ee6782417edeb05a73ede4f8432bebbb8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771804, "uuid": "7bca34e7-c42a-433d-be2d-236efbc00cb3", "value": "T16B03F111E381DC7CABB38D76DAAD0883D3DA6D3846F27577B902D054B680D0915FB2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771804, "uuid": "9dfe3f38-7502-4e54-8217-af2c07b5c2ab", "value": "768:+BQJo1T/oM6u+j8mjfA/lvywafEzTDpxKc7VPbKzhKND0s3Uozw8:+BCop/9TpmjrwaczTD7dp+EFRzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771804, "uuid": "4d498419-53ae-4fc3-af77-5a0fa016b199", "value": 40952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771804, "uuid": "c61257e1-4b19-4bc5-8fc9-04c6b11718a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771804, "uuid": "8577576d-1526-47e5-9fd5-c8955fb369a5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c452f91e-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771802, "uuid": "70973d71-39d9-4329-a040-fec9dc85a248", "comment": "Malware payload (Mirai)", "value": "ac275ed37855fe9914ee95a0a614a8ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771802, "uuid": "93370dad-3569-411a-b100-12dd4df5cc7e", "comment": "Malware payload (Mirai)", "value": "4e3cb6b19d5f76b471042b5647355e0ab7391a8bf11e8f1282f43f9e09ffb9db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771802, "uuid": "941c58e4-51d1-4c79-94b0-2a64192c7d1a", "comment": "Malware payload (Mirai)", "value": "1da4534781f8ec7694169c24c4628db0269d7b01", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771802, "uuid": "901caa66-a27d-4956-ad72-77c808b163cb", "comment": "Malware payload (Mirai)", "value": "25647960d3ad41cac406bf3f67a7cd142d106b2adaa935f243800e6800f50a48928e79376d401f3ee66ece6cc229afce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771802, "uuid": "2cfd7b53-5b23-42a9-bdf2-36920b49d315", "value": "T1940184CE216556372B6D4E94BAAEA2485980DAD236740D24DA7408B36CD4302779CF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771802, "uuid": "bd786ebb-ff18-4f9f-851b-7c57832770f6", "value": "24:3J3n2snW20H2TNIfK2zKlF2FtBs2Xh2Ve2h2gV2Zs2C2Sn:MCB0WklzUIlbXE/EgYZbdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771802, "uuid": "e453393f-b352-4f62-ab1e-9d6b1307c41d", "value": 788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771802, "uuid": "9c6a44db-07f9-4a26-963d-e3bf1f87c43b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771802, "uuid": "5000cbe2-db51-40f0-8412-fa775e6ffef1", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc83938-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766476, "uuid": "986ea37d-e1e0-4e60-9c78-714dd3150148", "comment": "Malware payload", "value": "dee6044dd453a324d99c0783ed586c5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766476, "uuid": "06d39f05-5763-4028-87f7-bc369f13c271", "comment": "Malware payload", "value": "4e5a6aefaeaef421c8375bec8e6a5aba73173d8bbc94896f67e44a24c669a9b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766476, "uuid": "a9ec3572-145d-452c-8b8f-d3423504f8fe", "comment": "Malware payload", "value": "88c946a650748c677c40fc378f82e3a19800e26a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766476, "uuid": "5c06d7a1-55b5-4822-8e9f-2b319b2ef834", "comment": "Malware payload", "value": "42cf25fd9de804cef6ba7a92571308121dfcb6a5b53b8717487c628c7e685c00b2891fd52b29eb46df70f70159558e1e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766476, "uuid": "e6f13b04-5191-44df-8285-93b799e7a414", "value": "T1E051E7B124F2483326209540B3371F96DF72DDE39CD37E88B45D1B372BA5612A26BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766476, "uuid": "0da22b33-6080-4480-a7b3-3df027554707", "value": "48:chRu9RUhPB6gjC764l4Ui4n4U34f7V4Ui4n4UNpZnjsrQnjw7lpmXRe7w474w4hU:cLuQFB6d64l474n4U34jV474n4UDZnjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766476, "uuid": "c3c3f0f7-6800-4448-a5a0-7969e9251496", "value": 3067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766476, "uuid": "9310becb-750f-47cc-ae4f-920969db42c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766476, "uuid": "19288d16-8d57-4c50-8efb-276514aa8ec3", "value": "4e5a6aefaeaef421c8375bec8e6a5aba73173d8bbc94896f67e44a24c669a9b1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444294b9-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769010, "uuid": "9ea42348-61de-400e-b078-a302f1c0d56d", "comment": "Malware payload (Mirai)", "value": "0f1e03e2963d142ff31bced7d7cc2d70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769010, "uuid": "33f304cf-b96b-4f7b-9555-846369244175", "comment": "Malware payload (Mirai)", "value": "4e7b07a8922b54cdc13f78a0234bf1766a549519429427600c5e6d79ba834fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769010, "uuid": "ef093dfd-34e6-404f-a62d-dfd9f5c19a65", "comment": "Malware payload (Mirai)", "value": "c06d58949e316a60d42e43b042b8412e1bc5e62d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769010, "uuid": "820b6022-cbbf-475f-b53f-1c3d7257a68f", "comment": "Malware payload (Mirai)", "value": "ae86a9e934ca4e062da29dbc8e2aef7e2f89a8f5100ab03d6b4f6650533ea6370e607dbde2e774a3cd63eb584b39cc46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769010, "uuid": "4f09df66-9aa7-46ab-9ede-323e4fc22c4b", "value": "T11B733BDAF801CD6DF80F9A7A54570E09B530A3E54AC30F36626BFD63AD721961D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769010, "uuid": "f44caefb-7878-4912-b38f-76569d43f3b6", "value": "1536:EJoB4ziBqQ4mJ6kXYKwqVh52BKNcF8ryBOdcx7gvxdwRkMteUxyaL:EJrzs52BKNc4yBOdc2vXktyaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769010, "uuid": "10bde9d4-276b-482c-8388-b1b3a126fe0e", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769010, "uuid": "9e4da659-fc6d-4c4f-b4fe-101e92d36b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769010, "uuid": "7ea08a39-dc28-4152-b304-b93dd9382233", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e545b3-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790569, "uuid": "babdba3d-9352-483f-b076-0e5b440137fe", "comment": "Malware payload (Mirai)", "value": "b8f4a7bf7116283c7cdc56b1279802b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790569, "uuid": "69106c68-ac9c-40ea-841d-4aa0ac954325", "comment": "Malware payload (Mirai)", "value": "4f09778d5ff6e8031c146406798e97aaeb64de204ed62709ebfe2302eaaa672b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790569, "uuid": "186e9308-afc1-4a10-937b-b0250b29cbc5", "comment": "Malware payload (Mirai)", "value": "b758ea829f0e0cb87a89e1bebc22f8a118236b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790569, "uuid": "b5d56643-463c-412e-912e-e355c0208279", "comment": "Malware payload (Mirai)", "value": "5402121dbfdc1a6a178d564f82ad419763eaffff388732e01d2e2b6802dda17ec3f51cf2b3fab5a3d0762a396b317351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790569, "uuid": "909aa32e-d127-4437-923f-17fb63fc5edd", "value": "T11A435C12D5BC1A2BD5D0A23702B38363E1F61B968194E68FBD624D0FAF553901A7B7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790569, "uuid": "58713a2a-5b37-40b9-9dbe-405ed76d2de6", "value": "768:sSsglFVpVohL7NcJJocescWnaK+seFVxzLgf57eGFcjuyz8q/gbzVWRMIZR5TD:fffVwLJcgsTnaK+sqS7eGClz8qYb4/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790569, "uuid": "1bef4619-4820-429a-9d8e-6d5f2951f4eb", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790569, "uuid": "d79458ba-3641-4cec-a9a1-60e678ce7bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790569, "uuid": "92e7de52-236f-4a0d-924d-3014e452efc5", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51861151-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800385, "uuid": "eb06b8a1-3bb4-4186-84e0-5cfd91e5aa55", "comment": "Malware payload (AsyncRAT)", "value": "53f2ad2687933ba9e896164c1e3e4b1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800385, "uuid": "01329016-3df4-44c0-8ec5-a482ad98dede", "comment": "Malware payload (AsyncRAT)", "value": "4f9fba3245a5f5010e16f258295bbcc207cf698c2a4dee3a40b810d866e1ca88", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800385, "uuid": "01fe307e-3f1d-4f27-8fe5-692182bd0d9c", "comment": "Malware payload (AsyncRAT)", "value": "53dfe73a5a332d1bab51c9538f4efa09365a55fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800385, "uuid": "8df2e5f9-a2b9-41ad-8750-33fd300ee2da", "comment": "Malware payload (AsyncRAT)", "value": "4953ae28dc811d8d26d6c660f2b99a6147fb9261f354ef2805e84ef498c4fe2d3e46dd431af98075841e842b8f00282a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800385, "uuid": "9a28c80b-7405-402a-9c0b-4d5aa9983767", "value": "T13D232A143BED5216E2FE8F7959F11545C6BAF6232602E74E1CC002CE4B23BC69A527F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800385, "uuid": "e592f435-f182-47eb-9a25-1fc6d6f55dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800385, "uuid": "aa36e775-38d6-4258-a893-dea8bac90e5b", "value": "768:dseYxf9w6PcveR32fCvz6A5RyIvrYoAeb1xgUptg/rAK8RccSrWBNeJn:cPcA2fezNRb0oxbQU3GrvYcl2On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800385, "uuid": "13179205-8ac0-46d4-9b66-01231e31ac07", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800385, "uuid": "d9d0ef7a-acb0-4563-834a-615a554a2ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800385, "uuid": "fdac410a-4741-4b5c-a752-7c843c0459c9", "value": "y2zb77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b922d-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750293, "uuid": "0e55d931-6919-43c3-aca5-d794fbfc8e7f", "comment": "Malware payload (Mirai)", "value": "05d802743047f1bd7771a4dce73eeb70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750293, "uuid": "428d3307-fbc9-4ca5-8202-04585599be67", "comment": "Malware payload (Mirai)", "value": "504b10cb02d1ca93f1ed87aa310f23aa6947a1912c746db53a5287a41b745ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750293, "uuid": "c3c83bd6-2ced-4e7d-99c3-cf219f97c037", "comment": "Malware payload (Mirai)", "value": "5e3e9ec7b67c1eabbe1ecb7af2a66372196e2dfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750293, "uuid": "b4509533-8a2b-4adc-bbe0-894637bab06a", "comment": "Malware payload (Mirai)", "value": "ea34ef97100e66ef5080bbe8747d3b7dca44a7858adc14df8fb27d4950ae39fc4702b5daf6570c4a8f3e6862a9153b8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750293, "uuid": "d4908f14-d0be-4dca-ab0e-1f53875662ea", "value": "T16614C70A9F510EFBD8BFDE3342E9070235CC650722A97B363674D924F64A94B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750293, "uuid": "ac0dccdf-0a9e-46dc-ac9b-88abba60f1e2", "value": "1536:yFtMxWIoQqOWMDxRMqXRpvj5WmYgWGOJeYH+n9riu+VfojECb1qRZ1qzYz0II1z3:Zq4hpI7Kuf4bU9wFeXh/zV2Av86MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750293, "uuid": "7235e87f-c032-464a-8b01-2acf504f82ee", "value": 206360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750293, "uuid": "c4ddfab5-9a1a-4004-b376-8d14caaa9b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750293, "uuid": "c25750ea-1f80-465c-b43b-9d1a29bf102c", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08329d07-0fef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771765473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765473, "uuid": "57befb6e-66eb-4aea-93a6-295a98aea3a1", "comment": "Malware payload (Mirai)", "value": "532e35617afd6ef3963bc3b0ef5ee685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765473, "uuid": "c034e755-750a-48c5-a9c3-b869290f9207", "comment": "Malware payload (Mirai)", "value": "508a75af865f1a2f7c890009f33390fb149eccbcf4073b0280f17d8990522d1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765473, "uuid": "e360094e-f8e7-49b4-8111-d7049e84d11c", "comment": "Malware payload (Mirai)", "value": "ec82f6fb36ff923500397635ac597c80c3c38191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765473, "uuid": "620af2a2-5638-478a-964c-d0ad1b42c8f5", "comment": "Malware payload (Mirai)", "value": "ee34176bc13e2688d8a91c023692b569d044b1a042c7e679f7aa13656ea8d2986a775426dfea16e1e30713f22f5fa1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765473, "uuid": "b871835b-5dfb-4c65-8e6a-00301da8824f", "value": "T10804D816AB550FFBDCABDD3706E9070139CCA51B22A43B363674D528F54E50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765473, "uuid": "e36527e7-0738-4ae1-a02e-7d977a217766", "value": "1536:Yzeia+IuUF3gPS0QCQO6oYJQqczaN7RtJaF64iiTU58NaZ0zk/SQ1pMnEySHtKeq:MeiaxkP1KnQ64hTRaO8pM3SS1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765473, "uuid": "ad5da618-9f39-490b-b46a-0833d74f054c", "value": 181860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765473, "uuid": "38ea40ae-aff4-4a89-9283-14a83837f791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765473, "uuid": "653d505b-635d-4c20-b89e-9f5008889234", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f713a4-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788144, "uuid": "5b5032b5-9d61-4c6b-8a25-83c33f96eefc", "comment": "Malware payload (Mirai)", "value": "da47a40978799e535bf49f3e81b428ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788144, "uuid": "63b23a2f-8196-4480-8bc8-6dd68954cab5", "comment": "Malware payload (Mirai)", "value": "50c75a14fa8287c23bbe1d5449099c705ff5c6a04bef031e9117aa43d6317f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788144, "uuid": "87fa7801-73df-4594-b58f-23a2271a47cc", "comment": "Malware payload (Mirai)", "value": "1aa96d1c92f9626a313d2b9eca0726f36efce384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788144, "uuid": "b371db5d-91e7-42aa-b025-d7978507c4f4", "comment": "Malware payload (Mirai)", "value": "7ff47642362cd717a4f91fa8adeca6cc828e5e2822a7d520f70b4d80046c0cda42f00bd5dcecadf2ef9eec9942b5592c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788144, "uuid": "f1375b78-be9c-40c0-83f3-1e9ec541c6c6", "value": "T13604392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788144, "uuid": "b4b33e61-47e7-429c-b8e4-5563f7ebc3d2", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wVUXS:7eJpJUVD1A8n0YNgEJi5aWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788144, "uuid": "9e950740-0de1-45fc-8298-10466324078b", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788144, "uuid": "768a5b9d-ae34-445b-9a6f-5845927ef60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788144, "uuid": "8e441b57-9f1b-423f-999f-dbbbd42ae4f2", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2da576c-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788147, "uuid": "6b43b9e3-bebc-4ad5-89ae-74781c3f87ec", "comment": "Malware payload (Mirai)", "value": "3df6d490fa569271aae0a4f19dcc9458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788147, "uuid": "f6c318c1-a7c0-4f30-a6c2-0dc60ea42181", "comment": "Malware payload (Mirai)", "value": "50d45db9495ef203dcaabdfb29f345c5b1e426a4101974230efa347869c98300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788147, "uuid": "955dea26-5817-4ef6-ac70-f504fb1d7a29", "comment": "Malware payload (Mirai)", "value": "3f09769196fecd2c2b7264ecd68900c2b3571f8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788147, "uuid": "fc1c3a15-bba1-49c8-a401-26dbdd788875", "comment": "Malware payload (Mirai)", "value": "4fd34d7ed55d55143110b94ec4b71d5d0b5029cd2e0ae925c2a60ba3b044392c779f75e305b09b22fcfa83cb4f7bdfca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788147, "uuid": "4d4f5ddf-6ed5-4a56-841c-61ba2db806aa", "value": "T19A933991FD918652CAC516B7FB1E028D372327A8E2EE72039C255F2177CB91B0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788147, "uuid": "e919d575-b0e3-464f-a827-8decb773a0c2", "value": "1536:AgAHUxiJ1kg87czJh9OZlDgzpIWKi0FlhlU+OQdHgebIJf2vC1FA:hAHuiJCg8OEkzpIW30F97PtMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788147, "uuid": "1a2e505b-5f2d-4b1e-b432-69bd5ba7c063", "value": 96524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788147, "uuid": "4c612400-895b-4e50-92a7-0510a7d1bc1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788147, "uuid": "0043e06a-5669-4223-a0e9-41e64d023d14", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b04d4d0-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784080, "uuid": "8cd1c159-d765-4e0c-b2b0-d2db0ed9e08a", "comment": "Malware payload", "value": "bd0edb96fe6f64271fca11c33708efb3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784080, "uuid": "99de1c2a-1abd-48de-b780-f77dff1040ed", "comment": "Malware payload", "value": "513a2bbd8758003f748f097a852cbfdfba2b65191db3463cffd2663f13f6da68", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784080, "uuid": "245850b1-5e71-410f-b728-b26db7b0e362", "comment": "Malware payload", "value": "4e2456a14574c03a66b929874daad1a328a06f99", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784080, "uuid": "0f2591db-acaa-4ec5-907d-aaa2b5be8ec3", "comment": "Malware payload", "value": "88ba347e978f23ab14b0be879979526f9506712d971332c9ae2ab6c8e89eccc5c6b87ba7461dd0238d0e5890ba0e2a8c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784080, "uuid": "ed5f6fb2-f814-4732-b41d-af2adfd1162d", "value": "T18FF2E12ADBCEB520C347B77A20467DCDF9071E2BE1FEB2673AA995CC8D028514607647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784080, "uuid": "a40f9e94-df09-49e5-9d42-ce3b05fafbd2", "value": "768:UiQP+NAiJQucR7gWUU/t10BwOLVxN50Xti+e1o2H3CrpD:UZ+WqQuctgd6mBPLNSi+OXClD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784080, "uuid": "cc414b43-ac1a-46a1-a871-6f5ce21ea64c", "value": 34883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784080, "uuid": "261ac3f0-7eff-4895-a997-b4c1c05d5496", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784080, "uuid": "b26a2bb6-2dcb-4c83-9b07-d5a029aa3b88", "value": "cmd_patch.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d986b932-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778709, "uuid": "c9915729-8252-4c7e-a2e1-61d92dad6245", "comment": "Malware payload (Mirai)", "value": "00b7692ab17766379a188d17f33ad436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778709, "uuid": "506e2c89-0f98-471f-be6a-757967ea1a73", "comment": "Malware payload (Mirai)", "value": "51f175a2ed965117263fe20f538addaaeb7e24e396619f92c1a21fe6c7c9273c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778709, "uuid": "ae9c51b3-64db-4a7b-9d89-7b74e316e2ba", "comment": "Malware payload (Mirai)", "value": "3f20b7e298fa104f337b153082e5898fa4824300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778709, "uuid": "39be9c7f-dffd-46ef-a2a0-1fbbfeb170cb", "comment": "Malware payload (Mirai)", "value": "af4c2f68501d6c3e3fdb8a427b67f9c534d3dc154672fa1d80f7aaeacc2db578bd5095b1616d8bb826067d854151381c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778709, "uuid": "9b6a079c-b29d-4b58-b119-27e91215c90d", "value": "T11FE2E194E3820FAAFFFB8D66AC97E1D937F80E8B6191D75271448700B8E54A2BD456C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778709, "uuid": "ee41e7b5-820a-4493-98dc-4f8120a737de", "value": "768:GFpDiy7K0L5CCnrncTwzEf2EpPKXL2C/BU2KQ4034uVcqgw09Lc:G/BDLcCnzXM/pPKXL2CpBKm34u+qgw0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778709, "uuid": "b8ae8f6c-b1ec-4e62-900b-7b8e765c590d", "value": 33200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778709, "uuid": "3120e05f-973f-4be5-b0ee-0552dd748ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778709, "uuid": "da49db56-c0f2-406c-808c-356eca1e2929", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62c6f3a-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771885, "uuid": "0c80fb3c-6026-4416-bedd-7687af8f5ab9", "comment": "Malware payload (Mirai)", "value": "05a72af2aad05d839f3ebbbdafce8b52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771885, "uuid": "93b28788-6029-4468-90db-d71a49fec0be", "comment": "Malware payload (Mirai)", "value": "530946c3a3c64eb8f2481bbd6fd25506b164591b710044caeb5f404e5c2346c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771885, "uuid": "f82d5b52-913a-4a8a-887c-8ec5094228e7", "comment": "Malware payload (Mirai)", "value": "a87defa3c69b487b541b6da43768fd454a18d922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771885, "uuid": "dc6b27d3-2af1-41ec-83fd-1a634e3b22ff", "comment": "Malware payload (Mirai)", "value": "a85aa0424d4f32e5173ef722db40987c8865b1c44c3a9a318bb69665756804e9c76b47c32d061134da14252426eb06ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771885, "uuid": "1698fa5c-802b-44ca-a353-99e0a7c61444", "value": "T188C3F809EB610EFBE86FDC370ABD0B0525CC651712A87B7A7574D828F64A24B49F3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771885, "uuid": "529a8917-f1b2-4cc8-b296-6ca9583902d5", "value": "1536:ZuVukiJoTO8ePxR0hV3yDsewHm2a1un+pYwgFU5ZLE2l08qlO3YXHYdxRKDKRh:kVukiJoGR0+lSwgy5Gt2z1Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771885, "uuid": "30afe930-0480-4451-94df-3addd0b76f0e", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771885, "uuid": "e2a7e4f8-0072-473a-8c09-da605363070f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771885, "uuid": "45341bf2-fc95-450e-bcec-9f38754ad5bc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6125c770-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766481, "uuid": "1e273a0f-63ce-4c42-ac30-28bdc685cb2a", "comment": "Malware payload", "value": "4c111e704823ba728a862603753ea086", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766481, "uuid": "7aab7e59-301f-4086-8be8-97c56680be21", "comment": "Malware payload", "value": "5351cc2dbd747fe8d3c90831b482aec71b34ab51568f521283a557db171c3171", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766481, "uuid": "f7f2bd2b-8976-406c-a613-65ee31932618", "comment": "Malware payload", "value": "c27e35b6f6d7ccda4532b88a8fd2f6f82d4579de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766481, "uuid": "4ebf2653-28c9-4501-8dea-46450e17d9fb", "comment": "Malware payload", "value": "43ae63253d2b2732d608f006ada9c056484a15c3fd82c8a438d1b8e42f55e755babfa6a7aab3b88799155570699d8c3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766481, "uuid": "7a73ce2d-fb15-48af-a881-517faed19c7b", "value": "T1A2827B3721F08A33A69055C4B3772BA14F76961745A720B8F4FE1A265F5AB0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766481, "uuid": "0e96dbeb-50e8-4662-84d0-19326298f507", "value": "384:a4hvZ5m5FGGoKNphveadu+qu0ITSSGEuNKHIz9:aUiVN7A1EuNKHIz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766481, "uuid": "a164478e-20a7-4f39-9580-d53c79bc53db", "value": 18088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766481, "uuid": "75952eef-5f8f-4574-8277-034feccc168d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766481, "uuid": "a4f35f07-7948-4970-be16-64ec79cdfc04", "value": "5351cc2dbd747fe8d3c90831b482aec71b34ab51568f521283a557db171c3171.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1812a1ae-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766359, "uuid": "634430fd-fb9f-49ed-9128-8e8720e1892e", "comment": "Malware payload", "value": "0dde628cc484b0a9f8b789a528ad0cb9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766359, "uuid": "062e8d51-c818-4a7d-9561-9d1645a2a965", "comment": "Malware payload", "value": "53b4d193626c6274e78db55a71363076f60c41038fda3a512ed6ae0aabf41fa2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766359, "uuid": "3bc90d3e-c086-41d9-9004-88f69207df07", "comment": "Malware payload", "value": "5bd34b7b06ec7553aaf96c8d6087cb3ff1c0a8fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766359, "uuid": "36e27a9d-aa40-4fc1-9f02-b4a2550188d4", "comment": "Malware payload", "value": "1240a70be731f289c0d00806fbe9c32f92332ad9de3b3c226aca10eb4da76555cbcfaf94a32c2d2dd6e85e76ca8d6aa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766359, "uuid": "015404d0-542c-4852-a9da-4a5b8238fe9a", "value": "T1B65172F424F04C732A212984B3772B956BB3E95745D3568C38DF2D295F96B02B1EB812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766359, "uuid": "01155c0a-da1c-4e33-acf6-e934e36c2281", "value": "48:csRu9RXfYnB6gWSqylrh5Ilri5KlrE5Llrb:cCurKB6cqwSN2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766359, "uuid": "8de69ca4-b1b0-4435-b0d1-7b0faecf79df", "value": 2574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766359, "uuid": "171a8483-36bb-4423-ad92-c64a82d4ee9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766359, "uuid": "921a7595-0492-4d2f-b304-5a9a90a8d4e2", "value": "53b4d193626c6274e78db55a71363076f60c41038fda3a512ed6ae0aabf41fa2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3bb255-0ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767464, "uuid": "a3784f1a-dddb-4d55-be2a-c82932350b72", "comment": "Malware payload (Mirai)", "value": "17d2ba9ee354ee5ed50cd6bf46ffeeab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767464, "uuid": "07242148-e91c-4f90-9a63-4137f9a2c73b", "comment": "Malware payload (Mirai)", "value": "54a97094e905eff0a12835153f7737d6faa2249dd417dde5b44b5a29f74a2941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767464, "uuid": "e8765493-8502-4f42-8679-23bc610b7ce2", "comment": "Malware payload (Mirai)", "value": "7e88aedb47978548e707347c1bc087c20891095e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767464, "uuid": "7d043228-b4c1-4a93-82e4-63ae51c7218b", "comment": "Malware payload (Mirai)", "value": "1c27532633f4578b63c6e15573e7428f8a51e816c7d38d385c82bee480e09d1fbadd27aab8759e7a3f8d9872716083ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767464, "uuid": "d898eb99-3e36-441a-9ce5-4e891e3a3cce", "value": "T130934B92FD818652C6C122B6FB5F028D376713A8E2EE72039D256F2137CB95B0E77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767464, "uuid": "e22d8b4b-e2f2-4494-a141-d88294e92f2d", "value": "1536:eQJ3AQSlH9rAScPlycYEUmhcFfPmeueCRilvl71ClIgKzzoDFvXOx:eQ1AQmp4lqKEfPme9qkvlQCTzkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767464, "uuid": "a6737534-c84f-4d41-8acf-f0a03552b719", "value": 96044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767464, "uuid": "223c74b0-40d6-47db-a905-de4bbcbf45af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767464, "uuid": "f7809d28-1d83-43c1-a2e6-06c14686cef2", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc3234e-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766472, "uuid": "7f9fe4b5-fc5e-468d-8fea-45522896a822", "comment": "Malware payload", "value": "91ae420d9c38c978095df850b5ac2f89", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766472, "uuid": "15b3250f-67c9-47cd-ad90-e63ac4f8ae18", "comment": "Malware payload", "value": "54e1e7b06176be06634d027f921b3fa3a57281f5905a5346ad12cf0c336f2242", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766472, "uuid": "fcce600a-c3ec-4ff7-a3c6-98605660ba90", "comment": "Malware payload", "value": "43f2cc9d8c26ed8247051069592397cc4eebb1d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766472, "uuid": "a3ffb189-320d-4b60-9ee2-3f38079c7fe5", "comment": "Malware payload", "value": "889e46e903269ca99184ee1d8ec4354c48cee975170e7f8ffc9a837e13f538625ec9b073483b657a2d218421d8544ba4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766472, "uuid": "5fb82918-9c15-4b37-8cbf-d867c27ab5e5", "value": "T13C511A7024F10C732A256540B6772B95AFB3EA53496323CC39DE1E6A6FC7B03A59F412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766472, "uuid": "dc01eb9f-540c-49d4-8787-5282ed10aafa", "value": "48:csRu9RG6B6gId/iPdFHPwWYccrmZZcr8MHcrivdcrEincrb:cCuy6B6v5ioP5UXSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766472, "uuid": "4e980855-4801-4b04-907f-38ac8512e3d9", "value": 2781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766472, "uuid": "eb2a52e1-e98b-4857-979b-815098f0b8ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766472, "uuid": "e8421d11-7578-433e-9122-b07a511693b8", "value": "54e1e7b06176be06634d027f921b3fa3a57281f5905a5346ad12cf0c336f2242.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744a8ed-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752935, "uuid": "e229e852-7b9d-4bc3-ad4e-e6f2a1970ab5", "comment": "Malware payload (Mirai)", "value": "54e07389b807c402f8b78260dedff497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752935, "uuid": "9e82f566-bf42-4df0-b6be-810d6d484c31", "comment": "Malware payload (Mirai)", "value": "54e9324311ecb0a89df542294c835aec1be2b08facb250ecf13d5a65817c9cc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752935, "uuid": "df429781-48c5-40dd-b1bd-cc96c640e81b", "comment": "Malware payload (Mirai)", "value": "dd567d5e59dc7ac28ded3ff2f93913d4b848116c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752935, "uuid": "419e3f4c-fd97-4288-b053-29ea12c739fb", "comment": "Malware payload (Mirai)", "value": "50ab82d6cdf15638c3a9f9c2d5e44679457330b82b470eede369564db21affe2e911a919d081d41c7d0a8966c3e23805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752935, "uuid": "2483e8eb-3ec0-4319-a77b-598f04e6ecdc", "value": "T1E8932982BD4B80F6D8174870406BF33FCB32E13A4065D35EEF5A9E76DA736426616389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752935, "uuid": "e1e888c5-90c6-4abb-a464-24d24f1752c9", "value": "1536:SAPA+QluI9mtT8ilYddP512caDWNKCJWVmZBB0e0YwO:BA+QlP9mxplYddPzv0CJWVmZvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752935, "uuid": "2fbd4195-77b1-4574-b43c-e38336bc54f6", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752935, "uuid": "8e36bce4-8941-4982-8911-14d6af3c529d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752935, "uuid": "562fa173-37cb-4b4e-bcdd-83a41f7c15f0", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d3864-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779385, "uuid": "4ccfbcbd-8983-4526-91a9-cfb199b231ab", "comment": "Malware payload (Mirai)", "value": "ff3a7c3f6d071e852f4ae725e9e3c54a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779385, "uuid": "5f706ecb-0d7a-4c55-a32a-fecb075e18af", "comment": "Malware payload (Mirai)", "value": "5559e4dc9059e7a59ea60a9af6addd794ba141d468219eb2f4c5e8ef700cbeb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779385, "uuid": "3ede600b-6107-4e49-b880-55f49314ca28", "comment": "Malware payload (Mirai)", "value": "14c7b1566d6214aabe444cd3ebeac2dfa363ba2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779385, "uuid": "fa8d30ea-8109-4436-b222-ed190c5afe60", "comment": "Malware payload (Mirai)", "value": "db63ad0c5c3f61294d7cd8913c303c7b28fa38eb3bf144082545fbf0d7353578cf4f4fb76397a0c0111d932bc5364792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779385, "uuid": "722a6905-33ab-4bde-b4b9-46edde91ad0a", "value": "T1FF732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779385, "uuid": "688bd6dd-2d98-4326-b10d-daca95296eaf", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9W/:927jqCt8v3GI/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779385, "uuid": "adc03140-8051-4976-b7ec-ff5fc1232334", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779385, "uuid": "9281d1fc-68ba-42f4-b3b3-598ca5b88e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779385, "uuid": "5dd9987c-a835-448f-85ad-9ec99dc719fe", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e3c536-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784102, "uuid": "d2acebc2-eed1-4893-b64e-47fede9f38c8", "comment": "Malware payload", "value": "7d96341d1d91464b990e998cb0703cb0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784102, "uuid": "9dce6ca7-7719-4fc6-a14f-a17d9a9f34e8", "comment": "Malware payload", "value": "558bb6eb15dcac4cff35a953b35bd6b067df71db3d36c7b6f29f7f82fcd73fb8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784102, "uuid": "74a0f244-252d-464c-abc2-56216afa37e9", "comment": "Malware payload", "value": "d118786757b20d954511cb75569148efbcad5688", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784102, "uuid": "87018d92-4905-4eb9-86e0-a7e0db8941f6", "comment": "Malware payload", "value": "4837c50a8916aa9117cad4b8be362497aa2b244b8d4d82f9dd9d9d842c572291b1e6f014aaa2b48e095de77b43d5f58e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784102, "uuid": "37eabcd2-8626-40f0-a392-4e11ce9e0cf6", "value": "T1CAF2E129AACAF530C347B37A20465D8DF9075E1BD1EE726B3EA492CCCD0185D4607A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784102, "uuid": "272918ff-4b26-4aed-aa7d-4b221133b70b", "value": "768:K1QP+NAiJQucR7gWUU/+10ilOLB8Jtite1o2H3CrpU:KA+WqQuctgdxmiSiHitOXClU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784102, "uuid": "bfb21780-8f36-4112-af8a-6b4e312ba538", "value": 34620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784102, "uuid": "1be4b5ec-6be4-4622-be7d-97ea44ce835f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784102, "uuid": "fda5f85e-2496-4ed2-bda3-2697d7e917ab", "value": "go2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087716b6-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759460, "uuid": "0195f53b-1e1b-4250-b7f4-4cebb8df335c", "comment": "Malware payload (Kaiji)", "value": "e3773f2291cb42ff45896ad6c8fe16e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759460, "uuid": "067ad357-7bd4-49aa-a8b0-58c4f5306096", "comment": "Malware payload (Kaiji)", "value": "559815c2516f4591ae3dee11aeb1a24eaae784f1dac32edd92bbb03f3d9fd548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759460, "uuid": "9e072a80-0ecc-4888-9dc1-a4ac8f42f14c", "comment": "Malware payload (Kaiji)", "value": "a444b57dcd7ec15a58a5fbd2078508a728501b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759460, "uuid": "238d291e-6012-443e-ad8f-79aa2b7d5746", "comment": "Malware payload (Kaiji)", "value": "77814385004a0257fbab4e9490ea73aa7dc46d0b4401f091fd1ed0dd0b130e34e4e74f972f3a4927c0a18a69c7f1800d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759460, "uuid": "5d23e01d-9ff6-4c44-849a-60865ae6a554", "value": "T1C3A50857B8918542C4E42677ACBE81C833635EB99B8663266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759460, "uuid": "7bd2dbc6-691c-4ddb-a345-69f29d8e31fb", "value": "24576:JgCbFbDVZ7bVCj3ozPQPTUkrtQ05OYRWNOrdErF4ff1kRrKnyVhv8uofvsRWA1SH:VCWIuM2T1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759460, "uuid": "7473dae4-52f7-47d9-b8e1-3a37fc587156", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759460, "uuid": "33e73924-7b6c-47fa-b0c0-49c6e2acfb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759460, "uuid": "f47e69ce-85d0-4429-8518-73dce262ed6f", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9987fb-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766318, "uuid": "1554c5d8-7463-47e4-9eaf-9a765aebd378", "comment": "Malware payload", "value": "07529b3b66be3d8fdf244115d9436d71", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766318, "uuid": "7dc3036b-a81a-4dc9-94cf-472b45c8a68a", "comment": "Malware payload", "value": "5600a51e6774980ccd740d3864782436d31decc2171d81ab5d103e458a3f4212", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766318, "uuid": "65750eb3-2d41-4416-b4b0-bb52e886d40b", "comment": "Malware payload", "value": "85e97e48de0a58699cd64b10031aae40f615f0f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766318, "uuid": "622b973f-0c44-4754-aee3-f9a745a745fa", "comment": "Malware payload", "value": "af87098febf886a54ccc49f2da9aa01963ab41888fcdf69a07ecd7965671236bdd5515625df863b43ad690c5a060dd03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766318, "uuid": "5097f525-7686-485e-8948-7871310dcf85", "value": "T13732E7B424F04C332E615A80F27727E59BB2955396D3A68C38DD1F3A1F8AB13A16F435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766318, "uuid": "4ed8ea7b-3b1b-478b-a4f5-27e8ddfd8973", "value": "96:cRurQB6exVx7xxxjxnxtxrx+xfxPxGUOUOUuUuUmUwUyU2UyUeUSU+UiUWUFAU6D:cRurM6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766318, "uuid": "2e4afb8c-ec55-47dd-ad5e-feb43d7d601f", "value": 11978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766318, "uuid": "84acc2ec-af87-4702-a4b6-1e06164bb80a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766318, "uuid": "2897d494-5d9a-4513-8472-08a19cc68d1e", "value": "5600a51e6774980ccd740d3864782436d31decc2171d81ab5d103e458a3f4212.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1f73de-0f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771718797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771718797, "uuid": "5cde299c-9518-4949-a8c5-27f8b61b0542", "comment": "Malware payload", "value": "7398dbbfac6ef116f6d39d4fb9b9ffb3", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771718797, "uuid": "7e15b8bb-0b27-41eb-b0a9-9d3f06b01efd", "comment": "Malware payload", "value": "562e02c4d2e4463402fcb0579c45acc089e3c874a89318cd98e61338618dacab", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771718797, "uuid": "b83c31a5-e56e-4895-84f9-564ef6ef4654", "comment": "Malware payload", "value": "8945bb85f8d5c07c1f82e2323f4ec2a5a11df64a", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771718797, "uuid": "3f74e26c-76ec-46f8-b7e5-5189cb8cf89c", "comment": "Malware payload", "value": "3660c1efacd17d46312954e0fc5879661de6313e505a0934a72c68f819d755928b2a5a698f59fe4b79445721958f34db", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771718797, "uuid": "8797787f-9c3f-4958-8bdc-0f7a3653bffb", "value": "T19CA419376E696DC4EF551FFE8221D9A28CD9E9C3A0A5C0E0BC8009417EE97D4F9147A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771718797, "uuid": "4f576a64-64e6-45c2-a165-a88c69cbbb56", "value": "6144:D8sdduP1pQfCQWe7i1Uxu6Qnf+1QIZS+EaCM:D8CuP1pVlMx0gQyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771718797, "uuid": "0dff50c3-a0fc-4897-a39e-978f946131dd", "value": 480266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771718797, "uuid": "77a0e13c-4dac-4adb-ad5b-b6fc38056e44", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771718797, "uuid": "ecaefd28-cac4-4082-a9bf-91de728f39a9", "value": "Installer.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5094f50-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771752932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752932, "uuid": "89600e2b-ea60-4b01-9f47-e648f0701933", "comment": "Malware payload", "value": "aba4317de47a7a021ca8ae2813b54e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752932, "uuid": "7afb80d3-a8f3-40eb-80d7-71fe2c5e946a", "comment": "Malware payload", "value": "569af99f50e0aab7512e598f9d9cd95356e0ff19b478da2511fcbff02628d54a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752932, "uuid": "ba69753e-c814-49d1-be66-f6d95644232b", "comment": "Malware payload", "value": "f18e2f048d15db11f3e94682d5a457a1e9995b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752932, "uuid": "fd69109c-93e4-49bf-a465-0adb93cd0996", "comment": "Malware payload", "value": "1a69b44bd11e127c4660d787cdd2a02cff5e52fe4b2e73d0e79ed62e962ac1930616c3f82e974ff3090536587b5c1f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752932, "uuid": "cf8db8a4-2271-42f8-8479-dc6ae0daa657", "value": "T1ED23279AF8428D7DF84BE73E54174E09B92063C152831B2B23ABFEA3BC731595D12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752932, "uuid": "9404128b-6692-41b7-b00f-55025bab23f9", "value": "768:EpDeMydn0XveJzwDmDYY7xSEuq0c4xs4/C6K6LD8NQE8l9Gn:mxXvedKgxSNq0bs4/C6K638N98yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752932, "uuid": "5ca0fcfb-ca10-4980-82ed-a445020fe3b0", "value": 46660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752932, "uuid": "80d86c9e-4236-43f8-bfaf-712ca82a833c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752932, "uuid": "55c566d3-b455-4a3e-a2d4-61b41d065c21", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6984edee-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779380, "uuid": "7af02e53-8956-41cc-a438-d9dbf40a2557", "comment": "Malware payload (Mirai)", "value": "eb27412d41672ed5e9ec417d1278e09f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779380, "uuid": "afde022f-7ae5-4552-a95b-97b0cf7b0b1c", "comment": "Malware payload (Mirai)", "value": "5773d99e05b0f349bf329964e9a42fe6c67ec2ea0d190680601aa0fef0d33a8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779380, "uuid": "546ecd03-fd8e-403c-bab6-a2b9b68f0860", "comment": "Malware payload (Mirai)", "value": "ac3f72266189cec7ea5edc35d29155aba6c73af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779380, "uuid": "e1b7f3c0-b79f-4f29-8aac-72487ccd17db", "comment": "Malware payload (Mirai)", "value": "fef5ab501d2aca1a57792ac64fc837c9de79c1f4c301fb76996e046fccc25272c100d52ff75400d86c43feec6a7c79b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779380, "uuid": "8a90c3de-e54c-44a2-bacd-6ddb8fe24eec", "value": "T1A123F963F84286ABC2D012B2B66F9B4D376253FAC2CBB353E91543407B9650F0D63E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779380, "uuid": "9590293a-a27b-447f-8d50-faf98d36cd70", "value": "768:x2r1LRGB+pEmcG5kIVIiNTzmuRqZe8oCxags4+b7KG6Soyr2IymQY2AUm6hh1LBS:orjEJG5kIXdauRIvH5shCG6i2IymQY2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779380, "uuid": "0e25e492-0cea-43a0-982d-4f7631800fd8", "value": 48048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779380, "uuid": "667348b4-9cdf-447c-9ed7-4b6e8a0485a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779380, "uuid": "4dff9e6f-c8f0-4f00-9e85-262ba6557903", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a92668-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768722, "uuid": "c194129d-e7d1-4f5d-abcc-b8a7d05db0d4", "comment": "Malware payload (Mirai)", "value": "4944037b7925b808fa5cf4f757809167", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768722, "uuid": "ae4205f1-a190-4b5c-b5cb-476bc2bde26f", "comment": "Malware payload (Mirai)", "value": "588ae8f644e3ebd93ebef016603021a7ed064679f61d2d3d5ad35904dbc77cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768722, "uuid": "ac4b633d-a8fc-4f06-b957-deb810fac974", "comment": "Malware payload (Mirai)", "value": "4e28b52d9b56cc506de065939ea2ca41d2d196e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768722, "uuid": "64a746c3-8ac4-4995-a817-7005faae997c", "comment": "Malware payload (Mirai)", "value": "0164bf3c7d516161a016a150da0e46e63a95d7d5d6f47bfee062d83780c327ae0715cbf9abf6cdde1efd6efe2f4f5a9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768722, "uuid": "51cc74e1-a9ed-46ee-86ad-53e030bb158d", "value": "T11D343A45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768722, "uuid": "8eabfe43-f0a1-482a-82e1-961360f0858e", "value": "6144:Ego/jNgGzHzakeqacEp1d4n1trcbf9ihM/9+AU:EDhgSHzakeqacE3W1i0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768722, "uuid": "38422bff-c78d-446b-858c-61a3aa6e7f0a", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768722, "uuid": "550e85f6-3a2c-413f-adea-6f0af2a1c225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768722, "uuid": "dc6cf135-cd06-4707-b33a-69887685679d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e310cb0-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800380, "uuid": "e815657b-4507-415a-a8c8-271d3d5308d1", "comment": "Malware payload (AsyncRAT)", "value": "c7d9400fbc7c53ab262d225707a0f620", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800380, "uuid": "b7a0357a-c573-46f6-9307-47aa74a65049", "comment": "Malware payload (AsyncRAT)", "value": "59122e24e0c7d24872ab26eada546c1e7f3812cabb837c2e2b78ec3134f96a59", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800380, "uuid": "8586e3c9-7b13-409e-8871-e155fb219ace", "comment": "Malware payload (AsyncRAT)", "value": "6805be365219f9a28d1f50a4c0ecc1567b59f5f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800380, "uuid": "cf49c3af-d87e-455e-9f1f-e6188c3f333f", "comment": "Malware payload (AsyncRAT)", "value": "d17100a8d0019dafa2613f62d9f8d3784bbc64bc280a2815343e522c85264f4865c219955da3d04d354e8ba4c173ac86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800380, "uuid": "76302ac8-3ec4-4a14-bb3c-99c6607c7cea", "value": "T116333B043BE94127E2BE5F789DF1218686BBE5633603D11F7CC842D64B13BC68A51AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800380, "uuid": "dff93b25-7eb8-4ba1-a913-e98c4edaa94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800380, "uuid": "4bb6f7de-a391-494f-b49d-6996d989cdf6", "value": "1536:4LAVH7X9WA0vVblJZ8kpGlJg5NS6OHvmVcl:4Ehl0dblWlq4zv8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800380, "uuid": "8dfb5376-1a5c-44a0-a170-28299f5023ab", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800380, "uuid": "a54204d7-d89e-4692-abf2-8e63fc689441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800380, "uuid": "52acf651-fe64-4b25-b62e-7c4f38f685a2", "value": "toy7thke.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8d62b9-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752922, "uuid": "d64aaabd-2580-460e-9df3-dc289b8d7431", "comment": "Malware payload (Mirai)", "value": "c55c3f1196442b0a865eb6bcf3c1e7a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752922, "uuid": "f699705f-e999-4c84-bc34-ff7c6fc9ceb3", "comment": "Malware payload (Mirai)", "value": "594300d42eb735eadc2e407ac84eaf7554c662450ebe9846d45e11888fd18137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752922, "uuid": "df173d71-0bdf-4846-99ef-9ce4006b833d", "comment": "Malware payload (Mirai)", "value": "1bce3b6c3584d6613c5b3c119c61e964b7b59ddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752922, "uuid": "e7b3729c-be4f-49b2-b306-094b5b7d7a60", "comment": "Malware payload (Mirai)", "value": "73982435cc3d4e5afae43e749cda085120114779f2ea96796ee7f1cd5704199950643a50b5d1fa1a593ab98069db6dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752922, "uuid": "1d48fb37-188b-4da3-a836-b1d027f073e2", "value": "T1A103D791F8429727C2E1237AA6BE5A8D373073E892CB7617D9214B103ACA51F0D63F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752922, "uuid": "982de479-06b6-4cb5-8e4b-46d37b8a6b5c", "value": "768:9jpBofvAG5/w802yuIm8nWpjd44vHkW9pSN8pOSBU2ko70NLLC/N2wUkkkkkkkkX:90fIG5/w4Im6oDV4qp/VOLLCBUkkkkkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752922, "uuid": "200edd98-ea13-47c5-bac7-c8c0ea59a1d2", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752922, "uuid": "b5472b41-c2b9-4115-9ba9-7c8e16bde8e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752922, "uuid": "1bba7c23-62d3-4c64-b6de-3827bc9ef8d4", "value": "bin.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2509199-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771769302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769302, "uuid": "09e98736-2e44-4bbf-bb91-42e9ee79d1a3", "comment": "Malware payload (ConnectWise)", "value": "454177682f738a7b97db6c78364b2fd4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769302, "uuid": "441da7d8-61d0-4abc-a774-a15fa01639bd", "comment": "Malware payload (ConnectWise)", "value": "594a69724db412ad577ddc13ee0be3f9254c9ef528bb863da49733578191db61", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769302, "uuid": "5fec66d6-cc89-4c5f-a5c4-c9883b1205e5", "comment": "Malware payload (ConnectWise)", "value": "c8c9c996d2100d5accdd6b23c5061d82416ea852", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769302, "uuid": "a45f1685-bf15-46f9-8254-182cc6540865", "comment": "Malware payload (ConnectWise)", "value": "691f5b873b058cdc9c424b6c68caab7379a03632372a48569192d6a9a1475f68549ebb954a4c8374449412a7de236e79", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769302, "uuid": "908b62f4-6b49-4cd0-a483-4d4d909d3d58", "value": "T1F121CA0F5D37D277D7462124F502811BC278D03BA588902FAD66F0F19CC60657B97950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769302, "uuid": "69f1c15c-2eed-46e4-86da-65b026401618", "value": "24:9ai0iAiBreoq+gWiyVwibs+C8Ut5G8NoB6H9sFSRJuB0iST:9aKAAreoq4O+NBceXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769302, "uuid": "041e15dd-2966-44a0-9405-f5f005baabf2", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769302, "uuid": "0758b173-7a12-4d23-a2cb-c82821e0a6ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769302, "uuid": "85802948-120e-4600-ba39-dfaac8152398", "value": "Google meet.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0743c21-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755930, "uuid": "9efb22b2-77a5-4906-9768-e411d5495cdf", "comment": "Malware payload", "value": "30184e6ece4b597d9380aaf2dde562cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755930, "uuid": "62ff4820-18ff-4a52-a47e-f9d4e748073f", "comment": "Malware payload", "value": "5a7fc3baaaaa3ce0db6afd9b575b379a0cefdd871e4edfab360fca5020c8a846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755930, "uuid": "928875cf-a2c7-42e2-b268-75efd8bd24e3", "comment": "Malware payload", "value": "56dc87b8ee945d3b329ec513c223c1fd9e37558b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755930, "uuid": "4de0b16e-36f7-4d9a-9c8f-812a1a62f11e", "comment": "Malware payload", "value": "2344c68f109be6fbed54838142a07caa00005a9dad5334c08f125c76e352de2b9c883f221008c6d6ee1c6c4c6c248340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755930, "uuid": "bbb340ba-6a53-4355-bc37-517382716832", "value": "T1D3534C0B339348EDC116D97482EBCE329B72F8650570AF2F13E4EA312E15E716F19A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755930, "uuid": "76198ff8-68c5-4ee6-b250-fd227eee8f75", "value": "15e5009604045a6269161b15a81fc470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755930, "uuid": "4e9deccb-d57a-4674-bfcd-f94a86350574", "value": "768:Yxv//anfZA6VpXUI/i20hHvdzVSgLXHvezlMY8+guy/MOBKVHoQj0YunByeNH6QW:kiKONXihtVSgbHvOv2sVh6np6O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755930, "uuid": "e8b3608f-fdba-494d-9012-dcbce848eecc", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755930, "uuid": "0bf0394c-6e5c-4bfe-917b-170b658635db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755930, "uuid": "29757f5a-bd20-4012-8bde-0f4b459b0af4", "value": "SecuriteInfo.com.FileRepMalware.58517393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f8ad92-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779480, "uuid": "3ca0e72f-0b88-4a3c-8fd3-6ca75c799582", "comment": "Malware payload (Mirai)", "value": "8a1d30e2c8d313ded24cdb962b84d7aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779480, "uuid": "8b9b45ac-904f-469b-94a4-1271c1ac6fb6", "comment": "Malware payload (Mirai)", "value": "5aaceffcc65a85df500eb5f5dbd7b79791fe97e60a88900bd0703fe557f49269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779480, "uuid": "c55cc245-2ae6-42e2-b283-628db84927a9", "comment": "Malware payload (Mirai)", "value": "f5e04c68e5b6d44c60268a8a7c1842203e4f00fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779480, "uuid": "b6fb7eae-54f3-4c71-8770-736eb389d7fa", "comment": "Malware payload (Mirai)", "value": "65acd3d550264d941cdda83cdc8cba1248fdfb7e21e8e118c0d1fd791b0e655320bc8ce6bd1473aada825c8c223b2a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779480, "uuid": "221045a7-b027-415a-9408-44f4fc0e31c5", "value": "T1FE336B01B3989E07F6EA2EF5383F2BD543AEED8016A5E085690FD7864171F33491DE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779480, "uuid": "ee21e0e0-607f-4ac6-9f1c-d863beabc559", "value": "768:OfrUxkzF5ByUwudt+2Ek5VbDlZihLq1nZW2nM1sy4qgDgxhBXsVV:38F5Stk5Uh0Zx9DMhGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779480, "uuid": "0370aa4e-99b7-4820-890b-dbadc45a89b3", "value": 54524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779480, "uuid": "cd903807-a40e-46d5-adc7-47d541a0f656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779480, "uuid": "868e7624-861f-4a60-9f6b-416c5a0bf869", "value": "purves.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253dc049-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766381, "uuid": "7255da82-3df3-4d07-aec4-44a55f0942d2", "comment": "Malware payload", "value": "9392790dd7c29c284c80f3d0b6210caf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766381, "uuid": "188e33ca-d694-4189-8f7e-661b16fd3938", "comment": "Malware payload", "value": "5ab89b1ccf4bdde388133fc6e89511a07d4b73c99b210cbe667ffb61ab620239", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766381, "uuid": "3e923d39-6b84-44a0-83c2-fee1206a7ac4", "comment": "Malware payload", "value": "3acefc366b402d73af63198cda23b7896a592073", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766381, "uuid": "eb114885-8869-4ee6-9ef3-559a2e28e94d", "comment": "Malware payload", "value": "3507bd44d7b40b3a87930b65130b2258d59476959b85cfdb4849b1d3d309ccde0cbf48398623d430fb4b3b606be5e2f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766381, "uuid": "ff37290c-b504-4f08-976d-f649fae2cb06", "value": "T15681DBB414F00C332E6556D0F27727E56BB2E94356D3A68C34DD1F392F9AB13A16B421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766381, "uuid": "c691685f-ef56-4608-bc0b-d6a05be1f31f", "value": "48:cnRV9R3NonB6sza/7dlwnmwUblrAwUblrGwUblrIwUblrqwUblrQwUblrGLUblrW:cRVrNiB69amxIxGxAxKxYxtxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766381, "uuid": "93ebe331-b4c8-4014-b92d-867b2eda45af", "value": 3834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766381, "uuid": "4e41a280-1709-4c67-b939-938071f091b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766381, "uuid": "3e787b8a-7b9c-4245-a20a-706ad1b1f5a1", "value": "5ab89b1ccf4bdde388133fc6e89511a07d4b73c99b210cbe667ffb61ab620239.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be868cc5-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800139, "uuid": "ce3627d9-bd91-4701-9a0d-f867a8dc2a9f", "comment": "Malware payload (AsyncRAT)", "value": "0c06e36fdfcd5c01d1cbfe525d4dec9b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800139, "uuid": "6a05e71f-db3d-49d5-8755-c2c6cb54801d", "comment": "Malware payload (AsyncRAT)", "value": "5b04c0eb0f7f7db1d0a7fce8449af364e2680740798b2815e00095b612d35826", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800139, "uuid": "5d3f075c-2c3a-4e8e-b233-79117bf56f6f", "comment": "Malware payload (AsyncRAT)", "value": "2cc6ce28ed6be73ca821b2f4a9d12bec59748fcb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800139, "uuid": "ae3eb3e6-4b8a-4382-a3d4-505416ee9eb8", "comment": "Malware payload (AsyncRAT)", "value": "7c65194ee657cc68ae21c404b029b831ae57956ace97a760a5a19091adc50209618c1606df3578cc0526063ab3f0cb8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800139, "uuid": "1b145000-cf36-4aa1-8e27-6c4f46122653", "value": "T1FE6309053BE88019F3BE8F7469F2628546F9F56F2D12C55D1C8510DE0A32B869A41BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800139, "uuid": "cdd7624b-adb9-4a6f-8ef6-1085c062b0b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800139, "uuid": "bfe191c3-3c15-4349-98fc-d8ae9a0577c0", "value": "1536:HOLTWn+vYk+Ls0Ku3UYFNXuFEoSI8b1d5QFP0rmTGVx:HOXU+vYk+7Ku3UYFoEo38b1zEex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800139, "uuid": "01ee9519-7725-41fe-935e-60fa4505b215", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800139, "uuid": "bd5a0dff-5c5c-4282-9dcb-a3a2a378ebd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800139, "uuid": "8a7e9c4d-3fc1-4a6e-83d1-22bdb74095ec", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdcbcb5-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784055, "uuid": "f8c7814c-4acb-4753-b62e-253599d1050f", "comment": "Malware payload", "value": "47fb48efdb8dab0ade2f38f796ad0143", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784055, "uuid": "2edfdeed-b188-412c-a603-3229e6cf147f", "comment": "Malware payload", "value": "5b27d34a29b92357f527efb54a1068c3cc8d7b5428e9fd61aae8790c6c73f348", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784055, "uuid": "b136f0c3-3363-43d4-9f08-d57d37d9f816", "comment": "Malware payload", "value": "2438313346db5bb6c06f74f216a707791ceef5f8", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784055, "uuid": "6c066b8d-9148-4eaf-8210-11681385e7ba", "comment": "Malware payload", "value": "593349c5be5a1d636a7d896ab8ad90d7a22fa3c95400c0606c80d75266f58212a152bcf42b13c7c2214e89119d302b45", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784055, "uuid": "6c2cd11a-c64b-45a2-8e45-47f20d98ed17", "value": "T1067252142C03156193E7A2CB9A37850129C978CF0F1B3968B4DE52AA6F5C61CDFF29F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784055, "uuid": "b2ae7732-7806-4383-87a1-0f461114c620", "value": "192:unpDYAVsjdSCfnhT5ljrQOjVzqWq4uy8kEzY51007I13vnWM:unp8SHOjx1ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784055, "uuid": "a35225c0-b240-40dc-b99f-b13e35360e59", "value": 16820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784055, "uuid": "18d10134-2772-402d-9e82-559b78b0d7dc", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784055, "uuid": "8228cd11-8b44-4273-bd5c-1d770d2cc6c6", "value": "PetitPotam.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731e1c80-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770806, "uuid": "cd840a2a-e222-496b-aaaa-cadc5ba59d27", "comment": "Malware payload (Mirai)", "value": "6176f25e04e970e8a8c75374f03c2401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770806, "uuid": "d691196e-4780-4db7-a4a7-0def4ecd4b02", "comment": "Malware payload (Mirai)", "value": "5b6da0770290b88d8d7a72429d15d6fe6f891fadbbd8fb3c0074e4ab781b4706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770806, "uuid": "67331491-cf96-4c10-bc49-1a4abb7b779b", "comment": "Malware payload (Mirai)", "value": "59d088f08683899e4c11f77072b6a87cf84cc8a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770806, "uuid": "ab4dec98-ff05-4839-856e-29fef69fdbfd", "comment": "Malware payload (Mirai)", "value": "8d376ec0efa974fd25f65e77c1d24997080bc424c9ce309b11e16cc20ad21a4f11fba52cf963b79a293d1d99aeba2ff0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770806, "uuid": "3874a7bb-36dc-4881-a6f1-2190a9e1c860", "value": "T10E431825AD792A26C0D8B57A61F78324F2F2224E26F4C61D3C721E4EFF14B4069177B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770806, "uuid": "19e9312b-53ad-4873-83bf-8cc29ae53b57", "value": "768:O1o8uYoq94eDDzMaRTafZPuSqtfTtgN8gUrisqvGgSO+9pOm12:O1nuYoSTDDzMaR2fpu1tfTyN8DgQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770806, "uuid": "818ec788-d96a-4b4f-98cf-076aaee67f23", "value": 59332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770806, "uuid": "670553b7-f72f-4e6a-9f8b-3648a97bce76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770806, "uuid": "313fe3d0-85e9-4ac5-a9de-8942df0bb09a", "value": "3atoNational.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b489c2-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784118, "uuid": "681d7758-fbf5-44e5-8893-5d81a71297ae", "comment": "Malware payload", "value": "e35199e8fa3d633cad28664c1dc85012", "object_relation": "md5", "Tag": [ { "name": "gif", "colour": "#EFE52B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784118, "uuid": "888f27a9-b065-4e1a-8e16-f82b5c2d1f4d", "comment": "Malware payload", "value": "5b89e4619aa420f9f5740d949ada519c6568bb810ae0e9f00682cf1a1243b6b4", "object_relation": "sha256", "Tag": [ { "name": "gif", "colour": "#EFE52B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784118, "uuid": "4a626ef5-6a9a-43a2-84ec-9ef2117b5e37", "comment": "Malware payload", "value": "23e40d6dbdb964c2d58a40e2689aa5ca793cefd6", "object_relation": "sha1", "Tag": [ { "name": "gif", "colour": "#EFE52B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784118, "uuid": "2b4e537a-71f1-4922-9cfe-1bb3d98374ab", "comment": "Malware payload", "value": "b60416d9c3ce1704ea7ef67ddcdefb2f97eac39bb5232be74ab8722c6c3af92bdc9ec49b0ddc9d78ef7ce8d9bc4af725", "object_relation": "sha3-384", "Tag": [ { "name": "gif", "colour": "#EFE52B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784118, "uuid": "ac70bae3-15a3-4e31-a2d8-2f6a8e953bb6", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784118, "uuid": "aa20b3dc-1928-461f-a015-12efba6b3398", "value": "3:C1O/a4m8YfFQ:6aIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784118, "uuid": "16d07510-7e09-47f0-9064-dc534072469d", "value": 37, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784118, "uuid": "a73c7b1a-13d2-4b87-9e1d-d9c6f3c9a8db", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784118, "uuid": "439a9ce5-e8b2-4e26-a08d-cf82f49b3ca1", "value": "poly.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f2efee-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766467, "uuid": "bb20d9cc-2c9f-4e10-97e5-34ee30a44fd0", "comment": "Malware payload", "value": "02acfab23750c44aea7b4513931ebecc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766467, "uuid": "0ea4f470-e7b0-4eeb-8812-15a8e58d4302", "comment": "Malware payload", "value": "5bafaf6313b77eda8a32328f1a74ea7c7dc1e7092fa6455b904f471a735b5900", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766467, "uuid": "b1c67638-1134-447f-b406-d0e2e2aefa9f", "comment": "Malware payload", "value": "33cb01e65edf0e0a2c053f894ab0758056b18a8c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766467, "uuid": "4f688cd7-9b7f-4fdf-b425-5d3637171ac2", "comment": "Malware payload", "value": "a0a196b6a374be3b7fdd983ab4dbaece498ec2ce7b5056802ad6d86883e6e4dc6c8381c2601c2ff26c7fdafe73fcb4a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766467, "uuid": "245e9868-65e6-41cb-af96-058958e94f6a", "value": "T1EE31B6B021F148736A605580B3772F6AABF6DC47499361CC38DE5E396F83B42B1AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766467, "uuid": "785bbfda-5002-4415-9bc3-b20bce352003", "value": "24:cnnRUR8fAR25bm09HHIuCzCRpYdZe1KOujKujsBjl/H/+sCl/HESkkKl/HRkeN:cnRu9Rf4nB6g1KO/Tjl/msCl/8kKl/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766467, "uuid": "6411d18a-dd29-4d8d-aa76-8b98b2734e25", "value": 1755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766467, "uuid": "4a117aa7-84ab-4bf0-ba5a-c338c4da7ee2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766467, "uuid": "a1c68e4b-a6ef-45a1-a9f4-d7033954c446", "value": "5bafaf6313b77eda8a32328f1a74ea7c7dc1e7092fa6455b904f471a735b5900.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b91180-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771806, "uuid": "a1601c92-c266-426f-bafb-0df22a1f2d3f", "comment": "Malware payload (Mirai)", "value": "db39cf1c31c6e3f00ae327050b710603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771806, "uuid": "6a43ff8e-693a-4c74-a25f-8ef36c77a6ed", "comment": "Malware payload (Mirai)", "value": "5bbc4a44267775d5268c97ae7a036d330cab86e85908b942ae1feefa7bc4dd09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771806, "uuid": "4700061c-384a-4bd9-86b9-b233949a3566", "comment": "Malware payload (Mirai)", "value": "7be1bf1beb11513dba3aa9a71368196f4b4de190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771806, "uuid": "39a51ec9-123e-4ab3-afed-796d59de17a6", "comment": "Malware payload (Mirai)", "value": "792ed3b38ea108cae3382609d906ab2c22c123d75282410c4b92cd4e6c86d8e85abae1f0f301f5b802d01fe2ca5d1d7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771806, "uuid": "88a1777e-5d93-45fb-bd83-b369d937b5b7", "value": "T150935C22FA79193BC4C4A87762F34726F2F6434B24A89A1E7D720D8DBF1465022977F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771806, "uuid": "3fef38c0-8ed6-4793-9f81-b7f1ce25d361", "value": "1536:GimLxksVEmbNzO5eIgmL0LkOUxYA6tJlaq5u0qQ7Z5t83Sau:xW9OiHUKDla6uP8au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771806, "uuid": "8e364c24-8135-4529-9bc3-a5b197e0b374", "value": 95056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771806, "uuid": "4e560446-4746-48cb-8f2c-8a253423d4df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771806, "uuid": "840436eb-2571-4981-9423-3acdd2b82383", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437975e6-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766431, "uuid": "4cdf2cb5-872d-4508-9c03-c75cde9f8a28", "comment": "Malware payload", "value": "0c91d447ac915e414946a3e9f9e895bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766431, "uuid": "4751bb98-dcab-4326-837e-e0f33a880387", "comment": "Malware payload", "value": "5c8c34511eb2806db94437b7155253fa7503422da3829f3f3a9391f6afbd8684", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766431, "uuid": "e95f4da7-f7d3-4095-8e18-a9d28e0de12f", "comment": "Malware payload", "value": "a9f789c76dbe277b76ae2e9710f3008bedbb3b67", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766431, "uuid": "edf460b8-6515-45c9-9402-fd4b0d58cbab", "comment": "Malware payload", "value": "51dbe490cf2c069c14c009ad9073b889e3cab9725da309ba7adadef1537de6c466f06f0599f6bc120761cd1bb442c068", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766431, "uuid": "e3370902-e557-45a3-85cc-78ea4fcc0868", "value": "T14732667B21F08B32D7D410C963B61A614E72A70B496614B9F4FE5739AF2DA0370E7B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766431, "uuid": "09534e65-1c65-45af-adf2-1afd075b74c9", "value": "96:cCuolB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjKlWXaEXHArCAr8ywiW:cCua6p4hvZ5mN9oKNpivAwRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766431, "uuid": "02ba9400-35fa-4ae2-950c-45852e430caa", "value": 11972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766431, "uuid": "8711f4e7-d027-4115-9b1e-b018a0cc7fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766431, "uuid": "3185d53e-7b44-4537-90a6-deaee2560a74", "value": "5c8c34511eb2806db94437b7155253fa7503422da3829f3f3a9391f6afbd8684.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79418439-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790573, "uuid": "b33334fb-6ccd-40cd-ba04-b8e4083bf1a1", "comment": "Malware payload (Mirai)", "value": "1db9a31c7e799229fbfce0093929c750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790573, "uuid": "6def39b3-2f2f-4852-83a6-015ed376ea2a", "comment": "Malware payload (Mirai)", "value": "5c97597af920ac8849441230b777e5c851028f7dc8af95cc1d595a1d6a9d78c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790573, "uuid": "9ec9a085-bd40-4796-ac05-6ca990caaa74", "comment": "Malware payload (Mirai)", "value": "3bdd2bca76f219e7101a224c4b1bcfe4181e0bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790573, "uuid": "49139e55-0780-424a-a65d-4957add42e52", "comment": "Malware payload (Mirai)", "value": "92a4a3e6b18fb87b4c3d2fe0b78de1e53215bd6e2b383c4b589f3b5d86844083df32362f5e451d34cd4c5c8570f3cef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790573, "uuid": "2ca12507-7911-4ef5-906f-7302040811c1", "value": "T138044A07B5C18CFCC49AD6744BAEA63AE975F09E123CB16B27C0AF231E4DE204E1D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790573, "uuid": "898563fb-29f2-43a4-bcac-fb38bef59a47", "value": "3072:y84T4Q5/RNB/9puk9rOVN6lb7DUgPu6G7HSq5pUiguzdrIKELDwbZnJEAn:qT4Q5JNB/9puuruPsG71KigQ4wRJEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790573, "uuid": "edcaec04-71d6-4537-a9d6-0cc0e3c278ce", "value": 174232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790573, "uuid": "19a73648-eca8-4462-8aff-8311bba6e314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790573, "uuid": "30b15918-fa06-40b8-8522-94e2e0928d91", "value": ".5r3fqt67ew531has4231.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e2f71c-1028-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789981, "uuid": "aa0b3326-3165-467a-bbfc-1df4df9748e0", "comment": "Malware payload (Mirai)", "value": "35ca931f579611a85687feb6f28de3d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789981, "uuid": "6628530a-df8f-4147-94b7-eb4a100070f5", "comment": "Malware payload (Mirai)", "value": "5d09603ad1d6abc7e25aac5e2090df74962748895da5236586343a36aaa356eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789981, "uuid": "a28b1a73-eb3d-4797-ae53-294c5b08e8a4", "comment": "Malware payload (Mirai)", "value": "4db4141893ed8e1f233e70cfb7f73194a7eedcd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789981, "uuid": "8b8f0e4e-bd78-4fc9-89b6-d25fd5ef239f", "comment": "Malware payload (Mirai)", "value": "32fea3169a8577ec56b05ef2877c6b4628a0b00175d1055ab99fd86f93cddf0fe663218b8e397fd94739e6047b524dcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789981, "uuid": "d45a96cf-777e-4e38-9319-85ca344649b2", "value": "T186431942F89245AAC6D007B6B71B5789339363A9C2DF7343D9084B516BCEA0F4E77D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789981, "uuid": "c69cee31-0d42-4a3f-91c8-69bfe11ebeff", "value": "768:JipL+zHr0c5ZbEz+ByYnCH1NkbVFrXQPvoOC6dWMrL2Fgsn95zO:QpL+f0yJs45q1N8LrXQASLN8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789981, "uuid": "a4b09b62-edb8-425b-930f-d8f234978b63", "value": 56608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789981, "uuid": "3191fe64-8af0-454c-9bfb-e12aef8d9f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789981, "uuid": "8dc3e189-dd4c-4c77-a4bb-afd07847bb9f", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf40af42-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771793, "uuid": "61ece08f-131f-4acc-b628-1d31dd1a44ca", "comment": "Malware payload (Mirai)", "value": "c9f63e23b8242bdbcd01e6741e2f3125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771793, "uuid": "2b994192-e485-4ace-b0b4-d065cb0b8353", "comment": "Malware payload (Mirai)", "value": "5d21226b83aa3cde424e129e75386d594dd43a08ed628dbd41c3135dcf0c128f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771793, "uuid": "d842caab-6735-4df8-b038-5a534a7c0c31", "comment": "Malware payload (Mirai)", "value": "fd17c98f25c3bf73aedd61ac4e990398cf7e22ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771793, "uuid": "4afb1612-3d2c-451f-9091-1ad6ddb06771", "comment": "Malware payload (Mirai)", "value": "e37658d1c58ffc4d8dbf81f4b9bc5639a2c4633789c266ac5f3d44f03ab276d64772e9ac321b6f5018c3bfc4fd5c5fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771793, "uuid": "633d02e9-fc3b-47e5-8fb0-6d8b7474f3de", "value": "T13FC39D87B78B14A0C4624AF013C71F9D6B53A211CE5FE8E3AC1E763F5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771793, "uuid": "6e51711c-4016-4c3b-ae0e-1698349ab0f2", "value": "3072:DAQ+rDaJ7MbzumvlSZcYKrpxVSoYJgFq:DGHaJ7G9vsZKrB7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771793, "uuid": "fe889798-3df1-4e10-9e07-5ff27e5d8cf8", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771793, "uuid": "c15c77f3-a54d-47c4-ae95-851e5a3108aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771793, "uuid": "faae82e5-16ed-4733-b277-075ac4d174e6", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5854f26-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766301, "uuid": "f3bcf3df-1668-43ce-8b1a-1819dc623984", "comment": "Malware payload", "value": "cfb99417b55f2820f2ac406e13d64069", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766301, "uuid": "ff2cd0d9-0105-4c85-843d-bbf7b2c86af1", "comment": "Malware payload", "value": "5d270a6bbff2b324b22fe715500255580174ec5c677bfc268e3d36c5b7a62dc8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766301, "uuid": "6c8493fb-ca23-4261-8f23-2554d3c6d9f8", "comment": "Malware payload", "value": "1fd099c3224c3c984c81a8f873fe106adfae599c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766301, "uuid": "49d2cb35-b909-433b-98d2-6c0b9f2ffc59", "comment": "Malware payload", "value": "31ac484f3034015b2374043d8bde63cbcf115dcc665a9e344535711712be855857fb71091c5ca497c4e87aae2a1b8e5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766301, "uuid": "f579aafe-8871-4ddf-88ea-c0ad0178ee7d", "value": "T13722A17425F14C332E216980B3772BA6ABB6D85345E3318C35DE2E366F86B12B1AF511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766301, "uuid": "27c0624c-c437-4966-99a5-d032316ad37b", "value": "96:cLuQuB6A1FMexuxl+SEgI4Ej87sRWpWZWWW7WvWaIBzIBn6eHI:cLu56AnvLk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766301, "uuid": "e4bcaceb-4f59-403c-947e-18acfd430d9a", "value": 10220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766301, "uuid": "df810da7-544b-4c61-a1cf-6fa0c5ddabf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766301, "uuid": "aa026f54-f94c-48ba-a9a4-10db37495d4c", "value": "5d270a6bbff2b324b22fe715500255580174ec5c677bfc268e3d36c5b7a62dc8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248e6131-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766380, "uuid": "11fad0ef-01ce-4317-9a0b-0b7f39ea3cc9", "comment": "Malware payload", "value": "48d33324cd4a65984c6de030608b1f61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766380, "uuid": "8454ef26-7eac-4c80-8a6d-b1e3e1ec381d", "comment": "Malware payload", "value": "5dacab9c50ffd3c66136668d67a7b8da5199bac3654c7c9fd539e77143b515de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766380, "uuid": "4a363435-a60a-40f5-9884-0295761249e6", "comment": "Malware payload", "value": "c71a6adc6dc89a1ea97746deb67838fef6e139a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766380, "uuid": "4384f485-c9a6-4ce9-a4cf-68007cc49dff", "comment": "Malware payload", "value": "dabb2281d72b7a3aa51eb94645cf9c43d6b15d89a6d5b8fecb4ac2567e400d47483e84303eaef2005d617690ef005b44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766380, "uuid": "12840592-9063-4e9d-95de-a46633af65c1", "value": "T1BD42353721F08B3297C055C9A2771B614F72970B496714B8F4BE5B2A9F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766380, "uuid": "0a5cacad-fce7-4d00-8712-a40e3149beca", "value": "96:cCu3k0B6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwaaIBRIB0IBT7IBbJYJ4:cCu0g6nC4hvZ5mzjqKNp02LG7hxm+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766380, "uuid": "c8b1a80f-6076-4bd5-b866-9369ee12c3b8", "value": 12356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766380, "uuid": "fffd2b14-288e-4e8f-a051-0b11a50ebf46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766380, "uuid": "642d62e5-6858-4088-8702-18789e8147f6", "value": "5dacab9c50ffd3c66136668d67a7b8da5199bac3654c7c9fd539e77143b515de.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3938fa16-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800344, "uuid": "b84209fa-ad00-4156-b2e0-ceb62d84489e", "comment": "Malware payload (AsyncRAT)", "value": "575d2b37ae00abc579fee48b5d1d2543", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800344, "uuid": "ee4a0348-dff4-46a4-b31f-24d83e51bdf7", "comment": "Malware payload (AsyncRAT)", "value": "5e01225192d45437cf43985f75672e1ee43d0a470edd31226a73d2aa969423b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800344, "uuid": "36848435-d95f-4d12-881f-047219c3718f", "comment": "Malware payload (AsyncRAT)", "value": "3a549550a94d6acb0c37a01721e5e4e76f39217e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800344, "uuid": "b1155720-8b7a-4cd7-808d-6ac836d52fc7", "comment": "Malware payload (AsyncRAT)", "value": "88b595d2d667d8666eca7bef0e6aad2e36827d948d4d69e2a4968be08cbd0b888b263959b619a4236a8b3f323a7a4856", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800344, "uuid": "08959e2a-6146-4765-a1c8-48e7f04fc19f", "value": "T1D663CFA7BAD1C4B3D1D08EFC6D22D619F73FBAB04D3859F198A808CCA84E782114C657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800344, "uuid": "1c1a0f16-c450-4ea5-bae3-de18c8837d27", "value": "c484513c371a4a0eb15e568b604daeee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800344, "uuid": "d07b348f-f877-4ad0-828c-6b780a406e72", "value": "1536:2mql9QlE41l+SvIVAQvu1zwCFjMdWNaNCtXxY:69UE4Xpv1skzymA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800344, "uuid": "27f9c8c2-b2d6-44e7-9e7f-b44fe3f7c563", "value": 70766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800344, "uuid": "7f353748-8ea2-480c-a1d0-0a09381816f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800344, "uuid": "22d229d7-7507-42af-8d09-b4be15ebb31f", "value": "noggorcrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e90626-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752376, "uuid": "71c589b2-7d0c-4dfa-9fac-21c8d1b47d96", "comment": "Malware payload (Mirai)", "value": "bfc595b6442bc879c8054da76ed45951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752376, "uuid": "3c48bee3-e0c7-4045-9a07-2af94e0309a5", "comment": "Malware payload (Mirai)", "value": "5e063c38ff4c36d7c4834faf4c789201426b523c836ba24eba4de55b2f8f69da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752376, "uuid": "563c70a2-9753-4c30-b6b8-c56543191327", "comment": "Malware payload (Mirai)", "value": "e81859ab0ac0b8419d161bca8f93335e2a738284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752376, "uuid": "fca5171a-5d4f-403a-967a-eb92967ad142", "comment": "Malware payload (Mirai)", "value": "6436cab3b9ed77ce592024146f8ffcec1fa21023d03919e9e10e75812e3b17c6891c72a72f52dd4fd9023338fe314ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752376, "uuid": "6627a668-ccae-457b-8786-62e8df8e48b6", "value": "T161148DA8FE4F78D1D2C7E37DAE4A0FA2302778749555C0B21E40A29FD5EAED488D0617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752376, "uuid": "f24ac615-371c-4b01-9c49-3e4ddb29a582", "value": "3072:V/9C2PLvlx+C0xEdNhFuUSMq1ZixVIHNYzPxW:V9jaC0xEdNhUniTbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752376, "uuid": "743fd4a0-629c-4345-ba70-037a68702f43", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752376, "uuid": "bdc8adca-68bf-4d5e-b803-7c13d0ca1329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752376, "uuid": "adc224d5-3a2b-470e-bbc1-43f61d6efcff", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5c45c6-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752330, "uuid": "9370859e-0858-406b-995a-7afe30b628a2", "comment": "Malware payload (Mirai)", "value": "624f5b63743f0e96f2c352a65c38362c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752330, "uuid": "3256d6c4-9bdd-4a87-b927-a67de7a72df2", "comment": "Malware payload (Mirai)", "value": "5e187a1040994123c7ffb7ce9860904799668db3900dee512099384d1f20bb2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752330, "uuid": "8e55e003-0930-4a65-a925-c9e85efca880", "comment": "Malware payload (Mirai)", "value": "98b0bd80f3dbe326c490e831abff152e52304591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752330, "uuid": "8d10d8c9-fdee-4d27-9c02-1b4354c462aa", "comment": "Malware payload (Mirai)", "value": "cd70c9372cd7a9807b870e90d822f95ceb2ba004da576a26489bf4c807a6dbcc4a897b10eb9b722e763481981a5f040f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752330, "uuid": "5797b745-0678-402b-84c3-96e6a28dc83e", "value": "T1CD6301F8327A5BC4D465297E4524DAAB6203127CF6A41E9D003BC10799BE08F2979FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752330, "uuid": "e9954f30-2d2b-42fd-8a75-51c932f7f392", "value": "1536:hl7KDxWDQOmd6veiG3PoBVu3tB8nOr4diSo/0+TYAaCeJ+aBN2:v7KVWFeiiP93o2SiSo/zYAaCVSN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752330, "uuid": "9145a52f-c7a3-476e-9711-bddf625f4d67", "value": 71048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752330, "uuid": "4eed79cd-80c9-4be2-bfe3-7e38ee8443c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752330, "uuid": "b3d35d21-cbd2-43bc-b0f4-c348037560f9", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c5e801-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750299, "uuid": "f5188738-fcec-4647-bf91-76cf3f12a8a3", "comment": "Malware payload (Mirai)", "value": "807787a0b175aec8ef4babf41f61b95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750299, "uuid": "ad766376-d026-492b-9684-30bb62b3398a", "comment": "Malware payload (Mirai)", "value": "5eb4a749b0390cd3afb22f5d4ac9f9776a70037fe2bb4ce2ac2fe158fabf6015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750299, "uuid": "b692ead3-2b97-458e-a3ce-2eb36d6de5bd", "comment": "Malware payload (Mirai)", "value": "59dbe36a8ffbd24c29351bf7c7a1e62a1bed9acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750299, "uuid": "6402d0f5-10dd-4ba1-9fa0-631f77aafcfb", "comment": "Malware payload (Mirai)", "value": "c9dee611d68ad01fccfe74db4825fa6a1941321f9ee684ffb5aa1864ee4983fffccbc15dd3e380417f8180d608ce23ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750299, "uuid": "d3ebb46d-a32c-4897-95a3-7e782d412236", "value": "T14214851E6E328F7DF368C73447B74A34975D23D626E1DA84D1ACD1052F6028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750299, "uuid": "6c2304f4-c950-4c02-a087-0a07fd2f1cb4", "value": "3072:Y8Rms66dNRgxe3yiuPTk+FFwHWBKgs5MXcDpgSkbtdt6nykZ8:Y8Rms6HOyiuL7DPeexPt6yke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750299, "uuid": "cf601f7c-729e-443d-a772-28524f6177de", "value": 203384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750299, "uuid": "395e81f1-6c9b-4056-b5dc-9a7be16a84fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750299, "uuid": "20c79b94-db28-417a-978d-e7c09ebab5b3", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b311e40c-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750298, "uuid": "907996c2-4b5d-49e5-8f40-119966b4febc", "comment": "Malware payload (Mirai)", "value": "54fe4d981929f91942df43239520d706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750298, "uuid": "5f0553cd-0dd0-4422-b4da-d4cdbdf17a46", "comment": "Malware payload (Mirai)", "value": "5ec789decb23daf80798176bbae0ab69298127e8ff1977bb9c50c012e7e1de7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750298, "uuid": "92521ace-da05-4202-8942-cb1adcc2b802", "comment": "Malware payload (Mirai)", "value": "737f2e25fc6b439eefeff08d4e2644d198d964cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750298, "uuid": "fa75c65d-ed9a-4c9c-939c-271519f1128c", "comment": "Malware payload (Mirai)", "value": "457b59642ce85ab21d402a50ede32844d7e6bdd6760b70ff8446225e928fcc7c0b34cc60a9fe06b49c88fd3893c54916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750298, "uuid": "4e7c9405-9e37-4345-9880-945c79d26bfc", "value": "T1B4D36B77CC266F58E525E5B1B0318F791B53A95081872FBE19A7C6788083D8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750298, "uuid": "86371a1a-59f2-4a57-88d2-62cb2c700167", "value": "3072:krGWR6KnPBbFeipMIAWpyaMMBW/ttYHtfk:qGWR6yboipMMAMMVt+fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750298, "uuid": "c90e9be1-86c8-49d1-af7a-3040ea9b9063", "value": 137980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750298, "uuid": "a4cdced9-30b6-47ce-85ff-eac036f6e2cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750298, "uuid": "d31e0ecb-6d37-458e-82ab-cb03e463b828", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb9475d-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753297, "uuid": "4b3ce7be-1d2d-4dca-bd99-11511e541bc2", "comment": "Malware payload (Mirai)", "value": "d5d94c788deedef9a23e28ca1f916afb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753297, "uuid": "aea56ed8-661f-49cc-95c6-3aff2177201d", "comment": "Malware payload (Mirai)", "value": "5ed8a70969bb4dda407debf7e8a951c3c32b87d27a72dd26db2969341bffb1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753297, "uuid": "3741f24a-d363-4d03-ac22-986738708c94", "comment": "Malware payload (Mirai)", "value": "3ea7b96a13555a9185b853a9970f93b66d8b4bf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753297, "uuid": "0d95b2d8-21b4-47d7-ae59-28209f5eea12", "comment": "Malware payload (Mirai)", "value": "b4e32bf18a381d3b944b8595bc3ea1c7908cfe02d673e54961e299df153020b5867f3e4e34621b99720ab19417216f5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753297, "uuid": "7078c403-2630-457f-ba83-1a8e6060556d", "value": "T1D523FA63F84286ABC2D012B2B66F9B49376313FAC2CBB353E91543507B9650F0D63E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753297, "uuid": "b715c09e-7bd6-4ae6-b2e1-005b0009c1ef", "value": "768:tGr1LIfNmapEOcG5kIVsiJnzquRqZe8UOxagsoSb7KmKSoyk2IymQY2AUm6hh1Ll:Mq15ERG5kIbVWuRIvf5stCmKF2IymQYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753297, "uuid": "8c7e3092-3365-44f2-ac7a-128afa762f20", "value": 48052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753297, "uuid": "f499c8cd-7d13-4afe-a522-958d7948cebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753297, "uuid": "44fe554e-a61e-4f81-ac36-5997121b2b08", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcd5cce-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771791, "uuid": "0cb98a63-f6ee-426d-8131-cc67a017e9da", "comment": "Malware payload (Mirai)", "value": "cb91c152f3fd6dcd30df23c15b6e8915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771791, "uuid": "472e7ad3-dbdc-478b-bd2d-236f1734b32d", "comment": "Malware payload (Mirai)", "value": "5ee6fd11fda468178043f02cd15ca3807cbe4eaf6804bd5f02b91cac41b79237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771791, "uuid": "e3786446-94c0-422a-92f8-19aaebd35e4a", "comment": "Malware payload (Mirai)", "value": "2bfd92a31423e966c3a9ebe32bddde0942a3bcf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771791, "uuid": "c0eea8cf-b89b-4707-ac0a-3406c0b2f2f3", "comment": "Malware payload (Mirai)", "value": "a6faed9323461e4cad070b44e66fab97927ddcf4b9daf06d20cf6ce08935830b7a6941b187a3e4b743f6925c01b0fab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771791, "uuid": "477e2db8-7709-4f51-990d-beea8a4a6533", "value": "T17203F1D08699C5CAC8BD537828F77D8E05B0F55AE0981E5ABB48639B53C3F60AF45A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771791, "uuid": "12d8423c-5c4d-45e6-989a-7b704163bee3", "value": "768:IOKap9X7JLYANuIQn5Cav6tm57/b0dy2KK7QtwNu2/q86nbcuyD7UtQRjZ:Iu3LYANyn/S6bIfQtwN8nouy8tyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771791, "uuid": "65bc7951-64e4-4181-b996-220bef91cc77", "value": 40336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771791, "uuid": "333b4d07-a78f-42f3-913a-e62f23800a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771791, "uuid": "b7720944-191a-4270-9951-b019cc60832d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbf13b6-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779387, "uuid": "38849712-11b0-4af4-a835-a4a0516ade51", "comment": "Malware payload (Mirai)", "value": "6a4aad4e8e05e3e519d1f88423ce292c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779387, "uuid": "b8460d96-5660-4d9e-937b-ca8a7eab2810", "comment": "Malware payload (Mirai)", "value": "5ef7217759f2b9b2b2ed5368fbd302953ea1693eb4c165443303c8a071c716a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779387, "uuid": "3df24032-6fba-4278-b226-fdb28a3a0278", "comment": "Malware payload (Mirai)", "value": "1675569a2ca26b6960f1b85ee766415f6548719e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779387, "uuid": "004f8b5c-53df-47cd-b0a5-d1fbe90d4304", "comment": "Malware payload (Mirai)", "value": "529cba07a9e605a3749ecab0e1799019a6fe837effdf75a5762cc124d88d272d03a5eb77290e80ea880bc4d338bad830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779387, "uuid": "cbbab305-b323-4d84-9851-2b489e3f5927", "value": "T134533B99F4029E3DF88FE9BA84160E05B93023D112931B2767ABFDE37D331659D12E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779387, "uuid": "34e2e64d-5109-4618-bc79-25e91b9486dd", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozfym:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJ3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779387, "uuid": "20ae3693-d250-4100-8531-d407f08933e3", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779387, "uuid": "cc406c20-e2fc-45a6-a9d5-276d25fd042f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779387, "uuid": "b89c11fa-023b-4b21-9db7-9e4bb4feb2d0", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dfb139-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750302, "uuid": "f70bf468-a592-4145-bff2-3ab49ca8340f", "comment": "Malware payload (Mirai)", "value": "8f58b122b4319bfa8402a0d68cc3cf4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750302, "uuid": "4dbeb7d1-732e-4e15-b413-82932d15d8dc", "comment": "Malware payload (Mirai)", "value": "5efc9e0edb71af4a3c4590a998ee393ccf1692fdbfeeb9ecb6eff6300f26b3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750302, "uuid": "130181d0-9470-4cf4-8eeb-7b9b4ad94b45", "comment": "Malware payload (Mirai)", "value": "0ab765b73a413ac036d743d9045035abce48eb55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750302, "uuid": "0bc3d476-4b63-4944-90ee-5b4806e9ccd1", "comment": "Malware payload (Mirai)", "value": "b8a5e6ee54fa7be062e232a99e2a45a779dae3f8618dbb34fcc91b0d9b714bc6487c0c0f3fa3e8b8d08edb19fad82342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750302, "uuid": "dcf45bb4-2ac5-41f9-b1c4-26f7c3cdb8cb", "value": "T1020429C7F900DEBAF40AE33748530509B130B7A204925A777257396FED3A1D91977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750302, "uuid": "759779b7-e830-4f3c-ba46-5bf1baf881cd", "value": "3072:8yjtBkysL29WamfVshN8yyWU34SAXYR0t5cbWuobHviJlj7jLV3jbiTL3+b6aTyJ:7NxUyyf3bAZtr67jaLY3KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750302, "uuid": "346667b6-b701-41c4-9b73-09e5c0a37e1a", "value": 177636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750302, "uuid": "1a88a4d8-ebad-473b-a0e3-b63ad904bf04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750302, "uuid": "81ca65cb-61fc-4836-a615-f16219af595d", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd87b9fa-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778716, "uuid": "63e5215b-777a-42a2-adf4-8571fb0cf46e", "comment": "Malware payload", "value": "95f4edb59fe22020933b886f2659e405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778716, "uuid": "895f5803-057d-408b-bff6-f0bfae2b69c3", "comment": "Malware payload", "value": "5f2cd96db21c26f0717c311abca95f757fcb7c6fe4738e837cc4ab4a6039f0f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778716, "uuid": "58fa6b81-b167-4dfe-9de2-104042d10f4d", "comment": "Malware payload", "value": "a0ca32231c518525f8b5a02ce5acb391aaa3392e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778716, "uuid": "6e545cf8-a70b-439c-9aff-049967cdfe72", "comment": "Malware payload", "value": "b8f2ea12ef69ac81e174abc3605a184a0a280e6f16326808d81cc3b45b0ab59d124e7321571682de7916b90b61fec2fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778716, "uuid": "f25a797d-4983-4842-b6aa-6b32dc81c635", "value": "T12982436B93D0CD3ECCF86236499B4A3462B3D074EB72532B6A5061B21D837881F7ADD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778716, "uuid": "bea78a04-9d2d-48b6-a34b-f0499018c276", "value": "384:+RVcAn0Xvn/3PHfXvn/3PHfayqC6Vu3D2P8tSfm:eN0Xvn/3PHfXvn/3PHfayqC6VotSfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778716, "uuid": "495ac61a-e21c-49b5-82f0-83092b0d5d0d", "value": 17688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778716, "uuid": "6ce45a20-f408-44d8-b26c-8ea72f999209", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778716, "uuid": "b435f781-4b0b-4262-b608-4575d7caf070", "value": "udpx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e512dfb3-0fb2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771739644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771739644, "uuid": "97fdf4fa-120e-496c-bace-400e962c2d08", "comment": "Malware payload (RemcosRAT)", "value": "d6f6b56efad1571248e173a7d3f2d04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771739644, "uuid": "ed6c6958-626b-4026-94f2-a23acaa4cc7e", "comment": "Malware payload (RemcosRAT)", "value": "5f4710bfecf96b1c4c9ef95b36543b698b2e89682f1a8524927ed860de826f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771739644, "uuid": "d36e5877-6d11-4c3d-abce-63b277f989a5", "comment": "Malware payload (RemcosRAT)", "value": "1b0bdf339933830b4d4de97e8089773b95d000f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771739644, "uuid": "84fea965-38ce-4536-8458-e0cc847199b9", "comment": "Malware payload (RemcosRAT)", "value": "c332f2f379e4877183b30c414786381238f33530bd94ebfb7e30d130016c33214a174149e0cda6af59eac8af72d79a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771739644, "uuid": "8dbf75c8-c08c-4070-bddd-1e3fcaa0f73c", "value": "T179451202BBC080B7D17235365AB687902A3C79305F66CADF53D06EAE5A709D1C636F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771739644, "uuid": "26243e13-f3ca-4aff-80b4-aec00a2346ab", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771739644, "uuid": "46a2ea40-b45e-4ba3-9513-4c9d34876137", "value": "24576:KN/BUBb+tYjBFHEPxZs5hQU3hRnsqaSWGf8lQwusjNEFTqX1zJ54D+qN5q:6pUlRhSE5h/nn/P8WJsjuMX1zJ5w+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771739644, "uuid": "3d798e22-5a70-4ff9-a99d-067891a73735", "value": 1240918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771739644, "uuid": "43738c4a-70d9-47ab-b907-eeeac2112d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771739644, "uuid": "4a92df0e-b4ac-4aff-8687-c12464b2c6bf", "value": "doc30326-002000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6330dc53-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766485, "uuid": "b9021c89-2017-4704-a13f-79e79b63d5d5", "comment": "Malware payload", "value": "651fdd805226237234cd6886a5bd8d76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766485, "uuid": "565bcc73-5de5-4ee0-91cb-8f777bbc42df", "comment": "Malware payload", "value": "5f95aba9daf68ef5a35b7b9c995f0fad4108e5cf3f3c18bf79186aba786aa21a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766485, "uuid": "55e5758e-2ec3-4e4b-b947-eb7d70ae6d7b", "comment": "Malware payload", "value": "327b853479b4241ce9ac7bc9e2b1295d28ed9c15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766485, "uuid": "0da9bbb1-3ab2-4b0a-b5d7-22c64affcff5", "comment": "Malware payload", "value": "b580f909960d3665e7f187b3ec4bc5d0a20372a2562b567a70b87704c3e3f4d7343be2b5b5f0b53ddb24b5c137401b88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766485, "uuid": "cb7baa42-5458-484c-a813-a9a2f33c05f6", "value": "T14921DD7011F11C7326206680B3772F967FB2DD4749A3618C34DE5D396F87B02A2AB452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766485, "uuid": "222bc134-a3b1-4980-80d6-d59cb2aee3dd", "value": "24:chnRUR8fAR25s9HHIuCzCRpYdZeMbHxlc9HH/+6Elc9HHVeN:chRu9RjnB6gM1lwnm6Elwns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766485, "uuid": "1e4ca13f-fecb-436e-b42c-044e2b3838e3", "value": 1339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766485, "uuid": "a6b55a8b-3013-44fe-a64c-c6a24da74901", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766485, "uuid": "dd502950-1bcf-4e25-807f-d31e9407ee7f", "value": "5f95aba9daf68ef5a35b7b9c995f0fad4108e5cf3f3c18bf79186aba786aa21a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f09f69c-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800354, "uuid": "cc0ea13c-f02f-4e60-be3c-baefec5182fe", "comment": "Malware payload (SalatStealer)", "value": "ce0d9d9aaed7dfa791db2363ce03756d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800354, "uuid": "fb11bf2d-99f4-4910-a018-ef3079ce4206", "comment": "Malware payload (SalatStealer)", "value": "5fd1c3b8f531140d556c98ec83e834f8d71e7b4a3915ca9066d24751720f6b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800354, "uuid": "be4053bc-901a-4262-90d0-607251247f3f", "comment": "Malware payload (SalatStealer)", "value": "6fdef37476a835010b959c4aab772c8c25826ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800354, "uuid": "8989ca95-a195-416e-ac8f-9f93cdbb949d", "comment": "Malware payload (SalatStealer)", "value": "0c148ad367bc769fba849eaf932a524a4532409cc567ad97148bafd773cec1a3274de696f170edd25c7fa8a13a54bb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800354, "uuid": "a5426476-4af6-4d27-99e4-578a29e35151", "value": "T19E262349FEC35AFAD966517008DFB3BAD6306D040016DDBBDBCAAC12F62F701196D60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800354, "uuid": "429acdf2-05c4-4cc5-8b0a-522501e097a5", "value": "fc648d00fda0b8c1f218b9e9e89292fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800354, "uuid": "dc1febc8-a678-40c5-bb2a-db4f8cd692e5", "value": "98304:J7/ZKlEBSHYkQ56iXAWlmlnp3oqh4dR4Hzh75cnyYtxk:J7iEBkY356iXRYp3oxR4Hzd5zYtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800354, "uuid": "6a9378ad-617c-4cc1-b7fb-46554e8d3241", "value": 4759288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800354, "uuid": "c0268f0b-677a-4bc7-a6da-e683867cfbb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800354, "uuid": "12ebd953-8ff3-4812-9d47-fc6f7123c696", "value": "ProgramFixed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f248c14-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770800, "uuid": "7df1f952-0203-4c59-9869-1d82452fecfb", "comment": "Malware payload (Mirai)", "value": "56f29e066a0c614a2302210d6c0e01b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770800, "uuid": "2d22996a-5c63-4053-b6a0-ebd6ea3b7af2", "comment": "Malware payload (Mirai)", "value": "5ff9fc44598d7b82242c23044f94fc9b7bdfb4477cc764f766fcd2bd893596e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770800, "uuid": "0a1d9e2c-6f6a-46cb-a74a-e04ff335080c", "comment": "Malware payload (Mirai)", "value": "8c79d204ad2df9563e88c7845d5253d6bf046da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770800, "uuid": "a5ea52d5-7191-45a1-8f4a-b5e05a636321", "comment": "Malware payload (Mirai)", "value": "e415c6af8f341a40cfb217761fd4b8d2c0edc5bfbaabd6f4318e5dabce53e9b0e163a7eec78961a81b8d98cce7ec7513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770800, "uuid": "ec186545-489d-459f-b741-583079f955c6", "value": "T157337CB6C4E9BDA8D2049B74BD15CA348B13A40086672EFEDA45C699C087DECF2097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770800, "uuid": "ea934531-8182-41c4-ac4f-5b07bfe726e3", "value": "768:UawatoKwtt8KH5BlqFejY9vijo9vKv5YJvumk9AC5o5A/YtLrCxJ:Uawa+KwtypzAhvSImk9AVcYtLrCxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770800, "uuid": "33bdacfc-1c35-4556-af3a-c00e2fffc8b1", "value": 50672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770800, "uuid": "c9d5fd3e-1900-4376-867d-c10d70f313f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770800, "uuid": "74874c60-b6aa-4067-bd46-59ce882e838d", "value": "3atoNational.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee9c08d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766424, "uuid": "78e536d5-e2b4-4d81-8da3-47c47980affd", "comment": "Malware payload", "value": "04431edc33d0e7e3c23a732ba41955ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766424, "uuid": "e1dac7eb-5d42-4fbc-8fdd-8b23eb90f2b6", "comment": "Malware payload", "value": "603476f2c4e60c2f5f3a80f67e45d3620e8c86e710f4fd54de236abb67cc6fdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766424, "uuid": "7dbd028a-2a1b-465d-85b0-48ead19cdc38", "comment": "Malware payload", "value": "2efe96a3b496c1012f328403a857b2da2cbc83eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766424, "uuid": "a27f97de-186b-4869-b671-2300db4fc254", "comment": "Malware payload", "value": "24f01a394cdd82da14d5e70e5a7fdfef6074b3b7864aabdf17d188a4316e60e4ed1a50bb81d645fcca73a48a3c09fdef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766424, "uuid": "b5cc9198-defb-4c33-b575-d5ddfd890f52", "value": "T1EF61EB7025F08D332D20AA80B3372B95ABB7D95345E7218C35DE2D266F97B12A0EF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766424, "uuid": "185f6ff6-fdbc-40d6-bdcb-4eb615a1e2bb", "value": "48:chRu9RcnB6gfCzyMc/mXJIrlr8wJIrlrimJIrlrE7Palr+09DlrM4gOPl/J:cLu6B6pzqgIBPIBTIBAIJvpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766424, "uuid": "7dac4f49-e616-4bcd-9366-f9528759046a", "value": 3334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766424, "uuid": "e4239a73-46ee-481a-81bd-f2434fc3710e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766424, "uuid": "6315646d-2941-49ad-803a-2c8c5c861f58", "value": "603476f2c4e60c2f5f3a80f67e45d3620e8c86e710f4fd54de236abb67cc6fdb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afefe45b-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752440, "uuid": "29d6278b-0c6e-4aff-b8d9-e5cc00d53bcc", "comment": "Malware payload (Mirai)", "value": "a58824bf4f4822d46b50e9ade7a36e9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752440, "uuid": "267ad1c5-aca5-4a9c-af74-1a6ca43cb81f", "comment": "Malware payload (Mirai)", "value": "6104f11d2556940ddca2ea1daeb2782bd98619d637b369252937cb88c525c464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752440, "uuid": "6e31dd44-94ec-472a-815f-b47c0d348ec6", "comment": "Malware payload (Mirai)", "value": "9f9a0f8c8deefe2a2801e8cc0521e3bca04c5a7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752440, "uuid": "abd64932-8da7-41cb-bdfb-ba3a054b1a96", "comment": "Malware payload (Mirai)", "value": "df26de56cef0835df712a000abcd2e2565112b6e5c3607b963db8c35a1dd8464b399b51de9668738c233f27c80cd798b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752440, "uuid": "7d3f372f-42b8-4dc5-9a0e-fad72abd68db", "value": "T1BC5302412ABCE83ACEA2D5390B6801A745DC59E46493901E53CD7DF88A06C74BFEC697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752440, "uuid": "17dbf1ae-ad8a-4aba-ad11-0f89c23228ca", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VH1AQw:MaHJgMo8FwOA4zUFGUO3UhbOQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752440, "uuid": "502f1ae0-792d-4430-a5d6-23a502a51519", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752440, "uuid": "b40818dd-011d-455d-a67b-78c23b6ac38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752440, "uuid": "e92d2106-065c-4347-95b0-de893ef3db96", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e639bf-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752447, "uuid": "8853c8e4-5895-4807-8eef-fa129a7622c9", "comment": "Malware payload (Mirai)", "value": "ea966a95e6b53365ce8a369fff0869c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752447, "uuid": "241571b8-3fd7-485f-b1d9-a79c5c717a94", "comment": "Malware payload (Mirai)", "value": "6312b6601eb53f407231e2b0d2e60f2c94ddbffc6e49744951d3bccc4f5d74c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752447, "uuid": "8ebb3261-299d-4d26-9cc1-4a40499ef091", "comment": "Malware payload (Mirai)", "value": "e2e9045a2eccc86bba05b9aeaab7b1b39cd1d409", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752447, "uuid": "8faa2489-d901-4c7c-8146-3afdd8762406", "comment": "Malware payload (Mirai)", "value": "7f5ae56ef8c1c000748890c4f9bbf0391f66f7d210e7994d60758366aee351d6dd8513b030f6705bc4152b27a2a793e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752447, "uuid": "cb990767-9f85-41ed-ad5f-fdc957da41dd", "value": "T19A01B5C2227138707CEE9CFE4A338C1C30C5A8773F865EB87965A5E60695C40D4429F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752447, "uuid": "7e1ca9f3-4dc6-4fbf-a36b-c0f839ba2391", "value": "12:YkF1kcClZF70ShHFDHFiHFWV0FSUFM5gFyV0FSeFMDgF+A1LRPb:ZDkH/FbhHFDHFiHFWWF/FM5gFyWFhFMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752447, "uuid": "ea6c6b30-2262-46d0-81f2-21381853f9c8", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752447, "uuid": "69ac4edd-e9a6-46fd-b94d-3ad7dc7ebd89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752447, "uuid": "32c9acf5-dd8d-4d2b-9cc6-ebb870aa29a3", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae83936e-0ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767470, "uuid": "6167cf48-65ed-4c52-affa-8744828a8928", "comment": "Malware payload (Mirai)", "value": "e662ea19336c70fe7348032cd20b3aaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767470, "uuid": "45d64ffb-e63c-4543-baa6-141bcdaa0d52", "comment": "Malware payload (Mirai)", "value": "632658bf0e523c2f2b80af1d1cbc46f040868742e6216d982c8ce36842c036fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767470, "uuid": "caa3cb26-2eba-418a-9364-1fcf841ba793", "comment": "Malware payload (Mirai)", "value": "68ecb4601fa94b314b4e16c4716851ace3db7bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767470, "uuid": "686d5416-6a16-482e-a05f-eaa1c3c34078", "comment": "Malware payload (Mirai)", "value": "985c81b6eeddfd0c2d804c4afeff099b29ffb46eef0d486e79e2647917ca7bf6c4f5212e7d70aeee6d5ccb15ca741736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767470, "uuid": "fd5c938c-e075-412c-931c-5aa26d3e4779", "value": "T10CA34AD7B406CDBDF84AD77744571906B530E3620A831F3A726BB967BD362A90832F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767470, "uuid": "3227efa2-c6a6-4639-bac3-26daccd74ecf", "value": "1536:NSQDzVTQbJLQj9TE2vDaF96bgT8/3kHE8PDeP7Nn7jATXdpvN+qD09LgW:NYQFEOq96bgz2P7Z7kl+qD0dgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767470, "uuid": "57793866-5fdf-48a1-b398-47b28a031898", "value": 104148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767470, "uuid": "fc78aa48-2d62-4ecb-8a43-b5c18d629bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767470, "uuid": "a1266fdb-58bf-4abc-9cb9-67f205729cfe", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a225157-1003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771774227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774227, "uuid": "368bfc72-a067-460e-82cf-1ea63f7ca206", "comment": "Malware payload", "value": "287e9f5b0b72e9499e0a3ab78a5233e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774227, "uuid": "eee5b72a-dfdb-4515-a052-6f167a96779c", "comment": "Malware payload", "value": "63450bf8e4abe98ba2b27b17d8da918848b466c0e38249ed4a71dc663f102172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774227, "uuid": "c5771048-c7bb-40aa-a513-4ecc247c2fe7", "comment": "Malware payload", "value": "d928758a0c749a0b80ce06f7df04c9e6bcd18a82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774227, "uuid": "da85b98a-d459-4486-a99e-d978de6c7bb0", "comment": "Malware payload", "value": "4649b2b3b910e088f9a037d08eea4aefd593601244f1d365b15cf9c0bd9b93b5788523618fd8e9026330f5d9a9b9f654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774227, "uuid": "f1ded6d4-3e25-4437-8d8f-ef17105a27c4", "value": "T1E8871256E2F900E8E97BC0B8C6575517EBB1344517309BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774227, "uuid": "62d4e636-8179-4ae3-a086-1951b5a31891", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774227, "uuid": "5b82334b-dcd8-4286-a341-9b9ec88e63b1", "value": "786432:H57bhtzhWNsKpjGct8To61nEPwd49C880XsChv:9bhtzEnpjGi8T1nEPtw8z8CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774227, "uuid": "249fdd9b-5c97-45d6-ac38-cb9c21966739", "value": 36214120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774227, "uuid": "45aed029-c91b-49fd-8211-c9ac3209601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774227, "uuid": "4cd1a78b-acf2-4c8a-bc5c-ef62e158ab07", "value": "AxisControlAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a273fecf-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768738, "uuid": "c6d2b453-a6e9-48bf-8881-85de0170a27f", "comment": "Malware payload (Mirai)", "value": "912aab85bc6ba03df70d332f0a376608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768738, "uuid": "a11cdd37-50b2-42ee-8c8d-085c701b7cd4", "comment": "Malware payload (Mirai)", "value": "63cc62b128ac4d19fd2c90c131a9d821c5f878d0c25a82eaff49f1c98d7e7dbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768738, "uuid": "cf323be1-7ec0-4057-9c82-4d1df18bda75", "comment": "Malware payload (Mirai)", "value": "d0cc2ffb68eafb01dfa59aa46d5e30bc842ddc94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768738, "uuid": "356718cf-8e3c-4b16-ae70-83d4fb053a04", "comment": "Malware payload (Mirai)", "value": "c770421c2d85b709604304c450730400c962c0670fdb05deee1e987942c28d81bd49c30d2d198c0b09d4892ed6d77c3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768738, "uuid": "04b96910-c681-4156-b6c0-44d5b2ee2d8e", "value": "T1A8D33841B9829A27C5E123BFFA6E018D332563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768738, "uuid": "99e224a1-e3cf-403c-935a-0d77dc004cc2", "value": "3072:snFif7apx6XS+kUgpjWXQQKMs0u29wzulziQSo:sn8ZS+dQWXQQK5s9TeQSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768738, "uuid": "11711151-e1b7-4519-8de3-b5c04a0a6d54", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768738, "uuid": "5a8df348-1d69-41a7-8708-da6ef1a077b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768738, "uuid": "ce78b5e8-5f90-46c9-870e-fa06ed1defdd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60c688-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779467, "uuid": "2111856e-2d38-4d5f-9d55-5495b070c093", "comment": "Malware payload (Mirai)", "value": "a6e73b893a34999f7463a5c349a8ed30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779467, "uuid": "c64de174-536f-430e-b29c-74fe3059338c", "comment": "Malware payload (Mirai)", "value": "647ff9fc045cafa9dbfd95f77716855832f9a6a5b2b488f5d689f7b95af501ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779467, "uuid": "daf2b552-72b2-40e6-927d-7911c0b6ba2c", "comment": "Malware payload (Mirai)", "value": "c5cd5d182669a242da8cb8792cb23417e1fe4672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779467, "uuid": "bd40808b-4d49-4873-9049-fa60db32b27f", "comment": "Malware payload (Mirai)", "value": "84a4e1740bd45fb7b880af4e315e13de2e80c16163ed5a60a5e09bc1d3cb46bceee5a5704a4a55a7be833665ee6aa867", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779467, "uuid": "4aaa1cc4-4596-4161-810e-09773e59ea9e", "value": "T1FE734A17B98080FCC599C1740B7BB23AD53375BD1239B2BA27E8FA177D89E215E1D940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779467, "uuid": "3dc22fbb-d20c-4690-88ff-3664a8a79f18", "value": "1536:e1bKEUCFCTGQ6Y2B5kxKfpUa0pKF6SlahJU5DcCRH7HF+Oxd/djrXxw:+KEbcTGQmHXfp/FnKJOcCRrF+OxdpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779467, "uuid": "ed1be90c-815e-4ead-b1f5-a651d267e2e4", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779467, "uuid": "56697b4b-8958-412c-8352-6bc943b7ef4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779467, "uuid": "9f1845d8-8c8b-4bb1-a7cf-d13ec7aa1e96", "value": "px64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcbb485-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752379, "uuid": "0ac5d015-ef6f-4b94-af3a-247071921447", "comment": "Malware payload (Mirai)", "value": "608dc90b4723045a0b5b27006113e1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752379, "uuid": "6b05dee8-d778-4142-9196-ac7f85dbbd2b", "comment": "Malware payload (Mirai)", "value": "6572f0d6b22d0fa43c24119b391a940384c87b52e5daab2e4f15d9c5aaef95bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752379, "uuid": "9bd6a54a-2a57-4c4a-8a8d-da21ef3e9ad7", "comment": "Malware payload (Mirai)", "value": "6572fea98666e540861a9460dc7303b2acb4c262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752379, "uuid": "7a19bec5-6f9d-4c47-b2b0-151588835ea3", "comment": "Malware payload (Mirai)", "value": "52579b865933b4aa74babe4cdd09ee41af40cba735cae8a6d4d7b146f9968d1b9ac65b368a6e9f7f1e046f4226d18187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752379, "uuid": "0ebca7ef-681b-41ff-9530-bf0e36d9ac36", "value": "T114D35A0A79D270FCC687D170926E9F61FA36746C02183DBB93C2AE711936DE06E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752379, "uuid": "fc9f4848-ebca-429b-b7fb-151a36600709", "value": "3072:uE3FdcM0mnkq/CNjo6ZFvFKrYL+DuGmAc8KYjV:TVdhnkq/90L+6dAV9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752379, "uuid": "304b8239-5b89-49ee-af0a-6212cbab3970", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752379, "uuid": "08f9c644-166f-4fca-ac84-328723bc9f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752379, "uuid": "bac6aee1-10fb-4083-ba53-86106d14a4e0", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31feb84e-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768979, "uuid": "92592850-513e-419d-8f52-e5ca6dec32ea", "comment": "Malware payload", "value": "e1c777ae14befb3dfd5662ba78ecde1f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768979, "uuid": "d263beab-e02b-493e-8077-a1b8e562767a", "comment": "Malware payload", "value": "65a70bd05096e971485da4c91e11018edf114856709098147bbfa800cc025583", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768979, "uuid": "1fc36417-d873-4637-ac71-c7cc8c2e90ff", "comment": "Malware payload", "value": "f496f43c08a89c2f992920d96fe4b726dc0ec35b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768979, "uuid": "bee9ca4e-4cf7-4f33-8f34-07dfd9ca3c0e", "comment": "Malware payload", "value": "33ded71f4eb535094fb7a5602fe17dd755e108c5c7b87b6e70ce6d4402ee148117f549fba1a22054d860a6fbd382771f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768979, "uuid": "9ca4d68f-6421-4881-8435-afb4c7b6cf13", "value": "T1E1E72263E7589DE6E4FBAB329275825661134CB05B43EBA26D11707C1DB3DC0C70AECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768979, "uuid": "618ec7d0-fa2c-4721-a4c2-5b72c53abb5d", "value": "1572864:/9FrQ/7p3QnAv4FlSM+1cOzidWs2CHBbZPPJGENken2oby37VEt:lF8/7pIk4FlSMTeidSQbZPPJ512oWx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768979, "uuid": "7d5b8f41-f69f-444d-b461-1821e13ca225", "value": 70077416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768979, "uuid": "df473217-bb93-4c2b-9cbb-1d75097ce4ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768979, "uuid": "ec1f9cec-c5b9-47f1-916d-ae0a66fbe42c", "value": "MOVIE_APP_1771740178796.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42dbc6c-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752528, "uuid": "b40e2304-9fcf-4759-a438-ec113ac0089b", "comment": "Malware payload (Mirai)", "value": "2fd5bc1988f312e5ffd6219a37d896ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752528, "uuid": "0f199127-0152-4d2a-8fdb-25d1a38d32d7", "comment": "Malware payload (Mirai)", "value": "668eb01e4c861dc8de3889d48c56c0d3e959d6c9cf4622387b4ac7a27d68852d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752528, "uuid": "a770e3f1-6c7f-4f69-9871-0301b4e76753", "comment": "Malware payload (Mirai)", "value": "27e2e3dbd145a7cdc3ca492e607f2353a5c0c2f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752528, "uuid": "37b4fc0d-e506-4175-a0b9-1d1899e431ab", "comment": "Malware payload (Mirai)", "value": "3c294e7a5c77bf1d29ab6852a2d976dbcd66ade9a7803bcbb0464e157bc8addbc20e1f6d6a5ccaccea9d4668aa69db7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752528, "uuid": "f2bb5c6f-c3a5-47fd-9d20-f1840a24467d", "value": "T17BB3E085B210AE45C02672FCB187099093B17E7B4B9A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752528, "uuid": "c1ecffe9-caaa-4bd0-b538-e9cdcd17670e", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuP:as5zqhr5Nzy7w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752528, "uuid": "3d31ff0a-66ef-44a0-93f7-537fba227245", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752528, "uuid": "a72e802c-e7c9-416c-a6d7-286ea0dbf2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752528, "uuid": "f21b6a50-afc0-4779-b655-930ac73b3bae", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe2b622-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766399, "uuid": "4236e751-b611-4869-861d-db33597545e9", "comment": "Malware payload", "value": "602ae2d9b85fce16ac61b1fe8320b086", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766399, "uuid": "a3b29e08-0622-46e3-939c-e3aeec7a5c8e", "comment": "Malware payload", "value": "66ef3092a483086c4c97177cde35768ac45996dc727681b35e4ae9ceedd7a9bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766399, "uuid": "d1309ea7-9fb3-4718-9519-41ac388971da", "comment": "Malware payload", "value": "04cafa407e319f5f7de739401db4fe7cdb382fba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766399, "uuid": "a8cc1c30-cfe9-429f-90c3-e23c47419690", "comment": "Malware payload", "value": "806aaee7195f0ff2562f7e3a5eaee43191d0c0b761558b129d5c0aaa60edf2c17808a117a03c24132af7d7d5c5116a54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766399, "uuid": "f3daf538-4158-4447-98b6-c84215af5373", "value": "T11B81697026F04C732E702A44F3772BA9ABB7A8170597718C349E1E395F87F82A5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766399, "uuid": "b2cfd36c-306e-4864-8629-b74cd04934d4", "value": "48:cniRxuGRys0Gk7lwnECtWhl7lwnmV5+ol3F9gE69lripE69lrEuE69lr+6DE69lA:cWu49l3WhmRmj6f36fM6fA6ff6fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766399, "uuid": "2fa7269b-18fc-4628-b3d0-973e917d6212", "value": 4065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766399, "uuid": "7d56c953-b0dd-4d33-b9c1-cd430a7ef890", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766399, "uuid": "87870e6b-ac31-424a-a745-9afdca9ea3a5", "value": "66ef3092a483086c4c97177cde35768ac45996dc727681b35e4ae9ceedd7a9bb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a58a67c-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800373, "uuid": "fb91c617-64a3-4455-ad5e-8c0f07497fc2", "comment": "Malware payload (SalatStealer)", "value": "251507ee4a0574463731dde276239b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800373, "uuid": "99b839c7-45b8-44ce-8ef7-e92f189baac9", "comment": "Malware payload (SalatStealer)", "value": "66f568064d21aa4a969eb7f2186aba996b14ca6c6437001bf26e9413a62bb493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800373, "uuid": "9e3667f1-d5ab-4984-aa0b-11bbfd2099fd", "comment": "Malware payload (SalatStealer)", "value": "19e3dc9cc65ea795a9f7de9cc8b98113dbb3ed4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800373, "uuid": "a388dc22-822f-4d1a-af31-fa87b686b8d8", "comment": "Malware payload (SalatStealer)", "value": "7ec7d623aa3086c92636949320624ca58bc80757655dc0458051b647a6fc14300858a8265b00dd4db622d51db7250ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800373, "uuid": "e5e100ac-46c6-4620-87b2-dbb6c721f59a", "value": "T12FE5333B84E87625FEFAF130057F1FA593F3811D5965C6E40CB3F82686BA44088A7D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800373, "uuid": "2bc10a22-09f2-4eff-af92-77548e6327ec", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800373, "uuid": "f3ac9589-fe34-4c45-b1b6-d566660c54c9", "value": "98304:fValoK0h0i2SydyPUIM6AKIs4TZvLgpHuKVHkx6a:Nuja0Gyd+XkBvci6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800373, "uuid": "08205ebb-9b36-4f68-b990-230dc2293f34", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800373, "uuid": "7668bd0d-81ce-406b-a4b4-53ff036debd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800373, "uuid": "b1843a53-45dd-437a-bc8f-96d2853997b2", "value": "SELIWAREEXECUTOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97cacd3-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778736, "uuid": "77aa650b-b244-493a-9960-568b93b4a6b6", "comment": "Malware payload", "value": "6f58091a849a7c467af537ef24e2c513", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778736, "uuid": "447e0afb-f9b5-44f4-8f0e-0106add4ee33", "comment": "Malware payload", "value": "675490b983022a13fc39278a99372d8abeecbb3301ac412535327dfc32f2afb0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778736, "uuid": "bb6ec5b9-f928-41ed-93ce-44a3d22ed8b5", "comment": "Malware payload", "value": "cf617fbe55dfdbd7c872d7acc824f5bb9c635707", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778736, "uuid": "417ec1cb-b10e-46e3-abe2-86c2a5ebb5c4", "comment": "Malware payload", "value": "827dc332da3fa9ffe2b7c46a228a6a8752211dec4028aa2f0d8fc466a4b9b80ec34d8331f01dbb32d8c3d914af384fab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778736, "uuid": "3d25656e-492d-4195-bb80-e8132d940fde", "value": "T11042337B21F08B3297D010C9A2771B614E72960B456624B9F4FE6735AF2DA0371EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778736, "uuid": "1bbf5a5b-062c-49a9-9d23-c446bb97bf98", "value": "96:cCuhmB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjxlPOSEgXYUcFn0m0F:cCuhK6p4hvZ5m5FoKNpivOX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778736, "uuid": "489c6c84-e85a-4e46-b650-3eb2d16d4bda", "value": 12547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778736, "uuid": "2f6df5c3-70f6-495c-af30-3a0d5402073d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778736, "uuid": "956750e7-ac85-4a0f-9f22-93d204e0ae5d", "value": "675490b983022a13fc39278a99372d8abeecbb3301ac412535327dfc32f2afb0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b101b8c2-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753301, "uuid": "df591914-6b6c-44a3-9f07-af4706bc76e8", "comment": "Malware payload (Mirai)", "value": "e6f22b5c77c7784853bb27645af424f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753301, "uuid": "b7e6cf5b-f3b5-4b46-8c35-d525ce227102", "comment": "Malware payload (Mirai)", "value": "6768cfd407400261ab449ecc93ddbf020c8335bd9dcbe9493d93b73f2ff8f594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753301, "uuid": "a5d5975d-ed2a-4453-b1b5-afe6efb9f705", "comment": "Malware payload (Mirai)", "value": "388cdec5a09ca9c69f8dd8f82c10f1ae409d453e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753301, "uuid": "39145b1a-e878-4197-9ad0-11f0651774e0", "comment": "Malware payload (Mirai)", "value": "03f152ee5a5c83c8a121f2c41b7fbf132a0951b57725646c9b0ae3d7700884a0d5a6d9b96347eee46cf31e69f43f1d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753301, "uuid": "34c62c86-e621-4e1c-bfa0-bdf336e148d0", "value": "T1BB14D71AAF520EBBD8AFDD3302E90B0139CC555722A47B363674D528F54A54F4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753301, "uuid": "52cec8dc-e612-42a0-9ad7-b59ac0980d49", "value": "3072:x8ntMibJebE/IEJVxqGMPLOh33Mjk2E61A88B6hh16+K:xICibJKYIexlELOpgc2A8o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753301, "uuid": "a2f129a7-280b-4ee3-9836-274884df5697", "value": 201184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753301, "uuid": "73a8a0e4-4543-4d44-9659-208a62bec06f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753301, "uuid": "7c5435af-708e-4ca7-9b08-1df0b9bcceda", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1f7469-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768973, "uuid": "cf3782df-41db-4ee9-b01b-6e082f3443a5", "comment": "Malware payload", "value": "fb6f74a7fd59fcbdf56065f81d8f06cc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768973, "uuid": "eed77802-cf40-4dff-9535-ab82e70962d3", "comment": "Malware payload", "value": "6844c65ab7fcf78fbecf910152cc13248f041a5b4857430bc5ff87a4ede4fd9f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768973, "uuid": "f01e4347-11be-49b4-a204-294fcbea40b6", "comment": "Malware payload", "value": "f7d4d3a86abbc559f8435d05f5a33d2157f76293", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768973, "uuid": "ec238450-e575-44e3-8147-887d39759f3b", "comment": "Malware payload", "value": "a96deb0ac6043ecb0177d5c78a0651455e896e51909e03e74377d48dce281c707324c61cda7103413476bd8628202527", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768973, "uuid": "bcd9fad6-99a3-4b39-81a0-6d91fea5e5dd", "value": "T165853375B50AC8D9D63DEE912E5DF3A80408898F3A91A7208335B58D59F7DFB8CE019C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768973, "uuid": "53f8b4b5-44a1-4391-aee6-4b175e73b703", "value": "49152:ARgv/C1/6g6uSSjyJDjUt3cK5QT6WGbIzgM+CLo4A:ARgv/Cl67et3hQT7GczWCLo4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768973, "uuid": "f9e3a5d6-faa4-4b1a-8bfb-d78c322651c9", "value": 1765779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768973, "uuid": "155a72a3-75c3-4f14-905e-660d105baa15", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768973, "uuid": "08f2a33a-b67d-47fc-a444-0364cd3b190f", "value": "1_0048481261.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664b87af-0feb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771763913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763913, "uuid": "1938a279-3fd5-43a6-a5f5-9a81289940b2", "comment": "Malware payload", "value": "be8f88c0669117d7b9687097ee16f5c4", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763913, "uuid": "4d28113b-8c29-4938-985c-cf3ef28849d8", "comment": "Malware payload", "value": "6863d2adfbc8c7953b228337a93b1ae6530475ff8364dcfd62e5c2f4e993ebe3", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763913, "uuid": "875df2ad-a138-47a5-8d18-c0bc08d09e12", "comment": "Malware payload", "value": "6923f556975a8341b8e8d0ae52235ddb50b8a7c2", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763913, "uuid": "3e822582-c458-4010-9073-686768856429", "comment": "Malware payload", "value": "8496d36e3b74beeb7ea295cd77f0a661fca58ddd42ebaa6d14e38fec89aa1818455a03858e136d37261a29a18d7621c5", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763913, "uuid": "cb0a1e74-e507-4301-8a8f-53ee7cd1d0d4", "value": "T1159633B181BA8B30FDBEF6729DBC63696513C35292548F74535A1BAB04CC3FA99BD004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763913, "uuid": "9962a451-2859-4bc8-bc03-003a30cda7a3", "value": "196608:r8z7S+mdRRAkQWHA3bXDImgyuTdlIhlC9ohd/FjMNM:g/JmRRQfwhTdUCe3tEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763913, "uuid": "0587c37b-47f7-4c06-ad47-f610c08a1ecf", "value": 8896378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763913, "uuid": "e510085f-01c6-4c54-a915-40eefc37a119", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763913, "uuid": "abf8f712-49f4-4613-88e1-4d8900f2c800", "value": "robomegadom.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b040b900-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753299, "uuid": "e8fc6ada-84a7-448c-af24-73c9eae9308c", "comment": "Malware payload (Mirai)", "value": "934d4716b441ad7185764c26d09ab3c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753299, "uuid": "d6c48ba8-c80a-4218-9b62-72ff06607d96", "comment": "Malware payload (Mirai)", "value": "688f61f547d837530d6903fdebae6c97539a108856c7d8b5849010a886153069", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753299, "uuid": "c8720745-80cd-4e2f-889e-8eec6ae3a2fd", "comment": "Malware payload (Mirai)", "value": "98419276faf7080f3ccf5a649e74d796813b6ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753299, "uuid": "deb9c54a-33b5-4799-84af-89cd5357dcde", "comment": "Malware payload (Mirai)", "value": "26970eac327cfbbf52e1aaccd7826ae15d8084ed39ae6b914771446e056f966162f2ad5b58d334ffcbcf6decc07f479f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753299, "uuid": "20207353-67e5-4d80-88eb-8a4c341bf65b", "value": "T1CAE31A45FC414B67C6C212B7FB5E428D7B2A17A9D3EAB2039D255F20378B85B0E3A581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753299, "uuid": "20f2cb4b-b2e7-44b6-9046-99ea3a70ba19", "value": "3072:MquVG6UmaUm2HcNbw4uFvlAJBAxZwZ64c6hh1xZ:MquNUmJn8Nk4adAJ6LwE4lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753299, "uuid": "51d92bb2-8444-4d02-9968-26229e5c3075", "value": 151072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753299, "uuid": "7725ba4b-efa6-4150-95eb-d172b66f66ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753299, "uuid": "8c5762f8-51e2-4925-8790-a32f16e2c877", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc18c1c7-0fe8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1771762822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762822, "uuid": "3cb2c149-657a-4553-b9c5-94e27d1bea7f", "comment": "Malware payload (ACRStealer)", "value": "049f6afa92e1a62413f7ec566b7bef75", "object_relation": "md5", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762822, "uuid": "d2dd0242-b905-412a-9397-86c6cf30d2ec", "comment": "Malware payload (ACRStealer)", "value": "68ca2e602ed8af643824add23819a73e861eff08cb61950b16a7ca4c940a6392", "object_relation": "sha256", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762822, "uuid": "9e34b94a-a19c-4970-a1e7-ec177aed196b", "comment": "Malware payload (ACRStealer)", "value": "6be0a505ec5ff0afad1a69b0c33fe56d695bad7a", "object_relation": "sha1", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762822, "uuid": "d08bd08e-c3bf-47b3-a3a5-f522c6c1de64", "comment": "Malware payload (ACRStealer)", "value": "15c172d0bb898fd3b6907319135b39952264a701d18b16ef1b3b63bb6a8fabe5e8f2c50918349c70805bf14806908426", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762822, "uuid": "7ebd6ae4-d154-4268-952c-70b4ffe1a309", "value": "T1C3969E11B10BC1FADCDE34B15A3A4AEFA9397D496B1500D3B1D97C2F2F306D26A36606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762822, "uuid": "dd0d591b-89eb-46fb-95d2-d2263ee0a8b1", "value": "cfc6d4cce1fd69ff3e7af533e7a773c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762822, "uuid": "38f6efeb-5b40-4b51-944b-3474cf2494c6", "value": "98304:XRwdwojfMk+r8gAmoOAujrJ5HPMguxK+d9SDicCCKBVjb3tF0:XudwoBugghhDgHb3tF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762822, "uuid": "6f205ad8-6e00-4ff1-89fb-e9e81432d677", "value": 8827712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762822, "uuid": "ef1193b2-4c46-49c0-a22c-6868dfdc8309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762822, "uuid": "f51c7073-443f-48da-83cf-c658a44c0b5f", "value": "python312.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bea838e-0fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753453, "uuid": "8750ff7a-29bc-4d6a-8250-2be0f2c8f360", "comment": "Malware payload (Mirai)", "value": "dc78d5022b48ce467860c9348581f8d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753453, "uuid": "7dc957b6-3d0f-4837-ac33-dc54e950045b", "comment": "Malware payload (Mirai)", "value": "68d7893dc16ce4f4966c869b1527634d3635b86243bd09b30eea831170bf306e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753453, "uuid": "c5fda856-eb97-4b52-8d4a-96ede2ae6a1b", "comment": "Malware payload (Mirai)", "value": "7745e48d4954ac921099193afbdab4cb917f1bf1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753453, "uuid": "1a02a0d9-ca57-4364-985f-20e2fc3d24e8", "comment": "Malware payload (Mirai)", "value": "4fbb04c045f65544303f2091f4ec6d199824d484b30ed353599d57a18ef9d7888a581a2af9abb21875adccb803bb1395", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753453, "uuid": "4d21103b-20eb-491e-8d2a-5014536f039d", "value": "T12A515BDB12005B719618855FB7F035B4624AE0D6AADECF14FB4C182E0FCAD4C7685B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753453, "uuid": "e558f4f6-a659-468c-b21e-b65bdd07a92f", "value": "24:MF2JMAebiBoLuZzEgEnE2EhEgoGbwrgJUf/AhM3k:MF2JMAebiBoLuZzzcvysGbwzAhM3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753453, "uuid": "1e43613a-ff17-474b-82c9-b221489776f1", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753453, "uuid": "b45e81de-0410-47a8-89a2-e67461d57a57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753453, "uuid": "82a66c6d-e055-4e2a-a989-2f53cb509fcc", "value": "android.exploit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5497ad-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755875, "uuid": "a85d9d32-da42-4329-b0ee-c1af52aba1b3", "comment": "Malware payload", "value": "6104699ae018c2477ef5583cd895af3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755875, "uuid": "c1fdeabc-be69-4d30-badd-b7075199f40c", "comment": "Malware payload", "value": "68dca26577a02491a150d46db129894262f8467414e68badbca6deb45f4f6d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755875, "uuid": "f84ac82d-b205-4aff-8d0f-8c1bb4deb378", "comment": "Malware payload", "value": "0fc009e5d890234a22a64d794387edd0f290f48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755875, "uuid": "d262b4e2-6ba6-4c9a-afee-76c9da36cb4e", "comment": "Malware payload", "value": "a8f962087ff8578272bf6ec1e305f164f2ae1346c83d85c15ecf22ea040d7711028ca6d7b00b7ee92add4367326dac25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755875, "uuid": "72d1b9c4-68c8-4993-bc12-230e315c71f1", "value": "T12FD2C04342F2276EF45A92B46C0B47BE5AB9781216D9CB6EC92601DE3D91FE38C34371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755875, "uuid": "ed37afac-29e9-44f7-9de2-302125c3f05f", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755875, "uuid": "4ed37fdf-6f8e-4f3f-badb-edbd6b0cec2a", "value": "768:bxwmq9h9EFp7NV8kNAriKIBoT+8iBtAzZyiN/MU81+Hrsa2:b42Fp5V8kirgBoT+ptAxNU91+L92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755875, "uuid": "2788e936-1ed3-4ae4-862e-7ac0c599c301", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755875, "uuid": "bf23f7ec-1c56-4b43-a91f-653d39b88db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755875, "uuid": "877db37c-09be-458c-b3b6-164a567bc020", "value": "SecuriteInfo.com.FileRepMalware.58517393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b26373a-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766149, "uuid": "307f0818-d39b-4ca7-ad8a-6d0b0db68e38", "comment": "Malware payload", "value": "773477cde46d4eb02682140cba194ef9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766149, "uuid": "4d53cfea-3848-4770-83a3-58e7e97c4641", "comment": "Malware payload", "value": "68ec2c674d57e2bdf4607704f3e1de1b42ec40df1f0d4a4bae923488999cf774", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766149, "uuid": "9e6f2462-ae3f-4805-81c5-2b76b1d386aa", "comment": "Malware payload", "value": "e0ec20dc88663cd4756fa3d84c727361dcf35b54", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766149, "uuid": "4a848172-cd2b-48dc-9333-9a129629b34d", "comment": "Malware payload", "value": "7123dc5191e11c976539b6a505fb119e76fbde81b44b10c39a42d370f63b6d6a2598b24e92ad578ea30d7b219e4d3ece", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766149, "uuid": "728c9060-d25c-410f-a3b4-e9f901f8fe63", "value": "T139315B7025F18A732950AA40F3333B969BB2950345A321CC76DE6E365F96B62A0FF015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766149, "uuid": "87d293d5-1956-4b02-b8af-dfbe614aa6e3", "value": "48:cniRxuGRys0DdvnSfr7lwnEAJIrlrmwJIrlrs:cWu44kQvIBFIBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766149, "uuid": "f2838dea-c17e-4d67-9787-71306f0bb04f", "value": 1658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766149, "uuid": "8d74136f-5331-46f8-acf7-d535a6052241", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766149, "uuid": "ed503447-cc85-4055-8370-f4ba4ed283ab", "value": "68ec2c674d57e2bdf4607704f3e1de1b42ec40df1f0d4a4bae923488999cf774.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a1fea0-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790571, "uuid": "48fdf8d0-0522-4dc2-b09d-bab6aa44bf5c", "comment": "Malware payload (Mirai)", "value": "a6972a2cb098bf4d1b2f43c44a88dd89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790571, "uuid": "f8eab295-e429-4f4f-a038-c7ce5d3a29f0", "comment": "Malware payload (Mirai)", "value": "6900a9dee07755d3ae82f429c9ae8399243cf1cc167978aa57e1e4e732cf7595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790571, "uuid": "160da51b-e6ae-4159-8dc9-6b187f06868f", "comment": "Malware payload (Mirai)", "value": "fa22af4b30df384c81a46b5511c8e62d7e2afe2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790571, "uuid": "9ac675ee-4cc1-4185-b078-79d207c1288c", "comment": "Malware payload (Mirai)", "value": "da9c02f5992cccf3b4101559eef221267ad3f6b4984e1d4549a3f30a538d52ecf66dced72bfca73b0103a5897e4688de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790571, "uuid": "6ec38fee-33ba-423a-8b19-211b9d5c41ce", "value": "T1E8835AC6BA43C4F0E8220571217BFB724673E53D1069EA86DB69E931FD13942972E39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790571, "uuid": "4420a29b-9e84-4641-b4ba-78b4d4429bf5", "value": "1536:EUhahkkCPpVoPXaG2aGlSSsxlX31cPmIrnl40xDsZGW:v2Rmp4XaG2aGlIxlX3iPvDe00GW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790571, "uuid": "6b821fc8-0986-47ad-a6a3-ec289ce17005", "value": 83632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790571, "uuid": "87ac3bb2-54ce-443d-a33e-289c3bd25684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790571, "uuid": "839d2146-5a69-4117-9cdd-51da19bf5291", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8d61f9-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769000, "uuid": "1d77ee66-f9fb-4d49-ad48-f0f777ae81cf", "comment": "Malware payload (Mirai)", "value": "d509393aa0dc8bb8e7fdd14a25aea12c", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769000, "uuid": "33ae7bf4-7f67-412e-9f25-912c74657267", "comment": "Malware payload (Mirai)", "value": "69b5a0b3bd14788d198e546d3a0fa123ccfc5a223d4bcd293764c7ecbbb41605", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769000, "uuid": "229b66f1-e333-4a17-a954-ae426d41bf7e", "comment": "Malware payload (Mirai)", "value": "1e8120ea96c9e5f50bc47b84db754191d495eae4", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769000, "uuid": "19dc94b8-ec2c-4328-9176-aa601fc2f1f8", "comment": "Malware payload (Mirai)", "value": "8fe4c3323fd03d76fd5a14eac49a1d50e82e5fcdf6316aeca1de11c1ce7b1138b5358b884cd5cd8c8900bfce5056591e", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769000, "uuid": "2f06f11c-41e3-4b76-b2e9-4c6df7aa3952", "value": "T157F2E110EA96BEE1C476482BA958C34364F7EBF1C6BF60B9075432682557C8A33DD783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769000, "uuid": "49b21f8c-7021-459d-a728-a28a732d28c7", "value": "768:AK/4Twx3VBT7t44PXTP2uEcKiePFPf2+mPK6cgU7j0Vxs3UozQ:J/4TI3VBxBfTPaxzvbZ7jfzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769000, "uuid": "614f8469-8dae-4026-92d8-cebb90e44e23", "value": 34436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769000, "uuid": "4af51df3-b413-40da-b666-8f097a034b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769000, "uuid": "3922d4f2-3678-4fd9-9c3c-46c258f12434", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0eae4e3-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778721, "uuid": "3b4c779b-af56-43e6-ae3e-a6ff9fe379db", "comment": "Malware payload", "value": "9ec49c4e3763b489d1a12e811636af9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778721, "uuid": "0cae8919-47a5-473c-bb5c-a6bd385ad66b", "comment": "Malware payload", "value": "69ba94b3ae8e39ca9b791fa9db219b188852cf38de0d8b436d5c441ae22429af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778721, "uuid": "8a222cce-7952-469b-a801-9ddc1a272e79", "comment": "Malware payload", "value": "2ab7318307db025ba6967942488018da369bc747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778721, "uuid": "4130b8db-d70f-417c-96cf-d209f5269759", "comment": "Malware payload", "value": "f2546ed031cb31d5811085200108b706ea23c55ac4e60d423a43a5c2a885dd4033e4a0c455f6e3cb443c7127943e66e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778721, "uuid": "59c1d9c1-6ad5-474d-90d3-d38a58782629", "value": "T17B765AC7FC9405A9C0AEE33189629263BA717C485F2123D72B50FF682F36BD06AB5754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778721, "uuid": "ca71b204-319e-4a25-8b5b-1869f6c71741", "value": "49152:eUhoYQqQpXkclXsqVDEeNPmQlAxsRd+mL8qF7FnQM/OrUoxwZP3ZRwtGi+fGDpTi:ef0C8IN+moA1/axF1VcBfEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778721, "uuid": "bf4abe8a-ad4f-481d-a17e-2b7f51994178", "value": 7164052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778721, "uuid": "21788ed3-c983-4fb9-86c0-90f737b17b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778721, "uuid": "142a6c71-919f-4225-a371-003074b06beb", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea68fd30-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752538, "uuid": "6bd569b8-ceae-4798-a0f6-dab40ddde185", "comment": "Malware payload (Mirai)", "value": "384a1baac72fcf36ad4d78c9700e07fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752538, "uuid": "1cd0c39b-8a66-49e7-9cdb-f0bfe748e062", "comment": "Malware payload (Mirai)", "value": "6a0c2a75df61c99057c7d671cb5d7119f36d34b1339d0f05fb90ea433ade22e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752538, "uuid": "1b947d75-1797-48e6-a766-534051026ae5", "comment": "Malware payload (Mirai)", "value": "540b8e04ab7d71830a46f8771ddfa06d6622e07f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752538, "uuid": "f6d8dc9b-0157-4b40-938a-5053adfd32e5", "comment": "Malware payload (Mirai)", "value": "e5c2ba088ee3418f7e0b28cc62ad46692f80c6723748a9c10eac406483b9648facadb81982db268767855f9244e9d4f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752538, "uuid": "ee56cb86-825d-445d-afc5-6dd2601f5f7d", "value": "T1A2D3BF32E0145CA0CC121A74787A567C1700DFB806E95243EFFFE5AE28B7DA579EDA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752538, "uuid": "ad63ecc3-e1ca-4d1a-b4ee-65b0ff9f4d2b", "value": "3072:sMEPoSS/jUyliXiwrLkcx73fjaaHy8K4JU0NGdbMBrSkmEZy:sMEPoj4Xiwrfx3aMy8K4pM1+rSPey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752538, "uuid": "baeed39b-4bfd-4943-b25d-dbf9ace56b49", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752538, "uuid": "d56f69d1-2e93-4372-88ac-32d4d1c72bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752538, "uuid": "b63cc442-e04b-4e06-9fcc-e7d4f81670f8", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdea238-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770796, "uuid": "dd09d704-92ed-4335-ab87-618cdc8e31fa", "comment": "Malware payload (Mirai)", "value": "02a65107051d80aad31077d3b968dae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770796, "uuid": "beab7df6-f70a-46fe-8533-2f2cdb07a823", "comment": "Malware payload (Mirai)", "value": "6a19224d35324d832ea1d41dfcca0be75f4939b873606a227bfdf78de670cbc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770796, "uuid": "fc01ad27-0655-4434-a944-1a62d3ac8f02", "comment": "Malware payload (Mirai)", "value": "5e4fd54008303a7575f2a38b107a2f9fe24f4e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770796, "uuid": "84882987-6820-4f07-94a1-90c491039e3f", "comment": "Malware payload (Mirai)", "value": "189042c09bb8f81f1f32045b59751e72d82d0f31b16e0a7c887a6fb9b13e33f1dcfded72492a011f418a658289baf102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770796, "uuid": "8b9087fa-3721-4bca-8fb1-cb8c7fb1929e", "value": "T16153F881B8819A25C6C557BBFE1F018D3306975CE2DE73129D245F647B8BD2F0E2BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770796, "uuid": "723ec9f9-267a-4833-8958-406d1756a52a", "value": "1536:YdnN3laIcTjKGo5Q/oNPAMKiYDLNIHiOataQyG:+AIG+GYQ/sPXvVataQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770796, "uuid": "8a27c035-3d79-4dc4-bafa-318f09a039b2", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770796, "uuid": "3118a73a-fcae-46c1-ab27-bf54e45140e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770796, "uuid": "5844b4d5-b0c2-46b4-b802-f5f678fffc04", "value": "3atoNational.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db3e647-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766449, "uuid": "f407179e-0e0a-4704-9d7f-40b30906593e", "comment": "Malware payload", "value": "6ee685feb8fbebf926e0fe0acc274fca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766449, "uuid": "efb9328c-9aae-4d8f-9055-101410adf1fc", "comment": "Malware payload", "value": "6a6554bb507e5cd0deff2899776a3848d202611d9bcd2d01f0430c8b96555df8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766449, "uuid": "0b06be95-5a89-4cce-8d95-a85fbf5ed3e1", "comment": "Malware payload", "value": "02857724b65fe7eae6b7318bc4b8d5c11c17a033", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766449, "uuid": "b87a69f8-4118-4a0b-a9bc-0301b86a8358", "comment": "Malware payload", "value": "bd014ff8660d45e390969bb631051cc9deafb8d02aacdd7ba3a681e13b95cdec44e1eb1b5665c8c932d4c63d42bc3526", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766449, "uuid": "d37ed353-aa3a-40df-95a7-16d344a3221c", "value": "T19B22587B21F08732D3D450C953A60E614E72AB4B996618B5F4BE9336AF2C90331D7F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766449, "uuid": "797c3a5a-08ed-4bc0-b81a-4df6b77a3194", "value": "192:cCu7e1OJi1OyPsN8GsNDM6p4hvZ5m5FoKNpivW:ye1OJi1OyPsN8GsND3p4hvZ5m5FoKNpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766449, "uuid": "91048fe2-788f-41ab-9bfb-6bfcce09ee80", "value": 10596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766449, "uuid": "d0bb2131-7ba2-4f0b-8dff-67f42f48810f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766449, "uuid": "bcbce4f8-71b7-46ab-b0e8-661cdaa4676a", "value": "6a6554bb507e5cd0deff2899776a3848d202611d9bcd2d01f0430c8b96555df8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a57f7c4-102f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771792964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792964, "uuid": "5c423cda-d1ba-486d-8cd3-b11ccb0b8d84", "comment": "Malware payload (Mirai)", "value": "1565c38a35e2123068496a046df4ad36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792964, "uuid": "efafe9c7-768f-4571-bee1-3e0398072df4", "comment": "Malware payload (Mirai)", "value": "6a7293bfb3fdf5f510029994de0440e5592e82ba04c50b5b51a623959fef509d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792964, "uuid": "acace4d3-4378-4497-9516-cad70b5aa001", "comment": "Malware payload (Mirai)", "value": "b525cd416ff4235249d5391f1910e459b93754d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792964, "uuid": "674651d6-7800-4b80-b489-e36202aab7c3", "comment": "Malware payload (Mirai)", "value": "87b7f69add78d4ddd2a983dfabe72ba6721b8074266ac4eb52d150eedca4b01fdccb6154d9425923768ec95debb67b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792964, "uuid": "3e587d41-8688-4641-9d5f-74f74c6999c1", "value": "T16D637DC5AA47C0F0EC131571217BFB329777E63E1019EA42D769A972EC12A41E61B3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792964, "uuid": "d54ff5fd-5cda-41b9-8d04-eb1958dae689", "value": "1536:xBUYHE/yP/mYFRKp2IQglaRwiDwmyfRGLmfVmkn+Q:zXHEGZvP/gla7DwB5mSQVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771792964, "uuid": "10329d9a-c4b7-4444-9981-54061258477c", "value": 71252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771792964, "uuid": "63e496f9-cde8-4c41-935c-e655ceaa9017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792964, "uuid": "a9208d89-a9ab-4fa3-a0ee-5c40db899464", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec36b89-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766155, "uuid": "f82ab28a-20cd-4546-9b06-9bac1dd3e397", "comment": "Malware payload", "value": "42ab57e7d874e3d0d9f5e678d8049ac5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766155, "uuid": "32774ac4-bfd5-4731-94c7-404835cff779", "comment": "Malware payload", "value": "6af09bea2ca0fb68967463ec094f0c0a0e1faeac8772f80e5206b4331d734318", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766155, "uuid": "1dff5518-b006-4e83-8b87-fcaf6fed2846", "comment": "Malware payload", "value": "9f9a24645b98b84955778dfc00d974ef4151b0fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766155, "uuid": "ec9c383c-1518-4686-94b2-be414bb47522", "comment": "Malware payload", "value": "a94b9dbcff2b18e5f4b9a2ed1554f682f3cd7ba8d41cf7e440ac9328818f4777151652b51ad12429d54698ccf5feb8d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766155, "uuid": "b4115c3a-d208-4a84-b74f-0214aac13c47", "value": "T10B12343B21F08732D3C450D953A65A614E72A70B892614B5F4BEA33AAF2C90731E7F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766155, "uuid": "00774eb6-b83e-45b1-903c-51967db5cdd2", "value": "96:cCuimB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjAAArs:cCuiK6p4hvZ5m5FoKNpivHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766155, "uuid": "b3a07f13-02ea-44fc-9caa-23a615be6c99", "value": 9531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766155, "uuid": "d5dbe72f-3e93-4586-838a-3545a0593504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766155, "uuid": "e065c8e6-8c01-4e4b-aa1e-5ed920ea619e", "value": "6af09bea2ca0fb68967463ec094f0c0a0e1faeac8772f80e5206b4331d734318.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff40295-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771794, "uuid": "e13be97a-08e1-4621-b3ec-5e7b9c469d36", "comment": "Malware payload (Mirai)", "value": "66a3b65a7797c78f290d39fa0f1fabd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771794, "uuid": "d9811a3c-3d61-4922-84aa-36038fc6da6e", "comment": "Malware payload (Mirai)", "value": "6af9813c79842fe9e490f043d7eeceb1bcc35adec81d8dcfae947911ed146a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771794, "uuid": "dd233bec-6eea-4185-9517-4a53c7be6f39", "comment": "Malware payload (Mirai)", "value": "70b8c1ec7f495ea60634ef17675a9a888b8a7f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771794, "uuid": "e7840a79-4d18-439b-8f28-0c17ee5dfbb6", "comment": "Malware payload (Mirai)", "value": "6aa6c27ec7ca74c02449c378141114e81bf9bc9fc90d02eec13da5771557870a00303c38a30e2cf2956ad24b7fe15f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771794, "uuid": "4b06f5a5-74ac-43c9-8c64-621454cd7a2b", "value": "T15B13E0DCB89FB889C99D0CF58592835DD689F280B6856F8F23160D1CBFA280FB599570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771794, "uuid": "78662df4-9ecc-4a48-88ed-d3f21cf2fe11", "value": "768:/RZe/ZCbkHnlrbF/8sgZHP+493V38GH5LbkVEGwrfQ+uWSWn:R2UXF+45V38GxPGw0+um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771794, "uuid": "e92d269d-206e-452f-b048-8b863e6d2041", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771794, "uuid": "aa4812b8-d8b2-4acd-8d5b-4b97596b6463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771794, "uuid": "2df59682-21cd-4751-ba42-2c26a79c41b3", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b491b1-103b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771798511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798511, "uuid": "592b8463-19c1-457b-87a1-67822083f8bb", "comment": "Malware payload (Mirai)", "value": "ca552ed18a6330f632313f78d6c0d9f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798511, "uuid": "f4ec3041-b630-4d71-a5e0-6646b93e8945", "comment": "Malware payload (Mirai)", "value": "6b11cd77e0b3490f55b87792e6aebaf0389914d9927e5ccb16d76f58ad26538d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798511, "uuid": "f46e6a52-2162-4319-8864-8a5796cac6c4", "comment": "Malware payload (Mirai)", "value": "c0ad57b79e046903bd5f2f4697aa861e54ae76da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771798511, "uuid": "801a0741-aab5-4fc8-bf24-8426fb246c91", "comment": "Malware payload (Mirai)", "value": "b9756f751431e2861cf4a6ab9703b361b09ef47a9a4e8760ab1830867445c7381bed1da3334200dac0a09e6c5e9ab458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798511, "uuid": "e5943ef8-ca2f-415d-b366-a1a3921ffb7a", "value": "T1DBB31A42BE529F13C5C261F6B7AF42483B126B7CD6EA3142ED247FA1274B4DA0E37611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798511, "uuid": "e16ba5f1-4996-45d8-8060-5894b1a48c0e", "value": "3072:QcPaT9sVLvyo6bV97BwEtsZDcd/4d1+xWS:JaT9sVLq3R7wEtsBcd/c1AWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771798511, "uuid": "84c56b3d-e8c3-4268-a749-268de36ef503", "value": 109168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771798511, "uuid": "19a88555-8f7a-47fc-9c4b-d2b0570be90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771798511, "uuid": "85040e2c-d2e4-44dc-a90f-d77f72ab767c", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e6d6e-102e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771792667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792667, "uuid": "6632c331-f4fa-4e85-9224-d2c18e330412", "comment": "Malware payload", "value": "b9abfb05d7924a758793f5ad1d190d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792667, "uuid": "ca66077b-0c66-4aec-8383-94d0daad89ee", "comment": "Malware payload", "value": "6b58d493596b7f593866ef6f42ef1e1a7e897d5a2435839511a766f7d1bf7ec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792667, "uuid": "739bc084-b41e-4047-ae6e-366c89d4043a", "comment": "Malware payload", "value": "9201498f980b337c1b59dd21f5d6d548a7298bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792667, "uuid": "346f6f4a-a660-464b-898a-69c44a90ccf7", "comment": "Malware payload", "value": "423fff000d0904d4fabe7c358588bb23651c084d5dd5952303ffa164923c5e528eee4e1f361de56974807b3343ebae68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792667, "uuid": "2fa81075-01c5-4f25-a0a4-60c400c8aecc", "value": "T1B9A35AC7F801DDBDF84AD77744538A06B531E3A209831F36626BB867BD352A44836F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792667, "uuid": "32559191-5e49-4b6a-9cff-0e9a968921d7", "value": "1536:K8Bqhigi4okSZUqwgbYR0O6h+Reu0nqNH813W5dy+bH680vZ/uCM42qd5IqDa/B:maZUgERJou0nqNJZ6Dvd9d5IqDsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771792667, "uuid": "20bb4254-58fa-4678-82ca-4274424bc9a7", "value": 104808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771792667, "uuid": "de28deef-f20d-4b1b-85ce-fe05cf91e679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792667, "uuid": "f6acb531-c261-47b2-a2fe-d34b60323bb7", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6750f236-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766492, "uuid": "afc8fca2-a50e-4ea8-85b3-8dfab17462a6", "comment": "Malware payload", "value": "bc73955f75a526ed1bd27a2e438bc38c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766492, "uuid": "d838804c-692b-4722-95f5-0912c1d8f0fe", "comment": "Malware payload", "value": "6be66a8360ccd4411b4216c875501b77a034e35a9a2888edb2910ce0689bd8f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766492, "uuid": "c6128966-58be-4320-82c8-e1b58a739e30", "comment": "Malware payload", "value": "7fba0f682eb9f2e75b27d91691fc11c434efc641", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766492, "uuid": "8fe1a91b-b7c9-43af-a3a7-03be4f688210", "comment": "Malware payload", "value": "30908fc0ba62aeb496cee638e37255edab3d0a4f210b51dff041d1e241baeb3ef05e2bfc6096ddebeaaf841ddeb4ef4a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766492, "uuid": "96312bcc-19f0-49c3-b07e-366fcc459103", "value": "T18B12B57125F14C332A605A84B3772BA6ABB7D95385E3318C35DE2E256F87B02B1BF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766492, "uuid": "4076df02-d989-4039-8e6a-00ad937cd16c", "value": "96:cLu7B6y6fOSwxkEgI4GKg+CIBcIBZIBDoYsEKEV/ENE0rEAEpuEFElCvd:cLul6wlXFX2lv+MDxX+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766492, "uuid": "300579d8-a1ef-4417-a245-deeb5c5519b1", "value": 9479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766492, "uuid": "b7098809-2980-42a8-b723-db2b8b5007ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766492, "uuid": "0fdcebce-7dcd-4313-811b-1592f07535dc", "value": "6be66a8360ccd4411b4216c875501b77a034e35a9a2888edb2910ce0689bd8f8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7e93c5-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752542, "uuid": "9c0e23e4-ddd8-4d90-b915-2883ea8c9750", "comment": "Malware payload (Mirai)", "value": "d502a2c6fa01cba1fdab4ee8dafd6477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752542, "uuid": "0c1a9efa-6d15-45c1-ac9d-d8a5fa57b87f", "comment": "Malware payload (Mirai)", "value": "6c3069d84cde3a690f4c0930ffd8378ebbae3fd07d9f8c09d14889e9ad96762f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752542, "uuid": "f7533f04-4aee-4c0f-8d04-3a3f1a065c9a", "comment": "Malware payload (Mirai)", "value": "8063f299eca5923c7b921b2dcf5ecffbbedf581f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752542, "uuid": "0ea52fc8-d58b-4888-a29d-9c0382332871", "comment": "Malware payload (Mirai)", "value": "4164532ac0b3f7807318ff842c7927bd95269b05560a21ce19f648a0ab840c29de46fae681b22db9e959d0228f646252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752542, "uuid": "dcce938a-45e9-4c96-8b2b-8d787a05c190", "value": "T17004392F258191F0FA411B746BCFD3976C290BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752542, "uuid": "699e86fe-c4fb-49f1-a0c3-a12fa2ab4839", "value": "3072:ug8JifJCLRSk0L6L4CUbGyJltg+6TgO/NVGLxNxKurrz55UsUX/:ug/V+8rqyJkn10Dx3rz5edP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752542, "uuid": "58eac372-7034-4d96-9dd2-fd8bc9bb2b72", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752542, "uuid": "4e717683-72ee-4c9c-95fe-4b2d5377f996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752542, "uuid": "e2cab81a-1151-4c26-9ef0-5041df18de5a", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34281ae-100e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779101, "uuid": "7c39bec8-f575-4a45-ae3e-1deb076ba31c", "comment": "Malware payload", "value": "eaafdee9ea32dad3ad227980cd937956", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779101, "uuid": "155976ae-0426-40d8-8f32-25b83674967e", "comment": "Malware payload", "value": "6c99d25b3f5a1f9148009475ff2c944b562bb06339ec0555c05208cbb5dd2445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779101, "uuid": "af1604ab-8d63-4279-8fb8-65ec8c713b23", "comment": "Malware payload", "value": "6722bd5a3e4a05fb4912ef40462bfb8babd80062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779101, "uuid": "c4a5424f-3eca-4ccc-a411-f325403e8019", "comment": "Malware payload", "value": "4bb225c3969ce4ab42d5afbb91831f7444c07b7e0205c653dddebd100b4f308a8d972e9856cc7e23650a93395a243458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779101, "uuid": "2e5a5ad3-8aea-4094-8f72-2a5fa066734a", "value": "T197458E56B2F374FDC067C030839BDB626935F46541326E7B61C4DA342EA2EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779101, "uuid": "183b8678-f85c-4f4e-9d21-87d22fbaf9ac", "value": "12288:RyMaDhKS9GYaUsI4RnO5tkd0+NCaedYKlmyStSosC5kCSgJ/CWh:R5aDhKS9II4RnO56m++dYPTsyLJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779101, "uuid": "a40f6c14-cc91-4b1b-8c69-5daab11bc8db", "value": 1177376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779101, "uuid": "a1a0b74c-eb5f-4ce5-812d-de030c39cd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779101, "uuid": "0e930046-72c9-47a3-abef-56526699075f", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03904e46-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766324, "uuid": "912b53ae-b411-49df-954b-5cf7d7711636", "comment": "Malware payload", "value": "40e512f5cb03a8dc68af9dda7ac95864", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766324, "uuid": "f845454a-363d-4f71-945f-7afb64272bbd", "comment": "Malware payload", "value": "6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766324, "uuid": "06e40014-05f5-4e65-85c2-0b2dd12aef4b", "comment": "Malware payload", "value": "40a733a4349dcb56d0192049ebe4babcdc6d2b09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766324, "uuid": "eb5b6d82-d44d-4cab-ab12-3f8befa728f2", "comment": "Malware payload", "value": "b872787e0aca017961cbeff9aa703edf4e432fbb9da2baa108749460d49f39ab016f330e153e4e752e0f8cfc1fdeffa1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766324, "uuid": "1170b1bb-79b9-49eb-bb5c-53dd9819b947", "value": "T18132D67025F18D732E25AA80B3372BA69BB6D95345E3318C35DD2E265F87B12A0FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766324, "uuid": "d50f92de-eee9-4788-ba6f-02db3e9fb8f9", "value": "96:cCu3k0B6VzYMPZo8zS+6+x+s6IBqHIBZIBcIBSIBrIB4IBNIBrIBFRDfBVZUdR1p:cCu0g6VjZYBe4Tm/9g/C4Q1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766324, "uuid": "71ce00ba-9883-4771-b18f-61549b5541ee", "value": 11492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766324, "uuid": "01a054f9-b22b-4180-bb9c-aef4cf0c0f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766324, "uuid": "7c6b9e9f-e3cf-463d-b699-44ce5a434447", "value": "6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8a43ec-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768995, "uuid": "6cc1db69-c4b4-4c9d-a354-3951fe6a4fb0", "comment": "Malware payload (Mirai)", "value": "259ab0277c9b02c032abf4a1ed307096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768995, "uuid": "eb74a57e-5448-4036-b15f-dfc47871b51e", "comment": "Malware payload (Mirai)", "value": "6d899f48f3741dbf23de4164485737d0b5bd0268b3cca2460a8a6d5fdb99911f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768995, "uuid": "1510e9fe-8cb2-4960-b2fc-1c3ac8514ee5", "comment": "Malware payload (Mirai)", "value": "d2492524bb35b1888fc93120f14fac3139c5e598", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768995, "uuid": "394374ce-8926-4da6-b161-88f4df0220e3", "comment": "Malware payload (Mirai)", "value": "b2c96a6473f2824c6e71c96b644ceedea26cc2be28b69c4a947a4866a42de9189e1871267696a20949e125ed91dbcfaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768995, "uuid": "9e8f8bae-7bf0-498f-b07c-6a8b806001e4", "value": "T152E33B46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768995, "uuid": "fb207257-2bc8-4a1e-8a31-03e6d1664926", "value": "3072:qNuculeEaMTzbx8PhGWNFYX7QCK8E/ZL1JuM/900S:qNu2EaMTzbx8PnNE7BKHxL1UM/9tS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768995, "uuid": "708d82c0-12cd-4484-9517-4a3e322ac361", "value": 154311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768995, "uuid": "cd9a89cf-757d-4a53-be19-560ed846a75d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768995, "uuid": "b85bc10a-0059-44b1-bae5-263242d90167", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5569cfa8-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784071, "uuid": "8231adf4-869c-4949-87fb-ea05e3d0a5da", "comment": "Malware payload", "value": "19f2ac20ee9c94dd27861cbd65fdc669", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784071, "uuid": "f4c02fdf-1009-42f6-8f40-a5e489757767", "comment": "Malware payload", "value": "6da682d86a23652dc735e89b4c17ac6fe64d70d330b32a600f8be452d45bf919", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784071, "uuid": "bf870d51-4cb7-4dbd-b92c-56af999f17d1", "comment": "Malware payload", "value": "a96d8d5c5dcdcdbcfc13f473b6dac9b8bd073224", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784071, "uuid": "591ddf3a-b3b4-4593-8923-dd0c8656fa32", "comment": "Malware payload", "value": "652c572c0dac9b3ab870f9b4124d3cc1ba194e8e0ba878cf1f5d336ad4f3c3825de9ff907bce32481f73d7590746f8ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784071, "uuid": "d0dda603-a384-4a2b-bddb-05536b2956e5", "value": "T114F2E12AAA9F5560C347B37B200E6DCCF50E5B17D5DDB27B37A491CD8D1289B4202A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784071, "uuid": "892dbb66-462f-4261-baf7-b42b3428c302", "value": "768:kYQP+NAiJQucR7gWUU/X10nCOLZjveitise1o2H3CrpQ:kv+WqQuctgdcmn9hmeisOXClQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784071, "uuid": "7e06f03e-3924-4893-a04e-95e1099c3eec", "value": 34629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784071, "uuid": "a50b1d8a-e319-4f93-bce4-35f75f470fb8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784071, "uuid": "5c9d3ee2-d276-408d-848c-2a1313d83b2b", "value": "adaptix_beacon.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db622aa2-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771840, "uuid": "ac459ebd-d480-4342-bc8b-f86a09638d87", "comment": "Malware payload (Mirai)", "value": "6dc7e1565669293ae4d33207442c50bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771840, "uuid": "3ea81be6-40fe-449c-a02a-5c07a33a13e0", "comment": "Malware payload (Mirai)", "value": "6e2b4cef923bf3768749e7d983a8da17e6a1211f901d4e2a7b0bfc24898151f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771840, "uuid": "44ec2a74-34cd-4bdb-984e-999bb701ea4d", "comment": "Malware payload (Mirai)", "value": "666aad764201c2bea3f64d6d16e2bad39b3d9b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771840, "uuid": "13163f9d-5773-4c44-9488-a4569e32631a", "comment": "Malware payload (Mirai)", "value": "0177ede5bfd8b2847aac4648d9a6daac87345be77814214ddae9e24c8f954724b07e5b156dcc9b1d06007eea3596f98c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771840, "uuid": "7658334d-9ef1-4be6-8ec6-de197f4a45b2", "value": "T193B3C85E7E218F7DF768863047B34B21A35933D627E1D685E2ACD9041F6034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771840, "uuid": "c0310cb5-3f89-4eed-92db-15630b4e821d", "value": "1536:pTkwJlCS4RqbYLajrSdBiOw1KW5rLRCNW2MOg2TakewrlHDSbABKy:pJ8ebpjT1KW5rLRClMO372bby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771840, "uuid": "774e01f9-4c80-4f08-b060-68c100b42489", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771840, "uuid": "d7e27ca4-a1cb-4402-adf0-defc2cbde77f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771840, "uuid": "be34db4b-7300-4fe5-b2ee-28a121d8d193", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3a3a6d-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770791, "uuid": "9b13ed34-f9e7-4008-9c46-5529f0132ea9", "comment": "Malware payload (Mirai)", "value": "3cbe1ab9828369a6a9cd188a4dd8213c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770791, "uuid": "332dca8c-3b17-43da-86a0-9bcb7c44a31c", "comment": "Malware payload (Mirai)", "value": "6e87a8f307b840926ada96378cef55692d571aea601b2eb094ad0784a4961132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770791, "uuid": "7ead8d2b-9235-4a3d-be62-bae95267f316", "comment": "Malware payload (Mirai)", "value": "77bc8c766f69fdcebb41dc990b3624adfbbb5403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770791, "uuid": "f26ee599-1375-4762-b079-e19d0d45c7f4", "comment": "Malware payload (Mirai)", "value": "e295d7d16d6a75bdbd913bba66c4d83594e07578899e0dc1a16d51268773794f0a54d46e9960f90c7f1449d04804c7cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770791, "uuid": "362440a6-946b-4262-9c55-7fe3ba9fd25f", "value": "T13363851A3E119FBDFBAC863887B79A20964837D616F1C584D15CEE015E7038E781FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770791, "uuid": "6196e9f6-8b2e-475d-9d8a-091508f4ebb0", "value": "1536:GVpuIaAyz90k15bNW/ZBVm/EGXCgPxJpmnx7d6bpcoE:GVEIJp8bNKBVmzhxJIGLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770791, "uuid": "5e8666c1-6f2b-4274-821a-7f7b6e71ff5c", "value": 68276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770791, "uuid": "416c761b-b030-453b-bca7-d9baa2baceeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770791, "uuid": "c399422e-d1fd-483c-b3c2-05d8841376d3", "value": "3atoNational.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0c782e-0fe8-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1771762632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762632, "uuid": "e04af3b5-a05b-4678-9362-878ebb38edf7", "comment": "Malware payload (PureLogsStealer)", "value": "0babdf4f2c64b9a140a08b72c53ed4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762632, "uuid": "c287f538-6933-411a-b414-2d02ed540f10", "comment": "Malware payload (PureLogsStealer)", "value": "6ea853b3dd5c90347452a6fa285c1bb14ea3334ebf4422562e890e5ea5090c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762632, "uuid": "784badd3-1efb-4acb-b718-6476abd4d3b9", "comment": "Malware payload (PureLogsStealer)", "value": "f79c555dd3d607ea0328af54e33729cea875d2fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762632, "uuid": "857a5e11-f4ed-44d6-bba3-b1bee551a20f", "comment": "Malware payload (PureLogsStealer)", "value": "47a107256dc3c123738422e051ac75df77b6ffdd7dbd9990be9625fa3f7f0e923a2c20c5807aec2b8f3754fdf069cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762632, "uuid": "9c8af745-e9bc-42c1-b827-1d7d1c2b187e", "value": "T104E633CA2B7AC0C1DDDA04347CE591B45727B1BCB8E1B2F02210EB45E998DBE4D7176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762632, "uuid": "e89f1cc6-d00c-495f-b144-0ffc8c4c19bf", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762632, "uuid": "88c71b8f-45e5-47b8-b3cd-f751dedb972b", "value": "393216:Ucw2aky4UHWQT1w/YBMcPsx4/9kJIWIAMZZS7:Uc9Py4qZwABMmYu9XWI1ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762632, "uuid": "feb3671d-1568-4498-bf87-39dfe539e255", "value": 14402048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762632, "uuid": "a7ac246f-7d5e-4b89-abb6-e510a5e91d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762632, "uuid": "02c8c815-dbf3-4d55-b858-e838e7cff457", "value": "Installer_v3239_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb6ac8c-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771752945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752945, "uuid": "e646eaeb-3daf-460a-aa23-569b7743867b", "comment": "Malware payload", "value": "b1ef596c41de3c248c5df128ffd65121", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752945, "uuid": "9596a0a7-a123-4bc7-9c96-cc714dbf7839", "comment": "Malware payload", "value": "6eac94b358df6a0edf44c3c91215f18acaa555b4ab43eb17aace09e7a98d6ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752945, "uuid": "dbfcd866-8b21-4798-a6d4-e87cae9f6279", "comment": "Malware payload", "value": "2691d91d711b8f54df9b01fa25be103b9a701dd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752945, "uuid": "5f38d7af-9efb-4bf9-bdb3-ed27ecef6606", "comment": "Malware payload", "value": "bde34f08471143db23c0d2696e0453d52c045aebd3704fe45d913440c1b724b3e880755ba289c9a91e956926582f4f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752945, "uuid": "e8cfa9dd-d2fb-45cb-b9d9-f5ec31085f8b", "value": "T1BA934C02770D0A43E1671DF02A3F17E1C3AE66E120E8FA496A0EDB49D6B1E365547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752945, "uuid": "3ed88f33-7e1e-469d-b79d-c4c72b87cf9c", "value": "1536:V2NwWKG7M9juFCd2qx0TEl/ID51xjSL7vnN3A+MO0J9Wre2b+UzQjxXq/:AwWH33yC51xeLu+MzWrehx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752945, "uuid": "61b17321-c3d8-43d2-8a9e-3d49e92fac82", "value": 96512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752945, "uuid": "ca05f708-9e28-443f-8702-0b8f715a4708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752945, "uuid": "7a5c9550-0985-413f-911c-f8555d71d455", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e437ce-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752532, "uuid": "6498bee5-f339-47b9-9630-0f59cdf74ab4", "comment": "Malware payload (Mirai)", "value": "ab0b6c95e5bd1541b3cd0bcbbc9185f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752532, "uuid": "614898a8-da51-4728-a4e5-08721f341e1d", "comment": "Malware payload (Mirai)", "value": "6f189ed8ff5deef6510a6d8f51a03bd68b264e353c711dafe92dd00ff17626d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752532, "uuid": "2c5b22da-842d-4062-935e-e0d916a100f2", "comment": "Malware payload (Mirai)", "value": "ed7cbd910b7eb74d790d80406b6c1d8e4f5f8832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752532, "uuid": "c0255f0c-327d-4b2c-bc46-9a94855162f3", "comment": "Malware payload (Mirai)", "value": "a8964326e91b1593fdb825fee053cac0945bdc514274872004d476e8ac2bccc73704e8df8cadce92e3839d15d84c97ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752532, "uuid": "a27425ed-8dba-494c-85a4-fe3a7a0007cb", "value": "T11B146B2BB3C39CD6D11067308C316366776FDB081518EAFFDA0B3794A997B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752532, "uuid": "c1b681f4-a22f-446d-bd98-edc17d758a86", "value": "6144:T9BOm51554Dk9mLH/Dex/omafjiFyT7IKTtH:n4DkCrexdsRT7Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752532, "uuid": "7143e70d-10f5-4ad8-9c46-f278192e96d4", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752532, "uuid": "52e1f2f2-2205-4056-a7cc-0cf24ce123e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752532, "uuid": "6d6c5551-35d8-4b66-8801-31ce8fb028f9", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdb42bb-0ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767467, "uuid": "52ef9627-5c2a-48ae-85d5-8bd60628000f", "comment": "Malware payload (Mirai)", "value": "b2d393ed324d481f1db3df991b1950f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767467, "uuid": "9fd717b0-0136-4446-b657-3888b8d7868f", "comment": "Malware payload (Mirai)", "value": "6f28c7f9d6c631bea5d1356861eb5e667fc06027d80fbbdd0beee82948fa098e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767467, "uuid": "c7da9280-16cb-45d1-abd7-f5cd38c42ede", "comment": "Malware payload (Mirai)", "value": "c82e0c7b695e93d79d6ae5a60ea18e8cca7ced7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767467, "uuid": "26d6c05b-c872-4ddc-a589-81cbdde83a94", "comment": "Malware payload (Mirai)", "value": "c875a2f9d50da6162423bc74be12d809032ea047c5297b0a92a86ec257523655fa63af1f15f6032bac156adb8da25bd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767467, "uuid": "7ba02f2b-ce57-4aaa-8b93-82d74ce13fd8", "value": "T14683AD63CD2A1E94D19986B075B08E384733E112865B2EF758AAC776D087E8CF54B3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767467, "uuid": "4a060a41-e6c6-4e62-9a20-d6f9683f79df", "value": "1536:Csd5xvDofm8GzSB+Je4Kt53lIp0KCOkRitjkF:CS5x3pzEie/tMp0KWEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767467, "uuid": "e3514290-390c-4d87-b645-5cf315a29f0f", "value": 87908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767467, "uuid": "63758c59-46aa-4f1c-a365-4815d0271a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767467, "uuid": "aa448c94-226b-4e0d-aff1-54712f15c4aa", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d02c67b-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779413, "uuid": "fd3202d1-f56e-40f4-a1fd-3e0a2975c4ad", "comment": "Malware payload (Mirai)", "value": "adadcaa69563979d48cb1a70ce995b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779413, "uuid": "18ba05d7-87ba-4bc0-b4ec-82423dcc2a26", "comment": "Malware payload (Mirai)", "value": "6f51475872b573c1d9c137526e4b93841a3f3bb0519bac29aecfe11cf43743e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779413, "uuid": "9c212d47-fa55-42a6-8f52-a057d668042f", "comment": "Malware payload (Mirai)", "value": "c09e40f4e6e896a9b12ecf135e28187effd32b22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779413, "uuid": "1926c38d-db89-41d5-931c-4037099c49c9", "comment": "Malware payload (Mirai)", "value": "5f12b19782b241c945a0df54dddea5180154dc0981d204287c34beba414d188bff0b4c4ca0638869e7011fed8977365e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779413, "uuid": "c1b7f571-68b1-4908-b75c-6f225f06121e", "value": "T1F953025266BCE83BCFE2C1390B6801F645CC5DF46496900E53CA7DF88E06968EBDC687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779413, "uuid": "319bb86f-9e6a-43bf-82e6-dba99cc69fc8", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uWAQd:MaHJgMo8FwOA4zUFGUO3UhARQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779413, "uuid": "3ba8fba3-e826-42fc-9368-e30ef8ea1eba", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779413, "uuid": "92cf1465-4f2e-41d7-bb38-36a41c8dec49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779413, "uuid": "d4e11125-e09a-4e06-a8a0-a0e542c53279", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e303c7-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784097, "uuid": "9a9b55ea-6ea1-496f-8e76-6e1035f6d687", "comment": "Malware payload", "value": "4ee96aa1d44ef3dd9bb3043032ed30e3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784097, "uuid": "7c42efcf-1fbd-4728-aa97-171e1d5226a1", "comment": "Malware payload", "value": "7047dedb4a79f06667afc7107cd2ae57e7a34d65af6d1e9c418b74e9207a7638", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784097, "uuid": "af51c1c7-ec2a-48c7-92cb-736313909856", "comment": "Malware payload", "value": "691394eb7398a5039929777c7ebdf3ffee12a06f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784097, "uuid": "be30b285-94b4-441e-a9d9-205c1f2ee73a", "comment": "Malware payload", "value": "ddf84e6b027535e92fa33dfb6df2eff96f9740ce049c91fe06d7bfb3e7ae6fb02819ca37b74e146a31fa6d7e1a3135e4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784097, "uuid": "439c3056-0096-4515-a8ba-b7c940fc0918", "value": "T1E0227D36B01A0F30D9AAAB74F0945B9AF85C148FF2163D25B215AFB3C9C31CF5264AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784097, "uuid": "59885813-10ed-4dc6-81d3-510ba68636e1", "value": "192:eEhMOQfFUUp9264wpmGhejb8Q7Z/c+8poF1d3jvvtl87e6rGxjPmK6:eqNQfFzp92hwYGAjbVcfa7pr1lApyxj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784097, "uuid": "94109320-8ff0-49c6-9dad-ca78a5d41a8e", "value": 10696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784097, "uuid": "71339e60-8481-4934-9909-09cd12a5797f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784097, "uuid": "81b530c9-628a-4d0b-b1f1-9cbb8c55e46e", "value": "follina.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c309990-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768728, "uuid": "bdca9fbe-cc4f-4db8-a88b-3f908c7a0911", "comment": "Malware payload (Mirai)", "value": "4aa1e9f9b9d1c8ca506995b6fa86978e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768728, "uuid": "7f4e79aa-262e-46cd-ba58-9ce600c792e4", "comment": "Malware payload (Mirai)", "value": "71a07cec8a8b815d558c2315d32f11c3df037735f75902d2b5dc6a18cdc701e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768728, "uuid": "da965ace-9887-4baf-90a3-ae139c26679c", "comment": "Malware payload (Mirai)", "value": "a39b85094cfdb98aeef38200a74e5c3c9eff4202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768728, "uuid": "00c7ceb4-3f80-46d2-996c-1e79e611e7a8", "comment": "Malware payload (Mirai)", "value": "a55cd8805305522f6b534845b509bf029db6a3ab8b8e8809aac50da82f444cec76a85e94a6f5b65f75b7b53969931566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768728, "uuid": "dfce650e-589c-4e28-a2f8-d38e4973831a", "value": "T15BE34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768728, "uuid": "e6274f4b-1e49-4faf-9831-775442a10e1e", "value": "3072:luWypdcGShA/TSPA39TsZJ243nxl9XzrTmdWp:gCGShAr7ThAxl9TmdWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768728, "uuid": "c0d932bc-07bf-4d16-8e98-8109124fafff", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768728, "uuid": "daf346a2-0c32-4bd7-9da2-f2053d851136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768728, "uuid": "454f2eda-f1ec-44bb-90ab-ca0769079f4d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a133bce1-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779474, "uuid": "4fcc5ac2-14f2-4368-959d-877699a7a4d4", "comment": "Malware payload (Mirai)", "value": "d9c8d5f79fa298db0e54f811969a65c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779474, "uuid": "adc72bbc-f615-4ce3-907a-2a1fffa05f66", "comment": "Malware payload (Mirai)", "value": "71c4e1528450d9a0a27f007f6b93753f8124f4545a40025af38eefb86fdc48b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779474, "uuid": "3df1b75c-e0f1-4cdf-9e45-b732b818ef84", "comment": "Malware payload (Mirai)", "value": "597fa29cfaa16977ac1366938c0f1918ce61f9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779474, "uuid": "b4cf18a4-2b44-44b0-97f1-1bb6b344c21e", "comment": "Malware payload (Mirai)", "value": "00ff03ff09ff1cb630a07868a477876533b437ce5b2716b195c0efc853b02c3e7eb095e616ab9292529bc5b845314401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779474, "uuid": "e1cdd913-cbb1-47a2-8b9b-a1215ef4c1d8", "value": "T1C193D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779474, "uuid": "8dff2052-62cc-483d-8fe2-835e3dfa4e72", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqhKK:NFjXYyCEx04KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779474, "uuid": "3220d461-bb7c-412a-9a46-df17358e391b", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779474, "uuid": "bf4836d3-9ebf-49de-89fb-be3de6f8b8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779474, "uuid": "c2f57cdb-7a28-49c4-9da0-8a988f33ada0", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e89ba0-0f86-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771720525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720525, "uuid": "cc825fbc-eade-4158-a44a-0e701f634ceb", "comment": "Malware payload (Vidar)", "value": "e2d7f12b53c2018279872b478a1801f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720525, "uuid": "04530d7b-e5a2-445b-ab57-e65895fa9891", "comment": "Malware payload (Vidar)", "value": "72cf8ed16f27a07225e88c4871a7e9cda0b089c086e3a84e40cda6704cabedb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720525, "uuid": "0c86c12e-f80b-4f0d-9a77-a7fb42bc8412", "comment": "Malware payload (Vidar)", "value": "09b622c95ab36cee278d0ca181eb6c2b80df9287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720525, "uuid": "d52b4d04-6254-4ac4-ad33-391a537b8e83", "comment": "Malware payload (Vidar)", "value": "7ee19ba2597b9ef739cdb9d68513042e591fbfe856624adcb44fe2b4609de1a7237fdb1243f1ed7d2118d63688db3b83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720525, "uuid": "e2bca038-c21a-4b38-b52b-c31f4f5c1e2d", "value": "T134D42BBDAC60E362F60DD0BAE286E7535F5178010236AA9309BED72412058739F577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720525, "uuid": "5a5fc9c5-f699-4d78-a1a4-b6458ac1a18d", "value": "33ae1da8e7325d3e73d4a52bada9dc7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720525, "uuid": "e63db5ed-b82a-4e94-a119-68cabd6a38fe", "value": "12288:61Z9H0I0Lqf0h0ewjUKlg8SIt14y0qSXWdH3ROr:61bH0IlJXgBIt14y0qNdH34r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771720525, "uuid": "96996b97-2056-4598-a75f-1b36718766f2", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771720525, "uuid": "5f646c59-c32e-41cc-8764-33fd00967c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720525, "uuid": "2f931080-e7eb-48f7-a75a-34cc09a50715", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4532e78a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766434, "uuid": "a47a5848-145f-4d78-afad-a2221c226aa8", "comment": "Malware payload", "value": "6c25ec8885c02a722d6c180f83aa5511", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766434, "uuid": "757d2391-532a-427b-9630-4ff22acea016", "comment": "Malware payload", "value": "735daead54ea93f00e40b9ed7c168cdfbfe7a0cf16c622d27194e9d821baddf5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766434, "uuid": "2e664624-24b4-4173-bac2-dc337c79f74c", "comment": "Malware payload", "value": "7c9011eaf7bdb1af1f40a9259e1c6e96c7273192", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766434, "uuid": "33b17a5c-3e53-4242-80f9-811231a4fa3a", "comment": "Malware payload", "value": "3a915f0c0e60d44bd12f9c9a7104a622bc479f2e65ef07fc728da8d9741c3c33ac3b3ca7def00e2d5508895aa9e4e8af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766434, "uuid": "754ebfb0-a4bb-4b11-bb30-69d3b89c0215", "value": "T1D7615C7011F00C736E301984F3772BA6AB77E8574997218C349E1E396F87F42A5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766434, "uuid": "663ab0be-622f-4c8a-a898-77fa6bec359f", "value": "48:csRu9+J9nB6gHrJilrmAE69lr8z6E69lriFE69lrElEHlEzl/+QxZWkol/w:cCuIB66Si6fA6fv6fiEFEl5Arw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766434, "uuid": "e912cec3-5ba1-497d-a76b-9294a00fa81f", "value": 3297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766434, "uuid": "99d06b93-cfa5-44d9-a7b8-c98a3564c803", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766434, "uuid": "07424367-455e-4e1d-9e53-582a760032a3", "value": "735daead54ea93f00e40b9ed7c168cdfbfe7a0cf16c622d27194e9d821baddf5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db52ced3-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800187, "uuid": "4fcc9eec-7b96-40a4-8541-da150c616bd8", "comment": "Malware payload (SalatStealer)", "value": "dfc07c96a68c511619337e376069196a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800187, "uuid": "78127588-c0fd-4eb6-b74e-019bb5cba3c4", "comment": "Malware payload (SalatStealer)", "value": "736ff0c6bd7151db3c9d22adb2bab14b4f8711bceafc02c9193ec13b347e6eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800187, "uuid": "dd9509d4-c7dc-487e-a3d0-fcaa11f7e2ab", "comment": "Malware payload (SalatStealer)", "value": "a12e024b6745f804508de64eb9afe98cfcf470eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800187, "uuid": "a6684c74-bc7e-432c-8f4a-7a175037f8c2", "comment": "Malware payload (SalatStealer)", "value": "015ae8bd31a8707816b16c127f8743c72ab6c96051619f55d99202311db6b7828be5e9d1dd44fd5d55a8efbd804c4773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800187, "uuid": "d2e37f28-045b-44c8-bb9d-0d7f62f5d359", "value": "T1B23733CE05C229EBC957BD309CDA51F0E3CD9A2914695CBA6BF84931A8F8F055CC970B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800187, "uuid": "0acfcf58-c978-4a5a-8b57-04bea873e0f5", "value": "5e3bfefcf121344de4ddfb07d02d7e38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800187, "uuid": "f02eae47-e2e3-4090-9725-6aa034f0cb16", "value": "196608:z6wMVHgALhn96GOsz1mi2qoyroyroyroyroyroyroyroyroyroyroyroyroyroyR:wgALhn96GzAqbbbbbbbbbbbbbbbbbbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800187, "uuid": "a90889b3-b15a-482d-bc4e-7fe365573b1b", "value": 23703368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800187, "uuid": "da3c5c96-e1fa-4c79-afa3-0e6711750be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800187, "uuid": "8af42f81-7b8c-4435-b9ce-229788b57d0f", "value": "Crypted_2de79d9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af549a6d-0fca-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771749862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749862, "uuid": "075dee0c-1874-41e5-ad68-e36cc9bb4f42", "comment": "Malware payload (AsyncRAT)", "value": "df8603abec47894b02be30b507ec4a06", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749862, "uuid": "eaf66f3c-5f2b-4845-8681-8f41caa9525d", "comment": "Malware payload (AsyncRAT)", "value": "73ad8b1102e5ba21163040657904e8e63f609bb52bd51f9dc0bcc3ed47ce87d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749862, "uuid": "b1ba8976-0a8c-4b21-9f7f-c41083a6f8c1", "comment": "Malware payload (AsyncRAT)", "value": "fe1f50f28837bd651e351a78d15c6bf49bee1b82", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749862, "uuid": "66d4d166-581b-4d20-b99f-2419a67da46c", "comment": "Malware payload (AsyncRAT)", "value": "b96101999f3997c5158271da242c3fc38aa10fec44c894fd7a374c1bcf2cb7f5427e628dc52c673c1de94ad7e4074065", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749862, "uuid": "ac5aedc3-6ac3-471c-8d47-f8a84e292013", "value": "T130D24A08B3D48561E1FD57B94D7293048375EA5BA973DB9E1FC440AE2623B88CF25BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749862, "uuid": "c3d4e6c8-8d42-4b5d-8bbc-2d2bbd63ce0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749862, "uuid": "235b50b6-b364-45a2-be5b-600555cef89b", "value": "768:hMARXV643iqBkgg/cIRGqom/Rb7fB/dT0/+:iARXT3iqBk51i4RbN/e/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771749862, "uuid": "87098396-8b88-4907-b193-bbb5a178550b", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771749862, "uuid": "3ce43a90-d0e3-43af-b660-bc25401ff7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749862, "uuid": "89279dde-03a6-44eb-b403-b25d87ed75b3", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7ebdd8-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738720, "uuid": "852056c5-b100-432a-9583-f4fe7dfe3cdd", "comment": "Malware payload (Gafgyt)", "value": "d58d7d8b41262a2259302dae651d5cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738720, "uuid": "992aede4-241d-4bc1-bc3a-2afe3e6ab792", "comment": "Malware payload (Gafgyt)", "value": "73c62f558a4e66f7d522483020ac0e1cd64de41764f332b89a56f5cf9d2a03cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738720, "uuid": "a7ef6b47-fc96-449d-80f1-6dd0534d6329", "comment": "Malware payload (Gafgyt)", "value": "bc71f2510be672752771de975bc463bc8971e362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738720, "uuid": "20163b2b-400e-4dae-864b-93d9718c1bcb", "comment": "Malware payload (Gafgyt)", "value": "72c2ef0e3074e320769a14fc11b31b669279c14768f904d0775f6644c01bbce3d579e4b3d856d6b8afcf3b1172bcb8c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738720, "uuid": "2a3cfcc7-dc3e-48df-ba8c-7df4a687a7f3", "value": "T1BF832B43E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A313CA7F4434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738720, "uuid": "77e5862e-02fa-4a2d-9c3c-8366adcc4527", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCyujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJd94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738720, "uuid": "a9baa7e8-8676-4f39-bbfe-6abf369e6342", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738720, "uuid": "c3302911-3dbc-4a94-afca-9865eb3f7a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738720, "uuid": "7545cacb-bc67-4cd1-8b91-75e43a8b507c", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d23bda-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752443, "uuid": "7dccb997-c69b-4319-bdb2-3315431e2970", "comment": "Malware payload (Mirai)", "value": "99b6b9de5d5c780eae1108150d8c272e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752443, "uuid": "a7e6f924-1d73-4f21-ac8a-67d3b49a9108", "comment": "Malware payload (Mirai)", "value": "73dc56d859583236a4ffbe5413792acdbc742edfc306efe8ab7bc57356bceb42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752443, "uuid": "c13af8bc-f8fb-44cb-8b9b-78a6f034115d", "comment": "Malware payload (Mirai)", "value": "5282b8017cf35f542f59a5eab85e6f736a1d1361", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752443, "uuid": "f8d7df97-2f94-4de8-ab2d-db20ff577610", "comment": "Malware payload (Mirai)", "value": "15f90ac3188a05c407ebb50c02b97038460176bdf162a9daf31d46a3ed05a1ac79d35b5231faf2fc32f3156cdd1e792e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752443, "uuid": "8248b040-4466-4de6-96fc-23709d159732", "value": "T1E2243B46EA408F13C0D727BAF69F4245332397A4D3E77306A924ABB43F8779E4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752443, "uuid": "4c53d61c-cb3f-4549-9747-4904fd8c48e3", "value": "6144:xTK8jctGpE/FDaDOA3zHZj1N721gdA3theM/Rmm12JLGhQH:JKNt/FDaDOA3zHdfq+6hX/cm1sLGhQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752443, "uuid": "659c54c2-67b5-4145-bacc-fa9f1c21fe82", "value": 219690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752443, "uuid": "672f538f-09fd-4aca-9eac-954784c56fc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752443, "uuid": "d0803b51-f380-42e3-a529-5d67223ed3ee", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2182d-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753303, "uuid": "83578c21-7b07-4507-bb80-f21c16233e88", "comment": "Malware payload (Mirai)", "value": "e74b21199610f5e80e41509cf7fff01b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753303, "uuid": "def7151f-645c-4025-89fb-671eb8994d40", "comment": "Malware payload (Mirai)", "value": "740e3d221957b9d322e4643d2c557540053d93c75e1bef6f8df71a17afffec81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753303, "uuid": "eae990c4-f967-4668-a4df-85e26cf7f870", "comment": "Malware payload (Mirai)", "value": "f55b1b34db4e42b8a3eb5c6633afc180868537b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753303, "uuid": "1d4dbea6-018c-4ec3-845e-ccd435d9d0fd", "comment": "Malware payload (Mirai)", "value": "7806aa6063ea209aa3023b97234b552c4002cf3034dd0d1a836fc6c124e448c0052f1d4b198276acd9dd844d92ca12fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753303, "uuid": "a5f6b6fd-fc61-4678-b414-2af1ac1417a0", "value": "T17D0439D7F800DDBAF80AE73708570905B630B7E600929B337257756BEC3A1991977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753303, "uuid": "a980e75d-6203-4ca0-ae5e-cb160e170baa", "value": "3072:16cnuTglZ6YtVSZgthVDf5YzegJ2Ej9/VNjbisLv1pNycAYAuh/F5Q6Q:XnDBYDFj9bLtpNycUqQ6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753303, "uuid": "ad0222f2-3ed4-47cd-811e-751cabd159ff", "value": 173280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753303, "uuid": "06a65ebc-8849-44f4-9459-b94a4415689e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753303, "uuid": "ae6701b0-df5b-4066-a900-047d2c9b8945", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a36d80-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771800, "uuid": "e7d88184-58d7-4a46-9def-03e88e35eaf4", "comment": "Malware payload (Mirai)", "value": "340be7a17cdafe24bcacd74d1a4f5c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771800, "uuid": "0b715d90-6d1c-445a-bde7-df0e2f1538c9", "comment": "Malware payload (Mirai)", "value": "7445d99bf22ba85941422f08ed5d00411b34366cb97188c2ba0f08d07242634f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771800, "uuid": "2f5b2454-a432-430b-92f6-aaa8f04d003d", "comment": "Malware payload (Mirai)", "value": "41477c8e406f48c280db4bba6d3090b7c95811b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771800, "uuid": "c41764fa-fe49-4697-8a30-ade40cb297db", "comment": "Malware payload (Mirai)", "value": "8d967001ffba2d14b62a0116561f458deefec077e2ef0d93e05043946ccb8adfccf64a1f68b838d0f6e4a1914c491fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771800, "uuid": "ea8ab6f4-1b65-4d53-8390-002e27cb82e2", "value": "T1C313F111E8876532B661B830DC73069E7CA56D3DA05F203915E5C3B83B53E16B8BB583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771800, "uuid": "a499c023-1b8f-49b7-9c77-9c142033a870", "value": "768:iF4H4deo0G4I2nB/HFJvlJROGzJ5P483SdF5VEjEywzC4Rn1JAIvU9q3UELkz:G41B1BfjHROGV5Pl3SdtEhwwIVL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771800, "uuid": "3f2ccc90-8f32-49da-81f1-9ea3cc45fdc8", "value": 43784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771800, "uuid": "310bd637-3805-4038-aa1f-eae6e8a22b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771800, "uuid": "46d8c2f6-515b-4b7f-b92c-f885efe901d7", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074ac171-0fef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771765471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765471, "uuid": "86126ad0-faa6-4e96-93dc-fa18fa802ecf", "comment": "Malware payload (Mirai)", "value": "5bbcacaa2cc2f62079f151fec0321788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765471, "uuid": "634c2999-3637-48f0-afbe-4f255071f6a7", "comment": "Malware payload (Mirai)", "value": "74876e5745994d129866683e2d86f9ff81d6491efa9b06e399ce9786469a5af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765471, "uuid": "56ae56e9-a244-4151-8323-fe9cc2602a26", "comment": "Malware payload (Mirai)", "value": "7c10caa344262cf07f56ebe6cf11c563d811bdfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765471, "uuid": "2a1b2426-ad7a-495a-9755-ce65e1f717f2", "comment": "Malware payload (Mirai)", "value": "362a07c01d83f87678e7e0d0171cb0c20593cd1824bb8b1db032b89ff7953187d74fa6d2c29ab69315f15bbfb34d4172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765471, "uuid": "c9e19931-7dfa-4dc6-bff4-9e7007f76eb4", "value": "T15E04961E6F228F6EF668873447B74925A75C23DA27E1D644E1ACC1106F6038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765471, "uuid": "8ffadd7e-b105-4d43-985b-d5469f5394b8", "value": "1536:ofqSIRrziLKey0oL1m6StkbkxEnISTr2VGVwIPecz1qGa0SDDf1TT1PIaBY+JmqD:z3RrmOukWq9TSVGVwIZ1qGcfgaBNJJbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765471, "uuid": "18b52c6e-9cd4-4c6e-b1b4-75587ccaa56e", "value": 181860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765471, "uuid": "c27eea79-036c-42d7-a5e8-80d0d3f6e5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765471, "uuid": "9cb5918d-0328-4591-902d-ca90fd8cf85d", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26376958-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768959, "uuid": "2d25b325-1a1e-4e3e-9906-e1291e922351", "comment": "Malware payload", "value": "d7af8b342366c75ae614a90abf19c735", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768959, "uuid": "bbbbd291-0572-447e-99d4-e0499400de1e", "comment": "Malware payload", "value": "74d238dc22f3ef07959d5298272f319145f244f692985ad76a8fefa38e9207f2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768959, "uuid": "9947068f-bff8-4287-8585-4bc756a15640", "comment": "Malware payload", "value": "d6fb1f910d6a3c7bf4b117b44c2a09f3005d5aa1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768959, "uuid": "15015018-78cf-4e98-b4c4-c89ad00070a0", "comment": "Malware payload", "value": "83b60f0b2851fc34cb9c360f15e26767c076e394a554e50a8b7ae1d61fbd33598eccaf74c797522aa76240d003134f40", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768959, "uuid": "39d616cd-64de-4859-be3a-f6e5b1fa02f7", "value": "T1C021412E150FD3684AB60259F891752FAB65605F1E1060B9BBBCE840430433C03CD68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768959, "uuid": "fc753481-4ae7-4c70-ad4f-19005d81957f", "value": "24:KmzyKpa/u4n9ohKU9iBB5u+paOMo8R82+/3AX/pka8uzWpH:KpQa/ui4N9iBBQE11Z/3AX/KOzWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768959, "uuid": "6465cbe7-563b-4ac3-b2ef-4aaf0ed97d01", "value": 1171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768959, "uuid": "a4ef00cc-a86c-4e63-8fe3-5b85c9a641d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768959, "uuid": "dda638a0-5e72-481e-b40c-2f77fc48df5a", "value": "Approved Document#402.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cb5632-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766333, "uuid": "bbcbd175-4da0-4496-9b2b-28f49f087f2d", "comment": "Malware payload", "value": "319fe1beda51b20ea533b9c32a2cc415", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766333, "uuid": "cea0e672-0852-4af9-aa5b-75f27e0fa6c5", "comment": "Malware payload", "value": "7548ace2f486fa6b9ac9d36c0e795a0b068ae28c540a996b47a35901483c8ea0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766333, "uuid": "e8553be3-1571-486b-b7fe-cb08b95b7960", "comment": "Malware payload", "value": "e5d7adedc9e4669a14cfa550b729f95ad2c230b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766333, "uuid": "4895397d-b7de-4b58-b68e-11d8a60b7af7", "comment": "Malware payload", "value": "94ad245fb5c80bb47349ae1cecef2738f57d3c3a75a50519b5f1d0a4c50a56a91848e44e6e6a211680a7e6960c1b0154", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766333, "uuid": "c8875f01-c873-467f-adc1-0cde8cfd25d4", "value": "T156216D3880F21D63260CB55025B31B807F73DF579A5213EC35EF9B9A5B89A032247870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766333, "uuid": "6bde5ad5-75c2-4410-8cd8-e8e8e8214998", "value": "24:chnRUR8fARW5WiPdFHjeef5uZW5FkXdflX9HHIuCzCRpYdZ1eN:chRu9R/iPdFHPwWYlnB6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766333, "uuid": "bad1a1e8-2ee1-45d0-a88d-a5092d6ca508", "value": 1259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766333, "uuid": "ef9b21ea-f602-489f-b4d2-d1b7947b0084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766333, "uuid": "2b2f7ee8-2ead-4564-a152-59836c66219a", "value": "7548ace2f486fa6b9ac9d36c0e795a0b068ae28c540a996b47a35901483c8ea0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bfd341-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766455, "uuid": "990da7b0-4a2b-4280-9fe8-a904b4c3790c", "comment": "Malware payload", "value": "444ebe8705441523c03aa1fadf1e37bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766455, "uuid": "ec4881b5-55d0-493c-8172-03d573dc5adc", "comment": "Malware payload", "value": "75498e24ceeb90a4d200da0418a6335013478493ef0aa53be79ec729fb98a04e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766455, "uuid": "1af23ab5-1c20-49ae-89e3-4e58286c4266", "comment": "Malware payload", "value": "27f4175cdd53c7aaf38fdd17c31561e298656d6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766455, "uuid": "370e2027-afad-4273-aa70-893024d70ceb", "comment": "Malware payload", "value": "954a1f51bb6d53692a8154809008658305c9cce2d979cadc17243d70af81ea9793ce3e9478a2a5b33e97f1697188ba01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766455, "uuid": "faa05968-011d-440e-886f-05ee32f767e0", "value": "T1CF32B67125F148333A30AA40B3772BA69BB6D95389E7318C35CD1E365F86F12B1BE511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766455, "uuid": "575fc210-da9a-4269-bcce-79df28ce01b6", "value": "192:cLu568e1OJi1Oxe1OJi1OXj94SCca+N3P7:w8e1OJi1Oxe1OJi1OXj94SCcrN3P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766455, "uuid": "b56526ee-5bfd-4227-acfd-9d9ae23bc341", "value": 11712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766455, "uuid": "e13b90b8-7eb4-40d5-8584-e7da44f6f03b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766455, "uuid": "2897716b-8d27-47fa-b30e-7869970f95a0", "value": "75498e24ceeb90a4d200da0418a6335013478493ef0aa53be79ec729fb98a04e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741ef193-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779398, "uuid": "6af8115e-d495-4a0d-b11e-452122296e0d", "comment": "Malware payload (Mirai)", "value": "c7443a80ea34ff0a14389e9ad63f5d90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779398, "uuid": "77c9d436-9f65-4ff8-b3c4-70696c2a54bb", "comment": "Malware payload (Mirai)", "value": "758847548b1ee124ddf21c2bc26e2307c19199e6844e29bb465f2c80ca05451f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779398, "uuid": "e00c8b31-b018-4b49-b233-e17a9530e2af", "comment": "Malware payload (Mirai)", "value": "5b0a2df6d7e05f5e6a44a603b122eb96d0f68117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779398, "uuid": "332ed320-e6d0-4628-8a10-b6fdafeb1941", "comment": "Malware payload (Mirai)", "value": "6c2b1f14b446020b38e0339c6bd80d1b45ac8e4f7941180dfb9f30f76ec06c5958453eb16a6bb4ec6876809b0f66c17f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779398, "uuid": "e93d3ad4-1090-49aa-8481-f9ba98810022", "value": "T12CB2C030EB457A86C7FBAEB549A95EC97BF00F0D8B139BC03185AB10160B67A754D4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779398, "uuid": "5133b8d3-8b0d-4f10-beff-7877e9ebc301", "value": "768:iMcwnuluctEkm5x+KVWo102rdhCs6cA7wua4uVcqgw09t:GFuccTndi+Z6cAkua4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779398, "uuid": "b99db4ad-34c6-4476-8782-f9168d170621", "value": 25144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779398, "uuid": "0f799fea-fc82-4e6e-bc4c-e73bfd1a7ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779398, "uuid": "8253804d-d2b1-44ae-b885-0d1749654437", "value": "purves.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de10291-0feb-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1771763872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763872, "uuid": "c90bcad2-19f0-4fa7-865c-2920e4715907", "comment": "Malware payload (EternalRocks)", "value": "89826c2899795c987fdd3d2f9c49c710", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763872, "uuid": "4e227cb0-30de-4de4-84cc-cd97c25e5628", "comment": "Malware payload (EternalRocks)", "value": "75fd36c36d65b3c1d738fb4a7d99f6e805e330a86e2bbf6eeb9f8bbac42a9de0", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763872, "uuid": "52e68ab6-e484-4563-9199-e16023e61504", "comment": "Malware payload (EternalRocks)", "value": "6e3ba99869b66a2c78f2b481d4866929f9143d52", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763872, "uuid": "c0f3226a-bb4e-432f-a9ce-0eb76eb454e9", "comment": "Malware payload (EternalRocks)", "value": "0f3f9787605b1c26319c73a713c956d8e6d3ee246266073ea631f9ae5887ce3f64693db2ce4ba6755db5f739c22c20e9", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "not-EternalRocks", "colour": "#573B85", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763872, "uuid": "fd24d6f5-2618-476e-8722-e7d259c03de6", "value": "T13E556ED1ED1F683B55C122EED6A3B406FD347249D2929DD833F5D88C71ADA883684B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763872, "uuid": "8f092ba9-006b-4c97-b30a-d8a1f73bd054", "value": "12288:Bv/geTp0tyRnYKo6ve8SpBSw79Brrt6GNVE+qmnjjekFuFWJdSDnXLkV:BvoA+AnYKoEVwLrHn3H4ydSD4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763872, "uuid": "5452d17e-a575-4d8f-9910-608a8e896612", "value": 1379598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763872, "uuid": "5749a2cb-ec72-4c12-b61d-55259e8df9e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763872, "uuid": "fae1db43-459e-4b4b-9ceb-c7dc3d63b836", "value": "74896.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b009c445-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755876, "uuid": "e6a705fb-d60e-4c01-aab4-2bdce9bcda73", "comment": "Malware payload", "value": "b6194f4581d2c7c77cb7ca2a422a3dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755876, "uuid": "629a71b2-8930-4f81-a996-3ac7e4ad9be9", "comment": "Malware payload", "value": "771bcaf6c059f07b349503f7c4e92f51aa4369fe5eab7cc72d32badb9ab1c051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755876, "uuid": "9d297b91-0a17-4229-9411-dc8eb992bf51", "comment": "Malware payload", "value": "33e48de52cd3c97c778198d50c20f9e0c6fadf85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755876, "uuid": "76176928-ea48-46c0-8177-e78ea363c5ee", "comment": "Malware payload", "value": "bfcda5800a026401602843adb1ae8d185bbf50292687e528f9ecc231aad17c4fa2146ad40da543099a1a21b335a51da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755876, "uuid": "adb3b569-fd9a-4474-beff-f5e9c67da93d", "value": "T19DD2D04342B2276EF45A82B46C0B47BE5AB9781216D9CB6FC92601DE3D91FE38C34371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755876, "uuid": "10ba76cf-84a9-4dd6-8ca7-0e50b6f865ab", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755876, "uuid": "a5e519dd-ab24-4149-8424-b560ce1d5a8e", "value": "768:oxwmq9h9EFp7NV8kNAriKIBoT+8iBtAzZyiN/MU81EHrsa2:o42Fp5V8kirgBoT+ptAxNU91EL92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755876, "uuid": "5bcd52b9-1a28-45fc-936a-a2f60f904a7a", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755876, "uuid": "c7397dc6-b922-4662-b7c5-3f6bc4ffd100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755876, "uuid": "8b730ef0-13c2-4019-8f84-d9454f5b623b", "value": "SecuriteInfo.com.Win64.Malware-gen.44351284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04360279-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766325, "uuid": "ecfced5e-5274-481d-aff0-d5b0b4c75ce2", "comment": "Malware payload", "value": "0415de3ee8bd9feddea45242ee5a7f14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766325, "uuid": "9e32c294-e6b8-4e68-a675-8f0a6ac0e03d", "comment": "Malware payload", "value": "7787679b1b37b82edd17109eeb2b80493d145e1e2ab5e70a30f4f3099a19e052", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766325, "uuid": "f43fba8b-6b07-4ee0-8b80-aad8f7783de6", "comment": "Malware payload", "value": "3ce26f3034a20c7826fcd5ea841ef63049615ff6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766325, "uuid": "e2c983cf-449a-411a-8eb6-1fdba001161e", "comment": "Malware payload", "value": "aebb17270e1ab134111861cbcbb7933f131cf04be770ab5d608d91c0769c07654958a1d37ce1f51ea10ef78502c102e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766325, "uuid": "30151b21-651d-4227-84a1-c67881335b3c", "value": "T11922A3B424F10C332E215980F3772BA5ABB6D85345E3758C34DE1E396F8AB12B5AF521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766325, "uuid": "e65413fe-f5be-4dbd-839a-e96dcf600ebd", "value": "96:cRuyB6PxExSx8xlxUxlhxWxxQy87ssUE/7WvW7W3WbWY7ER:cRuG6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766325, "uuid": "2c9a61d0-ba4d-4836-be1a-7ad44fa1be6b", "value": 10406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766325, "uuid": "26579c52-d1bf-4e29-b8aa-09a71fb9b1b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766325, "uuid": "fd617a18-0a01-43f7-a0cc-d6b78a583f19", "value": "7787679b1b37b82edd17109eeb2b80493d145e1e2ab5e70a30f4f3099a19e052.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854b1a40-0fe8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1771762676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762676, "uuid": "718cc818-bf63-45a2-9306-beb62b6d10d2", "comment": "Malware payload (LummaStealer)", "value": "0895eaaa538427ac98a8d4a4d995ada2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3520", "colour": "#C70D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762676, "uuid": "329d00e3-05ae-4c55-94d6-7f236ba4a96b", "comment": "Malware payload (LummaStealer)", "value": "789afd60231c869d8c885a1406a1a08ca8b64bce9ca558ec0f79c6165d093a9a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3520", "colour": "#C70D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762676, "uuid": "5f5831eb-2ae9-4844-935c-1f998b6ed87f", "comment": "Malware payload (LummaStealer)", "value": "971a97c2572054e2adb07afebec56c8609b5273a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3520", "colour": "#C70D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762676, "uuid": "9a51e02b-1556-418c-a5aa-5ecf1221f624", "comment": "Malware payload (LummaStealer)", "value": "dd06f1246210b431b8bca2f1b629d5d698798535aca86a651a3169292dd12eae1a53f54da0f6888f03224c87c2d0f663", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3520", "colour": "#C70D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762676, "uuid": "6404ff62-6641-4a33-889c-37025a9c8b85", "value": "T1F6F6333D313B44E773EE6110707AEDD1C294684BE232F1CDE265AF5B65B109138BAD8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762676, "uuid": "64961c25-054a-4a5f-9ff7-56d386aa8c57", "value": "393216:1zuZFIFDoSsJcrA4HU0SKvQlkpxfPUnxrT:WmFBsJuSKol2fcntT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762676, "uuid": "fe8fb8b4-35a9-4083-b431-61506b737f27", "value": 15859587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762676, "uuid": "5f83c073-f009-49d0-b16d-f86bdafa46a3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762676, "uuid": "7fca0b01-a8bd-4ca6-b56c-e4f5bbfb4f49", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29931a08-1010-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779702, "uuid": "e25e92af-20fa-448f-84b7-32c30cf523c7", "comment": "Malware payload (Mirai)", "value": "a683ea26bd7d19d78d645136d6f49f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779702, "uuid": "82a960dd-895d-4844-a5f7-7b7ed998d8fb", "comment": "Malware payload (Mirai)", "value": "78ca110cc0afa6d75ebb522e740567d38e9271a6e82db00a503567aed0b53411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779702, "uuid": "5d8577ad-f360-4ed8-9a33-e82c13d43829", "comment": "Malware payload (Mirai)", "value": "39776c879be837b66e41382cfb0f2be8791d481d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779702, "uuid": "56357fb0-1bf0-4f8c-80dc-2c7a066c2ffe", "comment": "Malware payload (Mirai)", "value": "db26e8fc486093db29ca49d45b96ba6dd72317ed73e41f73156778af025ca7b289330a2fe6f32690201b257e878d559d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779702, "uuid": "d934b721-434e-4f12-99d0-4fd070661d3f", "value": "T12EB3BF87B1907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779702, "uuid": "308f80f3-e701-4cca-bdb9-850de1d08318", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzr8rSR:t3SrlGWnKTU83AQB5A5Liy36fPUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779702, "uuid": "8115022f-b389-4c06-8e2e-61a9f3094d59", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779702, "uuid": "4359f314-e34d-4f38-a5bc-5ec8003dfc66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779702, "uuid": "3085ccef-3cdc-41b5-a20f-5fe0b2885251", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99639e40-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784185, "uuid": "f86f0273-8b1c-4352-9cb3-ed0856ae162d", "comment": "Malware payload", "value": "44767d1ee04bab52f99fb0ca26440987", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784185, "uuid": "a6140816-e757-4010-89a2-18a3cf3febe7", "comment": "Malware payload", "value": "78e22cf4ce317530bbefe5017b16423aa99bb949543ca905e983a1fd1b84fa9c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784185, "uuid": "0a407265-493a-4b4f-b523-f75c337a618f", "comment": "Malware payload", "value": "bcdae44c2dd384c00d61ee3323d20077912a1fe9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784185, "uuid": "d518fcc3-1adf-4b07-ad65-789b73b2b74c", "comment": "Malware payload", "value": "a89de84edcb42d955e8ab561c1ddeee7ba6dc9fe82d3bf4dbedc2e6fc71861c518344157871f4976206dcfc42d504779", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784185, "uuid": "ca27e487-c552-4133-ba7b-7a2d3dd099b8", "value": "T11DF2E019EB8A7170C74BB37A20466D8CF90A5E37E1DE766B76D091CCCD02C92C603A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784185, "uuid": "a8e1a999-d595-46eb-85d1-10a32c5fca7b", "value": "768:23QP+NAiJQucR7gWUU/A10IXOLB+dTiGVtiLe1o2H3CrpW:2y+WqQuctgdfmIgMdTiGbiLOXClW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784185, "uuid": "6e7f4f43-fc3c-4a43-808d-a5e7837425db", "value": 35822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784185, "uuid": "c7e9c929-fe06-49ae-9975-84e8c67115c9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784185, "uuid": "8b4047d1-aaf7-4c42-b218-fb30a6717ee7", "value": "revshell.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8e57f5-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779410, "uuid": "f120c7ad-2fa3-4e5f-b83e-32b246c02017", "comment": "Malware payload (Mirai)", "value": "ff8d9310538f833ba4793cae4a2bfb15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779410, "uuid": "3701f492-2f1a-44ca-820f-f3c2fd133c20", "comment": "Malware payload (Mirai)", "value": "790ff66eb7822abf4965867f796d3479f90ec13056e530b2e98c2713c78b9c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779410, "uuid": "d2507292-2a6d-4033-8d59-6668c8e49536", "comment": "Malware payload (Mirai)", "value": "7e9def6278e8c0630b788310205e7788b0e0ef4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779410, "uuid": "a883754e-ff5d-41c5-8af8-7bdd45ac7976", "comment": "Malware payload (Mirai)", "value": "85efb3fbf3ef5b368b7ff3ce807aae404a4f6a8ca5d2ec1529918a0688f24d1f37d87beb0d7ed30142272d6cf6f4350a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779410, "uuid": "4df8edef-9d53-4023-b233-0e34a16f83b3", "value": "T197C2D02C224AE1C9D07ACCB05D840BC06FBB8BB32512BD8B79CDE54B5AF54E6649D6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779410, "uuid": "ba76f697-723f-45a6-9e71-b856e4a91508", "value": "768:iyU59WnLstV4VPOcGLJVtKehawq+zJgGlzDpbuR1J7:5U59OLszKLwVdhTq+pVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779410, "uuid": "3c0d8c23-b657-49f1-95cf-ebf3bb543be0", "value": 27128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779410, "uuid": "7e808105-5de1-46e4-b948-23b9a357b31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779410, "uuid": "ca139fec-82ce-4fcf-a54e-d185744f7c89", "value": "purves.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b69075-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784234, "uuid": "70de1730-aca7-4fcf-87d7-9b7967860b61", "comment": "Malware payload", "value": "281d2ca40691bfa0debcfb96c81b6cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784234, "uuid": "f5fac760-165a-4b7b-9df9-c8d3d3986865", "comment": "Malware payload", "value": "7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784234, "uuid": "5279a6d6-143b-42f5-8e65-2ac85d417fac", "comment": "Malware payload", "value": "c590a1e8ed1e884f18aabcee9546ae6171035242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784234, "uuid": "3fbf61ed-03a2-46b3-a639-a90e35582edb", "comment": "Malware payload", "value": "cc7c3c11b900bbf962a5d56286978ca696c0dbc7168f4bb3cb0023637df901a1238d9bac47f6cc8b9623303e2373e7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784234, "uuid": "be6c6416-dee3-46a9-9118-e54b9ad53227", "value": "T1CAA6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784234, "uuid": "e385953f-13e7-4355-a14f-10c35c1ac9fd", "value": "196608:BPxdtVBFUcwti7TQlyVN8iNISRTRmW5QD:NZHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784234, "uuid": "749ce61c-75e2-4ceb-8639-f806ab29a813", "value": 10170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784234, "uuid": "68e3e2d7-1a4b-412b-9175-b180d781bef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784234, "uuid": "b2820229-f1c2-405d-8bd9-3658d6b7ce02", "value": "wp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef9f1f5-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753109, "uuid": "bdb56217-58ac-45aa-abc7-d562f585d997", "comment": "Malware payload (Mirai)", "value": "0d92a2122e93e227a653397d186c4654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753109, "uuid": "c763fbeb-5cce-4a52-bcea-6aaf9b14e7d0", "comment": "Malware payload (Mirai)", "value": "7a230c866f44cec2e20b1d146f0f2cef759a7642f41981c0532371cc98f97cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753109, "uuid": "2ea5987f-87f2-474d-ad54-a4b403f182bc", "comment": "Malware payload (Mirai)", "value": "cbfd100c86a3c9a9ddda5a32e8915efe54d884ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753109, "uuid": "23dc10ae-a788-4626-8c9f-a100e7f9d84b", "comment": "Malware payload (Mirai)", "value": "329fefbddf657f3b18598bbd09b161f92220573f5f0251faf576d54edc915621a2d8528f1168ce3466d1e7ade3121b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753109, "uuid": "6eef6a32-6f41-43eb-9412-504a3e66c306", "value": "T1791319C4F543D9F0DC5606703076EB365E36F5F6222CE683D3A5DA73BC92602A606A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753109, "uuid": "ee997d62-3069-481f-9e77-f073c4928e49", "value": "768:uQHB/Ghrvh0z1hht0lAcjSoA/dLuuuDjyAbG3wVFs:ZFGhrvh0z1hht0lX+oQLcjLbMwVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753109, "uuid": "d57361ae-20ee-408d-8ad8-074e277eb369", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753109, "uuid": "c4f78aad-b023-4dc0-a604-70119e9faa32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753109, "uuid": "c123f7bb-8cdf-4c37-8a5d-5ee0cd5a1c59", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8653aab-0fe9-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1771763192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763192, "uuid": "c515639c-8110-4bbd-87c3-802e49b0169c", "comment": "Malware payload (CountLoader)", "value": "602dbfe520ce9a93bc58e2ac613c2cb1", "object_relation": "md5", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763192, "uuid": "312b60d9-4ee5-42e1-896e-cb4f07d870b7", "comment": "Malware payload (CountLoader)", "value": "7a3c9c4f393a70cc9ebad109924e1ce89e9bffe4fdfab25b101f24b3d0d56b70", "object_relation": "sha256", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763192, "uuid": "e4090482-810c-4d99-b7ec-e4892324dfe3", "comment": "Malware payload (CountLoader)", "value": "91020e057102bf4e501fc434429a26d9536b829f", "object_relation": "sha1", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763192, "uuid": "e5c01722-f22b-42d0-92c1-fc38271b9571", "comment": "Malware payload (CountLoader)", "value": "210e41725180c7f5662e412bffd4c0380c14b85dcef5e984c3c74b475c6bfe0a17fa26edd4202e945abc94e0f864a094", "object_relation": "sha3-384", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763192, "uuid": "e5b957de-a4c3-44e3-8fc4-a89cd800811a", "value": "T16CC5022EFE6132B5E24D9DB46758956042933CACDE188E1C7381B39EEFF6A500C8D91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763192, "uuid": "02be23ee-4556-4db6-a94e-695f051110ea", "value": "24576:QxxG9HsncdM1AlIlJASPTXh7rtbiW602rZhFWaN4Tvm3aIAWwW0nbjLG3VagZ6o6:QxxH7yqgib7KgaNCpcn0n7GgRoy+Alv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763192, "uuid": "d8e09245-b1ae-42be-942a-ed39b7f5d36f", "value": 2587597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763192, "uuid": "db86ee1a-f7c2-443f-945e-cd6ecab1b41d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763192, "uuid": "bd670217-3e77-4747-843a-0e2b7b13247d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac970f9c-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769185, "uuid": "8b4b0e2b-4c1d-4dfd-bd98-4154e843c7ed", "comment": "Malware payload (Mirai)", "value": "4e59513a2c90430ed9bf56a016c2785c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769185, "uuid": "aaab8402-1428-4d07-ba55-1b4109d434da", "comment": "Malware payload (Mirai)", "value": "7a6739a5ab3b36baec92b7f697fa36e8f7e52e56d8c06026adc3343a66e77814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769185, "uuid": "25322b49-54ae-4d47-a38f-4d3fdf3fef9a", "comment": "Malware payload (Mirai)", "value": "30adc66a852fa70b28cca75dcebf7b2ccd9f7716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769185, "uuid": "5104cf6e-9693-448d-bdcd-c0f30d290c20", "comment": "Malware payload (Mirai)", "value": "0d6c0b3ace6e3e261d3dbd3209f5c33f400fe0c46b7b20a3ff2645cded23eea8bbc04d4d72a6aaaf202c23b4cabd2196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769185, "uuid": "2a90782f-6058-4040-ad8f-6539e6868b6d", "value": "T10F93E706FF110FB7D86BCD3705BD1B0128CC655A22EA6B37B634C568B54B64B2AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769185, "uuid": "e6a52f92-f4fe-417f-83c9-ed4a4516f8ee", "value": "1536:z5U3XcuL+bTZ6NdLCjawqhpeZiZ5VVBTEld+dNm3h:zS3Xc3Z6+jawqhui1dY3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769185, "uuid": "5aec0a4e-a9a8-4036-8b66-493cce07727b", "value": 93200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769185, "uuid": "5dd6dc78-b07c-48a9-bed0-d32a9b71fecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769185, "uuid": "83eef014-9a07-4f7f-9ca2-1bab5a0be6aa", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e7d405-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766412, "uuid": "0b25efe0-a190-49dd-88fb-0f6c1f20041b", "comment": "Malware payload", "value": "bd614564919de0be305d2634424c936c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766412, "uuid": "605c7964-7b7f-4dee-b3ad-a0ed63beec90", "comment": "Malware payload", "value": "7ad240b1fb349d0513fc4ab467df09b256278a6c84c2d9709a8a488bc0e6e020", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766412, "uuid": "ed92ba58-90aa-4500-9339-0937328d59f0", "comment": "Malware payload", "value": "375118265c87c2dc206f7ed66acd47e04741e2d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766412, "uuid": "c01ff59e-0311-414a-8932-54d388064d63", "comment": "Malware payload", "value": "5fce8bccef2cd54d433a6887e603728c35b824a34d1496a5ffcc9080a2ea59bca3f2085c35b8a698ee6e67cef8789a80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766412, "uuid": "ffbbb5e5-2ecb-4500-bbc9-33d626dc5959", "value": "T199C1E77525F14C333A60AA80B3772BA2ABB6D95345E7318C35DE2D265F86F12B0AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766412, "uuid": "bafee84e-42dd-4531-b8f0-da095562b8ce", "value": "96:cLu3k0B6IKxGx5OgNeFmtm6IBkIB5IBu+:cLu0g6Nj81jGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766412, "uuid": "0d8dc939-ac99-416e-91b4-eb0ef34e0ed2", "value": 5639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766412, "uuid": "d2e6283a-a850-43f4-9e6e-6496a8095964", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766412, "uuid": "c4352c9f-c4f1-4485-bbd4-54d72bcf6444", "value": "7ad240b1fb349d0513fc4ab467df09b256278a6c84c2d9709a8a488bc0e6e020.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6c5b13-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766148, "uuid": "da5724cf-4bef-41a0-ad3c-43a55bbc9c22", "comment": "Malware payload", "value": "5d5e1717cef97a2a9a7255104b5e9f95", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766148, "uuid": "14f7f010-875a-489f-b3fb-227df7f40bdd", "comment": "Malware payload", "value": "7b3485c2b788482bd73165a8f201bf898d000f45e0b4aaf757e6d1c9ac1032af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766148, "uuid": "16da7089-fd80-4183-9125-4424ffb4b346", "comment": "Malware payload", "value": "0ca2628eb06b39c05d8554a4bc74594896f94d1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766148, "uuid": "cd9ab7a2-fc2d-4bbf-8fc0-9d3cfe09f8d8", "comment": "Malware payload", "value": "6b03de0fb0f807ece1fcd8845a0e408320e7c2bd1b59dbfeed32b781e2ee3e4d4fec51d14e3821c085276f93fc2da8cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766148, "uuid": "c848bc98-bdba-4bfd-aa8e-f155b9d55134", "value": "T13891B4B420F008332D215540B3771BE6ABB6D85796A3628C34DD1F3A6F9BB03A5AF421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766148, "uuid": "ac4c8e4a-7d32-41eb-ade3-620c40d76d7d", "value": "48:cnRu9RJ9nB6gTUblrmTUblr8FUvylriJUbylrEJUbylr+nUbylrMJUbylri0UylQ:cRu7B61xvxhvwJUvU9UXU8wmJjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766148, "uuid": "b50956e3-fd5e-4a7c-a3db-a0e083b49d38", "value": 4552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766148, "uuid": "5ee9bcc4-bc24-4216-9855-3a76499e48a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766148, "uuid": "47c20f52-f9a9-4d2d-af5e-44d2a094beee", "value": "7b3485c2b788482bd73165a8f201bf898d000f45e0b4aaf757e6d1c9ac1032af.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972c4eb9-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768719, "uuid": "201451b0-f449-4684-83bc-c541f7a0c5c2", "comment": "Malware payload (Mirai)", "value": "97e37c5c5c324f057f092051a4871bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768719, "uuid": "c69cbdab-61a5-456d-b60d-3b8e9cf0e6a4", "comment": "Malware payload (Mirai)", "value": "7b4700a59a7cfbf8bc96a1ba77a76837c63ec6fa8c49d7e141550b53f8d6a4be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768719, "uuid": "3b980732-d191-4edc-b900-c96c70d17b04", "comment": "Malware payload (Mirai)", "value": "e695f1edc04ed922e1c79f994ef49253d0c114b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768719, "uuid": "f94824f8-16e1-44cc-8ef3-a054cfd88be6", "comment": "Malware payload (Mirai)", "value": "a8d059147e60b80894ecfb0cf0e2c3cd0af2be87a43d84e603780495a11955278c54850bcd3562662c20833ddd4e2c21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768719, "uuid": "73c3e794-505e-4eef-8ee9-e0576ca60872", "value": "T1E0D35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768719, "uuid": "599235d4-cef2-4f53-9786-509b0a685ea5", "value": "3072:CV0zui1ZhMHJCIqWrpP7OUK3y0uMg9Fk+H:LP1Yiwd7OUKC0uMg3k+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768719, "uuid": "4b92318b-d372-4915-9320-8919954adcc5", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768719, "uuid": "26bc1e61-78f0-401a-91c7-f9c8cf1f99c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768719, "uuid": "88379083-7283-4681-adb0-81a04ed8cae0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734b62e-1028-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771789979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789979, "uuid": "1881816a-214e-4810-8273-d99d555861c0", "comment": "Malware payload", "value": "521119227c8e30893ba443cf04bdc217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789979, "uuid": "f9a0af31-1150-4e6e-a8d5-c327a741b388", "comment": "Malware payload", "value": "7b9e3fecd2d656f9736290b90987c0175d9a977c169f8d79d3b945031527baca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789979, "uuid": "97074945-7828-453b-83df-fd2b2597d727", "comment": "Malware payload", "value": "9fc889a25b63ec8213f326fe58604f9c9e353bdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789979, "uuid": "2644784d-6d63-4f3b-9fcc-01bb8e90f083", "comment": "Malware payload", "value": "910741a65d3808a3eac4b1cb1d10a15bea803fee9964a318aadb8ca4b3afd35b24c600cbba97afa7ae2f21e6be910e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789979, "uuid": "098e8e99-063b-483f-8a15-ed4ed88da1fe", "value": "T10DA34ADBB810CDBDF84ADBB744634906B130E3620A831F366267B957FC361A55C22F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789979, "uuid": "a22f8a8f-3316-4335-aadf-296bafe09ebf", "value": "1536:xqiQWipOFsFBGSQ1n2GSOywgDnApnS+6y198B3vyZSq5n2gPgKbI0karHLHFC/2C:CFkSQ4odS+6y1eyZSSicPkAG26KvT5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789979, "uuid": "66a474d7-e720-4d48-ad46-10b38d79bafc", "value": 103412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789979, "uuid": "a115e845-f873-4c51-a0d9-b14ce0665e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789979, "uuid": "8197a09f-2396-44e0-959f-38e223bd4385", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0531b0e4-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752583, "uuid": "04847844-47f4-4cc7-a107-be36c20c808f", "comment": "Malware payload (Mirai)", "value": "2e9754027627b7f9ffe08f5fb52b59e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752583, "uuid": "4297f732-873a-43db-9345-32f098f25941", "comment": "Malware payload (Mirai)", "value": "7bf2b167bcd86b1c0650995eb2fc21efb4e173f8381bfc47882838d09e69e0ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752583, "uuid": "4677a8a6-8c98-4cd8-968a-98e881ee70a6", "comment": "Malware payload (Mirai)", "value": "6c14eee1bfa1468c5a20db4754519ab0a5dd2369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752583, "uuid": "0c6d2c1a-9396-4bf7-abd2-5e6f2fa25d49", "comment": "Malware payload (Mirai)", "value": "1a2e79e14fb3eda4f939d4d0616f15acb3c3a50bd2e767d37ecfd14052510e761c5918d8496f9542532e89187007e32c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752583, "uuid": "0d766a17-df32-4c09-8c8c-08104bb3caee", "value": "T1FBC36B82E6B2D0F1E69701B00157F3E68935E5305416CDC6EFA93DB1EC71A829D9BB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752583, "uuid": "78306a48-959e-4a84-89ff-647105db733b", "value": "3072:4hndrOhlyVmtvzCMNGThOvQrICrb3LCW4:idrOPyVmxgrfb3uW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752583, "uuid": "d353d14b-1fb5-4bb4-8b6a-efc985065f10", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752583, "uuid": "f51159a0-82a3-455b-829c-22a0b11726a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752583, "uuid": "ac333409-42d5-4e4b-8b3e-707da1ab4e63", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ddd687-102c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771791725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791725, "uuid": "35f790dc-932b-4c38-a8d8-dc56e88ffe14", "comment": "Malware payload", "value": "875669d442760872cdaddc8cc9cc2c49", "object_relation": "md5", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791725, "uuid": "0941d0e5-5119-4d9c-b0b5-243f42d83601", "comment": "Malware payload", "value": "7c67fa23010c492d564c53bc5e7bcd881cac83ac77c6c2596548ee693d5f6b45", "object_relation": "sha256", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791725, "uuid": "c55bda7e-541d-4f82-8d39-31c73d94e589", "comment": "Malware payload", "value": "6e41d2d80568b93909a8ae2ea8ee29903a414e52", "object_relation": "sha1", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791725, "uuid": "869b508c-595c-4bc2-8a0d-2d1c05d92cdb", "comment": "Malware payload", "value": "a064e84b88298852a5fee617f39ddeabe576bfcbe4b6d67ff707ad07c75a4c73db67eab10eb5b7f687cbad20cbc57143", "object_relation": "sha3-384", "Tag": [ { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791725, "uuid": "be45ef55-08b1-4b93-93bf-6d92886b8cce", "value": "T15D573311821CC6DBFEE7B5B4B4B0D516C4EE60B2728E76DEB9E831F4BD875848728811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791725, "uuid": "27c1ab45-71ed-4811-8a97-574f8ee1908c", "value": "786432:sX4hmMBT6+qRLhYxFojX0vDPYz5SQH0TZLih+:sX4sMBT67RSokbgND0Tpis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791725, "uuid": "3bea0d22-0c16-4ab5-8c75-d5cbf9ea2c7a", "value": 28687972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791725, "uuid": "480d3ead-c125-41a1-9364-deeee16d7a7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791725, "uuid": "56ca6981-495a-4fbc-8d58-a85dce4fd2cc", "value": "Free Downloaded Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c729567d-0fe8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1771762787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762787, "uuid": "5a624917-496c-40fd-b225-c29a81bda41e", "comment": "Malware payload (ACRStealer)", "value": "67610665181594221544b9c22032b4f3", "object_relation": "md5", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762787, "uuid": "65cf6ac5-42a7-4966-b816-2e5dfd02800c", "comment": "Malware payload (ACRStealer)", "value": "7c705076734aa6df6cab15d59d08f722f592e8486e66584d8a2483d0284f4ce1", "object_relation": "sha256", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762787, "uuid": "57796189-848e-42f9-818a-9585d230ccb7", "comment": "Malware payload (ACRStealer)", "value": "fb7b26234ae63619279dcfaf84bc1b51e3e0dec0", "object_relation": "sha1", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762787, "uuid": "efdbf274-52a4-4926-9d53-a7bb977e9b81", "comment": "Malware payload (ACRStealer)", "value": "f53db0f5426620d4d2f5949265d0482c016bb044de938cf52d91e876547eb9b2cb2df2c15e781f709d5b07af17c58619", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-233-47", "colour": "#6A29D5", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762787, "uuid": "399f8f48-3a57-464f-a26b-24bc302aad68", "value": "T1EC273361CEAC8FAE31987976CDC28C10A14146F1C511DCDEAB8AD3D687C1EF4A762DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762787, "uuid": "7c83c542-ace4-4719-a427-4c93b0ea402f", "value": "393216:wy1BmCoz3ycGprtbbXpNFkAE/ozMSgB883HPerJant0N1jQ9K68zkw2UJTW:f8nJGpNbps/wngi83HIkniN1j/68Lzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762787, "uuid": "ec370598-33de-4cbe-946d-e4c65af39a9f", "value": 21968070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762787, "uuid": "384b6133-a8f5-46b8-87d6-4d59af1096ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762787, "uuid": "faa2d8c3-5978-4cc1-9d79-56fdaf2bf635", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09c9799-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771795, "uuid": "704eb961-bad6-4ea6-b27a-3a7e8421f3da", "comment": "Malware payload (Mirai)", "value": "b6a4435a2557242f548ae8bfc86305e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771795, "uuid": "a36ce15e-a512-44d5-bf50-4c2d2e97d9a4", "comment": "Malware payload (Mirai)", "value": "7d623e46695300ccb07b19e5d9835518737251483ec1dac12fbab8c57d1dfe11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771795, "uuid": "a57f92a4-8d26-4334-b910-73c070b59732", "comment": "Malware payload (Mirai)", "value": "9ff1478003abc390f701bdc5841e6e8e644f4629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771795, "uuid": "1832ac65-39e7-49fd-bbc1-5e3cb3093476", "comment": "Malware payload (Mirai)", "value": "6cf67d064c65840d080652663797a4a8e7c83de7097f533d9f49c9ae2dba3d8f1a42fca7d377c40e6e1667ca4379ee70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771795, "uuid": "b65acd77-aa92-434d-aa88-29b147bd5930", "value": "T16503F1085DFA9753C069E37336DF39B605548B06F84892A26B907A338C18F5D7638BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771795, "uuid": "b8fc37ed-b865-4c47-8422-ee49244f75cd", "value": "768:r6axCXJjoBDqRIdfNAPOzv9ZJ1lrVqH5M0eSIBnbcuyD7UtQRjd:TIs2RufNQevxxCaRnouy8typ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771795, "uuid": "e3d27868-e4bf-4acd-9d8c-a648de38bce9", "value": 39372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771795, "uuid": "5c25f5d6-d9fc-4a07-a05e-21d796257cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771795, "uuid": "43c2627f-90e2-48db-9660-eee0ed51b2a9", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d983362-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770797, "uuid": "d0e91c55-9684-4ed1-b0b4-8205fa49f5e1", "comment": "Malware payload (Mirai)", "value": "7c566bbf825878d274cad3fa0a13ffdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770797, "uuid": "5463d7e4-415e-4a99-9e6f-770717a50c17", "comment": "Malware payload (Mirai)", "value": "7d6eafac8ca5ebb09d3594439dffc61cbedc726ef120977bab1198702ae984cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770797, "uuid": "db2348b4-d12e-4cc9-a4b2-8e2a48c8081a", "comment": "Malware payload (Mirai)", "value": "5f267cd6a7f42e3bb02d24bc2af0f0428c6a27c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770797, "uuid": "2685694a-0c42-465c-ba2a-7da91f0bc4cf", "comment": "Malware payload (Mirai)", "value": "0d0c371c165bc84f2376d421d615133ca5a3f92cbb39feda72c55ba68051fa56e1876f115add1befefdb051a0da9e6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770797, "uuid": "531d5c26-2623-4075-8f39-7cadd57c2bc8", "value": "T1CC332ADAF9029E7DF88FD6BA80674D09F631221040830B267777FDD37E321949A52E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770797, "uuid": "51b5316a-34cc-4608-a8ef-64ecd4ccc49b", "value": "768:HaeKdnuq3yaHFpeLZMpyeTLRDYuR7mwGJRytw9hDdEY8muc:6fdn33y++zuBmBRytwzDd98+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770797, "uuid": "2c7c6d81-39dd-402f-833a-d2bb7a52dce4", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770797, "uuid": "d78bdbdf-7b6f-409d-b27d-ccf18dda9fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770797, "uuid": "234f4b3b-5f73-4e86-8905-371ab1fcc140", "value": "3atoNational.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699b547c-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784105, "uuid": "6096588f-6567-480b-8a9e-ec8f52fc010e", "comment": "Malware payload", "value": "8a3803a54a1e9bb1cea7a227c2bb9399", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784105, "uuid": "af13e079-0bcc-4353-b994-60bdf1df407f", "comment": "Malware payload", "value": "7dc57e2042ca79bf1b5bdaad3640dd59140c947968721d12cbaec59682d4746a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784105, "uuid": "1d067a48-a6ba-4ba0-9208-2c8d5a5320e4", "comment": "Malware payload", "value": "1d50eee3b3f49279509b1020b11eb20cd7ad4077", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784105, "uuid": "d5450865-135c-430c-a4ec-2ed1b7ce12db", "comment": "Malware payload", "value": "990f4db71efab2570eb1792068b075c839f8bcc9260baa7dc438f15b151baa3a7ada0e47ab5341ccdbbc30c1cd7e7b76", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784105, "uuid": "583458e2-961e-40d9-8553-db62d142696f", "value": "T1DBF2E139EADAD520C347B37B20456E8EF8079E17F1EDB26B37A4D1CC8D828514607A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784105, "uuid": "065bf8c1-1228-49b0-ad6d-ade31c1e4b06", "value": "768:UaQP+NAiJQucR7gWUU/V10JIOLV5oti2e1o2H3Crpy:UB+WqQuctgdCmJnDsi2OXCly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784105, "uuid": "49c48aed-828f-4bd2-bc96-03bad94d0bee", "value": 34620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784105, "uuid": "531c6733-ea24-43a2-aeda-dc5c26fdec0b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784105, "uuid": "2d2bb5c9-22a2-4fb0-b78c-9b0d0e055307", "value": "go_update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de1d62d-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784085, "uuid": "a6c10188-ba28-44b0-bd3a-8ef34e787cca", "comment": "Malware payload", "value": "06ed25e6e4659eb2abdd34d7cdc5f44c", "object_relation": "md5", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784085, "uuid": "cc7d794f-b397-4c49-bec6-806645022398", "comment": "Malware payload", "value": "7e3cff8f984f3734715c7181ddf68611b19d15a7049cdf9d169a40f4bfef238d", "object_relation": "sha256", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784085, "uuid": "d5b9e4d8-293b-4b80-bd01-97e96158644d", "comment": "Malware payload", "value": "144500f9ddb6112fb94d48b069a4ace93bbe7966", "object_relation": "sha1", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784085, "uuid": "6de74c82-cca4-4cdd-b70a-bffc03c1bedc", "comment": "Malware payload", "value": "95633ff14c02a01227b98f4c6b896adabaf1aae321ebf9da228bbbf770c0ea8f116383db432ef6c777e4e401c84ef0d5", "object_relation": "sha3-384", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784085, "uuid": "b29ddfe8-9c70-492b-82dd-10d74d792437", "value": "T1755188DD9BC04BB4E2C82BE4412770AF99F1E819351A23A496F671DF6C9ACCD25E1134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784085, "uuid": "73d11796-9970-4d25-ba9f-81e84f1b7f17", "value": "48:l4VzJW1Rm9xzOWSRmBp6QFFWMD6diXk4OiZKhXvMMDUYJOjbelRXSDjFx:mZJW1R8NOWSRSpWipXtbiEMDUsOYRXS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784085, "uuid": "87fd3d56-b49f-4023-bdab-5d0f3f1c54bb", "value": 2553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784085, "uuid": "c42e65c8-12dc-4adb-ab8b-2bb84a42745c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784085, "uuid": "5a19a97e-fc00-48e4-94a2-099ec9813cc2", "value": "custom_macro.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16407ea-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771797, "uuid": "2dc4645c-bddc-422c-b5c7-2ff38f99ed31", "comment": "Malware payload (Mirai)", "value": "d239a7b5cadefbc6211b8816a2c7137a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771797, "uuid": "a9546c3d-0df1-4b05-8f3a-2cc3617a12dd", "comment": "Malware payload (Mirai)", "value": "7ea46ceb468496df2200343dccffd010c11e944392aeb12fed315613ceb76d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771797, "uuid": "2a6a7b79-5247-48c0-b047-64941b3bd82a", "comment": "Malware payload (Mirai)", "value": "af7dd93c3debd8a9c3642a81be9af9b31c95b04a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771797, "uuid": "0b728dbe-ca36-43ba-b87c-07a5bb8be1b0", "comment": "Malware payload (Mirai)", "value": "16c7bb2128def8f7a143aa006e9b9de8ad043f95fdde3e843c4c91a24b58bc3c129f19ab8569b21e048c83a3e6215c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771797, "uuid": "e8cd5eed-57cf-447b-81b4-881263ec5a2f", "value": "T134F43A45F8809F62C6D12576F75F826C731747B9D3EBB20699288B343BD792B0B3A640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771797, "uuid": "76c0003e-5559-42c3-af99-01482b9eb272", "value": "12288:c6sAyyIsmq29JGF2n0GLxhbsXoz+2AsDP93Qojl8p3PacRl3AvaAFvS:jsAyyIj9JGonfLxhbKoq2An1a43ACAFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771797, "uuid": "6885e024-3976-4ff5-b8eb-fc2889f21311", "value": 730176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771797, "uuid": "68cbc6bc-b9dc-4d0e-b061-b1a9f7664a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771797, "uuid": "d7d9f46d-15a5-432b-9fb0-8248d5f843e8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f91d85-1025-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788986, "uuid": "776b99e0-75ff-49ad-a3dc-385bfe40b902", "comment": "Malware payload (Mirai)", "value": "5e463df3776aac25fd30c129a8002843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788986, "uuid": "6b712aa0-51d9-409c-8b78-a673f4d1f802", "comment": "Malware payload (Mirai)", "value": "7f09511c3371221ec53ab26c3d4ccee0cee7941d7dbd80cdbc99c144ea9908c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788986, "uuid": "8b751ce7-b459-4c1f-81d1-e109230e600e", "comment": "Malware payload (Mirai)", "value": "19709fe44bbccaa347dd5f9bbf214dea51dd8a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788986, "uuid": "84fb5edc-4317-4f65-a242-3a621ef32e58", "comment": "Malware payload (Mirai)", "value": "5e2fb5719929dc23ee3602dd5bc486e408a06f95aec5cc6751f6af145259d70a1e13cccbe1c4f7037ebc3420d87f4aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788986, "uuid": "7b635a8c-5d57-45a9-9de9-e91bb369899f", "value": "T1D093390779C080FCC499C13056AFA23AC963F47E1239B19B63D4EE26BD8DE512F6D684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788986, "uuid": "c9a3225c-8c11-4cfc-b8a1-5be393761f37", "value": "1536:xl4orS5jKuaTTJjtevQZyY3ZA7b1b1mzi56oraiceGKRYDi8:xXsjK/TJ2QZ/3ZA1b1mzivraFenYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788986, "uuid": "bc0af604-2781-4162-b710-29258ad65a5c", "value": 91776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788986, "uuid": "e2d97987-28d5-406a-88fc-022ed7e727cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788986, "uuid": "a3490829-6b5f-478c-b07b-6b47534e3346", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363d7a90-102a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790890, "uuid": "f9a5ae0e-1fb2-4526-9f92-ec2d0933d466", "comment": "Malware payload (Mirai)", "value": "fb8a5b7a729fc616ad6d27167c09d2c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790890, "uuid": "1813bf0e-a48b-46cf-80ec-c5c2b776aeef", "comment": "Malware payload (Mirai)", "value": "7f55fd531dd0ed6b97a6da95fc16670c006070467d68513fa86c94452fb4c7ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790890, "uuid": "6695a82a-138d-4936-96cc-5e81d7090026", "comment": "Malware payload (Mirai)", "value": "8630d5984e6a05d1f7801f41ea32927d51be07d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790890, "uuid": "925f2043-c91a-43ef-8e99-e89a7d551977", "comment": "Malware payload (Mirai)", "value": "a0c51a1c5f0b8461532434f9f733221592faa23e740234c8a76d107df1b379220ac474f0996d9da94fd737a9423e97cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790890, "uuid": "f695ae04-b3cb-4253-88bc-ebbf00000512", "value": "T1A6431A56BD9246BAC5D043FABB5A538A33A323B5C2EF7303CD080B52668A50F4E77D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790890, "uuid": "28af25f0-5f03-47b0-a7ab-f8ac738feeb4", "value": "768:2D7MRMnz8Ifau8yxDJ9A9khytAivcmjC7G1evlOeCvPcCqzFp0nGzTs:2vAM4Mau8yxw9khaAiUmjCC1evld/zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790890, "uuid": "62ca6c0b-3dd0-4bda-902c-760137f7abdc", "value": 60468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790890, "uuid": "25cd2202-8e25-42c4-8981-6a982208f445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790890, "uuid": "2a4bc3a8-c64b-4035-94c5-3d111b2dd5cd", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e31a52c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766423, "uuid": "af3d7dbd-cc9a-4f84-9127-e20bfbf98b38", "comment": "Malware payload", "value": "4a7e150e2c84a65b42c88f04a8dd2c41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766423, "uuid": "2ebc4298-2554-4971-8f82-fae307702407", "comment": "Malware payload", "value": "7f6e05125b4fa5cea9312bf9af6c4355055ad8915c458bab51c34f56ffd371e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766423, "uuid": "b4c89006-fed9-4910-976d-308edd72c729", "comment": "Malware payload", "value": "2ae8a95c80c7888ca368672ee056ada9e56ffd12", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766423, "uuid": "ea9df614-7e3f-49f5-8080-6b33012e5dcc", "comment": "Malware payload", "value": "71496e56f5af2368b1745a0e6701a685759b5aece03d94455fd0f2b40a815ab1ed7ee20268f86d28b7f99afbd43d7fe7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766423, "uuid": "04bf9ecc-f936-4a4a-be21-5a63dec3aa11", "value": "T13BC1077025F189332A24AB80B3372B96ABB6D94345E7218C36DD2D265F87B11B0FF455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766423, "uuid": "1212013b-b263-4e50-8115-f0f4cd680388", "value": "96:cLu3k0B6UqrZ+a9H9MM9gIB9IBqIBSIBLIBaIB8Iy+:cLu0g6l9VNJumdD0R3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766423, "uuid": "d229a166-0482-4049-a2a1-97f7e3faa945", "value": 5784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766423, "uuid": "eb8ca1f0-f97e-480f-9eb3-1b34f046d290", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766423, "uuid": "3ee3bcb8-4361-4d5a-8beb-81a490179f84", "value": "7f6e05125b4fa5cea9312bf9af6c4355055ad8915c458bab51c34f56ffd371e2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3667b4b5-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766409, "uuid": "959e608f-9413-4914-a16d-cacfa9bb5718", "comment": "Malware payload", "value": "8b901f094dc0ca786eec99b07590dc5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766409, "uuid": "2513181e-4480-452f-9f65-97ce28be9021", "comment": "Malware payload", "value": "7f8acc5f4aa5c98887379ae574cfa7d6c894c71e42cbbe6ba4f582067b5a9804", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766409, "uuid": "7acde140-2a60-46c3-b490-f66f7f7766d3", "comment": "Malware payload", "value": "e5f95f5e5a01a3cb7cfd420978e586e6e45ab38b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766409, "uuid": "18507c20-9438-4933-8985-27e1f177153c", "comment": "Malware payload", "value": "d982e1f05f37e04b97c3e2f38f5a8ef1f91de8cf4c50af46f664bc4eb187ade3d7d71183d334d7a7b4429cc29225c1bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766409, "uuid": "6374ee27-cc12-45c9-93cc-5d66acf7ba66", "value": "T123A1D9B131F10C331A55A540B3371BD6DFB6EC938CD33E88B49D0B362BA6602E66AD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766409, "uuid": "21e9ca23-fd54-43b8-9b4b-620a1d7d7611", "value": "96:cLuA64l474n4U34jV474n4UDZnjsMnjVB6t73aofbF1uR64l474n4U34jV474n4A:cLuXYm8R32m8RDZnjsMnjn6t73ao7YmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766409, "uuid": "ad5c5da6-6b77-4996-870d-38c0b7e0b044", "value": 4656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766409, "uuid": "c6f9ffb1-0e9f-41ec-be57-3e5b2a5e823d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766409, "uuid": "56f6db28-64e0-4cf3-a1fd-4aca92059553", "value": "7f8acc5f4aa5c98887379ae574cfa7d6c894c71e42cbbe6ba4f582067b5a9804.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b75767b-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769022, "uuid": "4a95c779-5465-43fb-a676-3fb35469097b", "comment": "Malware payload (Mirai)", "value": "120125745bed58593c460e80e7642ee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769022, "uuid": "43ba287e-8bee-427c-a0d0-81ee6b614b44", "comment": "Malware payload (Mirai)", "value": "7f8ef0b8c936c81c0ce6d4a6191c294a043866a5f90d2aab77dd96eb169979f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769022, "uuid": "cb4cdd17-9fac-4de6-8044-9b88f1d057a6", "comment": "Malware payload (Mirai)", "value": "206c3022c675c46fce2267ec8f315278d081837c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769022, "uuid": "91230537-a0fb-40a8-a3f8-0b4444ff8330", "comment": "Malware payload (Mirai)", "value": "3468adca250c03044f155c42bc05a26980ade26dd7f1eee509fa788a6db3e5655ef3421cb6bd840bdc852f030824bcee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769022, "uuid": "dd44c8ca-b916-4852-b948-adfa4106543d", "value": "T1FC734A21BA361A27C0C1A47A21F74B11F6F287DA22A8C90B7D710E9EFF706502557EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769022, "uuid": "03f26a70-8203-48db-beaf-dd43bde4a29e", "value": "1536:+uS4Xfu5MzMucEJGtud+WU8ZtHiNUYk5Btby6f:+vkfSRusUCNUYUDy6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769022, "uuid": "6d6edd35-5adf-4557-b50b-545b6c9d0000", "value": 75856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769022, "uuid": "bb4aa627-6dbc-4d2c-bdbc-24ee0179e307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769022, "uuid": "4e0c55cc-f646-43b8-88e7-99892721796b", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39e735a-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752554, "uuid": "a0835013-75da-4e6d-9991-89a23a30f909", "comment": "Malware payload (Mirai)", "value": "3c8ac3bc654c6714e7f9f6f51910079e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752554, "uuid": "d7c14cae-61e8-41b5-97c7-37e3a39e30f3", "comment": "Malware payload (Mirai)", "value": "80b3a7e4763bcd547828ce79b27f8f580e2340f035bde5e93cf9981ccba7c7d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752554, "uuid": "2a41483b-9d05-415c-a7a7-351aff63b6df", "comment": "Malware payload (Mirai)", "value": "42a9304147b288d3cd44176e171f663d8c8157be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752554, "uuid": "3c78e642-8140-41bf-b32e-d614604362ca", "comment": "Malware payload (Mirai)", "value": "aba8e41e4aeeb83d1f0acd7134faad675628074a2cd21c7a8c76271ca581168a6d88a80487c659df742c1eb40904f60d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752554, "uuid": "4de6be03-51c6-4b26-981d-8d782059b1e1", "value": "T1F704392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752554, "uuid": "57ab2574-f1db-4be2-863a-726118a31edc", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wtUXS:7eJpJUVD1A8n0YNgEJi5a+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752554, "uuid": "c7d69e75-69bd-4abe-b8df-85b1a2aad991", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752554, "uuid": "7f70fc5a-d637-43ca-841d-f660336738cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752554, "uuid": "ed896c68-4fc9-48ca-a922-2edf1d00b027", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c0de44-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752581, "uuid": "3d3a888c-102d-4086-8aeb-f11906171bd1", "comment": "Malware payload (Mirai)", "value": "76c7eb419e93bbcc312bf23ae5f9440f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752581, "uuid": "9e1d2cd0-da90-44a7-aa6e-618e900a870b", "comment": "Malware payload (Mirai)", "value": "814ea5c0b3181eb479e53bf3f42f150274bf8a35461ce98482bd3b44bbc594d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752581, "uuid": "0b87b077-ba65-4c2b-a9a5-75dd05156d35", "comment": "Malware payload (Mirai)", "value": "7643d9ed39bd631e2df164b58764c08d9b9849c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752581, "uuid": "aa512acc-3f61-47ae-8d1e-24fa947086ad", "comment": "Malware payload (Mirai)", "value": "1d7da9766038c1171f48c82b92285828b59715c1dcffa0ed13e99754b6c37f06b762461bc05d8400054ed00ad662740c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752581, "uuid": "626fd85b-f160-44db-afcb-75b10ebdb334", "value": "T15BC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752581, "uuid": "3d270a8c-b9f4-424f-9b7f-e93c6c7d9977", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiymw:VoRNjmj1VGFVrRiyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752581, "uuid": "f410c432-f668-49b0-abe4-7f6a5713fcbc", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752581, "uuid": "309d196a-3129-42bc-8503-895f842824ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752581, "uuid": "be40ccfb-5473-4176-a78e-a9478b57ef61", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1901270c-1006-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771775380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775380, "uuid": "30fe0260-69d0-474a-928c-a61787a32d38", "comment": "Malware payload", "value": "2cd377a5218fb880fa479bc86f0f368d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775380, "uuid": "2836375c-e49e-4a4a-8bf9-75f1f453220d", "comment": "Malware payload", "value": "81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775380, "uuid": "0e03914e-2a42-4a2e-a9f1-d2a016e133fa", "comment": "Malware payload", "value": "7df029c3f456dc2515a74fd8263ac6c89c86a0c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775380, "uuid": "c657aed7-4941-4a94-a654-ee64138f0a8e", "comment": "Malware payload", "value": "f674b5fc33d43f3081e67dc2ba1584974afabd069e89dd18c2fa85cbcb2157e101038024fb356f60a52c61f50bcb71b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775380, "uuid": "274ecd10-60d8-4e86-aa4e-025d2b589ea5", "value": "T17732D77435F14C333A616940B3772BA2ABB7D95345A3218C39DE2E265F87B12B4BF811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775380, "uuid": "d647e07e-2fb4-4fc4-b9c9-efef3e6a5fe7", "value": "96:cLuKB63uxu+SEgI45+fIBVIB7IBMIB8IBrO9F7S+vevGvNSJCqArXy5vR:cLuu6Yvk0ewPzi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775380, "uuid": "5f816f3a-8a68-482a-bf4d-8e124584e7d6", "value": 11676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775380, "uuid": "2c460978-5079-4978-b31f-e1ff0cf28517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775380, "uuid": "be209d58-e012-4c6c-99c4-c6edd2aa3929", "value": "81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0fd006-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752539, "uuid": "f10697f5-bc0d-46ef-af24-0f0e02ef2a29", "comment": "Malware payload (Mirai)", "value": "e74830113b24a26a9e7d55f72a73e4b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752539, "uuid": "9f0a79fc-dc53-443c-83a2-a517e7611990", "comment": "Malware payload (Mirai)", "value": "820531ff09e25c12e7e042e87bf94cd6e6ca7c9fdc18c59bdc8d964f1d20839e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752539, "uuid": "19bc6074-dc21-4024-965d-95586ebf14c8", "comment": "Malware payload (Mirai)", "value": "a0f5848fa19d5338bd5f08046bbfbf8390bb6477", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752539, "uuid": "a2253f22-6a4c-44df-81cd-3cd081ec61c7", "comment": "Malware payload (Mirai)", "value": "2c1badcd5db3f07411e5b35a914380f0bc02017192b4e3ebbca8d3f05f260368ccab538e1adb7b1518519da4fdc93905", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752539, "uuid": "3a950bd5-2d34-4d8d-b33a-6de5bb5d0ac8", "value": "T18351F2DA02884FF59A46858F77F472F45B0FB082A6DBCA08AA84085D5ED9D5C36D5E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752539, "uuid": "0594a102-09bf-40a0-a2fb-0953e3f0aee8", "value": "48:wTsLkL2JMiY4YbiBW0D0uZO3O3cvy4LUVDVbwHoMW8rU1ImkmhM3iRT:FG2JMtbbiB1IuZFxbwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752539, "uuid": "21329b6f-3ae3-4d51-9a9e-151f25dd110b", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752539, "uuid": "2c38ede9-5e64-4ba5-8a76-267eec0b2626", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752539, "uuid": "8290078b-c75e-4fed-9085-1368fd8a2caa", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e13e18d-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766154, "uuid": "f510b6fb-29e2-42aa-ada6-92756401882c", "comment": "Malware payload", "value": "1335ac15463291ad58b52f1ca5b6f2e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766154, "uuid": "4b860a52-a2b7-4eb7-a101-885155187bd0", "comment": "Malware payload", "value": "8206ad9426b1167cd220fc338b917633c681b6c88528380ce5cf02cd847fb878", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766154, "uuid": "06836238-06cb-4aad-a14d-6d0dd92fb8bb", "comment": "Malware payload", "value": "c037734e5954a0c95c228b6ae7ebabaf62fd56a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766154, "uuid": "0138f24b-34d0-40fe-be10-27109a33a41f", "comment": "Malware payload", "value": "72e20eeeb7a27439f2c09679daaaeef41152ad88c604baebc07892845eb1b689c1481d4b9bcf18d485bcc91311c6bdd1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766154, "uuid": "98cc2b48-5e83-4b1e-a86a-3d1b700fcbc2", "value": "T14132453B21F08B32D7C410C9A3A61B654E72A70B452614B5F4FE6736AF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766154, "uuid": "0291da34-5bf4-47ed-b6c5-2ef5abc5cf73", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6y7OJgaqvlAAprb:cCul4hvZ5m5FG4j4HKNphvW/qdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766154, "uuid": "5764583b-e02d-4861-8093-8e919999fa34", "value": 10987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766154, "uuid": "66c5a1d4-dfa4-4352-99b8-168ad92983ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766154, "uuid": "1d6e5ed3-f85a-42ff-bcc4-e7888f1adb9e", "value": "8206ad9426b1167cd220fc338b917633c681b6c88528380ce5cf02cd847fb878.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dc6ab9-0ffc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771297, "uuid": "e77572fc-21cc-4956-8590-1b09b87a4ab0", "comment": "Malware payload (Mirai)", "value": "f2c468da7ac3f1d123290d94babdd323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771297, "uuid": "00502451-5e7f-46d1-a9e4-45edb3f47e0c", "comment": "Malware payload (Mirai)", "value": "826f9dd04ba492d80ec7fbc235b01c5ad44d07c267eaf03b51542bc34a98d866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771297, "uuid": "4722ecce-e8f5-44b2-89be-3818e07dba18", "comment": "Malware payload (Mirai)", "value": "f0b8fc6f7bda036df0f3228a9825e99a8d5fe7b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771297, "uuid": "34165c62-1518-48c3-967b-e1c7a3ebb1a1", "comment": "Malware payload (Mirai)", "value": "a7c401adcc673b3d96bb17f43b02c4ec608eb1787fdd0f1d1572da76e78c536d08cd25960f1a9fdb6d03ce04574a23fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771297, "uuid": "e7d2053e-f244-4e01-a2cf-cc23c8db14d6", "value": "T103F35B07F5C084FDC896C1B44BAFBA36ED72F05E1134F26B27D49A621E5DE201B6DA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771297, "uuid": "c1fce53d-c2fc-4113-a0e8-a85b78d3e4f9", "value": "3072:mMBxAhJMJdMj2AZxRlbqZw9jpbiiShhfHsAi6ELZ9hYx1Hr:lHAheXgTpKTOkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771297, "uuid": "b900c37d-016a-4f5b-bbd7-3cc09f3b265e", "value": 159224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771297, "uuid": "c6c9a9f6-37d0-4ab3-b79a-12588b6fe202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771297, "uuid": "a4e82bba-75ae-4f2b-a395-4bcd4f03f33d", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba42aad-1003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771774337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774337, "uuid": "bb7e5f01-a173-4c4f-8893-0aa147012c0c", "comment": "Malware payload", "value": "81e9ab6fe71b2197d9ecf1f2e2559c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774337, "uuid": "612a4d25-3385-417b-a079-78c02e03bb68", "comment": "Malware payload", "value": "827a08808e1729b8f6711b522e0c572a7997b1c48ae2dc64fabc81ceab69183f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774337, "uuid": "e20061dd-c1a7-48b2-a1d4-51e76036d98c", "comment": "Malware payload", "value": "0a32bcde1ae56c5f1cff55ce81e3a314bc84a807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774337, "uuid": "86a1b346-82cd-4797-962d-2651abe07e3a", "comment": "Malware payload", "value": "20d2a33653fb0e390da3333873b60f2fc20ec67ab7b0e537a289d900eed576d3f0cf19abe92135c5478bfddb7c90e355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774337, "uuid": "10aa5431-2d5d-4f41-a3c0-ddc333ccea93", "value": "T152871256E2F900E8E97BC0B8C6575517EBB1344517309BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774337, "uuid": "61cd1ae7-8134-4019-aac8-625fcec3613e", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774337, "uuid": "2d829d6e-3779-4bd5-b31d-f6a62463d539", "value": "786432:85cRhtzhWNsKpjGct8To61nEPwd49C880XsChv:DRhtzEnpjGi8T1nEPtw8z8Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774337, "uuid": "499240ef-5ed4-4e01-86e4-0d527eac8475", "value": 36214104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774337, "uuid": "0203a200-5775-41f5-b30c-0140080eaf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774337, "uuid": "773e9294-2ea8-4dc4-8b7e-5075239396e8", "value": "HardConnectAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791e7d13-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784131, "uuid": "542a7407-330d-4aef-9706-b1b693fe3366", "comment": "Malware payload", "value": "8137b046c204f291206f9cad3fc3b4c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784131, "uuid": "b1a052c2-8699-4a61-8fab-bfca71dd344a", "comment": "Malware payload", "value": "828a03e1a219dae9c5fc45dd92139cc6063dc01b3db7ae557aaf57ab9eabd80c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784131, "uuid": "c7e0d3d8-69ce-4e45-8737-19d63da195d8", "comment": "Malware payload", "value": "dd5442edf2ec94215cebd88c3d98eb02b1a95fdf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784131, "uuid": "4e5dcdd3-555a-4ecc-9665-84320e78c767", "comment": "Malware payload", "value": "5432268110cc3fe59a8067ce40006504bde1a5fdd054745a7dbb6a4b20e7cf2638ee0b329e63e14bf01dc423516c22d2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784131, "uuid": "a2e7dc43-f671-4558-b1b5-c7d7c7a60158", "value": "T177F2E11D9D22B431EEC312F09598191ED98FD51FB14D8BA33C2275ECA9F5ECB1381A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784131, "uuid": "d9bc0b29-5785-472f-b820-b195c24eabd1", "value": "768:a9R1FP+MPqguJBZ4Gb6NDOrnk9Pr1WJyz+zbSx5iH:+/fuJEZOLkNEyazWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784131, "uuid": "0fa30d25-7649-4b9a-8806-2c4ebd5b254e", "value": 35713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784131, "uuid": "ef49c3c9-9e8a-4137-a6d9-0598a9c34fe2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784131, "uuid": "44bb4140-9e58-4399-93ff-b3201d959a2f", "value": "ps_payload.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471094eb-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769014, "uuid": "24df22fb-1b9c-448e-98de-50d96d7002d2", "comment": "Malware payload (Mirai)", "value": "7e60950b10219836f0fa9535d1c48545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769014, "uuid": "036d408b-d1e1-421b-a799-b100bb38f6e9", "comment": "Malware payload (Mirai)", "value": "82bca1a833ef2803240fee4d04c9a267577048279b531c5368b5122aa758f13c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769014, "uuid": "25af7fff-3d58-4470-9878-d704400c8aa4", "comment": "Malware payload (Mirai)", "value": "2466e2b34262fae56a5324895228317996738bf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769014, "uuid": "3e68dd89-3160-4c55-b09d-5c1989af6454", "comment": "Malware payload (Mirai)", "value": "bbd40877183aae7f94e9a4ed0e3f1dacb7ad174183a5852b0fe1e5040f91ddeeba5110ce56e60bae76ce29bf912a1ce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769014, "uuid": "4266fcc5-b680-4b09-b56c-13d4b3f0deb0", "value": "T123F2D0CDF1EB7C80CCDE38BC309D16911955B8C5A5E2A6DD53218888A06989BD46EAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769014, "uuid": "6903ba28-8473-4fdc-acb2-891f5ac64d2c", "value": "768:zZdtcsIq+0LgOcsBqb2RriAMTc/2nDCcWaDiQ4mbZfX2jEbXWs:VdtcJU8OxRrOTc8BFRGAbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769014, "uuid": "4b3119cf-4d95-44d8-b897-f4557e49e1e3", "value": 37000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769014, "uuid": "40bcc817-ea01-4d03-b494-e0a4e820e7b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769014, "uuid": "c8d418a0-de84-4dea-9687-95894fdfa2b8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193b62b9-1028-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789983, "uuid": "3c122a4d-1b04-433d-b327-214c990850bc", "comment": "Malware payload (Mirai)", "value": "db678cee35bd428326710c4f32947b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789983, "uuid": "7a8a01df-f419-4494-a27c-63b5dffb5096", "comment": "Malware payload (Mirai)", "value": "838ec6923b32704cc7840d17114788c2d40f6aeb50291fa0b4ad636d8c31c121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789983, "uuid": "9b149cca-061f-44b5-a55b-88f2c37510de", "comment": "Malware payload (Mirai)", "value": "a456c572ca391e97323b72c0827147f3a366eafd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789983, "uuid": "523dd8de-aad1-4f77-bb5a-b24b824299b0", "comment": "Malware payload (Mirai)", "value": "7b80369bfdfa1333a27375171bf494ea19237a453c4f5cea702f8fd3d8b9b24c572867f64e88a9b298fd4415fba0e555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789983, "uuid": "ea6adf6f-88f9-4020-84df-67015d5ead57", "value": "T148537C3BE51A5A44C04785B074795F342F63E1C482A32FBB6AE186B96483DACF905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789983, "uuid": "91581e75-80d2-49cb-b538-4fd6a50034f2", "value": "1536:gacUNh2ewLZ4oXDC0cKiqj8eDVtCZrVn3R:gmAeyfXDC0Di2DVtan3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789983, "uuid": "cc80cead-5d46-43eb-bed3-30904a214a68", "value": 63016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789983, "uuid": "81255318-1df2-4655-9e0c-bdf04f830bd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789983, "uuid": "d77299f7-9b74-4176-a244-4a6e808b3aa2", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5310bb-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771785, "uuid": "103e2536-3292-4e64-9809-b5bbe3930b9f", "comment": "Malware payload (Mirai)", "value": "5701f991d95b0de0a94a60a50a839fde", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771785, "uuid": "27bc0523-47e6-442e-971e-a97ad5cacc2f", "comment": "Malware payload (Mirai)", "value": "846e6c1c8801c4d6187311212bfb2451f811934cfa43cff3280ec4fe04480ea1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771785, "uuid": "f1b10713-ba57-4552-be69-683a7f660664", "comment": "Malware payload (Mirai)", "value": "d92b29eda1b4fb3472e0a3772d43803f6127d0ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771785, "uuid": "81fd363c-a344-4329-be19-843446fd8c94", "comment": "Malware payload (Mirai)", "value": "d5e89b96f0daed48a28d55592bf4ea367f5c950d9a1837415697d47944a02fb7ff0884eac707ae0ff1952dd717ae7401", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771785, "uuid": "895ea129-859a-4bcf-a026-c87d163c6361", "value": "T145D0A98E212216302E8A898131B840002880D68235E82F2859EC24E12CC8F683688E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771785, "uuid": "e854e21b-c7db-4fb5-8952-9f7cded6e12d", "value": "6:COnFflE0FdjKfQNaKMBndjKhy+9N6dV0XBxn:I0Fd2fWAnd2E+0VEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771785, "uuid": "9bd767b0-c242-4dbd-b344-078794ea1202", "value": 200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771785, "uuid": "354a489a-72ae-40cf-8747-bffe4cab12cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771785, "uuid": "5bcdd777-2778-4c90-af50-6f14cf963e0c", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7535bf-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753298, "uuid": "61337efe-f7a5-4d89-9c88-7c50ee15b074", "comment": "Malware payload (Mirai)", "value": "1bd5987e1c6120171dc3d22fcddd21ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753298, "uuid": "c92b75b4-c601-4272-ab0c-67b53a187b83", "comment": "Malware payload (Mirai)", "value": "84ae516eb63b05a351c4944d196b922af3825c52090c6564298c3a1af6cd6e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753298, "uuid": "a06debc4-dc96-44d2-9347-7a0e70e72680", "comment": "Malware payload (Mirai)", "value": "274cf6c5ceb3eefa8ee5197802ca5e9232d6efe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753298, "uuid": "5e44b0f1-424e-46d6-b210-0d891e1351ee", "comment": "Malware payload (Mirai)", "value": "ffce240cf03a8b139fa88ccca4822e8ab86e6da1488b1365ca117899c094a174ec4c2fc205c83ab04f8975b573893c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753298, "uuid": "0a946765-70b8-4b53-87f6-d78a8deeab9a", "value": "T18514965E6E228F7EF668C73147B74E249B5923D627E1D680E2ACC1105E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753298, "uuid": "b3cd2788-6802-4224-8600-d17d47124d4a", "value": "3072:jUrEuoT986IQXgRVCefC6AbAP6rckC9ytr/6hh1a1mHD:jUrE1TeqmnHA9r+9yh31mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753298, "uuid": "5261313a-5821-49f2-977c-829e641f3f57", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753298, "uuid": "3a4f8d58-1b7d-418c-bab8-95cbca71d6aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753298, "uuid": "527b9f5c-50de-4750-a34a-78e2b6b761ca", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea4322e-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784006, "uuid": "c62ddf8b-a518-4680-afaf-613ca0cb6e49", "comment": "Malware payload", "value": "3a85d8a51ff724ce38a02d435e0c0bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784006, "uuid": "a3ee836e-b180-40de-bf84-46210f249e13", "comment": "Malware payload", "value": "84b24071b0229e189f03bc643027a63c582b02f6e96e82d730e12793cfcd9abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784006, "uuid": "3b39926e-c868-4b9a-90b8-ac2490dfd3b7", "comment": "Malware payload", "value": "bf5f9771fad47b1b19f366b88469b829901d0217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784006, "uuid": "65916de7-8b50-4d39-97e5-ca79a5426060", "comment": "Malware payload", "value": "4ee1ff7976a24b15ca768069bbb2a85d6d19c60ba0f7acdcbf9907e6806cfaa1f6835ce92906faa104c8c517be50f739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784006, "uuid": "a4ac2b57-277f-4a41-9ca5-09bd28193f1b", "value": "T1FA35E1392BEC5F09E5BF0735E071491906F2F112A4B2FB9EEE85909E2913B44E821777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784006, "uuid": "bd3662ee-4d53-4eb0-8b2f-7aa66da5bbce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784006, "uuid": "21eb43b5-9cb2-408f-b0e5-fc6771577515", "value": "24576:2ZeqOjAlC+9nHLmX63wZSGBI/u0+eW81ATw8FD5S7Ms:2Uhsl99nrmXOFp/HJW8itDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784006, "uuid": "d7a14755-1050-4f93-bb67-81251c857869", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784006, "uuid": "1365d27e-54d9-47de-a7f8-5c27907caba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784006, "uuid": "8c1788fe-c827-43ed-8ee7-eca4cc059708", "value": "DavRelayUp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1f2819-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766340, "uuid": "9fba221d-1408-4966-b074-29b4031ff013", "comment": "Malware payload", "value": "44f09532523c28f4e795d8daf1f5512f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766340, "uuid": "7e27f079-4132-4e20-bf7a-b68203d53ebb", "comment": "Malware payload", "value": "84c6cf527dcb09ce579656606dfa979a6783886e92600eb57fc0e265f407be15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766340, "uuid": "82195919-10fc-491a-ba66-ef7455a14148", "comment": "Malware payload", "value": "36fcad549f7f85e231457d116dc97d4e0c6dccc0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766340, "uuid": "2881d2ce-8d5a-42df-b435-ea04947aad97", "comment": "Malware payload", "value": "b129525961c7067e0772a7e583f174d0eb2dd1aaa89b675faed2cfe6ede8432eec25db7dffd76d97d866caab44b3d5e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766340, "uuid": "e1130753-3b2a-43e0-9a4e-6901f00686b9", "value": "T1F3113A7411F10C2326146690B2376F557F72EC4749A352CD38EF5A396F97F03A29B011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766340, "uuid": "d6571b28-057d-491c-af88-266fe7721560", "value": "24:cnnRUR8fARW5wt9HHIuCzCRpYdZe63NmUKLUlc9HHUeN:cnRu9RLXnB6g63NtlwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766340, "uuid": "d1dd43b5-62bd-4de9-93f1-f8b2f9ecdd44", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766340, "uuid": "bb2a2d9b-d06a-44e0-860c-64cd1894d43d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766340, "uuid": "827ed278-4796-4578-b07f-baa4fc399239", "value": "84c6cf527dcb09ce579656606dfa979a6783886e92600eb57fc0e265f407be15.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32638ad-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752445, "uuid": "c3d90cb2-5fc3-450a-bedf-af6c05506da4", "comment": "Malware payload (Mirai)", "value": "2b2a2e5725ca5fa24543e49d17031a7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752445, "uuid": "483a733d-e97e-41ba-a218-92ce37fa2b15", "comment": "Malware payload (Mirai)", "value": "8509612446d65b7ffd8c3f0439440eeb4b52f94b85d15fdeefc3d9caf332c084", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752445, "uuid": "7db910f0-cae2-4914-935f-95c1e52bc0d1", "comment": "Malware payload (Mirai)", "value": "7659094c36494c8075015b48244cfb03b6240970", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752445, "uuid": "6f52d974-d756-4e4e-ae54-a44b48df5197", "comment": "Malware payload (Mirai)", "value": "5a5a59a49b2c7bce5f33b104d4aab5592a9c0bb40de55dde2310ac247b12faa72757ace0bf3d8d81c6ca6b093cbf587b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752445, "uuid": "65097834-686d-4aad-a0a0-36f0ef22b840", "value": "T17701B98432F630F03AAED9DE4B725C9D308550653D877CB83CA7B0D60595D00AE86AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752445, "uuid": "5ada8171-70b1-443c-876a-5d0da429ab41", "value": "12:YkF1kcClZF70S9iHFniHF0iHFWfFSC+FM5gFlfFSs+FMDgFlA1LRPb:ZDkH/FbgHFiHFhHFWfFOFM5gFlfFIFMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752445, "uuid": "ba60da7c-04d7-447d-9c25-ec0ff54463ab", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752445, "uuid": "cfaded4f-6f10-4050-9bef-b43e1b4300cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752445, "uuid": "ac16cab8-4b98-4d4a-abdb-f76261b4f8bf", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6fc61a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766342, "uuid": "d106de55-ff34-447a-a027-3b93003c9607", "comment": "Malware payload", "value": "73bb3e7a743c7af2f2458a1c6750b862", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766342, "uuid": "1d5110f2-0cc7-4473-998f-1b0b31a1064b", "comment": "Malware payload", "value": "85d6bb6d5d7299c6db0878cbe9ade7e5acd061916f63278d1fb6a9d80875621f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766342, "uuid": "231150ae-ea35-4602-8987-b168bc081df6", "comment": "Malware payload", "value": "7ef119e8bf29c33ab345146860f90904e9da29c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766342, "uuid": "7bc1c1d6-c621-4d41-a0fd-d8bb005673fe", "comment": "Malware payload", "value": "793cb1863e8a8204b7e3882c498f08ee3746affbe272a2ee35e6b43d43eade67e44b65e3a0cc46c3dd275afda1b6ecbb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766342, "uuid": "dcad2883-d29c-4d93-b21c-2c0700226da6", "value": "T106F1C02B11F08B71D3C421D952A656954E72A75B992A08F8F4BF973ADB2C90334E3F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766342, "uuid": "a978d96a-fb7d-402e-aa43-68262898cc46", "value": "96:cCuaB657sht+O+v1fsn+h4+tIicqbA/GsGsioVbes:cCue65C4hvZ5mzjBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766342, "uuid": "1de8623e-4127-48a2-9016-6d5c022a7231", "value": 7656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766342, "uuid": "e2b528bf-08e7-4279-ab4d-3594ee3fc7b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766342, "uuid": "bae8aebd-dc68-4aa1-81c4-1ab9c254e618", "value": "85d6bb6d5d7299c6db0878cbe9ade7e5acd061916f63278d1fb6a9d80875621f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac2634f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766497, "uuid": "969fb776-29fa-4459-a155-77102151b3d8", "comment": "Malware payload", "value": "01b5356a3a9b927b38de91cae6b44d2a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766497, "uuid": "419790d1-cf9e-4951-81db-e6f885bfcb06", "comment": "Malware payload", "value": "85fb57a8d286b9e130a352d32df3e34a5b186e6d18adabaaf78170e24c03c0f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766497, "uuid": "40f99519-b809-44ca-92fd-551dfe3b4b46", "comment": "Malware payload", "value": "96f9f958b48f710bb06b64ee7c98a6ef4253571b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766497, "uuid": "64e500c3-ae8d-4358-bee5-2d82fb78d4e0", "comment": "Malware payload", "value": "c399042d7a8a4d9dab00bbdd8fe9fb0fe102400a776b8b88e9feedb00812e78613545f27bb6a8ca6c6636cf266e7a2e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766497, "uuid": "4574abdc-f3ee-45bd-912b-dac2cfacef28", "value": "T1C022463B21F08B32D3C450DA53A65E614E71A70F492614B5F4BEA329AF2C90735E3F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766497, "uuid": "0013b047-f96a-4516-bbee-04596ba35489", "value": "192:cCuYK6p4hvZ5m5FG4j4HKNphvbTVtAoMZrIT4:9p4hvZ5m5FGGoKNphvbTzAoMZrIT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766497, "uuid": "53f0801e-adcd-4ec4-9bc4-2f1737847443", "value": 10327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766497, "uuid": "2b85d1aa-4b21-4cc7-a819-bf800f13ce28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766497, "uuid": "88117458-7243-43f0-8089-e52809d77d5e", "value": "85fb57a8d286b9e130a352d32df3e34a5b186e6d18adabaaf78170e24c03c0f3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ccd835-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779392, "uuid": "471987d6-1fb6-479c-83d7-ad5cc2ac87da", "comment": "Malware payload (Mirai)", "value": "36a9462d04088f40c82c11a499fcc2ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779392, "uuid": "713ca863-a165-4c52-8cc6-ddc7fd75bdd7", "comment": "Malware payload (Mirai)", "value": "861b25202beca720f779cb959f4372c9499a18ddf3177918b3fb9bc57b5e1d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779392, "uuid": "fe9b5c62-cc1d-4cc8-86b5-72c978af4f6c", "comment": "Malware payload (Mirai)", "value": "ac4b9b3f11b0b18dccebeaca1a4589631ffdd316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779392, "uuid": "bc2d64e8-d069-48e9-ac91-482d2d4c0ed7", "comment": "Malware payload (Mirai)", "value": "d780efd635c4300163dcecbae9daff48b2f9a7c538257b09ad2b813a15cd01ae8501ff8f06de6716fc6ef27ee264afce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779392, "uuid": "a2a35035-2aa4-41b0-89ba-2bf4b820e492", "value": "T14CD2D0BEE4B441C6ED4E1C3E80CC3BA10E56E581631BDB9577218C895B32C5AF16A8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779392, "uuid": "4afc412b-0635-4602-b269-babf4101c880", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjaIrjRWGVCz0NvP:jMYHb62x4ahQ3CfdwLjWtWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779392, "uuid": "fb5ab208-ec8e-4ef0-92f8-89ecf2a9a255", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779392, "uuid": "d14d0985-2aa7-4879-a278-88a9024a4b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779392, "uuid": "4297e50c-c604-4184-9fb8-d2121fa61d84", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23458570-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766377, "uuid": "c4d8add9-b72a-4763-ab59-0fd3d0d57816", "comment": "Malware payload", "value": "2250c888f89c6dc34c80f3b34b951325", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766377, "uuid": "45019d45-a378-4329-9ff4-8fddec348e68", "comment": "Malware payload", "value": "863eb79f9eafd696ede0a898035cfeeb275e5381a8b6232328fd73d849380d4b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766377, "uuid": "1ea7d2ae-26e3-4ca7-83bf-400f1bd154f7", "comment": "Malware payload", "value": "60db35eeaff13d5b15521990987dc28fcd57c416", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766377, "uuid": "9319c3ee-ba46-49bf-88cb-470c498968e0", "comment": "Malware payload", "value": "d4f1bec1f9eb63c017afe3b87fc3eb1bb442ef08ecad93887e361a169e889081aa18dde0d33a1c0e777bfb0db6c61b98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766377, "uuid": "47a19019-d031-41c5-952c-4ace95365698", "value": "T1A5223E7034F04C732E256580F37727A69BB7A85749A3318C35DE1E2A6F87B12A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766377, "uuid": "58880bc6-3b8e-44bd-bda9-268c271bdd84", "value": "96:cRmX9Eh9mLj+ksN8ZPa65UOsp8CfUwD14Ims2hXY0:cRmACX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766377, "uuid": "e1a2fb5a-34dd-452c-ac4f-bc277da8b89b", "value": 10178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766377, "uuid": "1c31f5dc-4440-404c-9490-4e2ce5eddc96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766377, "uuid": "97050043-afa6-4a62-8f23-3ab9ec498f60", "value": "863eb79f9eafd696ede0a898035cfeeb275e5381a8b6232328fd73d849380d4b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557851d5-1027-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789654, "uuid": "ad6fa636-dfb9-405b-a7b2-b177b18de609", "comment": "Malware payload (Mirai)", "value": "2da41b74fd3c156fbcbf65396c8c6b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789654, "uuid": "58e1f2b6-0192-4df3-a0cf-b8430a8fa16b", "comment": "Malware payload (Mirai)", "value": "86d83cf80e5fdbd32d2c770dffdddbfbdf06ef3b5bc02aac4abef7e506edd508", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789654, "uuid": "9ea8ac4b-9bba-4f6d-bc87-ee0f14c001f8", "comment": "Malware payload (Mirai)", "value": "dab0513532f9b9a3443d6ad1f45beebbc10f86f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789654, "uuid": "cdec82ff-1261-4708-bd09-19217f31cceb", "comment": "Malware payload (Mirai)", "value": "40a5668b6eafbac09fdd0227ec908387d28ecfcb9f0ecfba86c7aa1f0a0ba00017192de78075f3c01cd5aad36483068e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789654, "uuid": "6b558cad-a1e2-40cc-80ff-95395d8f692e", "value": "T1AD83AD23CC6A1D58D05946B070A18F789B63E15181972EFB9C9ACB79C087ECCF64A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789654, "uuid": "dd0cb15c-542b-4fee-ba1b-b494f4c26c31", "value": "1536:gZKrlx5fVBjDqXK/mbXPoF5JK5djnQ7vVFCvuP1MAZr8:gQrlxhD6K/mbk5w5SzVFT9t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789654, "uuid": "d96b9c43-d0c5-4116-a234-2a8a2606f290", "value": 85684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789654, "uuid": "eae32a12-c5c8-44d4-91fb-e6b21251812b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789654, "uuid": "66d17da4-b4c1-46d8-8c72-3bcb9e48bdf8", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa37d89c-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784213, "uuid": "41d5b723-7be2-45ab-943f-09ecf5e73141", "comment": "Malware payload", "value": "3b6dc644059167ac095ba6b3e76649f4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784213, "uuid": "55ea26df-abaa-4bcc-808f-db1d7daf307f", "comment": "Malware payload", "value": "871dc5b2ce2b4eaa899321daed4453d4a09333a926818db3d135a9f5272723a8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784213, "uuid": "aa3a51c2-21ae-454d-9522-2a0bc955b924", "comment": "Malware payload", "value": "3c4f52afd4fbff75cf9b6183a40c101873e1a7b4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784213, "uuid": "9ccc79de-e779-476c-a0b9-ae4ae5744746", "comment": "Malware payload", "value": "146530a03ead849e3aeab9c52503baca58131448e9a1725f5a90045d6129ee27450837c70536260819e73974e811bf97", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784213, "uuid": "fa9c243d-a48f-4582-acf7-83c3185fec19", "value": "T1D7314EBDC475F9E4039EB1A084313D4110E8AE27C7744FBCFD4209AA5A147E4DF2994C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784213, "uuid": "a9a91776-f98d-41b7-b0b6-87dbfa6b471c", "value": "24:KqbNukBPd0BVF/hh65GZWEFpHTnY63RMLtsFp4dPnwhuEPwuSzfQ8Aw7IwL7hNDg:DNfPU//hhPAEjTlRMLtiUfG5ZSjHAUIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784213, "uuid": "e98e849b-a174-4cdc-953a-7af85b380952", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784213, "uuid": "3982f2e0-cbc0-4f90-a0ce-1da20f41e22a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784213, "uuid": "d0a5f27a-605a-4d47-a273-cf7ed597ae1f", "value": "revshell.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237417c7-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1771765948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765948, "uuid": "80463b0d-59fe-4f2b-9ce8-1dd51396e4b2", "comment": "Malware payload (CountLoader)", "value": "3d0def3081df35eacee2f9f540887040", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "immortal-service-cc", "colour": "#9734FD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765948, "uuid": "720060d3-821d-41d5-a60c-3b7a2532fa13", "comment": "Malware payload (CountLoader)", "value": "8752fde2d93f700a3866e52044714b406da1ce2f20b567f49f74b74f6bce947a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "immortal-service-cc", "colour": "#9734FD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765948, "uuid": "d8d20a07-6cc3-44ca-9475-0efa753b97fc", "comment": "Malware payload (CountLoader)", "value": "94a5fab547f6289dc7182dd9ce90bdbb1ca4e53b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "immortal-service-cc", "colour": "#9734FD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765948, "uuid": "eafc08cb-901a-4d8e-95f2-6b47aa659c23", "comment": "Malware payload (CountLoader)", "value": "a1213ee0af9019f0d6fd55d9facdd0410d7b28a5c2bee17b3f2d46478faabb0b52b92a6c18803e08dbc2f72dcd96a3a9", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "immortal-service-cc", "colour": "#9734FD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765948, "uuid": "bffd6dfe-ac0d-4e9c-94b1-6494e7f40604", "value": "T158746326ADCB6DA283D3DA63D1E7D30CBE7884DD801B5EC0B5B5C2825870D6A0799F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765948, "uuid": "03726e01-a3ff-435f-af7f-27b2849af895", "value": "3072:aNyk7xqAJTh4yRvVka1g5vTOV1gmfuEGDt:aNyk7xLJTh4yVV9C5bOPfu/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765948, "uuid": "2ab1f29d-525d-4ec1-9227-87f8c8cec129", "value": 353263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765948, "uuid": "dc951a79-2c45-43a6-938e-4a093ef590ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765948, "uuid": "8394b6cc-a371-4ffb-a2df-907a3e9b97e2", "value": "telegram.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd76ce-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768725, "uuid": "d0f0d84d-9803-4f05-a8b9-1c8373199ef9", "comment": "Malware payload (Mirai)", "value": "5305d612862b7c3ff2979c2b433f6696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768725, "uuid": "5be48000-2f46-4107-ade2-96a2490eff04", "comment": "Malware payload (Mirai)", "value": "87642111ef7bb966fd2e223b870dca549ef9059cbc2e9da94ca9bf5c3b591a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768725, "uuid": "119da366-5a05-4d02-b6d6-0f2c7e462835", "comment": "Malware payload (Mirai)", "value": "57b6504681cda8b166733ca00bec271638abb0d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768725, "uuid": "6ecb652e-4b06-4ab5-b571-76777956bdf3", "comment": "Malware payload (Mirai)", "value": "58db167e23ffaae0bb456975b76d6b4ca7e28bdf8a27a1f5abc9f11e9a7a9b99f74871131de0f3088826c8fd79b925fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768725, "uuid": "bf642c91-5063-444c-8b7e-d7e1b7a137e9", "value": "T1AAF3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768725, "uuid": "284f824c-8dc1-428a-b56b-71fd98225dde", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiww:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768725, "uuid": "45c1dcc7-465c-415f-9254-349e23d3e8ae", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768725, "uuid": "260fe74e-a519-425c-9ac9-ce2f4db0a24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768725, "uuid": "bfb67826-83ac-472e-88a1-26264732b273", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b934f6-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769034, "uuid": "d02fe224-1ab9-4249-9ff2-73de26dc7618", "comment": "Malware payload (Mirai)", "value": "eb257bbd53953583d01e02e60d25d614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769034, "uuid": "5c0d9781-b801-41e8-8a54-a2829cc20245", "comment": "Malware payload (Mirai)", "value": "885ad6bc703cb378f721f08d5da7ed452701ca8763538ce947802618043e1223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769034, "uuid": "b87f2c4f-1073-4547-aba1-471624d1f176", "comment": "Malware payload (Mirai)", "value": "2f163be3c2a3fd38d7d4b77700d726250a23cacc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769034, "uuid": "711b9e9e-a1f5-467d-bbf9-fbba705be53f", "comment": "Malware payload (Mirai)", "value": "df68648dbdce091e22be5997c8c4a1e63479c5751f881b6d76feab2b5a32ebfd674aca03b518c6dd127fd7678ea10d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769034, "uuid": "e13c1cc9-0373-48b8-b2b1-ff3dd1886a78", "value": "T11D93D506BB650FFBDC6FCD3746A9071239CC550A22E93B3A3634C91CB51B64A4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769034, "uuid": "f3f0d9ca-0678-4056-8e63-7947144a25b2", "value": "1536:lX1tMe0R/thi3+ZEzngaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//FE15Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769034, "uuid": "058890bf-5a4e-45e4-ac96-93d44643e2be", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769034, "uuid": "6dd0a2ce-f254-4f90-940b-86a08117783d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769034, "uuid": "ec68ff6a-c4bf-4812-b999-47034ebc4ac7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4fd6b-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770802, "uuid": "7016a7d6-330c-4e17-b508-180bc882ed4a", "comment": "Malware payload (Mirai)", "value": "d9925515be089ee733a0ffeb0e199e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770802, "uuid": "058ca225-a4dc-4404-bef8-2b6cdab923e8", "comment": "Malware payload (Mirai)", "value": "886507db78a4f3aeecbe461c11f93598165450acf04a3f83fdffc10e534827ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770802, "uuid": "83cab0d8-82ce-4186-b343-67b2a2f40a81", "comment": "Malware payload (Mirai)", "value": "8194f001b03f75a1ba03a0fef15775bc52fece3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770802, "uuid": "acecdc36-e8f9-403e-bdb0-ee45aa3f430c", "comment": "Malware payload (Mirai)", "value": "2bf103faf012014ad65cca7b149ed53523456ecac79b429e24f1eba749daafd14e30ced816e63e3018b5e52fa8357fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770802, "uuid": "7d72c633-39ae-43bb-a89e-040db19228fc", "value": "T167C33A46EA409A17C1D2177BFE9F01463322D755E3DB730689285FB43F86B9E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770802, "uuid": "8a72ac88-a3f4-40a7-84ee-d848b3d34e4c", "value": "3072:nF2f8Y+oqCRJXIEtfZLTFBM+j0NnmytzM/9qJUyo/:Qf8Y+1CjZZLTFBnjsmy1M/9qxo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770802, "uuid": "90e98d73-1159-4d47-b781-280ed74aa1ec", "value": 126156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770802, "uuid": "07ed5ab1-0fa1-4889-a491-b2139224ded6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770802, "uuid": "41b00cc2-77a5-4d4a-825d-c859952cc129", "value": "3atoNational.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b364a57-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766391, "uuid": "da2fb2f6-d829-465a-bca7-10c81ee3a920", "comment": "Malware payload", "value": "a5280fcb2acef49598b20a71eab89224", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766391, "uuid": "f9d513db-ed1a-4bc4-8daa-4380349f2f09", "comment": "Malware payload", "value": "88a4cb44b4df969a96830c34f26f347dcf518fc64c16de5244bd23f1d57974da", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766391, "uuid": "602989cd-72cb-469c-9d69-61910e178e3b", "comment": "Malware payload", "value": "e22f6b89774a4e3642ea793e85820483de23310b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766391, "uuid": "5331d3f2-a6a9-4cce-ba20-f435171c3f6c", "comment": "Malware payload", "value": "224ffc667b77dbf54888d82451f80f99a2233955732106fdb1ed83ebf1a40eb54510833463381ca9f7b1885c114a9443", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766391, "uuid": "0604ee7b-e9b0-4f0a-aaf4-22367d72ee18", "value": "T152E1847125F20C333A705944B2772BA6AB76D95385E3318C35DE2E366F86F02B5AB411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766391, "uuid": "60a12fc0-3522-452c-ac6e-c0ef71f1195c", "value": "48:cnRu9RrsnB6/wUblrbSJYlrWSJYlrGnJYlrGRsJYlrjNJYlr+xJYlr+wJYlrmsJq:cRu/mB6ZxLGNYxifImPvSKSegbzCPRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766391, "uuid": "d3abe77b-c71a-4ce3-b34b-91a845a884e9", "value": 7228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766391, "uuid": "15b32d0d-79ac-4f8e-93d9-79ebef32dc98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766391, "uuid": "5f81d7a6-0824-414a-887a-6412093a9a6a", "value": "88a4cb44b4df969a96830c34f26f347dcf518fc64c16de5244bd23f1d57974da.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4123e2f-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771755937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755937, "uuid": "ef826cd1-7230-434c-be70-8cf7615e413c", "comment": "Malware payload", "value": "40e947fba82b2f6401f84b9e3f142161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755937, "uuid": "1504dedf-ac95-41c9-94c2-f99d7f997730", "comment": "Malware payload", "value": "88e1c2a01afd90c77b3abb68bd2c6be4e77d9d74b5c57fcb2e6100e0a122f35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755937, "uuid": "ff024222-52f8-49b8-8535-67854c5531d5", "comment": "Malware payload", "value": "eb612f39ea467581b536d005cb6a13c55fe00a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755937, "uuid": "967f9ec5-ea2b-457a-b043-ffc95fd943ab", "comment": "Malware payload", "value": "9746883dd94bc68ed7a7420a0cc08f930b5a9afb62a9f93361ea3ee88eb5e09b3041b7e213aa124d902c54856081b27e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755937, "uuid": "ffc75a7c-299b-449e-a74f-1ba3a45ff64c", "value": "T1DE534C0B339348EDC116D97482EBCE329B72F8650570AF2F13E4EA312E15E716F19A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755937, "uuid": "ae3f01f0-32d9-4840-a3c0-0091d016e5bc", "value": "15e5009604045a6269161b15a81fc470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755937, "uuid": "befc8e4b-68c7-47ef-ae5b-7fb6430ac5fa", "value": "768:lxv//anfZA6VpXUI/i20hHvdzVSgLXHvezlMY8+guy/MOBKVHoQj0YunByeNH6QW:niKONXihtVSgbHvOv2sVh6np6O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755937, "uuid": "392e961b-1694-4d65-827b-8729567a271f", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755937, "uuid": "e6e2741e-b3d0-4e45-afc0-3ddf27f7f286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755937, "uuid": "71a94dab-373c-4fe4-9576-36a97941554d", "value": "SecuriteInfo.com.FileRepMalware.11236992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc3d9d4-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738719, "uuid": "1aef0796-8f3d-4f8a-b111-4ea045fbbec1", "comment": "Malware payload (Gafgyt)", "value": "e85c1194a5d1d599348619471d6e1973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738719, "uuid": "6a4a6f8c-70bd-4503-8476-420fa1e1c165", "comment": "Malware payload (Gafgyt)", "value": "88ecc071cd940d779abf742a73a0ee8f159286d5d96562ca4f4726b1d4d71f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738719, "uuid": "4b8b7e55-a874-4a42-9cc0-e3c1b3412a50", "comment": "Malware payload (Gafgyt)", "value": "aba1aa2a1aeef5e6be40e400e6d6c47ec18f0a22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738719, "uuid": "d0891318-3c7c-492f-898e-e6017a81bc0a", "comment": "Malware payload (Gafgyt)", "value": "22a2c6c6302a5d1fe88d85c21d1983ccbc2848f728ddfe40aa5bfb35a155d9147dddd50f216389fb7a3831bd736b2c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738719, "uuid": "c6e3ce79-5324-4650-bfa5-72eba4671af0", "value": "T1EEA30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738719, "uuid": "72edb733-60eb-4ca4-8c46-1e33bf5460b3", "value": "3072:BdKLGdUvuXwyKQlU8fzP6mumuxVqDr78fz1e:BdKLGdUfyKl8r6mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738719, "uuid": "13887e4d-e432-4d47-bb8a-53a913950802", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738719, "uuid": "4122ac57-5530-47fe-a308-68ac16584487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738719, "uuid": "477348f1-da14-4988-aae6-61a735434034", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dffaff0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766369, "uuid": "50ab16dd-a4cc-426f-b562-a9ff27fbc347", "comment": "Malware payload", "value": "2aedda2c4cd437d8ce56e6b76124c932", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766369, "uuid": "2801ccb9-f088-438b-84ce-3b6b0a9c7967", "comment": "Malware payload", "value": "8973b3766aea5694e051e28310b6be7ff346ae295c82efd20a25892d6fb409d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766369, "uuid": "82dc1279-e09a-462b-8399-944e4dac863f", "comment": "Malware payload", "value": "9d208bd2fb18ef00c5da666bbea9af3613e474a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766369, "uuid": "ee15e61a-851d-4837-9e0b-d098f38b7877", "comment": "Malware payload", "value": "580ffa3cae50f6af0209e4956294cc2fc8a50cbe85f174ce5893ff0a94cb86d18c8739e745a6ca50d92975f3c978ad43", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766369, "uuid": "2d816ace-252b-4875-980d-6ae8825f62ca", "value": "T1F232893721F08B32D3D010C9A2A61FA54F76A70B492614B5F4BE6739AF2DA4374D7B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766369, "uuid": "b6a58254-22c3-47e5-9f38-2aa217d1bbe8", "value": "96:cCuO3B6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6+26fS6fE6fOK:cCuG6p4hvZ5m5FG4j4HKNphv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766369, "uuid": "af84526c-5711-4f03-a2b9-ff7c0f274340", "value": 11958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766369, "uuid": "18643fdc-f77a-47b4-872b-f2b4e12f7961", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766369, "uuid": "5a7d5209-1c2e-4cff-8c6e-424361bef0a8", "value": "8973b3766aea5694e051e28310b6be7ff346ae295c82efd20a25892d6fb409d4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448cad79-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800363, "uuid": "6e67d65f-2d4d-4478-8b10-480e0a12745b", "comment": "Malware payload (SalatStealer)", "value": "023dcf0adfee99780ed71a4e525f7a28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800363, "uuid": "644c369c-614a-4e40-8970-79852ce131cd", "comment": "Malware payload (SalatStealer)", "value": "89a03f30664059aac60d9e2a2edb3adc44e4be26af5e7a57d55493ffb0c7ed05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800363, "uuid": "f2d77449-8b52-4578-925f-f902397d81eb", "comment": "Malware payload (SalatStealer)", "value": "e8f6332dfe159aa32b0444299b0fc32f0ad290a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800363, "uuid": "5b993021-36ec-4cbf-b9f4-710c4fff26a0", "comment": "Malware payload (SalatStealer)", "value": "75bc6fb9bf82b44e7c7cbc49a1f78acac7346e4484ec1f599e2f7267d5d82fe3db03fb73bfac10e40275a9480a9cbdc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800363, "uuid": "b063856e-f5f4-4c72-a33d-328a8a0a80a0", "value": "T167E5337A782E0739CD590733C77AEFC4957C469844CA01136A1E6CB74BA2E6C5A3DB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800363, "uuid": "7294c153-4759-4887-8f7b-b1525987223c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800363, "uuid": "1177de26-e167-4149-9a98-a0db0bb9c81c", "value": "98304:FQn2vTygRTqRTIUA+91SacWd+NoORihcqTa:u2vnORiKUoUi6qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800363, "uuid": "b6953563-f799-41ba-b115-827344f464bd", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800363, "uuid": "dc906209-a6cf-4863-8d78-b7afc04b729e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800363, "uuid": "538807c4-99c2-4897-8104-93f7a27241e6", "value": "RapidLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbc77b7-101c-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771785211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771785211, "uuid": "61bb9a43-2bd1-4151-880a-5ff827f76cdc", "comment": "Malware payload (SantaStealer)", "value": "edf91e6b1faa7792734a82ad1ed4d23b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771785211, "uuid": "e211e254-b448-43ee-9d96-68cb475cdb5e", "comment": "Malware payload (SantaStealer)", "value": "89ae9a2ad575daa389d6340696b23ca795101c72e9326cd295b8856a6b967d38", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771785211, "uuid": "e081ce34-6637-42ba-b8e6-729a64a566c4", "comment": "Malware payload (SantaStealer)", "value": "e2bf10aa4403933d0c7af400fd4d66c51700730c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771785211, "uuid": "80440e7b-6bd3-44fb-a1f4-cafd67e4d45a", "comment": "Malware payload (SantaStealer)", "value": "d344a77f8e60e6aad6ff388a535b992706e7abb8b454661bd65199724ea9ced895acd59ed2f2fac8d19d049a7533c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771785211, "uuid": "bf21a09b-5009-4cce-8bf8-dd597ded2d55", "value": "T1FD9623AC625433ECC40AC5B46133FD49B2B6466F1AC9D6FE72CF7AC0B79A411C942B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771785211, "uuid": "6e164914-1950-4b81-afbf-365925e6f1a4", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771785211, "uuid": "2e73a888-00a4-4d01-83b4-3fc91e637a14", "value": "196608:mL4jAqSFcwRvXNal+KKCGSKYvIjYyBTe6TBDCvTRioi7JIy:mL6AqsraMPCGjjJq6Fm0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771785211, "uuid": "2a65cd8b-b280-4e47-8272-cab618e5ccf5", "value": 9327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771785211, "uuid": "e5ee5389-d97d-47fd-b2eb-326a551aaf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771785211, "uuid": "e53f0b92-6166-4b79-82c4-860a075107cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b0f0a-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768723, "uuid": "e64f384f-5b66-4149-9450-ccb9caf7eaa5", "comment": "Malware payload (Mirai)", "value": "34a266097a4c6b37bdf62f12534216da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768723, "uuid": "c9bebe6e-499e-4f48-a5a5-d055f3cd0448", "comment": "Malware payload (Mirai)", "value": "89c31c048617234e920bf09d9636e74c8734a7f67e467cc749efc6d7c973753c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768723, "uuid": "3bea18f4-134c-4572-b06b-422f0e1e0369", "comment": "Malware payload (Mirai)", "value": "eaf3a42a8a3087f371f42b2037e53d34dd910325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768723, "uuid": "342c6c29-e139-4beb-99fe-24ba46078864", "comment": "Malware payload (Mirai)", "value": "d4fa16700a31c001238d76c7fe03b52bb67c112b4276c215657f2593365b2b3354f0d90b5e5dad3f51ea933b4eb768d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768723, "uuid": "5bc8ad60-94e9-45dd-9196-2dfd3ad19965", "value": "T1DEC39D32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768723, "uuid": "d6f4b69b-232a-4b53-84e9-3120d44f25cd", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYMYaXgDe6u8KSgnMwSMwm9rFHwf:6f5Z5Z98XdmVMJaWaXvbjSqSMrHQwEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768723, "uuid": "569bbaf2-9bd8-45a9-a3ca-cdbea491b8b8", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768723, "uuid": "60b591b1-2ac5-4299-8f23-2a9e1dab46c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768723, "uuid": "e2d76e36-cad2-48cb-b5dd-960f283acc3b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e30869-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766006, "uuid": "2cfce409-5d31-465f-ad34-849fe7efdad1", "comment": "Malware payload (Mirai)", "value": "cb5bf355f1ecf0f637ef9cc5a6bf16d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766006, "uuid": "32e80ae0-5adf-4e92-a323-4a85e57bbdb8", "comment": "Malware payload (Mirai)", "value": "89f0a3d9bb762324ad41a52f1d9a8c1dca8681ef26825c811b193a0de8f4b00a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766006, "uuid": "4edf4bcf-8371-4c81-9c43-c82d96615d00", "comment": "Malware payload (Mirai)", "value": "b1f1baed7cb55c42bca783b0998cf6229f7d82bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766006, "uuid": "05f3e28c-d116-4b9b-90f7-3af0bd5a92d3", "comment": "Malware payload (Mirai)", "value": "9c1be894c703e7651101bfe49250f13f72eafb025e8392749afabe4649eb873b16698752c98268571f86cd2b716ad3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766006, "uuid": "346f347d-9577-4e03-9a0e-e851371daad1", "value": "T12CA33996FD824612C6C112B7FB6E028D372717A8D2EE7203DD295F21338795B0E7B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766006, "uuid": "ff3dcca2-2ff7-4889-8bba-26c2f4a2eab8", "value": "1536:vMWrst+KZyiLfKjaAXqsfQtrpjqraQ9zhkzfHxAXhdidkvvoSrK:vM8stRZyi7RD7lpjIaY9kz2xvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766006, "uuid": "b2fbc322-d954-49a7-b801-9a040c04aaf2", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766006, "uuid": "dee61581-78cd-47e3-886c-b640ba7f74ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766006, "uuid": "c16cf47d-c3d0-41e4-8d2a-05b702a8e5cd", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a489b8-101a-11f1-a769-42010a9c0008", "comment": "Malware payload (Hive)", "timestamp": 1771784078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784078, "uuid": "70605d54-d641-4677-ad72-1dd87da6e6d2", "comment": "Malware payload (Hive)", "value": "527c71c523d275c8367b67bbebf48e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784078, "uuid": "caa35526-a3fa-41c7-9319-caccce9404d4", "comment": "Malware payload (Hive)", "value": "8a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784078, "uuid": "865dd282-cf78-4557-867b-67ec5ca4ade7", "comment": "Malware payload (Hive)", "value": "7902b08fb184cfb9580d0ad950baf048a795f7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784078, "uuid": "25819f03-19cb-45c5-8f9a-78d3ffd42923", "comment": "Malware payload (Hive)", "value": "29779d179a8d31d57e7cd2dc0d5e8fedded894d675778541f9a9e534378dc29b92d7e1fe1f228fc1ff7c06e6a40df404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784078, "uuid": "0c7c7eb1-2ee2-4d04-8840-06391da6c58f", "value": "T1FC862943FC9140E9C1EEC270C66B9292BF713895473423D72B60E6B62B67BD4BA79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784078, "uuid": "53e0516e-3350-4ef8-9f7e-5eadf0778d5e", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784078, "uuid": "2ead104a-3e90-4959-bd1a-4c6e591e6710", "value": "98304:/KRt9trenMQWMZ7+fD25GGF5LgNGzl3WVxE:qD/QBy25GGFxgA3WVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784078, "uuid": "3e3edae9-a9aa-4bc0-b130-faf9b0a96d5b", "value": 8230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784078, "uuid": "8f727870-69a0-4aa8-85a6-10a810b326b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784078, "uuid": "01caded2-4771-4682-8b08-8ffef4563ca8", "value": "chisel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e0ace5-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766388, "uuid": "3bb4d692-5c53-4378-98ff-17fd8506c9f7", "comment": "Malware payload", "value": "547003ad16caf9bc8a70642962780721", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766388, "uuid": "b5696258-c70f-43d8-93cb-8ed7d34d1cfc", "comment": "Malware payload", "value": "8af726f91569c45d9de4372a6a79bf3ddf370b277cb63fea8951e5c2a6d64b7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766388, "uuid": "16e177e1-16ee-49cc-b5fb-b920fe8de3b3", "comment": "Malware payload", "value": "f38a1774a7130fef06fb9728eec8c0171f41ec50", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766388, "uuid": "d6be7776-f3bb-4bd5-9101-71a9ed99476d", "comment": "Malware payload", "value": "d1c5afdde600581cde326fe8db17297f3d2fbd51b5a715f4d8bed4e8db00ce13b9319e375d3dff9b5c43c49734809f38", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766388, "uuid": "b666348a-b45a-48f3-aa2b-bedd2bfee408", "value": "T1AA02473B21F08B71D7D021C8A26616A54E72A30F552A14B8F4BF563ADF2DA4374E7B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766388, "uuid": "9e8f8956-d234-4ca6-b1be-a53bfe070ba7", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGNaqwB6fX6fa6fj6ffpw:cCuOC4hvZ5mzjAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766388, "uuid": "91d44b52-a7b5-41ba-94d4-cf75cffa5ca5", "value": 8674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766388, "uuid": "e9aadd1a-c139-4e25-968d-1e31c1d83277", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766388, "uuid": "5562a595-55cc-44bc-af91-35e0f970c5e8", "value": "8af726f91569c45d9de4372a6a79bf3ddf370b277cb63fea8951e5c2a6d64b7f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a9d013-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766490, "uuid": "533a14b8-dd67-41be-906a-68b33c087d43", "comment": "Malware payload", "value": "fd1bd8fb0f729a8383ee2fe4e2fbce0a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766490, "uuid": "9d121582-8c42-47d7-a98e-268fd29e5714", "comment": "Malware payload", "value": "8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766490, "uuid": "9c891186-37f5-42c1-b392-99cbe0348463", "comment": "Malware payload", "value": "4f2c01519ba8bd252997214f11b1d45cd8002b22", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766490, "uuid": "d7dcf29a-b2bb-422e-8efe-14ce4d35962c", "comment": "Malware payload", "value": "b680a4c3e6f688562c35c7eb381f7e6450b89c7883e92f35244f39c9dfca76bfa331608047e97c4708a8818964e3bbf5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766490, "uuid": "09c882a4-f474-423b-9951-f277318e9937", "value": "T17B2218B025F049332E206A40B3372BE6ABB6955349E3218C35DE1D35AF87B52B4BF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766490, "uuid": "6c9c47dc-33a2-40c8-ae97-8b23ab635aee", "value": "96:cRr3k0B6z93aoU21+CUXp9vr0WKGThKrKSw+F9t999jIBGIBsIBbIBRk:cRr0g6z93aoe0wGTTtBH85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766490, "uuid": "04954b96-2e49-4e33-a216-f3d1d1e69a7b", "value": 10263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766490, "uuid": "4cc8077a-abab-4503-ae63-602b14826a95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766490, "uuid": "2dd3f340-3db8-4d3c-8793-3f1990a0e055", "value": "8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a997f4-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771891, "uuid": "9a2c32d6-11c7-4736-88c5-bcad1e033601", "comment": "Malware payload (Mirai)", "value": "824023eb9cfc67a42e8ef89f04f89890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771891, "uuid": "8ffef506-c6da-4f70-99d8-b380fce48c12", "comment": "Malware payload (Mirai)", "value": "8b0e43b3d141e2a934a6ec118b92b4b41cd1a6315f515360a3173e93c4d0b27e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771891, "uuid": "a0f515a0-e733-4a5e-b914-6abfba67dffe", "comment": "Malware payload (Mirai)", "value": "ef14f954e7e4177d832525bc0c351a4e7e96e4f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771891, "uuid": "837e824e-1508-4795-b0b8-34cdd336d672", "comment": "Malware payload (Mirai)", "value": "37958468fde8705dd8b84946666bb16d31eaec826531ba2644c744e852d9901dbe7f43386c6573e587c29ec69e1d761a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771891, "uuid": "0f3a61be-c71f-45ad-b9f9-f2cf77b8a897", "value": "T163737BC2AB47D4F4EC2605712077E7728773E13E1029EE83D769AC32ED52A41966A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771891, "uuid": "c7413005-4d30-4519-b5e9-a14d6eb1111a", "value": "1536:IUQvN+2LhcFKEnNmv23PkP98U755e+Kj+w:8lVsKEncv238PO0Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771891, "uuid": "7cc4cfbd-8221-4485-99d4-cd30167dbaa3", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771891, "uuid": "ab2e5732-efa9-414e-994c-dbade2093ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771891, "uuid": "3ce1f673-a5b0-4981-a691-464c5bffaf1d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8760c5-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752545, "uuid": "a735fe69-6c0b-4af3-9a6a-decc9b149952", "comment": "Malware payload (Mirai)", "value": "5a37f8453617b322c99ef0e0286aca60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752545, "uuid": "fd49998e-551d-43fc-ab38-e7afaa2334d8", "comment": "Malware payload (Mirai)", "value": "8b87ae8568b1df2f5d663f240f9ef8983a70220a55a7f801ab17680be07c495e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752545, "uuid": "d89e1f67-c76c-4062-b5f2-d4906e38b116", "comment": "Malware payload (Mirai)", "value": "6ae4a10b81099a0b5a1b71afc38b59c0dc75cd7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752545, "uuid": "70631a1b-07b3-4dcb-8af5-1c53fe2595ae", "comment": "Malware payload (Mirai)", "value": "27c5a475a9f97d9296904ad6aaa6cef7af8daea6e8fa5049ab2f94f24724e8b797f58813034f5b5e0142a50c58ec884a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752545, "uuid": "c4ae6f21-49ef-4dab-98f9-22a57ed7360d", "value": "T191D3C031E004ADC4DC2229B5387A56780720EFB407D95986FEFDE96EA477DD438AD3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752545, "uuid": "0cda1082-6a7e-4bd7-944e-48d2355a32ea", "value": "3072:qEiohTb/VCywkoE2r7moYLWaLl1erm+542k:qJwbwkoEi+hl1erM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752545, "uuid": "2e986698-5ece-4e28-9774-8a85b313dfb7", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752545, "uuid": "6cb88a3e-38ad-4437-8493-c6b09632f65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752545, "uuid": "1b06163f-69e8-40d2-9481-c4ad101ca9b9", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f04ae3-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771782, "uuid": "1dad8304-690c-47fc-8f98-b95a12991add", "comment": "Malware payload (Mirai)", "value": "0825c98d7f07289fb5de62fc5a53b9e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771782, "uuid": "63f6fa99-b545-4411-8755-0c023ed43d88", "comment": "Malware payload (Mirai)", "value": "8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771782, "uuid": "6f056eae-1502-4c3a-8593-911feebdbeae", "comment": "Malware payload (Mirai)", "value": "51d31cf568d67a673fff4433fece5e4060f8eb25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771782, "uuid": "61f1807e-f16a-44ec-b751-c77a239b9a3e", "comment": "Malware payload (Mirai)", "value": "b710788658ff86d63a3d62ad756955bcc481642352d1ccbb731917a7af89ae35fcded6db0e55228eff901c4435ff4502", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771782, "uuid": "e6d050c0-4333-472e-880a-87afa0cec9f0", "value": "T161D12EF6B486127CDD9FC83A915129BD1189B98B26871D688BBE30757C89FCC2C45DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771782, "uuid": "c584c838-1a10-47c3-bd5a-c4b3cd447911", "value": "192:+j3mBp+OBq6Vp83rSC12mMk7sAIgnAEbPOZRbPOZRwofI85NwDHWGpii8Ur8w9xO:+j3mBp+OBq6Vp83rSC12mMk7sAIgnAEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771782, "uuid": "57055d3f-c068-4cc6-bd0e-d985f7045073", "value": 6359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771782, "uuid": "55db6efb-4ac5-435c-8eb0-943347756445", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771782, "uuid": "a012abdf-8cf6-4b16-9454-1d7b3fd6ace6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d805fd-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779503, "uuid": "a63c2117-0c54-4ab3-acab-da1c6e001536", "comment": "Malware payload (Mirai)", "value": "1a207a89e86489bdb9c6069cf8df7269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779503, "uuid": "19fed077-2a4b-4ede-825d-b4f2a3245368", "comment": "Malware payload (Mirai)", "value": "8cb85052ec0d4154f46b694a39e4b4fdf1edb010afe5e87259ea5b03179a55a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779503, "uuid": "cee5480d-2f69-4df1-a2f3-b947fb2b96be", "comment": "Malware payload (Mirai)", "value": "4b964ce2fc65c575f8c8bb870596518447aa8367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779503, "uuid": "7312d520-415c-4675-8f80-c4b64794fc3c", "comment": "Malware payload (Mirai)", "value": "c2986b2caf8bdb2c3d0af71160f1c806845d6e02d655ca91efbe6f02523aa84bee2a5575e53f45fdd3dbe03979ba4f43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779503, "uuid": "333a5b29-4936-4a87-b75c-75b0b4046ee8", "value": "T1E0D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711936ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779503, "uuid": "16213c54-e145-4e8a-bdf1-7d7462d10dbd", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQR:yIRfe3xvvSrlvZZ7UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779503, "uuid": "20566ade-27a9-4254-8fb5-3bae9a4251fa", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779503, "uuid": "09f2fd43-333a-43e9-a8fd-27d7c79eb7bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779503, "uuid": "b552e414-78d7-4931-aa78-cd139a03c3bd", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ce90ec-0fca-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771749792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749792, "uuid": "9bc998b3-e3e3-4c3d-adf0-7316a916a6ae", "comment": "Malware payload (AsyncRAT)", "value": "f319e8cf0bebd59a4e64c9c40b00eb88", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749792, "uuid": "6bdc921b-23a6-4550-acc3-65b62b125700", "comment": "Malware payload (AsyncRAT)", "value": "8ccd9ee01cea4e18fd434bcf781798604c44ef14c0849f9553c90bd5cc8e7cd9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749792, "uuid": "72a66e9a-c58b-44f0-8948-60b45dec4c09", "comment": "Malware payload (AsyncRAT)", "value": "7389b7ed945d8dfcf8e6c031cc1d6edf77f0a5be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749792, "uuid": "0a1bb581-17b8-48b8-a395-8484d7e8ec92", "comment": "Malware payload (AsyncRAT)", "value": "0a33dcf23978012168507d7548ceb80d4daeb57d4739b5702bc09bd64fa72d26e3f849a55e153dbc6bb5096568c4ea6c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749792, "uuid": "a3026c97-3060-44ab-86fd-a0a06ce70cdf", "value": "T1FED23A08B3D88551E1FD57B94D7293048771EA4BA973DB9E1FC440AE2A23B88DF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749792, "uuid": "377f9310-393a-4ee9-9bf5-b92cda14a070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749792, "uuid": "6b2163e2-9ea8-4b52-88de-0c1b1c3da657", "value": "768:DuGRXHMMVEo8Yg/cIRGqo+/Rb7fB/dTu/+:CGRXxVEo8B1iwRbN/c/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771749792, "uuid": "2c950363-8cf2-4830-a312-ec82276ce82e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771749792, "uuid": "5b2cfac7-ca91-4c0c-a7b5-ad3dc706b184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749792, "uuid": "5dac4a70-1c16-4230-858a-29d52ebc9b65", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a9170b-0ff3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767220, "uuid": "67595fc7-92e4-431a-9b01-05e7169a90bf", "comment": "Malware payload (Mirai)", "value": "127034728c5ad37a869406d71c0a9259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767220, "uuid": "efd77b49-db67-479b-bf5b-fbe1a8b32366", "comment": "Malware payload (Mirai)", "value": "8d038bffcb49046ca6d189e45e3b8dfeb8c0dde84ebb030701199a81872d696f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767220, "uuid": "c1272a23-42bd-4a4f-b90d-13dadf70f1eb", "comment": "Malware payload (Mirai)", "value": "da66c84eae5473520318381690d4c6f01677389c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767220, "uuid": "c9b2ddc0-6c98-447b-acec-96b55e90f822", "comment": "Malware payload (Mirai)", "value": "d417cd0f79f6526588b8899c91d18e111b8608cb6e7b88a7a5c2691b6f81d03194b6ef4f93adce184db3996f65718b8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767220, "uuid": "ff5e133c-3b2b-4517-9316-e22e694718d7", "value": "T17FE329C7F900DDB9F80AE73B48530909B230B79245825B372297797BED3B1D91963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767220, "uuid": "fffc75c1-874b-4c16-8de5-f1d1af041ce1", "value": "3072:f4A7HjKHZW/yGLj0PxmldWupK0lckVxjbiALlVrKSrc:f4VcyGf0PxmXWClcmLySrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767220, "uuid": "4bf7e277-fb39-4f8a-908d-88b845975342", "value": 154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767220, "uuid": "05571841-3174-483e-901d-709b8512a9ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767220, "uuid": "5753eee8-62d6-4dcf-84f3-6229d33bcf44", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d9609a-1010-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771780015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780015, "uuid": "1ea2ca3c-3bcf-47af-a464-e685bead8b70", "comment": "Malware payload (Mirai)", "value": "4d7b6aabffed17e2ab96a3d8fbde613f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780015, "uuid": "9cebd151-358c-4eac-bdf7-710cd8e63293", "comment": "Malware payload (Mirai)", "value": "8d2a6994a8fec5bb8a36bf92e115b08f39a785ed2084a1b8c77d445c7dfa9d16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780015, "uuid": "987c5267-325d-492e-8e28-6d82f2093d99", "comment": "Malware payload (Mirai)", "value": "2df65bb9c65777963e3e073952098eedeaead2d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780015, "uuid": "4ee39bdc-ca3d-4b1e-a606-4e743a6cc627", "comment": "Malware payload (Mirai)", "value": "80a10057c64b65113ed88a75a90d80f808c9184eb9ccf26b12f86da5a6b71e8dd42dbbe33535bd05db1b07195a472816", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780015, "uuid": "63dcc57c-28d0-4294-bcf2-2319ca2b8cc5", "value": "T1910429D7F800DDBAF80AE73708570905B630B7E600929B337257756BEC3A1991977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780015, "uuid": "837a2781-6b45-4a2b-9f5b-036e83b989fa", "value": "3072:16cnuTgsZgYtVSZgthVDf5YzegJ2Ej9/VNjbisLv1pNycAYAuh/F5QxQ:knDBYDFj9bLtpNycUqQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771780015, "uuid": "c89a9c01-ea11-4c1d-9288-e549f1a52c17", "value": 173280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771780015, "uuid": "97c6321e-6f81-4f49-a5c1-a6726d00b65b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780015, "uuid": "385fa396-1b23-4ef5-aa31-32a87c8a05aa", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a1ba75-0f90-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771725012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771725012, "uuid": "28f19acd-372a-422f-8b82-e12d091bcf05", "comment": "Malware payload (Mirai)", "value": "36f9d5c726233ac35f1a4d58b6032ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771725012, "uuid": "ec272088-d691-4472-bd47-93871925463f", "comment": "Malware payload (Mirai)", "value": "8dab2697dd22b6ee54fe70e1797811cce578b271753e17b79699cfb81b09df58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771725012, "uuid": "784201ff-d46e-40ce-b673-bd83d17d3234", "comment": "Malware payload (Mirai)", "value": "fce122d28ec998123b974875228cfef007c62385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771725012, "uuid": "63e38102-5a3a-4c6e-a99a-f235189b3a93", "comment": "Malware payload (Mirai)", "value": "94b6083ad0ea695d649bd037802f74ff001c33730b047f29015c9362d195a1dac0791971bbd8995723492f35a475c977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771725012, "uuid": "147aa556-c563-4a5e-afc6-d23586873143", "value": "T146C3AE83F78B14A0C4A206F007C74BBE2B93A121CE5F98E37D5DB53B5A7A4DB0916395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771725012, "uuid": "36f3444c-925e-4e68-bc34-ca45ee7f3e2e", "value": "1536:VKy2Ztnejju0QNEVQVCWxZQWaOcOQijlkPhJSqzYjxIRKQig4RQM//LWM:YHtejjuNkQcWZ3eOQOYhIqzYCigO/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771725012, "uuid": "5f92c0ad-a297-4677-bffe-e0c14cef90b4", "value": 124704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771725012, "uuid": "307963bc-6e86-40b2-8c50-5be62b821b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771725012, "uuid": "95a43f71-f972-4fdd-84a4-6e2eb1bcd07a", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b8cab6-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779401, "uuid": "b49f31f9-3218-4cc4-be94-4ba18e63fc16", "comment": "Malware payload (Mirai)", "value": "767ed7e4bf19f42b491e187631bc5442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779401, "uuid": "42db3429-7848-49d6-ba00-388a5a51b675", "comment": "Malware payload (Mirai)", "value": "8dba9661effdd6776c5695658f0ceb62d9cd9bab88133491907e917fb62d66e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779401, "uuid": "77f6d5a6-c078-4198-8165-cd29c9ac1939", "comment": "Malware payload (Mirai)", "value": "c7a06901da01ea972a919119068a1a829a48bcaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779401, "uuid": "ac6b5b9e-5673-4793-a39c-55d95bbed4da", "comment": "Malware payload (Mirai)", "value": "90ec3bf6da2c85e51617dc9ec6f3d17b17886c7f2c348b432b2fbd9e0e15a8c23d2910e907ab0205be6d260524815f8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779401, "uuid": "abe84e5d-2f19-4838-85cc-09990665e980", "value": "T13DC2E1DEDA74655AC61D2A77409E0BFA5CD4E29CA36C8F4C93318D8823389C7F59D238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779401, "uuid": "d5342c9c-57f3-48b5-8aef-1b83f5f8f6d6", "value": "384:+en7SsM5uAR7Siq23JJYi47uMKZ5KVWL3LjNd+7dsxn5bZHc+3kC8OVpc7mnWihx:V7DAN/qUF4KNr9IJmViL7m/QWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779401, "uuid": "e6071b0e-a002-4c93-92a4-46ac294afa8b", "value": 27688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779401, "uuid": "d792e702-d0bf-4247-92d2-3403ed9c7996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779401, "uuid": "b008708d-49f8-4525-a918-8802dc1f54d1", "value": "purves.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dea463-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766323, "uuid": "50688901-5a3a-408d-99bf-7f0de97fca3c", "comment": "Malware payload", "value": "903d5d8e42db6d120f6402df0268a844", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766323, "uuid": "9b57bdaf-3c4d-4ba7-946d-37995f75a798", "comment": "Malware payload", "value": "8e029b5718213f372c2e8034eb0c0ef1557beb894cd1d777c011bbde762b5a5e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766323, "uuid": "0a837c9d-e793-4411-91d0-36df2a102c14", "comment": "Malware payload", "value": "8c263924deb555d22c36820203238d8365c00354", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766323, "uuid": "6dbe8e67-0563-444d-a28d-6360333441a4", "comment": "Malware payload", "value": "3f70c0e02fd0035336724e4dfaab42f467cc3f47f3dc725350c59d93453d8a9bf4374b8a7e9b4e6f4c2b423908958eb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766323, "uuid": "cac991c7-b20d-4bad-ba5a-2deb62c41577", "value": "T19282AC3621F08B339B9055C4B3772BA54F769617456720B8F4FE1A259F5AB03B0EB720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766323, "uuid": "93d56967-6e72-4f3c-97d8-b80dbe4e58db", "value": "192:cCuA6p4hvZ5m5FG4j4HKNphvn/TONVLxo8vhM3xL+F:Mp4hvZ5m5FGGoKNphvn/TONVLxo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766323, "uuid": "16b069c5-9984-419c-bbcf-1daada275d34", "value": 18075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766323, "uuid": "95571fb1-29e0-44c8-999f-c4e6c6e00561", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766323, "uuid": "fb14f434-d6b9-4c04-b42e-27c1b2e5228a", "value": "8e029b5718213f372c2e8034eb0c0ef1557beb894cd1d777c011bbde762b5a5e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45958d5-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752501, "uuid": "04eb4225-eb10-4037-b857-db04972d4763", "comment": "Malware payload (Mirai)", "value": "b11d0f9326a314162230e71aa4144b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752501, "uuid": "997fce4e-fa61-447c-ad68-a183b79f69fe", "comment": "Malware payload (Mirai)", "value": "8e6732771a3e930ee2d912e382c1eb97109f489a133308a623f610cf396b99e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752501, "uuid": "8b091b7e-6c87-46bf-a3e6-e8b39b09bbc4", "comment": "Malware payload (Mirai)", "value": "1479a76dfa442af8d7561f188a96855c72feee24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752501, "uuid": "9dc2ec89-01a0-412c-aaf7-b7dceef37e9d", "comment": "Malware payload (Mirai)", "value": "5c15e6a21a05ff896eb36b52a94b1bdc543989fe80713cb26e064ab8ffbab8b82d27f73a7fe9d2cd0345e6cfd7b0f993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752501, "uuid": "59370feb-66c7-4617-83ef-37dacd200335", "value": "T198148D68FE4F78D2D2C7E37DAE4A0FA2312779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752501, "uuid": "09888e0d-2c75-4dd3-82ae-5d98829c22be", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxB:bOVfbEdxm4iubr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752501, "uuid": "03b1d826-b572-4a1b-8191-b79338417604", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752501, "uuid": "3f51ee69-3665-4804-971f-e4e9238adc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752501, "uuid": "465245e3-2c0d-4ba5-bfad-d1b24fb80919", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de3fca-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766299, "uuid": "2d1b40cc-3849-42db-80cc-5566f504f8b4", "comment": "Malware payload", "value": "92953c480eabdeef7088eeef3efec5bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766299, "uuid": "3b5d7318-1443-484d-8099-efa0a3cac2b8", "comment": "Malware payload", "value": "8e7599983eb09e44cd8144f12332eab82619579ff3f6a416fda20249f672e7ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766299, "uuid": "e570fa31-ca03-48c6-b3a4-8fbc7740ac8a", "comment": "Malware payload", "value": "abeeb934ed1a9899b03e6534969537762abb05f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766299, "uuid": "411ad90d-3697-407a-870d-297f2d892d2b", "comment": "Malware payload", "value": "55db9aba12d6039b13f8a7251d37f16d1279d779465501ee06b58b261fdeaca02d364f7237b8d2258bb27543b6a74be4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766299, "uuid": "4b78b50c-a512-47ea-96e9-e96022f262cb", "value": "T1DE32B47125F14C332A206984B3772BA6ABB6D95385E7318C35DE2E265F86F12B0BF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766299, "uuid": "248ec73d-32f2-47b0-bbb0-c8e60c0abaca", "value": "96:cCu7B6zJQOlexE+fkxaSN/oSoSogcm6mM+W+pIBBIBwIBVIBAXDDF06G00:cCul6zIFD/7zRiK7yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766299, "uuid": "7f96bab9-70c0-4784-8065-b6698f9e22b8", "value": 11677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766299, "uuid": "9fb030d6-4a3a-4549-8678-b342e68ad3a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766299, "uuid": "6f87406a-b130-43f9-b312-e52e5ec75554", "value": "8e7599983eb09e44cd8144f12332eab82619579ff3f6a416fda20249f672e7ca.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd68f86-1012-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771780592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780592, "uuid": "355bb509-0f3e-4d79-acd4-637e747e4334", "comment": "Malware payload (Mirai)", "value": "8a2476e1cb3cfbabaafbf0cd87af1d5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780592, "uuid": "2375d80f-1c87-45e1-8c5f-e156b4e8491a", "comment": "Malware payload (Mirai)", "value": "8ef6a433af58469b464352be95cf7506fb4442a61d9ded2a53aab31ccab2167e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780592, "uuid": "57edad6a-2559-4ec7-a43a-215d4d510e72", "comment": "Malware payload (Mirai)", "value": "4ad87a59bc32e205a3afe3c42ce2fc3294bd279e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780592, "uuid": "9c1e941c-ced8-4e41-a85c-4f49872284ab", "comment": "Malware payload (Mirai)", "value": "6092079582f477ef658bd00ae4238b2f06e2395fcaccad7cd661923da87bdbc8ce2ecd224123fc70456cc48affeafa68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780592, "uuid": "10170afe-2f7e-4105-b83d-3b6f6541bdf0", "value": "T1425302EA94E47ECCC29A5774060B49033EC673B8609A543BB3C4FA694AF1754CBD8BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780592, "uuid": "10b92e51-7cbc-4d6d-a5ae-d5c59df24b31", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAI+tLkg4azHJ:CM5az1Fy0oPgdZX6hTo8R2tLGazHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771780592, "uuid": "914f3bc3-47ed-4f77-9f20-1ce9646cf41e", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771780592, "uuid": "91afe3a4-8da9-4f58-9be9-eb45d6371da5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780592, "uuid": "8934b457-61f3-4e7d-ae77-688d354f8aa8", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06210da-100d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778747, "uuid": "01c8252a-3542-451a-98be-1391e50ec375", "comment": "Malware payload (Mirai)", "value": "406e7d32b8835f84890b09874bf9f659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778747, "uuid": "09b26945-0c46-4ca7-91b3-b6758987cddb", "comment": "Malware payload (Mirai)", "value": "8f74c1b77780bdfe2aa45533fb33b83619fa339fd2a37e7d47dc3b2d9d9e4d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778747, "uuid": "4a019dcb-b48f-4550-9afe-82ea3c15c78f", "comment": "Malware payload (Mirai)", "value": "8708f51ee1df25bee7e0e46280f46813809e3fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778747, "uuid": "b64a2907-fe6d-431e-82e0-af8b31a4d14d", "comment": "Malware payload (Mirai)", "value": "654fe464be2400ee2955cbcbb0d57d1d933b878b572cb119d0c7838cdfda1cd48f7d31bcc1335efa213a71067feaba23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778747, "uuid": "a0fc33c7-70d7-4949-9fc8-7913f394beee", "value": "T124434AC4B183FAF1DC05017C307AEB326E37F0B6613AED9BD7E455B36855206960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778747, "uuid": "a996f43a-64b3-460f-874f-b27826f55b4c", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778747, "uuid": "9db6b524-5a42-40eb-ba10-90a0c822ee9d", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778747, "uuid": "5a280565-b8df-4517-bc8f-c8c348958602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778747, "uuid": "a87321e9-ff96-452c-b836-402c26c38dbc", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ec6a78-0ffe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771908, "uuid": "b3257183-82a9-4077-85e0-0fb01afc498d", "comment": "Malware payload (Mirai)", "value": "b307bb523f694cd0d9beb5ec3d5c7ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771908, "uuid": "e7888633-24d5-4655-9430-654d6975dfe6", "comment": "Malware payload (Mirai)", "value": "8f995baa055df2180cba7dea7b455ebec3f39c6724bfd9c9509f0874439f2ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771908, "uuid": "b621d78c-667c-4f15-826a-48093b4c4249", "comment": "Malware payload (Mirai)", "value": "1aa9e4e72607dc30521a5fa5ad075ac3f12f33c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771908, "uuid": "34167fc2-c087-4424-b609-63f2473e3229", "comment": "Malware payload (Mirai)", "value": "b2868a93c27604d3eab3c8db0fe1076d5ff3a69eee950e7038a30c703e1f5c71fe11b892868165d2d7b3708695f7e31f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771908, "uuid": "d825b38b-f6dc-4745-9b9e-31236bef07bc", "value": "T115933A55FD819A12CAC112B7FB6E028D372713A8E2EE32039D256F2173CB91B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771908, "uuid": "87077614-47cd-4d1b-b1f6-98a92800f8fb", "value": "1536:kU+tmIjkv8P+V/Q4EFi53g5qVAc+HNwoeN5V77W1QrV1vvMBm:kUumEkv8fi5Q5qVAceNwok7qmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771908, "uuid": "3e958591-528d-483b-a35c-c511d767736c", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771908, "uuid": "e7eb4959-7eef-452d-9b04-feb35cffceb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771908, "uuid": "514be6c1-1f5c-480d-80c6-c28d5a62a866", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d9d26c-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766303, "uuid": "5aca6f3f-6578-4789-9f7d-5a20770da679", "comment": "Malware payload", "value": "d8a052d729bc5ad44e3bfcdc5e3068ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766303, "uuid": "1ef70b28-7d42-4ebb-8c4d-13fdcde9f4a9", "comment": "Malware payload", "value": "8fc1dd646af809409c338487365d6484407b3a3f617ddc1c2e3198c4f5f6e0c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766303, "uuid": "80412c42-4ebf-44f6-9f5c-d0496d2226d3", "comment": "Malware payload", "value": "fe0f131e11fd5c5bd3c482f44426ec059c6d46fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766303, "uuid": "820921c3-a202-49dd-ad9c-a5b796ebed3c", "comment": "Malware payload", "value": "7adcb20a282e73304257aaf2ef64a12c981ffedb5d8317d2494d5c86fc646bdbfbde7fdc7d3f97076bc076d1be05aaf9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766303, "uuid": "781db3c2-d893-4d62-98c0-6b981b4fb371", "value": "T106828D3621F08B335A9065C4B3772BA54F769607456720A8B4FE1E359F5AB03B0EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766303, "uuid": "1ea48051-ed30-4b82-bdcb-561ab1ef2e73", "value": "192:cCul4hvZ5m5FG4j4HKNphv1KLMW6MN7molZ3:a4hvZ5m5FGGoKNphv1KLMW6MN7mob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766303, "uuid": "dc3ff862-2cd7-4004-a710-6db94060ab9e", "value": 18579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766303, "uuid": "d57ec8bd-49c1-4897-b0b9-c8ab17de02ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766303, "uuid": "0053bb86-b5d2-4f0f-8357-2d2d188c49e1", "value": "8fc1dd646af809409c338487365d6484407b3a3f617ddc1c2e3198c4f5f6e0c0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadbcde2-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766310, "uuid": "40224b02-7f98-457c-846b-073ceee9e261", "comment": "Malware payload", "value": "a9e32a5bf06eb9c7f5d93550f760c103", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766310, "uuid": "3ce4d719-863c-4c3b-9bdc-8b91d95304e8", "comment": "Malware payload", "value": "913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766310, "uuid": "756e81f2-bbc7-4696-b982-c0809e978cb5", "comment": "Malware payload", "value": "f8408779cdcc63b287eb4cca721b52737cefee67", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766310, "uuid": "1363a674-6fc2-40c6-b2f2-a9a59fa0c5a9", "comment": "Malware payload", "value": "c91f236b9b3e42cd3f77ab109f39ba58e88d8fd3ad0212437b11267df16a7fcb6f0a48174558dc06aafa07fc68a0477c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766310, "uuid": "58f04f5d-3b3d-4a05-9b6e-76a187691870", "value": "T1E122387721F08B3297D021C8A36716A15F72E60B456714B8F4BE1A3A9F1DA0370EBF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766310, "uuid": "345df7b2-0b31-4868-980d-f71c04d609e0", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGFnI78ORtgjo5C4wEJgEFElG3+:cCuOC4hvZ5mzjG5fd+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766310, "uuid": "0728a89c-d39b-4d71-bdb7-758cfd1ca2d6", "value": 10779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766310, "uuid": "bd0b5547-461a-4d08-89a2-2e0c1a03967e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766310, "uuid": "a1068efe-22a4-48c6-a563-b5cf5a6a86cc", "value": "913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7249eaa6-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752337, "uuid": "b3493d9f-1694-4473-bc33-0a85e396d3aa", "comment": "Malware payload (Mirai)", "value": "0fb793155f770e09857fd19c59a6e9c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752337, "uuid": "80f82854-cbba-4f05-b26e-39ca41cc7521", "comment": "Malware payload (Mirai)", "value": "9238a6324ce477e1547d3d64606ef914adb682325a82f5bd5fdbac9a80c12234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752337, "uuid": "e31cad1b-254e-4ade-8242-2b41eda26216", "comment": "Malware payload (Mirai)", "value": "340efee34e89dc38b9564313e626f2723794f009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752337, "uuid": "32c01dfd-649b-435d-bbeb-3a3e615def74", "comment": "Malware payload (Mirai)", "value": "57368f8f498f6fe130a1cc5ab17a8351ed48696c4a804de6d3b89521d6bde292ebe80d10f4c2bf71662e7365aba54dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752337, "uuid": "0ba04861-d0df-460f-b8af-b479b92ae792", "value": "T11DB37CC2F743C0F6D85304B1507BAF369E33D4BA5025DB42E7689A71DCA2A05D71ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752337, "uuid": "c4db5875-de26-42c6-8906-3b85f306dc13", "value": "3072:EPian1DTbKm4EgPgdFRP2V2Zsv1hIB18eB:Eqan9ECukZsvoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752337, "uuid": "ea0085aa-0d1d-42e9-9d06-aebd0323fd71", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752337, "uuid": "44d9dfdf-1985-4372-911d-4c92fd9a357b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752337, "uuid": "54c1471d-d7a8-42a2-809b-5ec9beb793a1", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfec454-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766447, "uuid": "01bdc02c-b13d-48eb-8f13-9400fcd45ecc", "comment": "Malware payload", "value": "b30df3a36d60aa1959d949994854bb0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766447, "uuid": "b7023846-4f48-425f-9209-f17e1e21c99c", "comment": "Malware payload", "value": "92ad11701090b0be7829a004cf5f84fb3da6965621db6a33d766d5bba3234065", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766447, "uuid": "ca0daab4-58b3-46f7-ba2a-5fa2d202b268", "comment": "Malware payload", "value": "da3ab6c50493cbf053ba3ecd5414dbbd46ab0a5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766447, "uuid": "b900a6de-98ec-4761-b755-9f2bc583bb9d", "comment": "Malware payload", "value": "c17b874b7aa4cb5b4f14d8bf17a57c4578fe79936d9737bbbaa7410a98c9097e1d56c218b7cfaea4b4096a72f5b72b42", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766447, "uuid": "1f7191f8-466b-4095-b246-bf665775b610", "value": "T10C5193B025F04C732E611940F27727A96BB2A85745A3218C39DE1F356F96B02A5FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766447, "uuid": "a38ad9ac-ddf0-4de3-9f5d-9b05525b422b", "value": "48:cniRxuGRys01lwnE5Vlrm3Ucwn8a4dlwnibLU/k+l/ECU/k+l/b:cWu4lI3fYg8mu8mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766447, "uuid": "8b59536b-7971-4f78-887a-f1281faf60b4", "value": 2613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766447, "uuid": "a9665426-68e4-41f6-9def-4c562059720c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766447, "uuid": "720dc31a-3d3d-4cb9-ad3a-8d4720a6c9b3", "value": "92ad11701090b0be7829a004cf5f84fb3da6965621db6a33d766d5bba3234065.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ea737a-100e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779084, "uuid": "ca213fc3-0d43-483b-97c9-f0893de52173", "comment": "Malware payload", "value": "129c1761d4a0c3acfb8ab1bae71a1850", "object_relation": "md5", "Tag": [ { "name": "info-kak-is", "colour": "#1894FF", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779084, "uuid": "4b3044ff-ba4c-4b1f-9749-7a7318c03e8e", "comment": "Malware payload", "value": "92bf8858f323d9d335729cfde6cad182d3f6285b59b31ef11e15448813890a4e", "object_relation": "sha256", "Tag": [ { "name": "info-kak-is", "colour": "#1894FF", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779084, "uuid": "7926ab96-b236-48c1-8a49-a3d717dcae77", "comment": "Malware payload", "value": "f4a780240b172e45587359e5a88cb56e773a6183", "object_relation": "sha1", "Tag": [ { "name": "info-kak-is", "colour": "#1894FF", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779084, "uuid": "7a6a172f-2e16-41c1-a59e-8c8a3d8f2e68", "comment": "Malware payload", "value": "0b0e1e9a5edfe8faad6a7b78c68f08331081e15b5e628cdbd111cbdc9e28e1efc588d905a48be7744071e4447078bc2b", "object_relation": "sha3-384", "Tag": [ { "name": "info-kak-is", "colour": "#1894FF", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779084, "uuid": "3b4eece4-83ce-402f-a458-ab2a54591214", "value": "T1C1363358BBC00172CD33127A6497E9A5872DAC11E36D9E58C510F52D0EF72B9EFBE016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779084, "uuid": "5086d63c-7997-4bf5-bb1c-4e2639ddb538", "value": "98304:U6iUdJbeAXmUivXPVE59/B/BTQhQoM/AY+6pGZyVi6MNc+TYD1lLTNET3i3E:U6iUdJXivXylBTQhAYYzpqyV1M6RV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779084, "uuid": "75d95f41-64d7-41df-a973-e5477e669c2e", "value": 4939776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779084, "uuid": "2a1c9c7b-79ab-454d-b296-2453ac7ff52a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779084, "uuid": "760cb10c-d16f-4a66-a132-e53eb3b56db2", "value": "DTCWVFDV.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff45c2-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771786, "uuid": "ef06655f-2360-4271-a99a-63751df09195", "comment": "Malware payload (Mirai)", "value": "df7f4642adf41a85d995440cfe9ad99d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771786, "uuid": "dbc99c99-5c89-42e8-afd1-5c9e10202103", "comment": "Malware payload (Mirai)", "value": "92c7b4ef6daea605603fe3525305f7cc1af6d3338da514940877a92395f122b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771786, "uuid": "8e7418ff-b1c5-4fa9-a8d5-9e97af9adce2", "comment": "Malware payload (Mirai)", "value": "8109eac601cca269bf38e14a19ef6a1dbca75105", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771786, "uuid": "40e36c4f-2118-4859-9a78-1f89822849f6", "comment": "Malware payload (Mirai)", "value": "0d4ca36c8efcfad871a60cf65d4f709102c535dbaa7845b9598751ec96d2c80fc9407da1a8f2a97f6c38c318be1f4917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771786, "uuid": "31ff92f1-dab5-4305-bc01-ddd222b11352", "value": "T189B2D07213C7F663D2B1983BE531824B374169FDE5EE327672196264E8D700B19B4293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771786, "uuid": "55c778fe-346b-49da-b856-74a4452fcd19", "value": "384:y9NxpFFS+Zy7hoQ/vUzLHc9DcEaC5Dytmlkq8f4ZVGK9KZFF2p6BhymdGUop5hVd:QZScaP0zecxC5Drlkq4Mb9o2p6Bs3Uot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771786, "uuid": "febf90b0-1238-4eb5-88c1-a2f865df192a", "value": 24032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771786, "uuid": "44c2c775-4fe1-4c23-a99c-03ac2a5c1d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771786, "uuid": "1673fbb3-e8d2-4066-a26d-4f9d62c5ac1a", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000ea338-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800249, "uuid": "b2598223-02d8-4f3d-b9d7-70aa6adea9b3", "comment": "Malware payload (SalatStealer)", "value": "e2127b66de1184e264f80c4275a457c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800249, "uuid": "4756327f-7d69-41a7-95f9-2f61da4158ea", "comment": "Malware payload (SalatStealer)", "value": "930f969f9638e894e571d8c527b34961194edb642af11f4f67834cbb95aabe61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800249, "uuid": "4b799f27-bd97-46b3-8dd9-5aeb20cf4afc", "comment": "Malware payload (SalatStealer)", "value": "9463477134389c8c9b815ea4bbf095ec318d9ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800249, "uuid": "2861efb4-7f24-45ba-a425-719cf8e92cfa", "comment": "Malware payload (SalatStealer)", "value": "cecaeea5ef2a78961cdea760912fd35a088f86cedddd7e57530a2d9882bdeec4db80833b11e78e81614f3f8d31f8d4f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800249, "uuid": "5a1939d8-06b2-4b10-8c84-cf6b4af1e67b", "value": "T1DDC65D41FE8BA8F5E9035C31405BA23F63315D048B28DBD7EB547E6AFC776922D26608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800249, "uuid": "87679835-6b05-4634-971d-31e0537a678b", "value": "49152:/3YN6tEH1tVpuhJKCrpcwfYa3xeHYXVpub625bXB6RNnV/ItpNnpy2QrvB+FXMk+:g0tEVIJrz0XBUV/iJqvM8HYJk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800249, "uuid": "a7c05111-dca3-4551-af9d-948af3768dd3", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800249, "uuid": "2a4f183e-95b1-40dd-8e4d-a8fca9ed3901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800249, "uuid": "fc9e0b76-ed1d-42e0-a9d9-976b09bc8d23", "value": "jztt9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e50fe4c-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770798, "uuid": "522d839c-6a81-427e-8e5c-16faba1fc25a", "comment": "Malware payload (Mirai)", "value": "a55ae82cc08b2b6dbf29be1626f04956", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770798, "uuid": "fc144693-e0c3-4b32-93e4-59b594672138", "comment": "Malware payload (Mirai)", "value": "933577b40486428e60d29f5c774b1ea412b8a4a52d60de20eb316126e0153c6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770798, "uuid": "2abea58f-409d-4a70-83de-6f2d84e27963", "comment": "Malware payload (Mirai)", "value": "59a4b8e046d029fdd4b6ce50868c4f4669436c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770798, "uuid": "f7aac76c-7910-44a2-b3d6-cb7b83fa6e03", "comment": "Malware payload (Mirai)", "value": "a960a96b89723eb0eabfd2a5cac067620eb2426989a00f3ee4c13928b6de38ae47bd1cead34b24a33d89e4fee7820736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770798, "uuid": "a95d8d19-020e-4daa-8d62-fd44c4194b3c", "value": "T134232AC57583F9F8DC15057C207AE7729EB7F83E603ADDEBD399A4239812601A20329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770798, "uuid": "ffb21084-1e84-4d8a-9e9d-4bfed870d9ca", "value": "1536:AsbZYXNkWLJMkN2mBHQv5pkmHAkFwAEUT:A9XNj9MkN2mBH85Fgk6/UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770798, "uuid": "0bf82ec5-2a4f-483e-b89e-840ac9e36e9c", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770798, "uuid": "a9573121-0218-4963-8066-04bfaef98050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770798, "uuid": "c147ccae-4997-4bbd-8451-31992634b7d1", "value": "3atoNational.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c829bc-0fe3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771760718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760718, "uuid": "95b1896f-6418-4ec6-b412-762616cb78d7", "comment": "Malware payload", "value": "39c9e7aed01089ba429e8a4a7ebe1a9a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760718, "uuid": "fb41dee2-6a81-4750-96c5-e6d402498d00", "comment": "Malware payload", "value": "949ed300bbaf5b988190b4c42594a53fca5babd2dc46fad838b446556a00d889", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760718, "uuid": "0e63d88b-fcef-4732-84c0-d3a0f9228698", "comment": "Malware payload", "value": "dca1f28351c43f87e406e6adec7e82b2979d86fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760718, "uuid": "b68d94a0-6312-41c0-bbe2-c3e8f6538adb", "comment": "Malware payload", "value": "cf5164d9ef7815f2bbc04b04c77c811d276d2c4f7d0074bf16ba6d1d4b029eb4b947581f873d4b7d3a18f6e5d632d281", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760718, "uuid": "e6c7f082-8906-483e-a00d-0f6b92a335e8", "value": "T1A222453B21F08B32D3C410D953A65AA54E72A70B452614B5F4FEA33AAF2C90771E7F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760718, "uuid": "d60cb788-0539-416d-a89f-5a4fd1b098e0", "value": "96:cCu7sht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6Nn9le6AAs9F:cCuC4hvZ5m5FG4j4HKNphvM/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771760718, "uuid": "a46662cd-facb-4e67-82a0-802319b7c653", "value": 10461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771760718, "uuid": "4fe8749e-3a2c-4622-88d8-c5040fb71f6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760718, "uuid": "1bd4e09b-3716-44b4-9cd8-409cab71d19e", "value": "949ed300bbaf5b988190b4c42594a53fca5babd2dc46fad838b446556a00d889.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718c14bb-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779394, "uuid": "a0304b59-8318-4fdc-9d4a-5509c5067efc", "comment": "Malware payload (Mirai)", "value": "40e839cca2eeef69845718b11137420b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779394, "uuid": "e8db7d88-965d-4ac9-bd3a-f9bf19cbfb16", "comment": "Malware payload (Mirai)", "value": "94fa1fce8214ff38b5f3f9eab4c7a7af131b074501356179afc578c248b01ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779394, "uuid": "5663d653-4c9f-4d06-a4f9-c81a4642ed09", "comment": "Malware payload (Mirai)", "value": "1063743950a422af744429cd59294564327bd57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779394, "uuid": "90577015-5daa-491f-aefe-c551340b011a", "comment": "Malware payload (Mirai)", "value": "d0eb157cd032ae9f0ee270e0ffbccb69680cd1df5a053bfbeb3878356114564d045ce5db74da3619d5e98a66142e9718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779394, "uuid": "a7004348-e4d7-49d1-a8c5-806411ac4585", "value": "T1FD14965E6E228F7EF668C73147B74E249B5923D627E1D680E2ACC1105E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779394, "uuid": "ad3c70de-8c40-4a95-9ea8-3a1f3b49d714", "value": "3072:jUrEuoT9v6IQXgRVCefC6AbAP6rckC9ytr/6hh1a8mHD:jUrE1T7qmnHA9r+9yh38mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779394, "uuid": "16e28902-c28b-4e79-afd4-479102e7304a", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779394, "uuid": "22e3ff83-2479-4e5a-8642-ec4a73c967e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779394, "uuid": "83c3a692-781d-4a25-9f8c-73c1c78c56dc", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1892e452-1028-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789982, "uuid": "2ad24d42-cd57-4221-9a55-17c911454e64", "comment": "Malware payload (Mirai)", "value": "d4d8bb485bf82a78768687f2dc597607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789982, "uuid": "ad0e5412-d157-4a31-8632-7de2c15944fc", "comment": "Malware payload (Mirai)", "value": "957980d0c316a1cf0bf0051cb5682d566f1ab6df9929ad591f9644d1c88ee04e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789982, "uuid": "c1157c24-a2dd-4031-b809-153a41d1f243", "comment": "Malware payload (Mirai)", "value": "2de00cd32ffa920f2c4961051ca3f00753a8ba0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789982, "uuid": "019194f7-75f4-40b8-9a69-47e157df83b3", "comment": "Malware payload (Mirai)", "value": "01c3e4b99259f7d22cc4cec7d3fe1dcebce63cadcb893012be4d4a20b8af791eb449630532b0fc48429bd42235b5e896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789982, "uuid": "1c8b011d-0bf1-4704-a748-b6d8d43b7c5e", "value": "T120A33A96FD924622CAD112B7FB5E428D372717A8D2EE3203DD256F21338791B0E77582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789982, "uuid": "ff7bad53-926a-4358-9e39-8d72a9a68dbb", "value": "1536:ravjqjoeNTfISnAWTzhGxUySX5x/HjC7OsisgUJDXSWHLf25vn+vM:ra7qMeNrS6NGvSpx/DshJgYN6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789982, "uuid": "5c992fea-2411-4b27-954f-9f9e9c2ef451", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789982, "uuid": "298486d5-a181-4ce2-b37c-f6c982940714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789982, "uuid": "1224f03e-73d3-40f0-b60b-98fb8318c296", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904a1ab9-1011-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771780304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780304, "uuid": "ca27ac09-6d89-474b-b514-e7d988fe867d", "comment": "Malware payload (Mirai)", "value": "ad1b5695197b7f047323807a0158ac27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780304, "uuid": "a162aab7-3bc3-4aee-8446-b7781602b113", "comment": "Malware payload (Mirai)", "value": "968de6ca10bd19e4f5e57af64283cad5d5e729e6848c042a1da1aa80bfb4cf96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780304, "uuid": "ca8130bd-559a-4640-a86b-f9f7fb590eda", "comment": "Malware payload (Mirai)", "value": "6e26a91c37759824f700282ca7cf125c7e77e799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780304, "uuid": "3826373e-bfff-49a0-b816-2f0b9382597c", "comment": "Malware payload (Mirai)", "value": "48ed83028eaafa314519a7f0265a0555d1f789196818ae5f65c530b1ef2258266604afb2135ad20472a0095b15882a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780304, "uuid": "45af7550-1648-4f3a-975b-9f75c31f5354", "value": "T1B8D3C021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780304, "uuid": "13c8c7a4-7494-45dd-a6ce-e4a7d265ee97", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xa:PiySSGp+PMmT7zMplw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771780304, "uuid": "40b4c7ad-967b-4bb6-b440-6f71566ba5fb", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771780304, "uuid": "86cfd586-db33-4123-8f29-9d802688e86b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780304, "uuid": "a18b32dc-5b6a-4afb-9b0d-eca98d860c03", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec7d08-1009-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771776863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776863, "uuid": "9b5cbfdd-b299-4eb3-a571-78e5ba7e33c1", "comment": "Malware payload (Mirai)", "value": "9ccf5167878bcb63443cc09e5361ed4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776863, "uuid": "47c966d2-5993-479b-a529-9ed70a91c8a5", "comment": "Malware payload (Mirai)", "value": "973fcc77df20835d46de1e98c7709379f1b83be28e477c316af5a5273cd961c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776863, "uuid": "0876ccb4-8fc6-4303-b192-879dd47e9274", "comment": "Malware payload (Mirai)", "value": "b274145d6d332f7ecf19ce0d84f6719c54d58aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776863, "uuid": "858a3fa3-b588-4a23-a53b-6101d9a0da42", "comment": "Malware payload (Mirai)", "value": "08d77870414fd5134916d4818a5c46ffae1841cf0a0a79ee0d063e6692a74eedaeed338fe4dcea376b54891aa860fb0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776863, "uuid": "5c1f6688-ae00-4d5e-aacd-4d38f52a2811", "value": "T1A3731A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776863, "uuid": "28833198-629d-451d-969a-812376fe8995", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAyI:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776863, "uuid": "594c04f2-1075-4a2f-b2f6-3f781e880092", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776863, "uuid": "9c954b4f-7c24-48e9-b2b8-6c9f20997fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776863, "uuid": "2a380809-89fc-4728-a5e3-6e2b4f247377", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b080de13-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784224, "uuid": "413df29e-aa6f-4d35-af0c-5a4be6e34ccf", "comment": "Malware payload", "value": "4d56fcd9609e7c2acd345254ad2e3e8b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784224, "uuid": "ec9d2686-2d9f-4800-b7fd-9c5823efc792", "comment": "Malware payload", "value": "9779b841a22ca39777f4230bdc3a8b0bc9cfe5a4f34c232c3c22ece2c38cb44b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784224, "uuid": "f8402b4f-7e18-404e-899a-29d8b3a9247a", "comment": "Malware payload", "value": "e2aeef2b6df9c510970aa422ad9ff33494f52ebc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784224, "uuid": "2907b696-ed04-4d9c-b895-8136b09d97a1", "comment": "Malware payload", "value": "8fae5eae3a14858e49718a4c708705ba31c7d10cce440bfea0572ae0d61c7007029ed123eb513bcfca33d4fc1d078d39", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784224, "uuid": "8bb57b8c-b17c-4275-9b02-5d064c143975", "value": "T15AF2E03AEA9A6530C347B77B20466D8DF90B5E07D1FEB66F37A591CC8D128514703A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784224, "uuid": "2dcfab8d-b2e0-498f-aa3e-86ac96e9fd6c", "value": "768:oAQP+NAiJQucR7gWUU/X10feOL9Pftike1o2H3Crpl:on+WqQuctgd8mfxllikOXCll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784224, "uuid": "80d49a4c-cc72-4869-b88c-7a0a8b8f0a0d", "value": 34650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784224, "uuid": "14f9b350-0244-44e7-bbfe-1cdaef1f81dc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784224, "uuid": "6c84f5a0-c162-4dfc-86dc-4280b47c8315", "value": "update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a2701a-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790566, "uuid": "ee82edd3-145d-45ed-9d8f-fbcaec42df44", "comment": "Malware payload (Mirai)", "value": "b87f2a0f5562b65c5a0fe2a8f5b77596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790566, "uuid": "0467fc3b-1a9d-408c-8ede-21be010de9b4", "comment": "Malware payload (Mirai)", "value": "97aaf1560c05cb695790af8ed48fb6680cd5ec83b0caac432bf0367f80d8edf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790566, "uuid": "2b9722ca-a280-4268-95f2-e3688e552a6c", "comment": "Malware payload (Mirai)", "value": "07ef47609b1f06ddbe2df289c6b1c41c98f4f443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790566, "uuid": "fdc4863f-1025-4731-ad3a-d23787f8c51b", "comment": "Malware payload (Mirai)", "value": "6ab5cc41e35ccedd2d56220abee068f340dcc89a4f13718b57dd9756cbf9ea7385c9a1c1110670f94d7713182cb3f795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790566, "uuid": "94bee084-f020-4f27-a058-41dce883564f", "value": "T1CA243B46AA404F13C0D727BAFA9F42453333A7A4D3E7B30695186FB43B8779A4E53606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790566, "uuid": "6f31c128-8b3d-47ed-8d08-5e6101042ad8", "value": "6144:pdhjq++3mYHVaHtRCwnnjuh9wRM2/0p6M/RkIz62:tW+xYHVaHtRCwnnw1pD/SIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790566, "uuid": "561dcece-1886-4c79-adca-beeded708d5a", "value": 222419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790566, "uuid": "e6ef4631-d6ad-43c4-b9e5-43d342d6dd10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790566, "uuid": "edd89a4e-6f1f-4b37-aeba-1eb67edd1934", "value": ".5r3fqt67ew531has4231.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b306afc-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784107, "uuid": "007fe450-74cf-4b36-abb2-9c081a2bd70e", "comment": "Malware payload", "value": "c2db86b46eb27d46d7d710b707876ef1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784107, "uuid": "4a4de143-9847-42ac-b0f5-dcae17a8e1e0", "comment": "Malware payload", "value": "9818172dd6c8550a50ba902ec59300f68f8caa8afcbd585d2d7a60353668159d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784107, "uuid": "2271e451-5467-48e7-a25c-a22687079817", "comment": "Malware payload", "value": "860b2a444665370cf63f5fe6e80d5e2c89f33b59", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784107, "uuid": "4abfd658-d5e4-41c4-b412-30d620c8026f", "comment": "Malware payload", "value": "93f52c4ee87ebeeae3cce71add5b3fdbd34e52466e691e92ca70ce77a51f3994c510ac70a9c6a4a11a3beb1c2780921a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784107, "uuid": "2034f2d2-1fae-483a-9f21-d71a40f676ad", "value": "T1AEF2D039DA9A7520D34BB37A20466DCEF9065E17D3FEB666369492CC8E028514703ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784107, "uuid": "487b1104-b71b-4952-8f69-a1e05789be92", "value": "768:azQP+NAiJQucR7gWUU/410gPOL92m5Vti7e1o2H3Crps:am+WqQuctgdLmgYQWi7OXCls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784107, "uuid": "a4b0cc84-e5aa-4520-a2b7-3bca7882a9b2", "value": 34621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784107, "uuid": "6211c53e-b0a9-46df-84de-3470884438d4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784107, "uuid": "f39a9b00-f7ee-460d-a0ce-576c91d89e69", "value": "patch_update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3980d3f-0fed-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771765009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765009, "uuid": "4f85aa5c-4450-40ae-99c7-bc85f67c7786", "comment": "Malware payload (Mirai)", "value": "a8f23626df889a51941777e3b31227c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765009, "uuid": "e150d549-2b49-46d1-baf3-ff295ceb61fd", "comment": "Malware payload (Mirai)", "value": "9862cd352e14b1542bc46c8d2164ab47ae32cfe003de9b2d531ba8c25fff7e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765009, "uuid": "e5d6a339-6777-4087-b5a3-ad48fe40ce62", "comment": "Malware payload (Mirai)", "value": "c75fdfa3d45b7a09a98c4d230953fa9469b1b58e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765009, "uuid": "7e8cc96b-e598-4009-a2b9-83126a72a7f2", "comment": "Malware payload (Mirai)", "value": "d52411d3877b947eb7d0b4ba7a5513d8b43388bb79c4afa310663c57a1233524e3a0ee15404432f9eac2ecaee4795aee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765009, "uuid": "e0ab2887-caae-465a-ad2d-9886375955c0", "value": "T113D3E195F580EB12C7D121BEEA4D4248334317B9E1ED73018E158B7537EB92A0E3BE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765009, "uuid": "f0cf90b2-5b7d-48bd-9500-70cd92bf7e5b", "value": "3072:rponhnSMawQpPwQT45NGcEgTPgwDe1onf/1/PAMqJ10:rUhSjwc8Hlg2Lf9Dey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765009, "uuid": "736e8a3e-df38-461e-92d2-073a6f6e833d", "value": 141439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765009, "uuid": "185d3aa7-a766-41f3-905e-25b91d3135f5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765009, "uuid": "81759f84-feee-40b5-9e5c-2d207846a158", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e74282-1001-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1771773306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773306, "uuid": "ca631b90-7a2f-4404-ae85-309198928f6b", "comment": "Malware payload (NanoCore)", "value": "1d689d7e15b2bc86dd943cb7a6296814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773306, "uuid": "3dcd5595-4ad5-4525-b30c-208afe68d276", "comment": "Malware payload (NanoCore)", "value": "98c997c2904ba50d7ac7dfd31b0164d2cd57ca77084ebb8149682cb2b8ea8cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773306, "uuid": "86248de0-6f15-4686-ab7a-a42059a57544", "comment": "Malware payload (NanoCore)", "value": "c2dcde58ee50c5f044f59021c44b71f18db20400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771773306, "uuid": "bff211bc-8c7a-43da-bb75-16e878cf2f6e", "comment": "Malware payload (NanoCore)", "value": "8c12b4e8048f5051bf4dbd190c730e73e6e5cbea4bd35a3a855597efd09ea660fabbab4369f5e02f225b8412e4ffe96c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773306, "uuid": "56ac50bc-b065-4e63-bc60-65112f492188", "value": "T11714C05A7BA94A2FE1DE86B9212241139379C2E3D9D3F3DE28D415B38B137E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773306, "uuid": "fa7e0d97-b231-4474-be25-93410e9c7617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773306, "uuid": "989c9f35-0f13-4257-9c4f-6d49fb8ffb4b", "value": "6144:ULV6Bta6dtJmakIM5oSn5P/qHpuvuN/E+mtQl:ULV6Btpmk5Sn5P/8pu0Eht8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771773306, "uuid": "89b1c6cb-c5c8-4455-b758-be0936560ed1", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771773306, "uuid": "db1e7e59-c6c7-4622-8bb2-c35bb57c7dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771773306, "uuid": "d5167117-440f-4d7a-8575-1d89e530a9ad", "value": "ObamaBrowserSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e4aed5-0ff2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766972, "uuid": "a5d67796-1189-45df-be6e-618953f9ef51", "comment": "Malware payload (Mirai)", "value": "3ebb76158f85276e474f192ba1d09b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766972, "uuid": "3f434788-47b6-47c0-8295-04553e475983", "comment": "Malware payload (Mirai)", "value": "9907f41a5e3c9bc02f8da2af833ad43d21cd0e377cb5f8bf0862537961c92003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766972, "uuid": "13dcf199-3218-458a-9813-167bd0f8f2a8", "comment": "Malware payload (Mirai)", "value": "8cc5d884cc354ccbdf61dfc2181084bfcd7f7ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766972, "uuid": "875ac0c0-5b24-4f61-9000-c2bdc5567fb4", "comment": "Malware payload (Mirai)", "value": "33fbe77dff0c1753e2d0e469b45e4aed1c8556fe4ce16883de333cd27441168d296ac95ab156819b16a9dca07e3cfd68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766972, "uuid": "60db3322-f6c4-44aa-acdd-aa4313537fb5", "value": "T155D33B06731C0A47D2633EB43A3F27E193EFDA8121E4F644255FAB8A9171E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766972, "uuid": "d70dd08a-ee0b-469b-8a8c-03f35f6c1136", "value": "1536:bz94fQVaghE2mTA1FboAExfTIoEPtn2n+Y7bQ4znvAbj00WulzNsq1GcmywJ4:bzZEZE1poAEx7Et27k4kbtVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766972, "uuid": "8c20ed09-e895-46a6-a10d-31c300646563", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766972, "uuid": "5c869fc6-b9d4-4d04-a05d-be2788436317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766972, "uuid": "51bf448b-5a88-4c86-94ec-da3a267ac320", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a46974a-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768993, "uuid": "43cbbadf-ef79-4100-80a2-116b52e6e32e", "comment": "Malware payload (Mirai)", "value": "a649911068d4fa4dabebe4c9ed4e40bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768993, "uuid": "0a3e64c7-15c6-44dd-bcb5-883d4820eeaf", "comment": "Malware payload (Mirai)", "value": "9915a16407319b55f2cbe670f1e2f756f832f54ee4e1a85272a351b1e77ab685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768993, "uuid": "1449b53d-d8d3-474d-8e1f-fbaa2c40b8a9", "comment": "Malware payload (Mirai)", "value": "aea6ff1c36a77ec58ef7d1a35fcaf8b1b2f52d13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768993, "uuid": "16c095ab-5b70-4779-8d15-a69e8b8322df", "comment": "Malware payload (Mirai)", "value": "cd86403c7ed1452bcf283c7978a3341bb78afbdf123e73bfc612c5aa48d4b6424ef722991ac99908b84669b5473b5276", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768993, "uuid": "fe393a6b-f5d5-451d-9d61-753595ce8296", "value": "T13D731995B8818B22C9D512BEFA1E118E3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768993, "uuid": "75bf18cd-6231-4d39-affd-009231eb556c", "value": "1536:TAnB7Xm2yKiCTNpoutSaH2NjTQ3MFiP+C/lw17IP52YMd:cW2m2iutSaHR+C/lw1kP8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768993, "uuid": "9d651656-a3c1-4b45-a1d5-454c7eb2bfb3", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768993, "uuid": "9a0f53a4-fa91-4813-b6c4-cdeeac040e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768993, "uuid": "3b5ee2d3-f1a1-4950-abf5-e924d37cf8a7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07781a7a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766331, "uuid": "0276f6c9-06b5-4cb1-a672-ce9a20e586b2", "comment": "Malware payload", "value": "ec5e7dec92f5d8a51f6dd2157e49999f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766331, "uuid": "29122932-f7fe-45b4-9b0e-01d0a26256bc", "comment": "Malware payload", "value": "99232e0223c71c2eef20bfa4a0709201f25d4ed58d083f23e77b719b76172205", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766331, "uuid": "49267265-a8b5-4e39-98c2-60a872208fe2", "comment": "Malware payload", "value": "da189d1b0b28014af3577638b034624073b29633", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766331, "uuid": "8c3ec397-b912-48e2-831a-74e750831166", "comment": "Malware payload", "value": "5b20106ca9209ad051a6dc3e41e6577dbe8c943a68b5d7064da4602b929b33f8cc873d06485cacbe499dec6c9502cb65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766331, "uuid": "4d379e6b-52e7-4ab0-955f-732c7a39716f", "value": "T1C532663B11F08B32D3C460D952A65A610E72AB0B452614F5F4FEA72AAF2C90335E7F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766331, "uuid": "ae480114-491c-49a0-b294-173161ca9bbf", "value": "96:cCu4B6csht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjHUVTuzXlITPioVRJAs:cCuk6p4hvZ5mrFoKNpivbUVazXlITPVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766331, "uuid": "a150357d-33b7-4aca-a336-504a1b613a7f", "value": 11052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766331, "uuid": "7a7bad62-21ec-44e2-bedf-7488622eafac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766331, "uuid": "73f70c27-8106-4f46-b847-ee47ee172241", "value": "99232e0223c71c2eef20bfa4a0709201f25d4ed58d083f23e77b719b76172205.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6b89ad-0fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771756115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771756115, "uuid": "fd8ff056-863b-4980-b67c-1a318cedbbe3", "comment": "Malware payload (Mirai)", "value": "4eede3e9369350274c743ca32278e1a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771756115, "uuid": "57f6d6df-ec28-411d-a4f2-bd7814440060", "comment": "Malware payload (Mirai)", "value": "9980df3ab1d38c47d472617a993ab1757a649ea0c3a28a7f97551711bedc8f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771756115, "uuid": "4bd2b183-94a8-41c1-bc2f-e241a5cb1e8a", "comment": "Malware payload (Mirai)", "value": "b0ef7220e636ffe42f0571adb1b2e79036a48969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771756115, "uuid": "269ca516-cae0-4e64-89fa-4d68f73b9de1", "comment": "Malware payload (Mirai)", "value": "7fd233f7741a6c3ab123b844a8422a9d08c2df92360db80fec9e2b1a8a79a487949bcc3eca407e58e8414a27a004df3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771756115, "uuid": "e304222c-da2f-473b-9cf1-8abb04d5a54a", "value": "T119042B46EA404B13C0D627BAFADF42463323AB5497EB73059528AFB43F8679E4F13605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771756115, "uuid": "2e840c0e-c963-4cd0-90a4-8ff939c02361", "value": "3072:cZ3jyJNrdwZsctacyL8l5y1TAehLLjE3RDrRoNM/RSj0LYJuy:cVjcrdwPtacyL8l5yxLLjE3JiNM/RSjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771756115, "uuid": "003bedb2-5bd7-4286-807c-6d9d0bf6338e", "value": 188102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771756115, "uuid": "d38646d0-2ec8-4c4c-86f9-f4debf1050cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771756115, "uuid": "5154e14e-b93c-446f-8129-831412815d8e", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa3328-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766442, "uuid": "9bfa166a-35e5-4001-a8d4-9c2cf02a2d81", "comment": "Malware payload", "value": "d9bb6555644514bfac11aa04a57a6b9d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766442, "uuid": "299a22b0-9350-4abd-9fe5-75c02ce9b6f9", "comment": "Malware payload", "value": "99b150d5f7b224188266648f2f0756b52867e44ccf94ac4b2f9385554bb157f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766442, "uuid": "6f3f344d-f778-458f-a659-ac4a39789f66", "comment": "Malware payload", "value": "93614690db5ab58b32924eb958d33ae1c01f99ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766442, "uuid": "8b12b2a1-d680-4257-8f42-47a78f542320", "comment": "Malware payload", "value": "68fc4f390005cda87262e843442b0eaba9bf2f31d7c6e8bf27d6dab8667e6bf22a7279460c2a934e3b0a79ebd8b64c8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766442, "uuid": "0b1053f8-282f-4613-b3a7-6e3422d86b55", "value": "T1E0E1D6F125F008736E209984F2773BA5AF76A8174997238C349E1E3A5F87B43B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766442, "uuid": "6cd9d6ef-6bdf-4687-b296-7157c62ca309", "value": "96:cLu7B6MjlcCKbpi6fL6fL6fh6fI6fBEAA8AADAAZAAs:cLul6VhGB32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766442, "uuid": "fef6198e-c92b-4c48-8f94-710af1b29a9d", "value": 7259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766442, "uuid": "d33bd534-e01f-440b-a6cd-e9f8b372f552", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766442, "uuid": "0310a488-1dd5-4742-8f91-bc125295da57", "value": "99b150d5f7b224188266648f2f0756b52867e44ccf94ac4b2f9385554bb157f6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82a96d9-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766305, "uuid": "ea7218cb-1df4-45cd-b3f6-78ffa36b051e", "comment": "Malware payload", "value": "2b2657cfb856020b4689469a522190c2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766305, "uuid": "f24e6926-885b-47ce-aa4f-677d26fe73b2", "comment": "Malware payload", "value": "9a08b9c950e6db1abab0226b893a75427640b463a49a7d71c4464edcc6bf6596", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766305, "uuid": "428ce838-41f4-4718-a9c8-e3986fa071bd", "comment": "Malware payload", "value": "47ce87a38c6d89257dc441f5219c9186b86965e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766305, "uuid": "d1cd4406-e59b-4c3f-b909-ae20823d6b61", "comment": "Malware payload", "value": "1e2f8a568563b44a0b2f50f1d0a8cd8f143b3ee0639242dc3aba39749def4e3cf16b6fe41f25e5b5b3a4201ca8352450", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766305, "uuid": "1f9b3337-e9e9-4e69-914e-f5c96187c496", "value": "T1BD42287621F08A3397D025C4A37717A15F72E61B44A714BCF4BE1A3A9F59B0370EBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766305, "uuid": "1ba9bdf0-b702-46e0-bb18-fe7c5232b7b5", "value": "96:cCu/mB6n7sht+O+v1fsn+h4+tIicqbA/GsGqNz2rJO11IB4IBq5rC2OJyJpJDDAz:cCu/K6nC4hvZ5mzjE+f1mj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766305, "uuid": "690e6ddc-d2f4-4b97-a0c8-630aa4659ee9", "value": 12706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766305, "uuid": "a0d52ed4-d715-4a34-83d0-863ff1c758b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766305, "uuid": "080dd06e-0422-41f8-afce-d6c0689bd622", "value": "9a08b9c950e6db1abab0226b893a75427640b463a49a7d71c4464edcc6bf6596.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e334048e-0ff8-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1771769706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769706, "uuid": "fa98881c-30d3-40a9-92cf-bafc18c75e5b", "comment": "Malware payload (NanoCore)", "value": "0d017a19df84e902559fde9c396c3f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769706, "uuid": "8529c51f-aff2-4852-b7fd-021a69b6f8dd", "comment": "Malware payload (NanoCore)", "value": "9b15f5ba26ba941bdebc53d38f2a14688c2be61e11b3486156f11ec07141a349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769706, "uuid": "338c596d-227f-4548-8787-82bca2f80c28", "comment": "Malware payload (NanoCore)", "value": "338d703c3bde586dfca23e51391cbcc0d18027db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769706, "uuid": "5a9f292a-d049-49a6-b4a4-f27db63ed0d8", "comment": "Malware payload (NanoCore)", "value": "07f070b910a0b3ad16cfeca586068ee06a9cb539ad5b0ff8c2bdbde99f9cb11545068159ebac5ded94e95cb8e62587ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769706, "uuid": "2caf2034-71b5-4a07-bc42-b9cbe88ff876", "value": "T1A714CF163BA94A2FE2DE8A79711251539379C2E3A8C3F7DE29D454F34B223E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769706, "uuid": "e742ba2f-8775-442a-8b19-9d5e0e5066da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769706, "uuid": "80856a03-6957-4dfd-9936-3e67700f3d5f", "value": "6144:ULV6Bta6dtJmakIM5nP0CLaqLVXQAGVYKUR:ULV6BtpmksP0COqRX8OKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769706, "uuid": "ba3aed80-20d3-4e5b-b6f3-0cc3b5db90fd", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769706, "uuid": "6777330c-7ef9-4b26-9eb6-e3794ee075b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769706, "uuid": "d03cfdee-8766-4ff2-a694-796c001b4676", "value": "DriverPack-04.09.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44850b75-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766004, "uuid": "7ddbcecf-6cfe-4605-a96a-302480912b2f", "comment": "Malware payload (Mirai)", "value": "a8664aac92b872db2e6ed55474c023e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766004, "uuid": "d146ffcd-a452-42ef-a0cd-cba52c3e574e", "comment": "Malware payload (Mirai)", "value": "9b1a9dda8bf545853af4ae19bf676487a58cec7bbbf87de38a4bac5a8c258305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766004, "uuid": "0ec7299f-7f49-4673-9b32-62bae70e40ea", "comment": "Malware payload (Mirai)", "value": "0847e76e30a8723572a55b245cc553420887cfaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766004, "uuid": "67363f30-ee76-45ae-88f5-1259ce18683e", "comment": "Malware payload (Mirai)", "value": "5a68c5dfad48441e3c4fbe3397fa71b0aaf184051bba94768aa22e40692febd3ae9648d79a171968942c3fc3f9c98c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766004, "uuid": "af549f8f-aa5f-4036-9f69-1f9d81f831a9", "value": "T15D93290375C084FCC49AC17407AFA532D863F47E1239B19F27D4EA22BE99E512F6E694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766004, "uuid": "e4f00bae-7df0-4a14-aa27-9e4421294f5a", "value": "1536:6PnSnKmzFEdYFPxIxNP+dW+fxwX8Raa1C1wBd752nPXaJKDRSsS:6dmBEePxKNPCxwXU1C1wBdYnPXaa8sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766004, "uuid": "032f7731-7f7a-4ef8-b373-c4e0187e7896", "value": 93728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766004, "uuid": "627991e3-7179-44ad-9eb1-cec2bfdcd178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766004, "uuid": "87de2c2a-86d6-4fc2-9bb1-3a0251491aa7", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28918263-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766386, "uuid": "a8dd9ec9-abd8-4d10-9f8f-545cbbe0e37f", "comment": "Malware payload", "value": "e913bb1abbc8d7a53bba5496ccf477a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766386, "uuid": "ddaa47de-441e-4389-9203-6a772d30d2cf", "comment": "Malware payload", "value": "9b1acce506a40ecc0e20ebe1860c3faa55bb22e2f54318f8e60fef2c900f5258", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766386, "uuid": "54794cd1-9c8a-4285-b5f3-0a3d27cb7eca", "comment": "Malware payload", "value": "ca4c49e26335bbd192d4bff0cb7c2be8a22b2a96", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766386, "uuid": "465310e9-4dc6-4828-8d6e-3851d30f6cbb", "comment": "Malware payload", "value": "29ca187d01f4cd594ab19b37e544614bef32e451424b04598776c1735f68ff64d996e7e1e5af8068e6f50240deca095c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766386, "uuid": "745a8fa4-f251-477a-b426-6d98dad68e25", "value": "T12D52643721F08B33D7D410C9A2B61AA14E72970B986610B9F4FE57359F6DA0770EBB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766386, "uuid": "c6849208-19ad-4100-aa31-8ee89e95d60f", "value": "192:cCuP16p4hvZ5m5FG4j4HKNphvgaq+GVups:Fp4hvZ5m5FGGoKNphvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766386, "uuid": "18d03045-3baf-47b5-95db-ae00a933d1fa", "value": 14024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766386, "uuid": "87864c0b-6c11-459b-812b-247dfa91f7f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766386, "uuid": "9f6d1bf6-7931-459e-9408-f991cea88680", "value": "9b1acce506a40ecc0e20ebe1860c3faa55bb22e2f54318f8e60fef2c900f5258.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a6ae6b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766494, "uuid": "68cf5fda-be0c-4390-943a-af4a32fe156a", "comment": "Malware payload", "value": "92be4cd162eb518ba3e93112adf741ad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766494, "uuid": "68d3ca11-a727-46e3-82df-e2203ad1381d", "comment": "Malware payload", "value": "9b1c952cf5ebbaf3869fddd515a2d6f908f13b92d3acaac6c348ed0599bdc0a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766494, "uuid": "58eab104-68bd-4041-a8f6-5d742aa9e7a6", "comment": "Malware payload", "value": "e008e5672c307c2a8c813b6c6e6148e9e01f0e7d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766494, "uuid": "f8e4840a-3d24-4172-a978-0bb42001572f", "comment": "Malware payload", "value": "c17759cdbe39dd1350903ef0707f84dba9a31a683d0a7be60b532a727eb42077a8f5fd47d73ebadaaefacdf7b0565e46", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766494, "uuid": "eb002c53-147a-404b-87d5-629b30aa19ac", "value": "T13A313C7850F10D732A1CA540B6B327957F73DF17865323DC35DE5E665B8AB03625B420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766494, "uuid": "9c05c0f1-c130-4be6-87c1-a59fe7b88284", "value": "24:cnnRUR8fARWER5/iPdFHjeef5uZW5FkXdflUlc9HHEDsJlc9HHUeN:cnRu9RWEj/iPdFHPwWYclwnEDsJlwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766494, "uuid": "bbe91359-fc2a-4f6e-b648-125b41067c22", "value": 1500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766494, "uuid": "906bf8e4-dacd-466d-971a-2f442e6a4f83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766494, "uuid": "45783c5e-a900-4c70-84c0-fa8e3fae7515", "value": "9b1c952cf5ebbaf3869fddd515a2d6f908f13b92d3acaac6c348ed0599bdc0a6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe07344-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779471, "uuid": "e43c1bab-1b2b-43e2-8540-07f430231ea9", "comment": "Malware payload (Mirai)", "value": "7f964191364ba8142eadf0617f16d465", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779471, "uuid": "93e01584-eecc-4458-9688-19f04ecf0187", "comment": "Malware payload (Mirai)", "value": "9b1d9bc19b0356f4162f2536162dce2909f5afc9a91853b1e15b410505cce0e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779471, "uuid": "2fceb681-f36e-4a95-b9b6-8dc0d3a1ca9e", "comment": "Malware payload (Mirai)", "value": "6bff214e9a544721d528c98eb733f9a0ba8f9dd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779471, "uuid": "acc7dc22-bc9f-4815-8b48-da0efe4b4f27", "comment": "Malware payload (Mirai)", "value": "4d20681f6e57159e36ad1efec9ba56d165c36b7174c3bf809069ba8689529c480453c1b478670530580671eb823763d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779471, "uuid": "02936076-30cb-4023-9e89-6dbe7c1e15c2", "value": "T1E4730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779471, "uuid": "eabc5e3a-f1ba-4813-921d-399e1e14ae43", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjA0g:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779471, "uuid": "276b09bb-647d-4dc4-b75f-8cdcd0d937b1", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779471, "uuid": "3ccd968a-ec00-4468-9fb0-3302989a6ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779471, "uuid": "cfcb80b0-a0ef-4edb-b3a8-478573bb3df1", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b206853-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766337, "uuid": "5848bdb1-d5c6-488b-b483-6f8f2f80583b", "comment": "Malware payload", "value": "7baf2a4bd584b48f8962688bc36ec713", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766337, "uuid": "8a9bb446-f516-4375-a23c-4c1e96f06a92", "comment": "Malware payload", "value": "9b5f472ba3f15b3da83739480dadd2292263b2ef966c929091f44e367db73533", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766337, "uuid": "f08d8af8-756b-4f2a-a0f7-a02785f73502", "comment": "Malware payload", "value": "fff33d4fae18c3fa1d243c3c2a0f080e1139b9a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766337, "uuid": "ae77fa9d-37ba-4df7-b5ec-ea63e684ec29", "comment": "Malware payload", "value": "a9603894b20c4b0eda1512cacfa01273ea6ef6444a4a2bf07b03266f4523269fba142ad359de82b2fdd50b5cb415a3ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766337, "uuid": "ec6609d6-8a97-4369-ae7d-164f509983f2", "value": "T1F8A27E7621F04933AA9055C4B3772BA14F72D65784A321B8B4FE1B359F59B03B0FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766337, "uuid": "f45e1a84-6c71-4f64-9877-9a657421a56f", "value": "192:cCu2g6p4hvZ5m5FoKNpivFDFCrxIT+10DUwoKmjLaeOWO+8TRi1:Bbp4hvZ5m5FoKNpivFDQrxIT+10DUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766337, "uuid": "d4541fa9-d426-4221-b01a-28b784b17690", "value": 21423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766337, "uuid": "aeced0e5-c963-42bd-9b73-8acef9c7a062", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766337, "uuid": "7c51fc8b-d7a6-4409-bac4-c5ea9891e61e", "value": "9b5f472ba3f15b3da83739480dadd2292263b2ef966c929091f44e367db73533.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795b7fee-1026-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771789285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789285, "uuid": "67cf56fc-ba91-41a4-81a7-f747f58b80a7", "comment": "Malware payload (Mirai)", "value": "bd962e0903b19342646f04e7650821da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789285, "uuid": "ba10b934-2e98-4031-b5b3-7838c3942f7c", "comment": "Malware payload (Mirai)", "value": "9bb794a1ae36b23f37724cf3261c74eca4defad531a88fb9c455ee739443a7a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789285, "uuid": "0352749e-3911-40ad-b127-1ad2ec3ba53e", "comment": "Malware payload (Mirai)", "value": "ac5a735bdddf9a2d3c96132e339bd35f27fb7728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789285, "uuid": "1b4b5319-5281-420e-a2fb-73e64941df46", "comment": "Malware payload (Mirai)", "value": "adcc4fc2e2ec71dc8437ec629f054c003a805c804dcf6ac97cf584c183338e5b9663c411b38a294b359db529a64351d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789285, "uuid": "a95368c5-a013-4d37-9e4f-b306597630bd", "value": "T1DE145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789285, "uuid": "ea4d021a-12ee-403c-815a-c1bd4386b2f2", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXwUaN:HZ15BTYCrYq1QDY6h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789285, "uuid": "b991b207-2efe-44c2-9359-e5113901b4b3", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789285, "uuid": "bf2d0153-a2e7-4b0a-b208-5abe17870441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789285, "uuid": "18c87697-56f9-403d-b30c-3672fc60ad69", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d874d68d-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778707, "uuid": "ea3bfc8e-c0b9-447c-80a2-c12523e66264", "comment": "Malware payload", "value": "dbe8de91651bd6157035db0167e01c39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778707, "uuid": "f7f0ae5d-0bd3-4325-b346-3524417a6e99", "comment": "Malware payload", "value": "9bc32c3d9f0108740ece3cf74b9e81eb0ec43c6740a50e50cc742b9f32345a37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778707, "uuid": "8ffd01fd-c7eb-470c-9b78-38a5cad36697", "comment": "Malware payload", "value": "956d004da2f76de5be6bada8826a9909915dbb2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778707, "uuid": "89fa8513-3a71-45ad-94fd-50bf2a7c601d", "comment": "Malware payload", "value": "85b4bbfd02431be81bf774c1b350d3ae16e1c6d69763c2a8986ae909b90845b61c20a70f23515f7de038502c772a540a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778707, "uuid": "521ff02b-00be-4427-8ed6-e8473cbe2b0c", "value": "T1B921997421F148731E545980F2372BAAAB73D85755D3624C38DE2F39AFA7B03A5BE012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778707, "uuid": "d60aea52-7252-405a-a736-bb03df3593fc", "value": "24:cnnRUR8fARVNvoslc9HHYbxtNuPl/Ha+VsUy/Yul/HVeN:cnRu9RVJoslwnYbxaPl/BWUQl/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778707, "uuid": "0b526196-e58e-4ffe-bcbf-e76310dacc47", "value": 1430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778707, "uuid": "3fca54f3-104e-4b83-ab18-bf40b1cf88e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778707, "uuid": "2e5e5372-ff6f-4917-aa96-85cb4a32e700", "value": "9bc32c3d9f0108740ece3cf74b9e81eb0ec43c6740a50e50cc742b9f32345a37.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a011685-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766496, "uuid": "20a1239d-0d92-4ae4-9c65-3b32d14fbc2f", "comment": "Malware payload", "value": "236e76c64eceb8b47ce683c36c254079", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766496, "uuid": "a6682108-44ed-4ba3-98f1-86091d3c7fe3", "comment": "Malware payload", "value": "9bdedce0feb233ce02eafe2d234e0fafdb125d3f0c737111343bc6b600b0da84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766496, "uuid": "479ec649-0592-442d-bb7c-a1a224d0436a", "comment": "Malware payload", "value": "e6fff2890e9ee94f4e995a49f9f7853598f8ad78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766496, "uuid": "6576b7cd-be63-4299-9957-699ccd1075b6", "comment": "Malware payload", "value": "76e401e8824488d57ffda618b015e267131b32238c4aa4a474b768a1679de702739db4d113830b23ae49dd7fbd1b3ce8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766496, "uuid": "98e0dafe-4abc-4ab8-b509-f2f69a78ea1d", "value": "T145C1F9B424F14C332E21AA40B3772BA2ABB6D85349E3258C35DE2D355F87B12B5BF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766496, "uuid": "0a723e09-178d-48b0-b64a-56ef368cdfc3", "value": "96:cRm3k0B6ZjmLuXfUbsmzqmvs8+bXIBSIBC+:cRm0g6FUQv6oXdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766496, "uuid": "6857fec6-52b6-44ad-897a-df8cdf37b1a5", "value": 6019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766496, "uuid": "779fc44e-2115-4be9-8336-c446a6931a57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766496, "uuid": "4779ab56-58b9-4e82-baec-f8e387be0b68", "value": "9bdedce0feb233ce02eafe2d234e0fafdb125d3f0c737111343bc6b600b0da84.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bcfa68-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766360, "uuid": "a045153a-f697-47fd-aab6-44c991d60090", "comment": "Malware payload", "value": "8f8d421508a1f33914733b601e37a6d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766360, "uuid": "62d71e00-2b3e-4f2f-954e-9529a86804fa", "comment": "Malware payload", "value": "9be2715d564019eed27ca252949d6003195ae577071651c862f9e66b0d0f7f44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766360, "uuid": "55c9a470-9497-4e92-b72d-6ce662e516b1", "comment": "Malware payload", "value": "7b6ba1def2f3b862af4cb3594843d2ce98fd02ed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766360, "uuid": "2bbdcef0-bc3e-4a5f-9d6a-2e4ebaf80418", "comment": "Malware payload", "value": "0f88eaa986aafcfe17009c223191ce702a897d6bbb285551030fceb72897c53459a313d64337538a263a25a21577d2f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766360, "uuid": "199375e8-76d9-4d54-a67c-8bf47c3f81a6", "value": "T1BA411CB520F1187329245640B3331BD5AB72EC53599326CC38DE6A3A6F96F13B1AB421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766360, "uuid": "73a676c5-c087-49b0-98a0-e57f2dc4ca05", "value": "48:cgRu9+OA4R/anB6ghGk7lrmPX3lr8PJYlrF:c2unA3B6v24lhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766360, "uuid": "b44f8136-9964-4f63-929d-db9140836e75", "value": 2015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766360, "uuid": "88b539f1-866a-425f-be06-f557c0fbd3ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766360, "uuid": "0fa2f5eb-3055-43e3-8700-eabf61bb230f", "value": "9be2715d564019eed27ca252949d6003195ae577071651c862f9e66b0d0f7f44.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc59871-1019-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771783894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783894, "uuid": "6269e860-72b4-43f4-bf31-7fc12cc5bb85", "comment": "Malware payload (SantaStealer)", "value": "c919f6e3642f3bebea963a67cba6da51", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783894, "uuid": "dff930ea-0ba2-43a7-8307-b40ed1edfbdf", "comment": "Malware payload (SantaStealer)", "value": "9c35257d055f8f2c16a57a05787775e07acd17508fdbb4b2b06a965b7f11d9ba", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783894, "uuid": "46f4b7ba-2702-4b1e-a84d-74cf2625bf72", "comment": "Malware payload (SantaStealer)", "value": "292b27890f227317ea2f996c567077dde04a0587", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783894, "uuid": "eb52ecd6-e8da-4a2f-94f7-fb9c278dc085", "comment": "Malware payload (SantaStealer)", "value": "f6e00c50dc9c375e27335eeeb936010311683cf30edace470dd5dbd9ace0f796bea0713ffed142c96044a736e9ea7ceb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783894, "uuid": "c92d586e-1d06-4fe2-a94e-169c550c3408", "value": "T1F79623BE2248336CC81CC930A633ED59B2B6211D1BF998A931DBFED07B57464E506F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783894, "uuid": "ccb577a7-3bcd-4a3d-bcd7-452f12494d32", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783894, "uuid": "ad1128c8-5c83-4190-81a6-ef673586b622", "value": "196608:BMM1gUOga0RES8ytlSrhcr+cWY1Xr+fjtM304K2pJkQEyaGqD2cfxdxW8/oRgGId:BMGg+a0REb66cW3jozLKJD2cJdT/oW1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771783894, "uuid": "9025cec4-6f7d-449a-83f7-b5ed48243f0c", "value": 9307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771783894, "uuid": "29eb8bfd-4e08-45a1-876c-b8c4e459aa95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783894, "uuid": "f69cc773-c8cf-4e62-af14-221f77c1f659", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa8c16a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766425, "uuid": "ed46567e-c164-4c22-986e-ce10658c9ed5", "comment": "Malware payload", "value": "9ae8061903719707c4a861261aff2244", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766425, "uuid": "e6153cba-ee9f-41c3-965e-54f5612b5ce4", "comment": "Malware payload", "value": "9da888cb59880f6cf90f2574c56076ae3993a81a8d9f6ee9442131c42a048d5e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766425, "uuid": "ed68768a-6339-4258-b906-838ca88e76b4", "comment": "Malware payload", "value": "181fc58d46d2e95a2beb02f50064848638c19c63", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766425, "uuid": "7a5cc0be-9f6b-4d97-b262-af4ef296b432", "comment": "Malware payload", "value": "35f5711e996b58fba0901b5909d12fa0066cff457d79b8d5bbe1b8e324efe5a0f585c8a8a2017b979a9e9c8c34199c3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766425, "uuid": "27932f1e-1aa9-4da2-8e83-98b631daf49a", "value": "T1C4B137B024F14C773E651545B33767E1BB77AC5305A36388348E1E26AF8AB03B9AF416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766425, "uuid": "fe76defc-8812-4372-8ca3-82b709fbb586", "value": "48:cnRu9+7nB6FWgzlrAW6wlrdWgzlroW+HllrIWmzlrqWzlr5tzlrPtDlritDlrTtV:cRuSB6lZ8ytZAHXoZphnEjFnHd7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766425, "uuid": "7d374efe-ed6b-44ef-8788-9f3599ee24cd", "value": 5524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766425, "uuid": "f14243b3-156e-4ea7-b545-c988eb1ed90e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766425, "uuid": "34051366-a4b6-476e-95e2-880fdacd2110", "value": "9da888cb59880f6cf90f2574c56076ae3993a81a8d9f6ee9442131c42a048d5e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f242f489-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766295, "uuid": "a51f153c-9ebf-4bc6-8ec3-c4779285e975", "comment": "Malware payload", "value": "f27c660fb3e87a0805ed6cb811700fe6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766295, "uuid": "520c1f0f-6574-406f-ba13-ce493b20eb12", "comment": "Malware payload", "value": "9e679a511c5f6192473cf6e98aebcca39e2878690e309e283f90e7b70c56ff15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766295, "uuid": "cafca04b-c75d-4b64-a38c-e5cfeebd8147", "comment": "Malware payload", "value": "33b7b4a4cde2b6fd71d5f3ba23c44d5dbd0ab032", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766295, "uuid": "6826dce6-f102-4099-938b-f671bd96159d", "comment": "Malware payload", "value": "84c62ad19b20442a8803898a2a737df8bfcb73f6808dda4c2a2a6e75424c48e4f578313ddc13a91e2168f29625b5266c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766295, "uuid": "4968fca2-c7cf-48dd-897f-065bc60aaad8", "value": "T18EF1F17B21F08B31D3C021C9526656654E72A75B996A14B8F4BF933ADF2DA0330E7B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766295, "uuid": "896a3a7e-54f0-49b7-a924-08846dfd4628", "value": "96:cCu1B657sht+O+v1fsn+h4+tIicqbA/GsGOMbSm3uC:cCuH65C4hvZ5mzjy+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766295, "uuid": "1a99148e-2ae2-4fa2-aebf-12f3ae827256", "value": 7841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766295, "uuid": "16af4d28-071a-4ac8-9a13-1925e8dcbf8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766295, "uuid": "cf12eea8-23c5-4d7d-a928-e79372d84ea7", "value": "9e679a511c5f6192473cf6e98aebcca39e2878690e309e283f90e7b70c56ff15.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ca5444-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759456, "uuid": "a5698889-ff09-49e0-8d90-eb92d4b0a716", "comment": "Malware payload (Kaiji)", "value": "57748972481676c33918763a14993d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759456, "uuid": "07e37ba6-409b-4d50-86b0-e0b124845519", "comment": "Malware payload (Kaiji)", "value": "9f73a29ebf4031678a74cc3a45e41d741bd70c2000417c1b54fb6a0176d39abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759456, "uuid": "ea7bccef-e6c5-4dde-b775-8e365cd8c5bc", "comment": "Malware payload (Kaiji)", "value": "fdea5e2b2f792cfafe55618d020f82ab9f5fc0a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759456, "uuid": "208c3482-9db5-4f94-ad83-324457fd80e4", "comment": "Malware payload (Kaiji)", "value": "a0642525ec12937832037b502316c010f8b2b0cddfaf47c11fb256d42a14dcc72b4f99100b97777ba75e2f815773d266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759456, "uuid": "47f859e3-cefd-4058-9ac8-ff7b8ab43e92", "value": "T1CB951711F98B54F2E9071A3104AFA26F27319D054F34EBC7EA40BB6AFD776D20932259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759456, "uuid": "d532c5cf-3e0f-4a6b-bc72-75ffb0dfd947", "value": "24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJjTbdYVVMtIwWz1v:WYMnwRO4ssPDd5Wz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759456, "uuid": "150bd7ad-0c31-421e-949b-759fafb97585", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759456, "uuid": "b6b7c6a1-752f-4bbd-bf21-a08cb515f411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759456, "uuid": "85573343-95e3-4ffb-9f7a-bf0da0baf747", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf7cd25-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768997, "uuid": "83a08612-a2cd-42da-936e-b804f300f727", "comment": "Malware payload (Mirai)", "value": "e0d2ed9ae441dc4e7e6fc4062454af44", "object_relation": "md5", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768997, "uuid": "eaf46897-3005-43f1-b5a7-456975c06e24", "comment": "Malware payload (Mirai)", "value": "9f8745447de08ec282c310bfecebfc42a07458251759b33d39fb48a7171b4eda", "object_relation": "sha256", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768997, "uuid": "27344920-fd78-48c8-b612-e0e10d01262f", "comment": "Malware payload (Mirai)", "value": "fd73ea065c83d06c2e9ad8173cb5c5847c0a7c9a", "object_relation": "sha1", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768997, "uuid": "69a07c8b-f4ac-474c-979b-706b44ac1f77", "comment": "Malware payload (Mirai)", "value": "a15616765956fceb8365b86aa222e302ab7ca351ad2b3b7cf173c7b8e50e1923113622a54f89d40388f87ce4a6197041", "object_relation": "sha3-384", "Tag": [ { "name": "arc", "colour": "#C3096D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768997, "uuid": "512c33a6-2687-48eb-b7ea-bfe48a634bb4", "value": "T163B38C8BF38744A0C86286F007CB0FDE6D2322C25F67A5E36D6A66395E750DF0A05BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768997, "uuid": "7ed1fa71-8aba-4fc5-8f19-75fec91f4e10", "value": "1536:AmpTaTiE3oFI7PpO6QC7lZpg+SO5XgG//LWSY:ASgTII7P89C7Rg+S+gG/qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768997, "uuid": "254f7aa1-efd4-4c9c-aa4f-3586b72549b1", "value": 116072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768997, "uuid": "76369c04-fd4e-4b13-8094-d794d276802a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768997, "uuid": "98a489e3-1615-4c05-b3d7-547275bc784a", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289cfd98-100a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771777124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777124, "uuid": "b99b3674-3c46-4ecc-99a1-de9d50d4cbf3", "comment": "Malware payload (Mirai)", "value": "0ed981cf99b94650110635c9198f54cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777124, "uuid": "d6bbda52-fb03-4601-bd87-2d53b3531c21", "comment": "Malware payload (Mirai)", "value": "9f9506f604eda3b3875196fac23bb2f89ed1850b1c425d3c75411103e1d8a6a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777124, "uuid": "0694488c-3819-4474-a771-2cb6b89dbb65", "comment": "Malware payload (Mirai)", "value": "67ac5bfb84ab3e5a361b077d76fd03ee2e90c3a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777124, "uuid": "ed845249-4ba9-4d1b-9796-a387f489f72e", "comment": "Malware payload (Mirai)", "value": "d8328a157f9fb643147790b2f5fbf4aa38cf33c7b63ef3be63cbe2598a15a6d6f0fa30111e868deff5a7d029053ae17c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777124, "uuid": "6305810b-70ca-469b-a5ae-41c6eb6b9462", "value": "T12F243A46EA408F13C0D727BAF69F4245332397A4D3E77306A924ABB43F8779E4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777124, "uuid": "ece4cef3-1050-4d85-bfa5-bcd8c08498e5", "value": "6144:ZTK8jctNpI/FbavOA3zHJT14j2lggI3theM/R9m12JLGhQH:hKN4/FbavOA3zHN+i/ShX/fm1sLGhQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771777124, "uuid": "8988d7ed-9615-466c-be04-655da98045b6", "value": 219690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771777124, "uuid": "615b8d8b-ee11-4a91-aad7-312ebd2f5b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777124, "uuid": "57b29174-9988-4c2e-97bb-7a9be4e644b5", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5473bd-1024-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771788434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788434, "uuid": "80cad8b1-bd33-4c1a-8f70-efb44633db92", "comment": "Malware payload", "value": "eb24d7e2230f311e35c5275a23ecf1cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788434, "uuid": "2e95b4f8-0626-48f3-8940-225862d5977a", "comment": "Malware payload", "value": "9f98cb6433591c6ad46051bb926e5230d0b0c43d8fb6bd4a8ecff6d10937112c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788434, "uuid": "6afb820e-ab3c-4285-ad62-c2eb0f747af1", "comment": "Malware payload", "value": "3512e927dcaf3faaa76866e64855571a501128d3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788434, "uuid": "ef5690cd-b815-4fb5-95e2-a2c08bcfba72", "comment": "Malware payload", "value": "35f9e805b4b25398b3aba183d2a079e80ee4943ce4726b06521b40e2f5005a7acdac41dfbbd5a44551f72d4f933c8ee5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788434, "uuid": "573f90d3-d506-40bf-89c5-6cffb7557ecb", "value": "T10BA1418778A266302B8B807A5B4D65827587022F1424AC5CB59EFC306F785B4F2F9FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788434, "uuid": "67c536a5-aad3-458f-9340-c71cc0b63350", "value": "96:/fL1FczktwyfRVjRivaIHgf60sxJZy9r4SfVzuGDg58uL/uL5xBW:HszTyfRVQfxm0StiGUmxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788434, "uuid": "dbc7b468-7d0a-4c8d-a22e-8331f71f2c67", "value": 4947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788434, "uuid": "ea1b2539-327b-4e36-b987-d2e8ba1427fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788434, "uuid": "64f38c02-9449-4ae8-9d5c-3c800fe9849b", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1336b241-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766350, "uuid": "abc58bd2-1cd1-47fa-b2d7-748aeee6d878", "comment": "Malware payload", "value": "6dfb4352b15e12ef040cac8b74bd8015", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766350, "uuid": "043b9cfe-7dd1-4d76-9875-09d67ec0a7df", "comment": "Malware payload", "value": "9fb4b026b6295176b801cd3f1815093042260a27afb9b38fd7a7546a822ea578", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766350, "uuid": "07b2525c-24f8-4345-be4f-c71a54f7f88a", "comment": "Malware payload", "value": "31fbcc56141810b5b8b6d802ff21aaffbd166325", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766350, "uuid": "75dea783-afe0-4e7b-8625-b33009dbd7d0", "comment": "Malware payload", "value": "6a3c5be1c47ef8e145ed92512a0fc6b9631f6ff4ee82c6adc23fbb2fb344910958a6be5858fe35ec0ffdc93974fcffc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766350, "uuid": "b4db3dbe-eabb-47b8-b165-37a2d79eae1b", "value": "T152325B3721F08B72D7D021C8A26716A55F76A60B456714B8F4BF1A399F5EB0370EBB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766350, "uuid": "d407d345-f19f-48df-a6f0-2895f780b838", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGs9WXYUvIynt6fM6ft6f96f8TH+:cCuOC4hvZ5mzjy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766350, "uuid": "6d5ea0fc-ae9a-4515-9280-29deba963d96", "value": 11139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766350, "uuid": "4e2c3bfe-9552-4023-8827-49fbc382ee80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766350, "uuid": "811f5671-2b04-41e8-9016-11bac1abfae3", "value": "9fb4b026b6295176b801cd3f1815093042260a27afb9b38fd7a7546a822ea578.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6efb7c-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771788, "uuid": "2f0aabc4-41ae-45c4-b12f-f4ee38b7c08f", "comment": "Malware payload (Mirai)", "value": "61d13a09a9fdd0ebfc89bb2eca95117e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771788, "uuid": "754b4aaa-46eb-4adf-adcc-b0145fbcd8b0", "comment": "Malware payload (Mirai)", "value": "9fbd9afe9593e557a71687a9509da9b90788f7a95e0eff7ff79691e3d6bf4673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771788, "uuid": "cde7977f-9201-45c5-ba50-ba0a13bbe65d", "comment": "Malware payload (Mirai)", "value": "84a1639ee052a47c29d9cd5d7c02a7a5f6febe9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771788, "uuid": "e78710c0-b877-4ce6-bb1a-fe0ba2ec7f3e", "comment": "Malware payload (Mirai)", "value": "141dcca7a87b662879ce18fb7984ead2172ef2e42c601486a26eef26ce0c7071730447b8eeb11d88e24d4f175bbdc077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771788, "uuid": "c33b5e2a-8f04-43d8-b592-3d71b359b406", "value": "T1D103F112CEE65E2D97A979766CFEAF4C0854130C8864EF37E6E6386B0922F501939483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771788, "uuid": "57786124-2817-4a37-8002-97a52555ddd5", "value": "768:wF4H3lUrTc2nLZPsivlGXRRYPyU7DI79XXDvoZ0ipe8Rg+GHdfM9nbcuyD7UHQRl:mY3MPLhbWRY1IRHDgZBKfM9nouy8Hyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771788, "uuid": "4bc650e0-1aea-4c98-a100-441cdfa8a5b5", "value": 40580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771788, "uuid": "ff4e7b8f-a352-4fba-974e-e05862dc212b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771788, "uuid": "cf712367-ad9f-4bdd-8898-3cb8a2b78cd2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7561bf4a-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790567, "uuid": "eb4e1ddf-b56f-4436-a06a-d46d0b460a72", "comment": "Malware payload (Mirai)", "value": "067d41ae40d4f7f4cd2f4a0ba61a2b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790567, "uuid": "9705ec0d-32e2-406e-b187-184c4a8bb5bb", "comment": "Malware payload (Mirai)", "value": "a00637ebf8cce62c632c73fb585aeae27381b734ea09de6e4dcdfdf89540d82a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790567, "uuid": "a6e78bb7-e3b5-474f-b4d5-f96af471d81f", "comment": "Malware payload (Mirai)", "value": "6b7dfe38c59dd6c0cd57588ce0b2989f433f3e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790567, "uuid": "62836553-2edf-4552-8fbc-5d89e9cb6125", "comment": "Malware payload (Mirai)", "value": "4ea47861e28c24a1d25ce09268a761170e5b7440e265d1295bbd0ad31dd6227881921f0584f8253d5a6bd24975b52c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790567, "uuid": "20171772-a280-471c-933b-31d005e89ef4", "value": "T144731A93F900FF7DF80BD63949D21A0AA728AE47DA53161A7327799758372C12C17A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790567, "uuid": "2d97c725-2629-49ff-ada3-de3ec3883949", "value": "1536:5oTR3agJzmAXC9HpCndZ+ShTk/Y5C5RJgh4JIhU8gk6L7r:5od3aCXC9HpCndEatwDJyqk6Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790567, "uuid": "370313a4-60d8-4e60-aee3-55ebb97ce5d1", "value": 79755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790567, "uuid": "8962dc99-48af-4a14-afb6-dad6b96c4c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790567, "uuid": "ddbba04f-b273-4f98-9f59-ea222297dab0", "value": "kt12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832b0377-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771770833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770833, "uuid": "a59bf315-60dc-4a6c-a729-9bc5059a22a6", "comment": "Malware payload", "value": "a85524981223406c8f66ae4b5429015b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770833, "uuid": "ae949f12-2bec-4883-b2da-1be1814c8fad", "comment": "Malware payload", "value": "a020f181a5d60da5ed907d9693e9ea6537ce5a7aef041c16dbaac68561dd7ae7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770833, "uuid": "7de150d6-c41b-4600-a53a-654bd75dc9be", "comment": "Malware payload", "value": "e410b229993585c9e9769ffa1003b80697bc181a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770833, "uuid": "01f06a74-bff1-46f3-83ae-276e80086545", "comment": "Malware payload", "value": "57d941ad85627816dd4e8681da6dc315d3553a2670476623eab4f23ae80ce31175f522f7f5e279d98ed3d348a27c024b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770833, "uuid": "6fe91765-c668-4e17-9918-bad5151e830c", "value": "T185E55B075CE199A5C59FA335A8A26186BB30BC040B3233D32F917A766E367C45E37B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770833, "uuid": "8ba70552-84f7-4da6-8583-e00738a72d22", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770833, "uuid": "300c338f-7c8f-474c-8dc2-23bd141319e5", "value": "24576:Ihq0y5KNL9rMnqIfdXEFDMkYzYofN7BYOQdLXPjs2LjmbA4GS3qhelet29m9c+fx:IhfyYNLcTfd6K7flBFY6Faffziv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770833, "uuid": "85dbb2a0-4598-47d9-ad12-bdeccce4efa4", "value": 3148288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770833, "uuid": "a3bed25d-233b-46fb-a8fb-b1b300508cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770833, "uuid": "add7d2de-c684-4b74-b1be-e39fa806b9dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42159fa5-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778455, "uuid": "a5328a89-1983-43b9-ad47-2f54e7cac23a", "comment": "Malware payload", "value": "7a54d2ac0996e420be706667bb61507d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778455, "uuid": "edf376b4-5456-4c8a-a0f0-7fe688436a75", "comment": "Malware payload", "value": "a03e022e231731959c9e37b09927232817223d8b815bd6457bc81edebfc04519", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778455, "uuid": "9906f170-5cba-44f2-b400-0d01f1b2ef5d", "comment": "Malware payload", "value": "8b1d14fd2a93b304b798bdff26631d2f19195d66", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778455, "uuid": "f276328a-d13a-4574-8e18-b8ee4c7bbdbc", "comment": "Malware payload", "value": "b3da7fd3ec3134f17cc547a3c024d869f048fdecac64cd415f6d2e4b201afaa359c0af25b74ef866d2672696e88f3db8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778455, "uuid": "ee233849-b67b-437f-ba85-b94f7f1456ed", "value": "T150412C7421F20C332A212684B3371B657F76DC474993618C39EE2D29BF97F16A5AB001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778455, "uuid": "dc3dbbca-cf1f-4c87-8eb6-9eb995823628", "value": "24:chnRUR8fARW5wgH9HHIuCzCRpYdZetuX56KLUlDHr4+YWIyK9lc9HHESkZWglDHF:chRu9RLQnB6gtuXqlrvwx9lwn8ZLlrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778455, "uuid": "22ce412a-ab83-4823-805e-40fe40aae0df", "value": 1922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778455, "uuid": "8b5dd074-947b-4ad3-bf8c-25e161274ae7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778455, "uuid": "6191641d-0fae-4772-9a26-91fe333d687f", "value": "a03e022e231731959c9e37b09927232817223d8b815bd6457bc81edebfc04519.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73ddae9-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771769310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769310, "uuid": "650254bd-50e8-4212-825e-df521534d5a7", "comment": "Malware payload (ConnectWise)", "value": "1759c6efb44333a97b28287d7ed55eff", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "msi?e=access&y=guest&t=rado-x-inc", "colour": "#AC3C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769310, "uuid": "04d9f7a6-44c3-41e8-a9eb-84c7441f8eaf", "comment": "Malware payload (ConnectWise)", "value": "a050c3b46946e473efff8c35828df5c60a2924cf5dcccfc04c69ccb92e02b6cb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "msi?e=access&y=guest&t=rado-x-inc", "colour": "#AC3C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769310, "uuid": "2f1bd231-6366-4870-a0dd-0ba6b16ae0ca", "comment": "Malware payload (ConnectWise)", "value": "6f0c030c516051d053efcfd51002854890e44438", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "msi?e=access&y=guest&t=rado-x-inc", "colour": "#AC3C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769310, "uuid": "cdc64e2e-0125-4310-914b-9aba17a224ce", "comment": "Malware payload (ConnectWise)", "value": "30a42bb570d1e6b19c081b9c52232a12d89d7ff2405082373ea9b707725c6a073d5309eb1314796186ad709997a4cb1f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "msi?e=access&y=guest&t=rado-x-inc", "colour": "#AC3C5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769310, "uuid": "c1c6f76d-757f-4098-8f02-aa59f05e86ad", "value": "T15AD623116BF89268F1F22E39E876A071A5377C515E22D12E2328791E2D75EC0C9B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769310, "uuid": "f47940e8-edc0-4971-ae8b-ce095d93e2f6", "value": "196608:WHxcp9ym3nltDUJVdHxcp9ym3EHxcp9ym3VHxcp9ym3aHxcp9ym3QHxcp9ym3vH3:kGplpSGpiGpHGpoGp+Gp5Gpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769310, "uuid": "9754f398-62cc-4358-906b-505e6e703a02", "value": 13451264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769310, "uuid": "d4e4b559-b253-4105-92c3-eb69275950bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769310, "uuid": "a7966ae3-cad6-4666-85e3-11b7c2f401af", "value": "ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=RADO-X-INC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734443cf-1047-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771803448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803448, "uuid": "388a07ed-03cf-4f68-90b1-f8d4a8711b14", "comment": "Malware payload (Mirai)", "value": "36038f4effbafe97912f38bd5a1d34ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803448, "uuid": "85d3e34b-e3cc-4e80-b68e-40cee311ea23", "comment": "Malware payload (Mirai)", "value": "a0ff3ef26171e3ed9f61df9a94e3da176f09f0c09bab3fa28d3fe03373463a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803448, "uuid": "386fa97c-7434-4e82-a635-8324efe0a312", "comment": "Malware payload (Mirai)", "value": "9f0d70f929236b1d8e87fe1c91b756180c5bfe9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803448, "uuid": "e6fdf16f-803d-45d1-a169-587157673568", "comment": "Malware payload (Mirai)", "value": "42123cf8a330261707a0452e38d31d4344391b4719cef7e2b5a7d9528b4359852c594a0676d34ab57a0f4a6ceaa3c35f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803448, "uuid": "f9cd153b-bb46-4b19-a2c9-56d2e8d57e82", "value": "T18D156C5BB2B374BDC057C43443ABDAB2A935B42902226E7B65C4D7303E17E701B1AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803448, "uuid": "b464bc30-a6a7-47e1-a8d4-c4ef02e61483", "value": "12288:ZyPboByW/Gc4sd0D/YkBy+KEBrTvJkvEZWtcJOLh5axjK4iNEE0bdzuF9rbJy1q+:OSt4sLkBy+zpRksZWtcOLh5z3EVc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771803448, "uuid": "a5a4633c-a617-4d44-9350-930237875bb5", "value": 890600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771803448, "uuid": "96c5ca0a-5bf0-4480-af66-47c1f62ed019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803448, "uuid": "a03c8f57-cc9e-48d7-b6c2-b87811cb6669", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad6b684-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766417, "uuid": "8ed49103-8426-4e7c-9b69-f1d03c7875fe", "comment": "Malware payload", "value": "7ec92f8596c70e9ccaefe77e5f011538", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766417, "uuid": "76522a02-2228-4167-a98d-95f4f4b58eac", "comment": "Malware payload", "value": "a12b90d200741ceb4971909014bcdbd3374df504515a55519963092f4b947b9f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766417, "uuid": "62c6169a-7804-4a8d-b88e-987c89993506", "comment": "Malware payload", "value": "9f310ca929aa77deb251f5e8cf591a252db2ae9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766417, "uuid": "7e363550-892a-4ad8-89c8-ff4e24249887", "comment": "Malware payload", "value": "3f9683a51eb8fd52a334a79169d994764d4e79af07a4ae0dec0df7843984e7142da268476da5eb5e031d51c92ef1be07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766417, "uuid": "22f7a4da-bd47-498a-acfa-fd3d33204ea7", "value": "T1CD914D7025F14D332E10AA40B3772BA27BB2D85349A3658C35DE1D35AFC6B52B5BE015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766417, "uuid": "82cdda76-9a0f-45af-9df9-014a1cb552d7", "value": "48:cnRu9RDdvnSfranB6qcRAb0lrl5R4lrkKRUGlrEHR1Blr+6RBs0vlr3v5JIrlroI:cRu3k0B6MqUbo2kf7IBiIBFIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766417, "uuid": "00490611-cfad-4f16-81e6-8e9a2e3ee2c1", "value": 4208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766417, "uuid": "c39a8ada-617f-484d-a661-df1de4de7a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766417, "uuid": "51ced9dc-9d2b-430b-9aa6-5f266ffa28fc", "value": "a12b90d200741ceb4971909014bcdbd3374df504515a55519963092f4b947b9f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b273e932-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752444, "uuid": "9bd82bfc-3403-4d9d-8b4d-df3f66d769c1", "comment": "Malware payload (Mirai)", "value": "71f1d1a49346cda47ba641953ab4ebfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752444, "uuid": "c48e23fb-672b-4880-bbb7-645939fa80e9", "comment": "Malware payload (Mirai)", "value": "a147cbde451e4a8a0c461c0e969d733d83abf5daae8ea15616da8bd7daa9cfc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752444, "uuid": "89c51167-fed5-46eb-9709-1ecee43492b0", "comment": "Malware payload (Mirai)", "value": "8c6fc0b2da7f1934bddf8dc5409e44701829269e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752444, "uuid": "cb853675-ba3a-401a-bfa7-f83e53d17601", "comment": "Malware payload (Mirai)", "value": "bf9a3af59adcbd9203395847743f5a044c6a6b6fd8f4af0a77acc45bfd4e056f28454536c362af8878ea53e034a757ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752444, "uuid": "0c1507fd-a332-4709-beba-22cf5feaa13e", "value": "T120510887127255B43CE29DBE72B51514F280E4692DC69DEDECD93AF48ACCE08229D783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752444, "uuid": "123e69a7-cfac-4a2c-9d7b-3f154f248801", "value": "24:vh/3/gh/0l/0bikh/5P/5Hyh/x2/xynh/xTQ/xTYh/+/Ch/is/N3Ch/5pj/5Oh/P:vWiObsXaYXsktcwCBUNU3Ush7kKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752444, "uuid": "e2afae65-5f59-4ceb-b388-fa8decb16fed", "value": 2670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752444, "uuid": "aaebd8da-b290-43f2-b08e-23a542a52854", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752444, "uuid": "b65655b0-7310-4df0-a4a1-4944e085b61a", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3cea1e-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766315, "uuid": "eeda5499-f12b-4103-af3e-499d87ddbe7e", "comment": "Malware payload", "value": "1f782a0eb04c3852316b234703bd8bf0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766315, "uuid": "4bedd082-658d-45c6-b5e6-22253bbf7f96", "comment": "Malware payload", "value": "a148452aa349d84efccab96b21cca5d74c1179ddf990ffff647310df88069d01", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766315, "uuid": "ef061c31-dbf3-4afd-920b-a09635083dca", "comment": "Malware payload", "value": "ec15be98aff8aa0c8c73b43e2c75abc2e3d8c679", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766315, "uuid": "62072b0d-8858-4813-9cb1-4618d1a80f0f", "comment": "Malware payload", "value": "038e4fcd854dc6d2b82f5493ef7beb83d456e4a48cac7314387cc1d0c284cdc256d52635b57f1cd9d526e9ad2fe49d90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766315, "uuid": "21d6f958-1877-456b-b315-c54e747a5021", "value": "T194928B7A20F14A33969056E4B3B31B904F739657459321A8F8BD2A365F1DB0374EBB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766315, "uuid": "21261b2c-c032-48b4-82b1-9199b93fae26", "value": "96:cCuisht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjH8TitVl4JLRTl7RGdEj87b:cCu34hvZ5mN9oKNpivT8GtNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766315, "uuid": "46f0e50a-0392-4d95-ab21-f1d67bb6c27a", "value": 19374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766315, "uuid": "6195c419-2dd9-4ced-8874-d6629ffe9648", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766315, "uuid": "e3a148d4-88bc-49fb-b129-688665584b3a", "value": "a148452aa349d84efccab96b21cca5d74c1179ddf990ffff647310df88069d01.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ef9874-1003-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1771774408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774408, "uuid": "fe306532-290d-43d4-85ee-3b6ef97e7f2f", "comment": "Malware payload (LummaStealer)", "value": "fe2f21aa88a58266aaadff3ab241b61a", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774408, "uuid": "231f6990-93aa-4786-af5c-31cb89db0509", "comment": "Malware payload (LummaStealer)", "value": "a1575e3c71357ccdfbf673eed389b2a70a775560e35db0d8222169f14f7a7675", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774408, "uuid": "b0684805-48c9-4452-a8dc-eb11eb696a34", "comment": "Malware payload (LummaStealer)", "value": "5c701d0b9eeae82c7fbd536fb23d1afc253f3c76", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774408, "uuid": "ef744456-7154-4759-9389-1169af7bd504", "comment": "Malware payload (LummaStealer)", "value": "0161d305f7ca0f7680a1983d41d11f0e6e6b11abbdb6e0410ca0f9750abe370b93b6d32a0c3b509d41df613043062d8e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774408, "uuid": "9eb06121-f986-4fbb-8af5-4c29423f399b", "value": "T149B51342A9A0D497C5790330C4A1FBF28137FFF5BB24995F52C8BDA735B2AC05A60E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774408, "uuid": "6456edf7-92e6-4821-8cef-3cb334c6fd7b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774408, "uuid": "74c0cdfb-3bd2-457a-adfd-53b09e682be8", "value": "49152:cpKvpKx9a8NX/AiVmG6Ci6uBFFsroaMKryX4crFbKqC375KQe:cpKvpKx9a8NvP36suBTstGocxb1C3tle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774408, "uuid": "a8e10274-b2bc-4e04-9490-1cd4b18633da", "value": 2381824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774408, "uuid": "d92be02a-4bd0-464e-b7a0-d36b9f25ef4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774408, "uuid": "a7f69bcd-6112-44f4-a93a-b27424f22ad6", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312fc17-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800227, "uuid": "5ae5d34d-eedf-4da4-a642-8a35219ee17f", "comment": "Malware payload (AsyncRAT)", "value": "aa3e744af4968897f952836c3db7e1b2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800227, "uuid": "59963daf-6e05-430d-8f8e-b6b4e661d1ea", "comment": "Malware payload (AsyncRAT)", "value": "a18bd7b115350e8efae868b10d2ffd1de6ceeb7f06f77563514f357116c933c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800227, "uuid": "42aebfab-6420-47bc-a6d2-62489ac553e4", "comment": "Malware payload (AsyncRAT)", "value": "0eb56b794bb0d2fd9e8ac6fa47d8b3147c218011", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800227, "uuid": "052f0a29-94d4-4434-b80c-19b4b9fa2825", "comment": "Malware payload (AsyncRAT)", "value": "467399b9a25784100f0b5c1351c64d386ec09e9c8a7bdf31b7f99195d999ae5d112ddb25d356f28b18d82668c023604f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800227, "uuid": "d92d2f0c-0d0b-47a8-b9a1-27178529643c", "value": "T199232A143BE99226E2FE9F7959F11646C67EF6132602D74B1CC002CE4A23BC6DA127F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800227, "uuid": "1756f383-150c-414d-af2a-45d7d2b95f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800227, "uuid": "576d1918-4642-456e-9a83-c386eb37c5b9", "value": "768:eseYofWG0cve172fE9enm51a5vXJlHAeb17gUptw5MmrAK8Rcc/rWBN9F:y0c42fnna1MFxbCU3wMmrvYcQ29F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800227, "uuid": "9428813b-5e87-4a90-b1e9-c03e4db5b6e2", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800227, "uuid": "efcbca49-a6b6-4050-8b76-221060ff8f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800227, "uuid": "3f5cc6ea-44ae-49e7-a16a-1cb176d6f4af", "value": "gv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75615a9-0ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768022, "uuid": "34bee3f3-f797-4bb4-ace9-56ebe5995549", "comment": "Malware payload (Mirai)", "value": "02a736a86ad5858924c6333643dc1025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768022, "uuid": "05f13104-c798-4976-a6e2-06243ab64c0d", "comment": "Malware payload (Mirai)", "value": "a1f96b747ae6e1c3bf80ae5894769599cabf34bb7f6b9dcb4cfa601a45fffa28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768022, "uuid": "f9c55abc-1da7-4d40-9e03-dcc32578d429", "comment": "Malware payload (Mirai)", "value": "0419fdae8f5cc814acd21d11cbdfaa9702cd6a94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768022, "uuid": "eb722027-ab2b-478d-bc2b-a4618ff01f9e", "comment": "Malware payload (Mirai)", "value": "bc237728777633403580bef4e4fd09d7fc545f91f4d384aea7228a632fb1a82c0c8da807714acf7054288d7e884ed82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768022, "uuid": "f8b313e6-b026-46cb-885a-878e47dd3446", "value": "T1B6B2D03471A8A0F0CD316434F97DC943AB9B45FDD0F97721366600F89B9A88D26E8AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768022, "uuid": "d48e9748-27f6-4df8-be00-6e4eb5f18914", "value": "384:qoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1+hymdGUop5hF:2aNSq5sOHpTqncvsdDePiAUgefoeDeXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768022, "uuid": "adc29a98-c7d6-405e-913f-6fccf536efb1", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768022, "uuid": "3147db80-5f88-4197-9db9-3e5bd90607a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768022, "uuid": "20b412bc-4347-48d6-8db0-b1be7f8dacc8", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39952bf-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771788148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788148, "uuid": "fb80dc44-1dbd-46bd-b8d6-17c35434a08d", "comment": "Malware payload (Mirai)", "value": "25888bb116e8d251831dd811619a7a70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788148, "uuid": "f0567fce-d3f8-4b70-ad91-a8e1df519f2a", "comment": "Malware payload (Mirai)", "value": "a2ab991be378f41d5529a84239f35adf7155bcf16bdd4f8135615e9d35b34c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788148, "uuid": "031ffe64-f2f0-469f-bf9d-fd72377a8aac", "comment": "Malware payload (Mirai)", "value": "8778257f82c472410d4e5aba39714aeb28c2559e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788148, "uuid": "6b9f96e0-4b5f-44f7-810f-89d43f4c06a6", "comment": "Malware payload (Mirai)", "value": "c637bd141f4b25e952637c7c2d46611839df451f6f8d60f8e1137bc47650ea89a148805878e6002a5cbe932ef0ad38d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788148, "uuid": "646b510c-165f-430d-a9db-b514a0c64b9a", "value": "T1B3837DC66A43C0F4EE2604712077FB325673E63D0069ED43DB69E932ED52642A66B3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788148, "uuid": "09867859-bf24-4b7d-8d7a-8e7a459b0edc", "value": "1536:nct1qAVNoPgozCOf++nNH83VkOkLkCG6bizp1E:+UAVURzbfnH83VjkICGuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788148, "uuid": "597ce6f5-8d49-4a35-a8d2-48c877ae8771", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788148, "uuid": "7cc533c7-f5e3-46dd-8634-752eb9e4284f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788148, "uuid": "5468c116-3676-4b90-9e50-edb81686209d", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708cd9d9-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752334, "uuid": "5a6e171a-96a7-46fa-94e5-faf96767555a", "comment": "Malware payload (Mirai)", "value": "bca61daf0979151ca40a38d3b6af4841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752334, "uuid": "4c096f02-7e48-4c52-b09d-86252d8d79c8", "comment": "Malware payload (Mirai)", "value": "a2af8fee20e7a601036388b1770e3e2ba077e7eb3ebe93ff47fd14af2799fb91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752334, "uuid": "443fe12d-347e-44a4-8fd6-ec9c42bca188", "comment": "Malware payload (Mirai)", "value": "f086ada523893be950473d9235b37e35779fac9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752334, "uuid": "496c49be-a2d0-498f-a87e-7d67f9eb08d9", "comment": "Malware payload (Mirai)", "value": "499ea4acdc05f82c645bb557a05e47e895cd15387c4e36ad202ddf6355f709d2ea91564069a2e2c35d78c81f77d77f3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752334, "uuid": "bbb60022-b2a8-467a-befb-1cf7b7711720", "value": "T1E993280379C080FCC89AC13446AFA636D863F43D1239B25F27D4EA267E99E502F6D695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752334, "uuid": "05d618ad-1b5e-4059-b22a-ad9f87d0b5c0", "value": "1536:APeuH8xmeaU4/dYnJ4CXsuOfCYkE8Xu1l10B4n4TxanJhTpRETdCoFQ:AlEmJU4/UiCXs9EEh1l10B41nJhTPSoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752334, "uuid": "f1edd9d3-f4f9-48fb-b47b-ff420299d749", "value": 93760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752334, "uuid": "e2fcc8e7-7f5e-4037-984f-2b7bceb0cfd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752334, "uuid": "2660d71d-db38-4e59-b673-47319a421374", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c865649-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784029, "uuid": "7eaba227-bbd9-4990-af03-0821aa9b1dc9", "comment": "Malware payload", "value": "2da00e62c1f064a4c23137f5eb439c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784029, "uuid": "9c57dec4-534f-451a-8661-27573942293b", "comment": "Malware payload", "value": "a2bafb5367ea1de0349c20bd59c95ab5143a174c7deeecf1c6bbb012bcd6bcbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784029, "uuid": "091da9d9-118b-4f9c-84e6-f1c1b1e1f613", "comment": "Malware payload", "value": "bcd20ed9ba3a42f506060c58510299486eba5f77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784029, "uuid": "fdf40f4e-0f1b-4349-a2b3-08da04a86509", "comment": "Malware payload", "value": "5e2bb962c6bf6bb92f961b80b8ceba2b9c2e2325b3ece6eb46d657fffe1c3fef81ac015cba8c53978218e8501608230f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784029, "uuid": "d8acdf14-1fc5-4707-87bf-2458ac3dad4c", "value": "T177F4C02013F8826ED5BD1771F0B0542D46F6F60A3EB0DBAE9F42948F3622B41E555BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784029, "uuid": "1073ba39-545b-4611-a795-62767439c52d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784029, "uuid": "9923ac7d-ba11-494b-b7a4-a15e7d7c4c0a", "value": "12288:D1nxXSW8YdocZbsm7PHZxsDDMOMfyTyJxtXotYNLNOb79qpnsBOGXe20bRLqLFbE:D1nhsYdB9sg/ZCDD6OyJxRoCNLsVqpnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784029, "uuid": "e90fdc62-c7c0-4a93-91e4-381300a2ff04", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784029, "uuid": "2ecfbd42-ce08-4dad-80a0-64ed2f6ae3b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784029, "uuid": "a6f82722-a069-4c4d-b878-0b862d07e5b8", "value": "Inveigh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5108c85f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766454, "uuid": "2d5d9a4e-5d26-4be4-9fb5-449d74208186", "comment": "Malware payload", "value": "e95d6050431b86c0639fd10b0f5a2457", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766454, "uuid": "43dfebe8-ea5e-4f65-a760-31763e237968", "comment": "Malware payload", "value": "a2ec21c77fc0ad318efadc8a5accd1d0ed42ccc46b02a15f12a75b11c2ab8aae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766454, "uuid": "62c35754-f57d-4248-82dd-a5e8cea83d09", "comment": "Malware payload", "value": "bad379473efbe31a128f2be2afade4b6f0114167", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766454, "uuid": "04b44b85-c551-4299-9e51-f1e655683feb", "comment": "Malware payload", "value": "e0f0505862ddaed46cd7e42a9a399000e5b637ec6efcbabf30afc98597b1d5663a1d84340f8f9e56a3dc45cfdf00ca1f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766454, "uuid": "6c0813c5-fe83-4347-a67c-e4030a082a8f", "value": "T17562563721F04B3297D415C8A3671BA54F76A60B456724B8F4BE5B399F1DA0370EBB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766454, "uuid": "76a16c6f-7b48-4e84-8e65-83b22f688906", "value": "96:cCuolB6Lsht+O+v1fsn+h4+tIiKkC1ymyRyzuKNpUj4waYvjJlVv38Zo8zJwD6fW:cCua6S4hvZ5mN9i/KNpiv2ZkvsMQ+Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766454, "uuid": "ef61074d-a53b-4f6c-a7c9-bbceace5fa95", "value": 15721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766454, "uuid": "a2f31749-2345-4cd9-a6a4-c4f06841c5cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766454, "uuid": "72509414-9170-46bf-9a66-de678dd79467", "value": "a2ec21c77fc0ad318efadc8a5accd1d0ed42ccc46b02a15f12a75b11c2ab8aae.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8331d79a-1024-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771788443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788443, "uuid": "d84a4f9f-292d-4c31-b3fb-bd40de6c91a3", "comment": "Malware payload", "value": "a180f19431dd6257bca7cfb987e57728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788443, "uuid": "60aebeb1-38b2-40cf-b63b-78deb9e55951", "comment": "Malware payload", "value": "a33c9ff72d31fcdb9ef40e91114ea6ceb60512fd4630eb7b90504d3e36e57bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788443, "uuid": "32528945-9cfe-462e-894f-c81d6ea82d1b", "comment": "Malware payload", "value": "117eabc5d7c97bebe51d4d25fc83bf8f51bedb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771788443, "uuid": "fe32f441-67ae-4a6e-a7f3-f046ede6d9a0", "comment": "Malware payload", "value": "898184a1f9880a04b718a9e095bf69b1a2b8a0c370492de3c469b15d1cc2e5f7a31d572a59a0e5de3c782a1ea127f4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788443, "uuid": "0c47c644-fc05-426b-b9dc-07361f10afc1", "value": "T15DC4C40CFE91F805DE1E3DB7CFEA11004B7165C1AE2195422149AFFE8B663B259E627C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788443, "uuid": "0c64029f-8c65-4d09-a8c2-5ea9e9510c42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788443, "uuid": "85939281-faae-49d7-832b-0fc6d847a965", "value": "6144:bS6Huwakm2/Pwuxkdhe6VlWT8b9Izudsu2xmz3zSFs5bKLhY3uUuE0izoB:O6HbvQJPVle8Vr2sPSjVUulko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771788443, "uuid": "f2de8fc2-a578-460e-bd93-928f096fc7ed", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771788443, "uuid": "b996e3d5-f55f-4979-bead-29e5e23025fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771788443, "uuid": "5561fe56-a0f6-477f-bb99-63639c552bb3", "value": "11213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a014c0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766438, "uuid": "a3771045-f91c-4457-8675-d4b06a8558e2", "comment": "Malware payload", "value": "fc6a891b25b8d75be65cf6be9c027ca4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766438, "uuid": "7f2a47c1-090d-4930-9d94-0d14c2536f9f", "comment": "Malware payload", "value": "a3f39650c54aa6305dd65562373a5d3c11b4cec4e76305a6997dfc89ddd3d554", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766438, "uuid": "235064b2-5362-4a9a-9c77-cbe7003bfe86", "comment": "Malware payload", "value": "d00c9c4f8e5c50a63edbe5e6e9f861e75d0d199c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766438, "uuid": "de659a9a-f6a4-4479-bfcd-11618c37dabf", "comment": "Malware payload", "value": "feaff2528e9c52b770e61545709a65b5693d5fb3376ae2d387d0463abd744a11e1f6646fb3e75169e916977610caa9c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766438, "uuid": "d72f4708-2716-4bd8-bcdd-0e7bf63efec2", "value": "T1DB32927125F20C333A705984B2772BA2AB76D95385E7318C35DE2E266F86F02B1AB511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766438, "uuid": "ff0e5606-01c7-49f4-b5a1-e8f108447063", "value": "96:cRu/B6wNc2XJRxG22eeFwx4xrsVYAtgmS6SuSFQg6bMoo:cRuJ6MLf9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766438, "uuid": "21d07f76-8447-4df7-b5dd-1cd6fcbe84c1", "value": 11084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766438, "uuid": "07ee4e61-cb29-4615-aa49-e5efd6df6c7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766438, "uuid": "86c20c83-2d41-499d-95cc-8ec18bd41e4c", "value": "a3f39650c54aa6305dd65562373a5d3c11b4cec4e76305a6997dfc89ddd3d554.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e589e4f6-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752530, "uuid": "dd2c94b7-d946-41c4-953d-841f4705b539", "comment": "Malware payload (Mirai)", "value": "c7cfb3079f3196fd052f6fff092c3d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752530, "uuid": "20371057-74eb-4647-9745-7a96dafd655f", "comment": "Malware payload (Mirai)", "value": "a412e9d4b89be000db074fd0d3fabda7db829d712a7fff1a5ce90a7558e96534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752530, "uuid": "88717eb7-6c15-4580-b942-685d38aaa040", "comment": "Malware payload (Mirai)", "value": "d045a2b6b94910fdfd9195d4b833133c5c458ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752530, "uuid": "10b29e95-ee81-414a-84ed-81402db55563", "comment": "Malware payload (Mirai)", "value": "e6ebd361503fd7e1061f2941fd66c31e65391efed675ddad0913f35785e006a07734ded4750b2447bff39522d499ac75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752530, "uuid": "82c0d27f-f156-44bd-9551-be93b5e49f83", "value": "T1A07302DDA53F5F84DA951F77B7721BD0397366214AF88F2FE917B16809060886C03A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752530, "uuid": "b1795546-22e8-401c-a627-3442b9656e8f", "value": "1536:AuUPEcMMOUUQx6v2TDLxfK+srJvzR4OGJJuN+PlbH92P3AFptMLPNcBmorD:HGEuRxDw+sBe9NpkPwc+YSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752530, "uuid": "2a374800-dadc-4370-8719-888f358eb25d", "value": 75548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752530, "uuid": "be7f1f6f-14c4-40cc-a6f5-a8f30c25d8b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752530, "uuid": "adf41352-6bfc-467c-b0a3-bd6379da0776", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355355a2-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771768985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768985, "uuid": "62bc590c-58b5-475b-9151-1bcb6ea876f8", "comment": "Malware payload (ConnectWise)", "value": "f277a3aa0d394e65a2b5a4c49c6e52d5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768985, "uuid": "3c6fec66-046e-4a3f-8264-f1348372778a", "comment": "Malware payload (ConnectWise)", "value": "a44596d3be667dea9150d40d5ba4de6eb05f9624b39f8fcddacec6c9b1412004", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768985, "uuid": "d2b7d2d3-ec1e-4555-ace0-85aa286d524e", "comment": "Malware payload (ConnectWise)", "value": "e09f41f7a59e382714798b6c246aec5f5fe549d6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768985, "uuid": "c721b658-bd5b-4d05-a5ab-099e65dc055a", "comment": "Malware payload (ConnectWise)", "value": "7a7c6fcc601349f481b1e779dfd7efa489867a91e1a3808a5ed619ec5d09ec32bca4750fe365c595b769b628359f0369", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768985, "uuid": "6dc42518-408f-4969-ae79-6139769721b1", "value": "T15CD623116BF89678F0F22A35E876A0B1A5377D125E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768985, "uuid": "4f05eda0-621a-4f61-ad39-a37560da97d9", "value": "196608:yHxcp9ym3nltDUJVFHxcp9ym3oHxcp9ym3RHxcp9ym3XHxcp9ym3HHxcp9ym3aHH:AGplpmGp2GpDGpBGpxGpoGp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768985, "uuid": "4f2f6a6b-24e2-4e66-893e-1cd4667f5fe6", "value": 13438976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768985, "uuid": "bb4d0296-6556-4574-838d-30cbf93c5f64", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768985, "uuid": "da9f2a74-45a0-4d3f-bb50-3e9cef1461d9", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fad30f-1047-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771803449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803449, "uuid": "479bd3b5-6731-419b-8a71-72f14381b026", "comment": "Malware payload (Mirai)", "value": "5c096ceffd7a736172ad21f85a6db149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803449, "uuid": "58cbab5e-7b74-457e-83b8-f17f3ab15179", "comment": "Malware payload (Mirai)", "value": "a46687efa74df0095dcbb90678faa411e505b27b4436011dcb1a882fd2f136f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803449, "uuid": "8fc0410c-df67-4f3b-ad8f-6c7b9b77be0e", "comment": "Malware payload (Mirai)", "value": "09f71aeb2ca1168908badaafe2098ef41becf721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803449, "uuid": "cddce6d7-b0d5-4d37-89b6-01ce5be71b2f", "comment": "Malware payload (Mirai)", "value": "ecd7a398d803cc774a46d6da94e43014eb11791789b53b8cae3c7937d7e664240c7cb716f63b79d221ca50e4f9ebb883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803449, "uuid": "bc990542-7c08-43a5-b067-9731c4506871", "value": "T199145B47EEC90EDFC45BCDB086AE836B2AEB559B8CD1F1F4543CCC0C755928A4693688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803449, "uuid": "f5441a3c-8ea6-4581-a5e4-0ae1d4a55627", "value": "3072:zRVcgKhwoaDkmE6JJ+EUhNWmKINuz5zxu4LIW73DMfzLialfmsN+CDq:j3oL6CszPIW73wfzdlN+CDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771803449, "uuid": "31c00f43-5720-4eb1-ac34-50ab9802108f", "value": 196972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771803449, "uuid": "08d09a0d-6f8f-4aaa-aafc-78b02b81e3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803449, "uuid": "669987cc-538f-47ae-b881-43df7907b642", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b404d051-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769197, "uuid": "0cdb8fe4-c283-4df4-a2f0-e586e459dfa0", "comment": "Malware payload (Mirai)", "value": "5144258e1cf5433f27b736516e728525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769197, "uuid": "2be11061-9ab4-4eed-a074-159a58901627", "comment": "Malware payload (Mirai)", "value": "a4a6514d0f2ca0882f138ee959b101fd7189ccd6bd4e7909d88e55cda66045b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769197, "uuid": "925a31fc-b50f-4ba5-8363-4c0e5eb87f8e", "comment": "Malware payload (Mirai)", "value": "ba487356badeb185edb7d7a81d3b914412816317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769197, "uuid": "2bfd9cc3-0ddf-4a4d-a0a4-10df4784a3a3", "comment": "Malware payload (Mirai)", "value": "c5d1d0c2645b07664bd0b05c10f544c61b47c62b7f31447d5cb25fc791f200d7b65839b2947c4987555211659a2871fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769197, "uuid": "3bd9c976-29a3-4070-b665-33e12f2375c0", "value": "T143635BC1E643C1B5E8070570217BF7336E72E1FA0258EA43D7A5D672FC52A42E256ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769197, "uuid": "b6675bc0-1186-4b13-a777-23a4027b63bc", "value": "1536:MGH4CSCFqGveRygh0JENfGMiUOvc6IvRRAbwvC8zD/qOps1TdaNQWbf3EKAXdJf7:BCCFqGveRygh0JENfGMiUO06wRRywvCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769197, "uuid": "f38d919d-b7ed-40b6-af32-ebd89af5e180", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769197, "uuid": "4030d709-aaaa-432f-bafe-aabf58fd393f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769197, "uuid": "76058e57-3fd1-461f-9b54-3964943ea265", "value": "boatnet.x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbbd75a-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771898, "uuid": "ee650c4a-d5b0-4ab3-b9fd-daa9793cf27d", "comment": "Malware payload (Mirai)", "value": "a4e5dcda892600d37cae58fab2f6a999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771898, "uuid": "7e0087ab-8839-4cf7-a177-5038cc73d0e2", "comment": "Malware payload (Mirai)", "value": "a4bf60600484292e50eff0cbb2963c6bef9df9dc17543b27d5ab35fc466c50b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771898, "uuid": "644f1d1e-4709-47e5-a237-23f71c883514", "comment": "Malware payload (Mirai)", "value": "ebeb8d72396a5c8e5bbd281d6c04e7b4ab74f34e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771898, "uuid": "f240a6ca-906a-46a9-8474-e9e17e38a5f1", "comment": "Malware payload (Mirai)", "value": "db8dcc2d2ea823d056287e46b3f3e6c6257b8677c92cf586cbf4145458b4110de3e7529b7e1e819fe85d4fbed7a9b5e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771898, "uuid": "4abd44c8-61cd-4a2f-a695-562480377456", "value": "T180043B46EB418A13C4D227B5BB9F424533239B64D3EB730699287FB43F86B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771898, "uuid": "2d593569-fcbc-496f-8a08-9f01f0f41755", "value": "3072:XopnC6fVzZ4ya2AZOvJs/SDLdoQgpDtkXehVSFbyM/9wucOU:Ypn/OyaPZOvJsKDLCphkuhVSFOM/9AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771898, "uuid": "23c0dce7-b2bd-4363-b12b-784ba105a575", "value": 177907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771898, "uuid": "3f0d3ff1-d557-48ce-b4e7-7f46a2fa3707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771898, "uuid": "dff5ed35-ff5b-4d7e-9281-9b7578b39110", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb77289-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784216, "uuid": "3930db07-1b7f-419a-a1d6-839f847edde0", "comment": "Malware payload", "value": "99b01164daf2732840eda4213badab92", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784216, "uuid": "44d94115-a2c8-4b5d-8699-52ee0b585f17", "comment": "Malware payload", "value": "a4c7d6d5445243f3c8d4154bba3f22e746335d8e9815c2e0c5f572ff1e4cd938", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784216, "uuid": "2c7c2fd5-a6f6-46e5-80c7-7d1317fe7e7a", "comment": "Malware payload", "value": "54a4524fe4120d17c9f4177ac7700b63595031d5", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784216, "uuid": "2bf903d3-bdac-43e4-b311-9de77776da4b", "comment": "Malware payload", "value": "2d810e33b081efe589b1b8039f0ee5e416895923b7eff4af5f8ec79e6d2e3152abfeed6afa8d7d51d3cbc2d6f5693913", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784216, "uuid": "e922fc27-7050-43e1-bb71-0c72b22cc943", "value": "T1BEF0D4313700200DD5287549CD539C3BA7D589B9323638B297DC01137756F755155151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784216, "uuid": "1dadfa99-69fc-43ec-81ce-e8ba5abc6756", "value": "12:ytrO1tLtaUl8RupK9UmQHshkeNDJSzmNUmh7EvudnAkeG/KID:UaKq9K9qXeNDJSqUmZEWdXCID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784216, "uuid": "f12f1dfa-2c72-436a-8014-1363015c5dec", "value": 460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784216, "uuid": "5ac0c823-033a-4c89-bdd9-11510a7f4162", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784216, "uuid": "45e493b9-0382-4e68-acbd-a743b53a0abe", "value": "sc64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1d55f2-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766344, "uuid": "ac84e21e-c9aa-49db-9cfc-5b5533ea6a01", "comment": "Malware payload", "value": "bdf5ad83225d479331662cc92855b27c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766344, "uuid": "677ac404-e683-4432-b3c4-40245fd07fe5", "comment": "Malware payload", "value": "a5252a163fea8491fe35b9c9578a677100615419c099b5bad8568bdce50364be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766344, "uuid": "512f4c3d-088c-43b6-994c-00404c1ddfca", "comment": "Malware payload", "value": "1214e3b04b196c712801f4fb09653a9a0489f0ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766344, "uuid": "897d3807-450c-4aa0-b54f-6310f2da34fa", "comment": "Malware payload", "value": "79fb67b00a1623402886b6c472a91adfba855bd62a9cb9d92953ca54f55eb688709063eb94a87ee304c0fc81f135b632", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766344, "uuid": "d5aae342-3b84-49ed-8c94-305767f5b1b9", "value": "T17CE1277025F14C732E216644F3372BA5ABBBE8570597218C39DE2E256F87B42F4AF811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766344, "uuid": "1fb1b2de-bd3a-417f-bbdc-6e0906763e87", "value": "96:cLu7B6vlgxITYEYdG0j6fK6f76fh6fwb6fiJ49XX:cLul6gwIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766344, "uuid": "44dfc0b9-122c-4670-aefb-cad67ba014cd", "value": 7365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766344, "uuid": "6a60fc4d-575e-42c0-a509-2e4a903916c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766344, "uuid": "631ad8a2-f7e3-4274-be91-c244b0bba68b", "value": "a5252a163fea8491fe35b9c9578a677100615419c099b5bad8568bdce50364be.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38eaeea2-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "b6392772-3f09-4f62-aa02-4fb79cf91e41", "comment": "Malware payload (Mirai)", "value": "20745159f268196a4e741caaaf93bb7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "9c187a27-5a87-4209-ad52-2f702355b2a2", "comment": "Malware payload (Mirai)", "value": "a53ac1aa5a78b807c75e4f29083f8bce4a8c44a940eb8c9d1c1835af0ec09430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "b9fc23ce-3761-4407-9743-0394857fc6cf", "comment": "Malware payload (Mirai)", "value": "e7094545e96c1a5d429a4ea222e0e5b7ad1359f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "cf624036-0a98-4a7b-8c91-fb824a5c6e07", "comment": "Malware payload (Mirai)", "value": "5da987f8dd18cf5e728e95a703d4060b7e590f8e9102b153ef2d692b04b1740ba52b84fda9389abfeeb4181c27cd940d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "cc7c7e5d-4155-49e8-811e-c79f65ada895", "value": "T114F2E781B8C25A2BC2E423BAAA6F518E336173A8D2DF7717D8111F107B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "a19fb41d-7e4a-46fa-b918-d80f5dfbb86c", "value": "768:nPQoxXK9zq3GVKWKKNOo2TfCOjfdiGswrxfE+MyiL+:pXYzmGj2TZ5IwrxcTL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768991, "uuid": "3ec9914a-c8a4-4d22-bccf-b325b5127782", "value": 37108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768991, "uuid": "2536d45c-fbe5-4c38-aa2f-bea065c9db29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "00e4092f-db46-43f1-8824-b7f8dfa9c98a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3697a14-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753305, "uuid": "62b25338-00d9-4bf4-ace9-4886f93996c2", "comment": "Malware payload (Mirai)", "value": "66c69d941edea88753275145d7c5cd88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753305, "uuid": "762c1a61-88f6-4b35-b491-b286ea578d4c", "comment": "Malware payload (Mirai)", "value": "a5aa9e327fbdd18063aa0bf3832bac22f02ab783c48232e28a9af3d61659337c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753305, "uuid": "f75803f1-5501-4c5b-95b5-0f60c6ef0794", "comment": "Malware payload (Mirai)", "value": "2e3cbf6e452e3934c62e883691902db21349e0b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753305, "uuid": "0fec599e-3713-472d-b693-c6ef1557726a", "comment": "Malware payload (Mirai)", "value": "366d91ae1c10df40e4503d83f68de44a9552c8b9d5a1c65fbae5d29b62ac5dabe7317da3c45ab571ca4c078f07c6bc26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753305, "uuid": "d04dfcdc-5397-481e-83cc-71845c9ad125", "value": "T126F35B07F5C084FDC896C1B44BAFBA36ED72F05E1134F26B27D49A621E5DE201B6DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753305, "uuid": "3a17342d-6760-46de-8d9b-fc759e4bba8a", "value": "3072:mMBxAhJMJdMjUAZxRlbqZw9jpbiiShhfHsAi6ELZ9hYx1Hy:lHAheX6TpKTOky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753305, "uuid": "b4eef43e-c4c1-4b3e-a112-8e9731a966ef", "value": 159224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753305, "uuid": "e7e3069d-7357-4e72-9bbc-ed8c64ca6e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753305, "uuid": "62b389d5-5c3d-4d1e-bbf3-a2c1ae877d52", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de348a9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766395, "uuid": "a73c477a-abd4-440a-98a6-28fdf2d4d6ec", "comment": "Malware payload", "value": "27191d6805570c1e118ea924c61a5032", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766395, "uuid": "479fd269-0530-402e-b20e-21bc54019e7e", "comment": "Malware payload", "value": "a5de8a891dfc8c4f79bb20a04b20be2722e2b1b1abbca2a37e3ea67a3921f1ce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766395, "uuid": "1a92a258-95ff-48f9-941c-cde2135081a3", "comment": "Malware payload", "value": "73a7dfdcd99603bd0bc056a2941c6a7024ee8d1d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766395, "uuid": "d7d9f90a-9a60-45a4-b83a-e2cab2f63cd1", "comment": "Malware payload", "value": "b1af8159d0ca187ae438d98b69b3cad85f02c5c095967b0e5f1d79dcfc5958681c95871d481ac9a877458defe2bd6008", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766395, "uuid": "8a8a908c-3e87-47e4-86f1-e7cae3870772", "value": "T117317A3840F21D63260CB58062B32B857F73DF538A5213DC39DF5FAA6F8AA03624B420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766395, "uuid": "4e8948f7-6f76-4905-b132-191560f745c8", "value": "24:chnRUR8fARW52q9HHIuCzCRpYdZeH8d/iPdFHjeef5uZW5FkXdflU1Dlc9HHUeN:chRu9RfinB6gcd/iPdFHPwWYcdlwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766395, "uuid": "532a5ef0-1452-41db-98fd-8520681bcb55", "value": 1561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766395, "uuid": "2258ee35-8200-42c6-b5a6-e9fd07b95d8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766395, "uuid": "f04b39ca-ea9d-4a4b-b690-2c22ddbcf876", "value": "a5de8a891dfc8c4f79bb20a04b20be2722e2b1b1abbca2a37e3ea67a3921f1ce.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7170c5e-1006-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771775645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775645, "uuid": "91322976-f8a9-4ef6-83bc-9d2edd260401", "comment": "Malware payload", "value": "a4acb8db601ed78fe04502d94e04294a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775645, "uuid": "ad8d34b5-4ce8-4dd6-bb09-31d7cb0175d2", "comment": "Malware payload", "value": "a63b4b9df52c5586e5e633862562b8565a0e7a621fa40128e366fc99e5dd25ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775645, "uuid": "6b993eea-58c5-4c2b-84ff-aa88bc421e2e", "comment": "Malware payload", "value": "3516cdf5fee49e1b69ff49494776cc3025551d20", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775645, "uuid": "c518a15d-a7fa-47e8-9039-6a15e277635a", "comment": "Malware payload", "value": "edce132ed1e1ec7f37ca031b0554a4241827961bc39a5ded09eab73d655a474ab19ac2ac699f951ebc31f0aa02a6bc1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775645, "uuid": "b7e26ee2-a429-4c20-92b9-023f3b0f998b", "value": "T185713AFFE8A088A1224A4B29E116C175C403ACBB0CF8AE51849B99D1D53D57CF31DBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775645, "uuid": "ab0dd5c7-0392-4819-b809-e40258913527", "value": "96:r7x78787q7X7OkNyDyUBMQGT61wgclSQJYr6MDyLsU9fI32k:fNiior/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775645, "uuid": "649dd5dc-6c9d-43b6-be08-5a5412974da2", "value": 3603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775645, "uuid": "2a12b231-d8b1-45be-b442-291d2ecdecf5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775645, "uuid": "47f16073-5264-4cf0-afea-4512a04508bb", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146803cb-0fb7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771741442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741442, "uuid": "6a71a51c-da48-473c-a70b-d03d93f951d5", "comment": "Malware payload (AsyncRAT)", "value": "6899371e269aad9aece523cf5cfd8bd5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741442, "uuid": "147a52be-5379-4634-8b5e-fb6bad23b78b", "comment": "Malware payload (AsyncRAT)", "value": "a6f5f6da9c5b2307a84f9cf1791d66314b1aa086429c0b5df34ed749628f5c59", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741442, "uuid": "77658576-05b0-4b7b-9481-d9377b139653", "comment": "Malware payload (AsyncRAT)", "value": "b43e5f85039f638bab417fecc50986ec3b6bbfed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771741442, "uuid": "4dd8d297-163d-4134-a441-b1e5e8131728", "comment": "Malware payload (AsyncRAT)", "value": "b155e47db368bf00c997c6038c231702355f8669add95cec2fe6f7eb956eae9df78d778b206de97dde0e25aebe9964cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741442, "uuid": "d371cfaa-a902-4459-b93a-1afa1d217615", "value": "T165D23A08B3D48562E1FD56B94D7292048775EE4BA973DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741442, "uuid": "e8b311b4-193e-4d0c-9586-7cb09f070435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741442, "uuid": "e2ebdf8a-dd3f-492c-a984-18d10937f3e1", "value": "768:50oRXxvJ/qymYg/cIRGqo+/Rb7fB/dTR/+:CoRXD/qymB1iwRbN/r/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771741442, "uuid": "daa46f00-c49c-43f6-a09e-47cb28ea9d08", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771741442, "uuid": "154c42a1-63c3-457d-a538-f5e5bb7ca4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771741442, "uuid": "db493efc-6fc3-48d2-9e66-86b7d9f9938f", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a870f0d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766390, "uuid": "67cba67e-c414-4d7c-a9aa-2c9e1e80059d", "comment": "Malware payload", "value": "5d6b1f910815ab128fc6625a1dc92826", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766390, "uuid": "08452a2e-e65f-4997-bd68-f4ea7b285f57", "comment": "Malware payload", "value": "a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766390, "uuid": "93cb1f39-3109-48f9-949a-7090e60158b7", "comment": "Malware payload", "value": "e60b6db81fb4da2705ea2f6fcd650575b54c8a74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766390, "uuid": "3f0af11a-a315-4dde-8931-de539480fe69", "comment": "Malware payload", "value": "ee25884fc88bcbedf1b0dccbeb63cfa846368d547b848bd2d55bfbeb85840ee505a17b06cbec3ceaa6f35a18b50bd11b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766390, "uuid": "57870254-6851-401e-8f43-38267c353ea5", "value": "T1F342D4B435F14C731E611A40B23727B56BB7945749E3218C39DD2F39AFA6B02A4FE421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766390, "uuid": "81cfd2e7-9d0b-4309-a779-d4af9052c9c0", "value": "96:cRrqB6uL/7pydbpleU1eUGpE9pNZeUF/eU6inFdLeUndpZdNdVdtdWddd1uPuFum:cRrO6XeweOeke4eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766390, "uuid": "ddfb6028-698c-47ca-80e9-5842523d9e4d", "value": 12848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766390, "uuid": "fb77d40c-7009-40fc-bbde-cbc248136f7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766390, "uuid": "075dc516-407a-4b37-b66f-af7879cb2dd1", "value": "a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40202aa-0f8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771724073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771724073, "uuid": "5b123e68-08a3-422b-86f9-e2426f7e1d46", "comment": "Malware payload (Mirai)", "value": "298eb35ed0cacd76d7279d8a4315a758", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771724073, "uuid": "5564c53b-66cd-482e-9784-3da40392e6da", "comment": "Malware payload (Mirai)", "value": "a774b70d943f5ebb70aabc83be313d4bfda3746074de194c0047e1583c8335a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771724073, "uuid": "0134f3f4-f6ae-4319-8573-a9f2cae3c53e", "comment": "Malware payload (Mirai)", "value": "5335c278b44a7cc187e6b75ecf6d50a23d84398e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771724073, "uuid": "e1d9ede9-79ab-47bb-82ca-dbce9abcca6a", "comment": "Malware payload (Mirai)", "value": "76f78424452b7c11c5a6cbba332df986a154c12cb613ace8a43e6467c7e6da2e8db710372b286657b5dcaf5e08f72c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771724073, "uuid": "93d21f2b-a2c1-4a56-8abd-ecf6fb4d96c1", "value": "T10AA35C85F747E1F4E94909B011ABF73A8631DC371014DDABEB94FE72BD22642A11A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771724073, "uuid": "5e63c3cb-c5b7-41dc-abf2-9b75686fdf9a", "value": "1536:J1hQ2dgBnd4rFROszWnboM8htnzDxtoV0/htkUv31QwMgaJkr:JfQlBnWLWnbo1vImfuvgGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771724073, "uuid": "39611776-6cb2-4422-975d-66667665e625", "value": 99572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771724073, "uuid": "db6dac0d-1ded-4c4f-a9dd-c75150f6c476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771724073, "uuid": "838fabcd-483b-4bb4-90aa-436d45ba9893", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45de7764-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784045, "uuid": "076186b5-c95c-487f-9739-134583fc4e60", "comment": "Malware payload", "value": "6b6ee63e1b57405281275a7bcfba6f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784045, "uuid": "5ff2ed75-7b1b-488b-9e61-1ecf6e02ccd1", "comment": "Malware payload", "value": "a84d2731983b2f9765bdc2048d1108aa69c7d926bbb57a6cea60de7d3002de1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784045, "uuid": "6cf2e5b9-1e8a-474d-8f79-73f179b05eaa", "comment": "Malware payload", "value": "8b4e7306a489827edf13be549ce5649abe15ade8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784045, "uuid": "c9eafb56-3b0c-4be3-98a7-043f66ee8bc6", "comment": "Malware payload", "value": "49603018d9cfc098750aeea7f0d66634793f78870896b2c665148a79cf5cb3f5c418929dd43abb4e4b065ca9b2179b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784045, "uuid": "5ca14f57-9d2b-46b0-8f22-e0f3831a3555", "value": "T19235D02437E88F1BE5AE0735F071151507F2F422A672E79F6A81D0AA2E83751ED10BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784045, "uuid": "dd733bbc-fe87-4a70-a593-8afc991ebb29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784045, "uuid": "a0b8dc93-e638-4954-a4cc-f026e47b619f", "value": "24576:/Ud4OjAlC+9nHLmX63wZSGBI/u0+eW81ATw89rgX6BCYICX:/mHsl99nrmXOFp/HJW8ilIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784045, "uuid": "a852b418-caf1-4bce-b30b-7e27988454f9", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784045, "uuid": "5dc53f22-794f-49c1-9913-1a5ca1b5a9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784045, "uuid": "1e23ab4e-23c9-4e4a-8939-246a673f1f10", "value": "KrbRelayUp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6bfec9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766421, "uuid": "3b9d254b-08be-4a4e-99d5-54c73449fe1b", "comment": "Malware payload", "value": "947d5f6b7a9616a3ac243432ece7ea4a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766421, "uuid": "6e5d4fb8-fbc1-47e2-be48-8cb021558ace", "comment": "Malware payload", "value": "a89ea3b0e532d325f9e35d31b32f70fd3133b56e9bd9d5fc045b170df320b4b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766421, "uuid": "0f602973-aead-4e56-9d3d-21349e961971", "comment": "Malware payload", "value": "a80ee74c0b33531940f5272d6cfcb8df93331db8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766421, "uuid": "9bef2837-5b6a-4e21-8bb5-4c2503e1aaca", "comment": "Malware payload", "value": "a9f137ab8c09a753ca2ee0f48515455fd6cf073040a955967a96882d567e9baa24c566ebc2d34e1d383aadf526d3f415", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766421, "uuid": "537d22ec-e0ce-4a49-b465-f9ef1e1a3e2b", "value": "T12C42683720F08B32D7D011C9A3A21A614F72975B456724B5F4FE6729AF2DA0374EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766421, "uuid": "325a7609-0127-4247-be73-89eb680851b3", "value": "192:cCuaC4hvZ5mZRcKNpivNbVWTxI1vgMrxl+XA:I4hvZ5mZRcKNpivNb8TxI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766421, "uuid": "2b7ea56f-95da-4c2c-b913-dc2c2351c078", "value": 12981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766421, "uuid": "458cc53e-070d-467a-a52d-fa1ad8c5b2b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766421, "uuid": "46388bd2-8feb-4c63-be9a-dbf773f6f29c", "value": "a89ea3b0e532d325f9e35d31b32f70fd3133b56e9bd9d5fc045b170df320b4b7.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a032389c-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766157, "uuid": "3df89e24-d96a-486e-b1af-313ea55b88d3", "comment": "Malware payload", "value": "1d9631a17859a8ebe777196ba98faa9d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766157, "uuid": "d1e09a5c-4d75-45de-ba6d-05a10c51f7d9", "comment": "Malware payload", "value": "a8b551fe17b2c17b24e4352790dd5428b28e5165b1589d2c59c9696930c2c5d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766157, "uuid": "1677c57b-7519-4ff4-838f-dc17d6007e20", "comment": "Malware payload", "value": "d4c5573a59c0e84d7905fc9652f762b89432ca84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766157, "uuid": "093ea30c-85bc-4d54-8b89-6cc53baf0848", "comment": "Malware payload", "value": "57257c5b220a5c48ef5d53f0905883d6f665e7f8c2e688ef88ee0facee34d2b824ce534b3d7aaf8c5786d7fa13bd89f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766157, "uuid": "b3ba226c-06e6-4809-ab83-f46b7be84d97", "value": "T1071270B424F04C332E215580B2772BE6ABB6D55395A3758C35DD1F3A6F87B03A1AF421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766157, "uuid": "7371a6d6-41bc-4420-aad3-78c2e3034d7f", "value": "96:cRubB6PxbxlxwxlxMQlTUtU9U9UdUdUVUVUgwQwPwNdItV/XT:cRuF6BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766157, "uuid": "ffab509b-787b-4a79-a126-2884402b1b12", "value": 9892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766157, "uuid": "998aabcc-e374-4ab2-9b7e-929efc3f8cf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766157, "uuid": "82f15b6d-92ad-4bb4-b500-fba29a3a18ea", "value": "a8b551fe17b2c17b24e4352790dd5428b28e5165b1589d2c59c9696930c2c5d0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef218256-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771800220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800220, "uuid": "6fd29993-9d5a-483a-90a0-99a30e988fbd", "comment": "Malware payload (AsyncRAT)", "value": "682524afc62d3877f88fd5aa3e1807fc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800220, "uuid": "347bff56-da8c-43a9-99f3-8b10af422d36", "comment": "Malware payload (AsyncRAT)", "value": "a99675413f273ab9eff39c9c43b2f82534c371f04221dfe69516c941183e9979", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800220, "uuid": "592c763a-be65-45cc-941c-bc15e93ce098", "comment": "Malware payload (AsyncRAT)", "value": "18def46f4c3d78275abbbd4a3e4d87f31243b0ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800220, "uuid": "3ae42f43-8066-4702-b9c8-41d3038fe593", "comment": "Malware payload (AsyncRAT)", "value": "c4eec47a41a29b707db20a99aa8a32555b03622e01ed713c61af78bd8c0b3c3c988daa79394a930172192b533fd31643", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800220, "uuid": "a08bc680-6b33-4c77-ae80-618f52915927", "value": "T109232A003BE9921BE2FE9E7D99F11545867AF6533602D64F1CC002DA4A23BC6EE127F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800220, "uuid": "f0cf33b9-53b7-4a1b-8056-d169d1a2178a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800220, "uuid": "7d56def7-22e4-4ca1-99ae-2755786954fa", "value": "768:sseYN5ferQcveJP2f4TjzuGnuvTYzqib9eb1+gUptw5MFrAK8RccsrWBNEJM:jwQcA2fojzNnbzqibUbvU3wMFrvYcD2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800220, "uuid": "7b55458f-6a95-4999-bd88-f76b3ea9c642", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800220, "uuid": "6627fe09-582a-4513-b39d-ca4b19a12934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800220, "uuid": "cf468441-36b9-4b3d-b353-03a7e69c88d6", "value": "gStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cc1595-1006-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771775646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775646, "uuid": "a62aec88-2aac-44ab-bb5d-4b5456770d2f", "comment": "Malware payload (Mirai)", "value": "dcce3aa15c9b3cfc263fc273c6e4c62d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775646, "uuid": "35e46e04-52e0-41d4-968d-8987856ca6d6", "comment": "Malware payload (Mirai)", "value": "a9a1bec82293228f65072c95a12a53edc08a3602ed40aa5e15fc2e4fa891d4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775646, "uuid": "c2dcab65-dbe4-4d06-ac1c-0431996a4be8", "comment": "Malware payload (Mirai)", "value": "dc1570ec0d96af1119d3695793f2c53553f36495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775646, "uuid": "abeb1f87-2eb1-451a-ae93-ba5402142839", "comment": "Malware payload (Mirai)", "value": "90cbbedd7a73a20f24b17a42e393879edb620aea6e77e74ba9444b7fbdfe99871d3dad8c0f7893e140d1686bbc5584ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775646, "uuid": "fc0f8a27-18cc-44c3-8a4b-3b9279eae66b", "value": "T1F803E1119B6518B3C8B0253FC9C50BC2FF2B2B7C51A67A23046957A83DCA5D169B39C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775646, "uuid": "8423c5af-2e67-4ac3-a91b-691842cebf3f", "value": "768:jnq6CSA+gICyThftXfSyzgEVQOR2FM3I95twxqKL+NMGaAbC1ozWQY9q3UELOc:jnRdA+g25tfSAPVQOR2Oa5OxqKL+NM7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775646, "uuid": "36f070db-43b2-47a9-8b21-9f138ce12f3f", "value": 39200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775646, "uuid": "528bd5c6-7c3e-4b00-a263-6e7b03e38e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775646, "uuid": "cd5e3098-afd4-4a51-bc03-15f40184b49c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3360f60-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752955, "uuid": "e3b780e6-e925-4c57-9686-b17873da78e3", "comment": "Malware payload (Mirai)", "value": "3be6c433f7741c74c51360a94f11361d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752955, "uuid": "89304efa-d727-46e1-ba5d-2de9d94105e8", "comment": "Malware payload (Mirai)", "value": "a9d01a2e280f28a97733228360f31bb3f94d82cd8c99e2f21108f618e2fdd3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752955, "uuid": "cc30bb58-3570-4364-b84e-c46caed9ef3c", "comment": "Malware payload (Mirai)", "value": "7f62cb5a884fb9d1a435179a0d9499d994dfc25b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752955, "uuid": "f43ef95a-6a5b-4603-9366-867e956f7730", "comment": "Malware payload (Mirai)", "value": "f1827df738af7076bbd0290c83fe4158c84a20caa707e1ac5533e1a98d438e9c77f58922bb71804b7b7affa5c7cb7491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752955, "uuid": "10a82e93-2c9d-4283-ad34-aa903382f07a", "value": "T135838D63CD2A1D68D58884B470B0CE395733E502829B1EF759AAC679D047F8CF54A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752955, "uuid": "7ecb8e12-0a92-44d5-b3db-1ae396f2242f", "value": "1536:K2eEex+ag97zJS2FwBxf4LKcxD4qjSXRb3HwCaVhFQTkF:KKex2k2FKx4ucFjSXRb3HwPT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752955, "uuid": "50d6c85c-4eef-4ea9-9aa4-44c5f6d05820", "value": 87908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752955, "uuid": "cc5fed6d-f83c-47d5-b62e-5614ad01741f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752955, "uuid": "957fb4ad-3ca3-47b5-8614-f1e114b871e1", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f5e37c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766493, "uuid": "28a05c89-b56f-40ce-ab64-ec138b2d30cf", "comment": "Malware payload", "value": "e94486d96c822589ddafd85e4606d386", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766493, "uuid": "bbfb5826-cfc5-49d4-abcb-7134847cfb89", "comment": "Malware payload", "value": "aa661cd6457e783a30a4be81b281af73228a93f5ca23d1ec2639237f4599e4fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766493, "uuid": "bcda60bd-c1e3-4e1f-b973-e49eca875f3b", "comment": "Malware payload", "value": "d8fbd81937fcc2f96b447d610fcf3341d786744b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766493, "uuid": "aa44d789-965b-48ab-94aa-ae9730bd9d26", "comment": "Malware payload", "value": "b7d9c09f54dc9f39090b0a59af89c4b37b06c58fd00374550b6f63047255c43b7545f9a5753b72e0903cd3a39d996a67", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766493, "uuid": "bc62d1d0-bdd9-4a89-8534-ff3915216507", "value": "T1D441AB7450F14D732A586440B6B32B856F73CA13415322D875EE4E6A5F8AB0266AF821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766493, "uuid": "b240e7ee-b0c2-45ef-ab61-3945408c0397", "value": "48:cniRxuGRys0/iPdFHPwWYclwnECPZmDl27lwnp6Elwns:cWu4SioVdZqzQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766493, "uuid": "c28a7414-950a-431d-850a-deac73a93a1c", "value": 2217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766493, "uuid": "ccc9bf1e-ab2a-4008-a842-d86894856dd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766493, "uuid": "dd23d0ef-8643-4fae-8826-0b2a82325172", "value": "aa661cd6457e783a30a4be81b281af73228a93f5ca23d1ec2639237f4599e4fe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d157d0a9-0fe9-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1771763233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763233, "uuid": "27dec95d-95ba-4647-9d03-e9b384f689fc", "comment": "Malware payload (CountLoader)", "value": "93c08918c3ba106931799c9e32e98af8", "object_relation": "md5", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763233, "uuid": "91adce8a-9290-41c4-b660-2ca4e42310a2", "comment": "Malware payload (CountLoader)", "value": "aaa00e06e65ce88637005e88a6ce84ea2afd5e072dd6aacf7aadfb014ed1f41b", "object_relation": "sha256", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763233, "uuid": "5db2c904-9e02-414d-80f8-2b846bcc3bca", "comment": "Malware payload (CountLoader)", "value": "49a855bae1abdd938460c3c1aa86caa2e6c0e51b", "object_relation": "sha1", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763233, "uuid": "56689b01-4fd7-4664-a6d7-93b2d3b258c9", "comment": "Malware payload (CountLoader)", "value": "ac70fbf6b6dfa454b7877661deaf02aaa7dcbfbdabece0d48f31071a026d845c960895f440e17401f04e41642ba3e438", "object_relation": "sha3-384", "Tag": [ { "name": "185-90-162-118", "colour": "#1E0D5F", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763233, "uuid": "9fb3ca5a-01ba-4420-83db-115550083f41", "value": "T190E5122306882A5AD1605B758CBFDEB552317E931650A36F01F0FC7B7DF2A833A67219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763233, "uuid": "908fc2ca-93be-4f1d-b044-6f4b3cc64a34", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763233, "uuid": "84c5f57c-dd0c-48f9-93c0-b7a3089f2882", "value": "24576:MDtX/tXOdEvsVylJguT3xh3L3dEWSSwX73V0aX4ptcnyM6yg6I/1jHGVv2AP6oGb:AtX/tXvUsA2dxAOaXw7QJI/hGUJoGi8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763233, "uuid": "f8bbf45e-7c6f-4161-830c-dd0552252362", "value": 3212798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763233, "uuid": "a0e81f44-f7f6-46b2-8cf6-a3e74895febf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763233, "uuid": "b9a2f4d4-7216-420d-b60f-3651e1bc31db", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00eb480f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766320, "uuid": "8ab074db-451a-4720-87aa-6bce94472744", "comment": "Malware payload", "value": "443aa89548bd8df4562d00a17de7b449", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766320, "uuid": "c45b4c4c-aa3c-4987-94ae-614ad33fd0f0", "comment": "Malware payload", "value": "ab066ca96447008e227ac2c7fc7637821fbdcc0ac4db30124dbd9eebdd1d1acd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766320, "uuid": "3a64bb23-448b-4735-98a7-e2d207b050b7", "comment": "Malware payload", "value": "43b77f45b69b37fe83c0465eafdceb3c6d37fc72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766320, "uuid": "16362d1e-de97-41a2-8ec3-41c693f2b102", "comment": "Malware payload", "value": "56ccf37571a2de38827e03e6fa92d38415673b23c3638a201aef9448682bb954f294209beb1a4848019c7f0d82fbdf3f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766320, "uuid": "f2b992ca-edc8-47d4-b3df-c03402ff14a9", "value": "T1F312362B21F08731D3C460DA52A65A614E72AB1F892514F5F4BFA32A9F2C90735D3F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766320, "uuid": "27967b22-3aa7-41d3-8c64-eac7bb463874", "value": "96:cCu8io5B6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjQ:cCu8v6p4hvZ5m5FoKNpivM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766320, "uuid": "f48dbf4b-b8dd-4873-ab00-1f95a0093cff", "value": 9465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766320, "uuid": "88aaadc8-661c-4ea2-abe3-d4f6388d1fcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766320, "uuid": "00b630af-04a2-4056-95a2-103352e32f72", "value": "ab066ca96447008e227ac2c7fc7637821fbdcc0ac4db30124dbd9eebdd1d1acd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119e5832-100e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771778803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778803, "uuid": "48fd61c3-0962-4878-a8ac-dc0306e7e50d", "comment": "Malware payload (Mirai)", "value": "339a08648208a49f0684bb47f33331e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778803, "uuid": "8e09d0ac-5c99-4dd8-8ac0-6bca7be416d9", "comment": "Malware payload (Mirai)", "value": "ab39542005b04a4ef38414cd7a1710ec9a4c4dd71afc2fee5a804535ab520033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778803, "uuid": "339b31ff-19cc-471f-b883-2b1167c056fd", "comment": "Malware payload (Mirai)", "value": "9f8b121429b984b441c260ccb000970b5bd4f365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778803, "uuid": "a2afe78a-74cb-454c-88dc-e12cbac3628e", "comment": "Malware payload (Mirai)", "value": "b18d9604d085aee268029d8c0651eabfc24397aa6e075772967a0ddea6e3ce527093d43b214eee9f66d8fef72f40bd95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778803, "uuid": "8e8dd1f7-10e0-4828-b3be-e7ba0718e878", "value": "T158158C46B2F374FDC057C03087ABDB62A931F46551222E7B21C4DA392E96E701B1AF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778803, "uuid": "5654b99c-d8ed-4b59-a35e-3fe7ff456f8d", "value": "12288:k1aMnphCDhx0kyAIYJpv/tmhR3UDzfhmyJ0H/g8x5k6yOIgN4x:k1aMnphCDz0kyA9pv/tmh5Unn2YShIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778803, "uuid": "e6260bce-44f4-4d29-9074-a12bf887c49d", "value": 954824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778803, "uuid": "24500e8b-4f80-4b43-a477-4e27a4539ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778803, "uuid": "f0b9ad23-29e5-43c9-8646-c16527c78ddc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343e6ee0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766406, "uuid": "72869cb5-a676-4b8d-8d6f-222a34e90335", "comment": "Malware payload", "value": "db05bff8cb2e3d3a6fdecf63a4606512", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766406, "uuid": "4c3e103c-7548-4c46-bbb1-238b64dce52f", "comment": "Malware payload", "value": "ab3b01abbe49ea654f946e3c5a50e6ee996a2e4d8fdabf91146a788db9949245", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766406, "uuid": "0d13b9ab-a5c2-4663-a8de-041b335452c7", "comment": "Malware payload", "value": "da541e1681b05c9819b7f6276ee4e1c9c83001e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766406, "uuid": "aa7a8031-2eb2-482f-8fb2-41643acc44b6", "comment": "Malware payload", "value": "0811c14586806e0dc19a848e3d0d7c75011a499681a689ffd462b21d55ada2e05e97e4d4631dbec5a9adfb86a8b42254", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766406, "uuid": "33277be4-e1fd-4772-8c40-f98c947409e2", "value": "T12FA27C7620F08A735A9015C4B33317A15F72955745A320B8B4FE2B39AF6AB03B4FF621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766406, "uuid": "1ff22c5e-710f-43bf-9f77-e4665ee37697", "value": "384:6L4hvZ5mN9oKNpivjF9+gukIFzITNTXG6:6LUiPN8Hvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766406, "uuid": "1a2ea142-e92a-472c-b6b4-f335532c799a", "value": 21872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766406, "uuid": "b19e878a-4e92-46ef-8fbd-b8ca58750aed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766406, "uuid": "f42c3a37-9cdf-41a8-bbd8-511c10298d1a", "value": "ab3b01abbe49ea654f946e3c5a50e6ee996a2e4d8fdabf91146a788db9949245.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7623b39f-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790568, "uuid": "ad610c15-353c-4c39-8961-a591f6f210ad", "comment": "Malware payload (Mirai)", "value": "591efbd4c2a51c5ff0592aa40cb20a75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790568, "uuid": "79da7b89-a7af-4413-842c-03bcaaf98f76", "comment": "Malware payload (Mirai)", "value": "abb3612926052acde7e8624cf49edcd2584c51db836b026fce8950bf733dba96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790568, "uuid": "558d081e-c92c-4f2d-8a12-e05230928b24", "comment": "Malware payload (Mirai)", "value": "996365fc1471ed186d4669a529500f164596b34f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790568, "uuid": "f322b3d2-9836-47b3-8ee6-35924dfbda1b", "comment": "Malware payload (Mirai)", "value": "dc0e0e5b65ea348b77f60932320cf09989c86761eb7e40282b854a19c548e8d9b509f4801681b351237dea9bcac57e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790568, "uuid": "f611f499-4bc9-42f3-9639-c088e87193e7", "value": "T10873F78E85625FF6C044F8B5B83A7D340F0C79261B6F19D5A87D5362078F4DAB04FAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790568, "uuid": "0b6755ed-59b7-4616-b1a3-97ef82428e80", "value": "768:aCtj3AtzmRvXFhJCv2YhIr4AgcPIH4lDsryXTHBcvfVdHJ/Oo8KVXIoA/g7xcET+:jizCXFhCJWn2RvHAoA7JE7VdXsVTC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790568, "uuid": "f85b0be0-a30a-4b59-8283-070d61d0bece", "value": 76380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790568, "uuid": "5f7e1e01-9232-4dd7-9734-1012c5611f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790568, "uuid": "00b9c2e8-27de-4037-add7-4aaf8421baa8", "value": "kt10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b174c84-0feb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771763975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763975, "uuid": "fa332a8a-db2a-4e28-a95c-8de044ea8a1d", "comment": "Malware payload (Mirai)", "value": "666fd92b2cfd2b54ff9599ee49a34af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763975, "uuid": "73e03ee8-8cdf-4151-b970-755f4c56cd32", "comment": "Malware payload (Mirai)", "value": "abcf6f2502a1a51f623788c7e16e393a36de5bb8b6df2775dbcaf7d4962017e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763975, "uuid": "6b97420b-2b0a-47b4-8d63-d1b9865e8877", "comment": "Malware payload (Mirai)", "value": "8f6c95de54ed4f33ce5eb67505e4e9fcdfca6262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771763975, "uuid": "dab7a0d8-06fe-4358-b52c-228008db506c", "comment": "Malware payload (Mirai)", "value": "538ba3b8e0c359a0788022eafd6caaed09952c1893374301e036c9d9f3c06f0ebced1b657a2fccf8adcfcd1d80522c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763975, "uuid": "f9764fdd-d253-44e6-9f40-73abd9befd67", "value": "T172D32A45F9414F23C6D112BBFB5E428D372A17A8D2EF72039D256F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763975, "uuid": "c7c27926-38ca-4c43-9fb4-738933b4e0da", "value": "1536:eW3+JAXM5fh2R4vqujBgF83AxM54VMtb4TjxB9DSxVAOBwWGFytCIv+TljFwywPx:eW3oSw083j4c85B9DgIDGrICp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771763975, "uuid": "1e058073-04f0-4bbf-8d9f-5d2d760396bd", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771763975, "uuid": "b5ffd1b4-e370-4e4a-862a-25abb057f127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771763975, "uuid": "9462572c-8b62-4a12-8e5a-57db08bb6106", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99927a2c-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779461, "uuid": "027d9662-8c07-4111-89e9-2655c5fd9e82", "comment": "Malware payload (Mirai)", "value": "e7f04d3db1455b51dea806f48e3210f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779461, "uuid": "4b65690b-da88-4062-914d-d0e513aadecc", "comment": "Malware payload (Mirai)", "value": "abf781d457b13630ada28da78cea10ed47e648d19b9a0850eecb9694dee6bead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779461, "uuid": "a2085546-8b60-4f3e-a7bb-51d8ee7410e7", "comment": "Malware payload (Mirai)", "value": "8ba02f26f733528d6706653e1dbebe4cab77e4d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779461, "uuid": "54a627c4-5464-4c09-b491-49c4c4014318", "comment": "Malware payload (Mirai)", "value": "65735bedb475b2db1e03a3a9fd91c7a3f292efa62004e66534ad2928de695ea5ea8e2fb70a4ebe67acf86e1e3fdd4feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779461, "uuid": "588b5992-70a8-420e-8aa6-04f51e4139d3", "value": "T1EF53F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779461, "uuid": "fedf49ec-0002-4f7b-8926-94e2da6fc540", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pX+:dn3QxJpRISDMKf5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779461, "uuid": "0b5be1a9-6f5e-4b00-81c9-3e5408aa7fb5", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779461, "uuid": "f953aed9-b1ed-4699-8d61-90f135f25a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779461, "uuid": "f119e8cc-13f9-489c-be51-9ef16cc865db", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8a9f5d-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779469, "uuid": "cd9847ec-a656-459c-b236-e6eb8ee42c8d", "comment": "Malware payload (Mirai)", "value": "792a14abbef2c495b98336423d228123", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779469, "uuid": "67916015-6a39-4a6f-9e27-a2dc2abd871e", "comment": "Malware payload (Mirai)", "value": "ac3cd93f8f444d2970d43fd309f686a0d7bdaa105846d98603718e2ecfeac9fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779469, "uuid": "c816830a-9535-4154-aca6-f29faf62019f", "comment": "Malware payload (Mirai)", "value": "dfbf02f4d7714c02b28eab65bacd1dd4da40c8df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779469, "uuid": "13a47799-fa54-4306-8414-b9f66c4293af", "comment": "Malware payload (Mirai)", "value": "590c7982050b85582b17c616d4fe8ba813d14e402258d8e7169dc5f021a25ac58651fee00293c7f30c6b984dff54e463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779469, "uuid": "e7f6d691-4d12-4c1e-b1f4-e9b44f13dbc3", "value": "T1CB83C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779469, "uuid": "6368ad75-1ac8-4cc0-b06c-a1405b135c85", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoA+EG:x/8RHTgMcJ0fmqJZOpkM/dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779469, "uuid": "e7b2139e-c88b-45cc-b9d2-56e714876f26", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779469, "uuid": "0528eda0-454f-4772-8c2c-eda5a9329ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779469, "uuid": "0e15fa8b-9098-4545-9147-d1edd7da4867", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3942095-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766297, "uuid": "9130a606-3735-4b7b-b863-2cf2acea7661", "comment": "Malware payload", "value": "9428dcfd65eefd5a379f9f75dd3f22e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766297, "uuid": "a960271a-0b2d-4140-85ef-9399517f660f", "comment": "Malware payload", "value": "ac5997b8e593647af95780e23627db8b52d42b4dbca86576a52b6f04c30c2821", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766297, "uuid": "7a1f9b65-9072-4f71-995e-6531230bb18b", "comment": "Malware payload", "value": "5e3a87eaab9f47a34a6f52eb1e9c52839624efb5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766297, "uuid": "47b80fd9-b905-4c05-906e-39c4fccc678c", "comment": "Malware payload", "value": "120acbbb8517e20b21b4089e4760471282fef83f67e0fd5e63f520336e68e82063a9b528a2c166c585d54243cce071f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766297, "uuid": "05a821ab-02ad-4a1a-9343-e3998502806d", "value": "T19012352B21F08B32D3C460DA53A64A614E72A70F552614B5F4BEA33AAF2C90735D3F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766297, "uuid": "9ba0ed34-76a1-4401-ab05-86dadaca3554", "value": "192:cCu+rC6p4hvZ5m5FoKNpivlLVyTYMr9ITB:Jp4hvZ5m5FoKNpivlLsTYMr9ITB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766297, "uuid": "5a211bab-3bfc-4732-b437-3e059157f6d9", "value": 9822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766297, "uuid": "901a73bc-cd94-4d6b-8e2e-8694040f9a64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766297, "uuid": "bc6a2dc0-b0b8-4cf5-bcf4-6f955f6578fe", "value": "ac5997b8e593647af95780e23627db8b52d42b4dbca86576a52b6f04c30c2821.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c529f0ed-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771803, "uuid": "b47522b6-cfb0-4a9a-86dc-90c38f26b9c6", "comment": "Malware payload (Mirai)", "value": "869777654173a2d8202df12b853167bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771803, "uuid": "4d1c447e-72fa-48e8-b1bf-fd51787a1159", "comment": "Malware payload (Mirai)", "value": "ac8252ed014d64351f428943cd9a31ef7a716b2438d8aba8d84983ec0c23c7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771803, "uuid": "293b7f51-e15e-455a-a91c-7ba5c5a40dbe", "comment": "Malware payload (Mirai)", "value": "2e47375592e1078c1e7661bce3d444ea5a2e92a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771803, "uuid": "547fc9bb-86e5-462f-9a0a-be5af2e224f2", "comment": "Malware payload (Mirai)", "value": "5665726864a64d7bc42ba3b06baa3004b352e608f735de9b98e715ea065ef3d01334f285b55880f2daa5f6d4f9275334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771803, "uuid": "90d7ab88-15dc-4a4c-83bd-dde44bd592e7", "value": "T14183AD73C86A0D28D44844F0B0A4AF3597A3E116C5972FF6989AC679D08BEDCF6423F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771803, "uuid": "1d7029bb-1fee-4f54-a58a-5657fa4030bb", "value": "1536:mcJrLx5PZB6AQezed2ujKeB2np24ybCn8FH/Smpg:msLxYOz2NGe024yb1paL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771803, "uuid": "db615de7-d8fd-4751-934a-a329f79ff435", "value": 81160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771803, "uuid": "cbb59e51-44a3-4bd6-a9eb-3fd167ee0aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771803, "uuid": "9e297ad2-cb17-488f-ab05-bd8c3e6fdb0c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfe2a02-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776834, "uuid": "8e160a31-ffad-472e-b32a-5b3616c44139", "comment": "Malware payload", "value": "21c9809f80e4b30a4dfe8ff060e6ad42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776834, "uuid": "39b52bb7-4f93-4ffc-9105-ff60df32c587", "comment": "Malware payload", "value": "ac82ffa5ef705a7e8b2f5a2890a859ffe63f30bc0c92c3ce0a268fbc03279e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776834, "uuid": "e198d863-4ab9-42da-a04d-e92464bdecb2", "comment": "Malware payload", "value": "614508d746d82a2e7d2156a5c00212050ce5e8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776834, "uuid": "3e0a5d7b-da2f-44a3-8371-f54cd42ee32d", "comment": "Malware payload", "value": "25783410862dae2fd7cc7fd3ab27641e5c85092bd6db377ee58433d61fb841057c56d1e4263e6c3215aedb0e00a5df1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776834, "uuid": "49ee8e03-564d-40f5-896e-1d6c61b4a38d", "value": "T108C3F1C2E99281F5E2430637089FA75B9BB59F370018DBABD34C1F1579A2797981E38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776834, "uuid": "41c47199-7d48-4f0f-944b-c81a39147464", "value": "3072:rOlNTZa+Ef6jFjeiIal3uGtRrRuhJ8zeK82rpuRsiY6TE/t+:aPGfcFjeRal3ntRQXAeerQRsGE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776834, "uuid": "537099d6-1d24-40fe-966a-fe35be0ab6b1", "value": 126963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776834, "uuid": "d8678605-4e1b-43eb-8173-5caf9dc7a746", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776834, "uuid": "23749980-c0c7-40e4-bb96-f767a1e469b6", "value": "pmapqb9hcs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77179267-1033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771794865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771794865, "uuid": "77045e7a-cc77-4b44-b594-0273089b4e68", "comment": "Malware payload (Mirai)", "value": "db45f0071d0758ef1f9bc4bdc0f58135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771794865, "uuid": "71aa406c-6569-482b-bb40-8fa70276189a", "comment": "Malware payload (Mirai)", "value": "acb319c8f15ed0787fa8a2f4086166e01dda0a9caed2076ed1d48d9de1176b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771794865, "uuid": "3ee46f88-f447-4159-b8bf-991d0d268f7c", "comment": "Malware payload (Mirai)", "value": "4df655df9cc214fcf415736d1f95228678c9f561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771794865, "uuid": "ba3b370a-9cd9-4968-9236-10125dcd8f2d", "comment": "Malware payload (Mirai)", "value": "8fb7ce340b8080f1003b7610e47a43ca15591e1cd9d14a8cacdf5cd48538d6c7e2bc9c2b8e65851c57b3d319141eb9d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771794865, "uuid": "18d9e9ec-823f-41fa-bc90-cb6592672665", "value": "T10BD34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771794865, "uuid": "72bd6947-dd31-42b4-8448-c6e63e5aee66", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3jkA:APeCK9kzivVYQitymTTkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771794865, "uuid": "16930efd-d53b-4ca3-93e9-6413d12abbe1", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771794865, "uuid": "d8572a7a-2501-44ff-a125-af1845a988a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771794865, "uuid": "0799b0f7-1e1c-464e-b2be-1f39b68d1088", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516e719e-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769032, "uuid": "a003ef77-6cc3-4532-ae11-28b02a3b985d", "comment": "Malware payload (Mirai)", "value": "341b80250dc371ffb13aa0ccde873d0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769032, "uuid": "6663fac4-b1c2-4981-848d-8fe48eae58db", "comment": "Malware payload (Mirai)", "value": "ad3ac83dde69091d05f96343db6fbbb0acdd262f8d7ed4069bcfcea044164f94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769032, "uuid": "f71764ec-61a6-40e6-9308-14178071e9e2", "comment": "Malware payload (Mirai)", "value": "0734968f3ecc928f7eef2a7395d9a5c59c54c3b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769032, "uuid": "028cbb79-e73a-41d7-946b-a146721507e0", "comment": "Malware payload (Mirai)", "value": "35d1ce12f3513751e5c4c96ff133249eb5da0dbcf944ba60b9e96bfceaf8c9952ff3233a97c285d210f532702c6eec71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769032, "uuid": "1a1fb781-5046-4e99-abc2-a284a7b6ddda", "value": "T10BE026801430D81B0E80480DF111CC9DBC4EB0967DD20A1C6A4E8AA24BD6FE830457A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769032, "uuid": "29cecec4-b6be-4538-8d2e-1cc96cdb2b11", "value": "6:tYM3FicfVQgNUzFGaQMVeMTyMcIaoef1Jf7FKiE5TZHhyMVeMTyI6Iaoef1JfN:Mcq5GcVkVxoefDoHBxVkI6xoefDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769032, "uuid": "dcbbd6ba-038c-415f-a314-f58519ce9d26", "value": 333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769032, "uuid": "fd9eeb56-4156-4362-b8e3-7caccc7b4eec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769032, "uuid": "7ff5f9e0-81ad-4a92-9650-b8290a1dd012", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0234460f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766322, "uuid": "5139eef0-70d8-4643-85b0-9627b4acca3c", "comment": "Malware payload", "value": "14ba8962bd51716c4f5d43d9e35a9289", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766322, "uuid": "97d06cc3-baab-4c16-a29c-8a03efb6ee17", "comment": "Malware payload", "value": "ad5c4928b38f87a07bdf6a44e46097304baef57c1ff2982ac2293a7bb9746eb1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766322, "uuid": "fb465097-ec2e-4403-bb1c-d60449a694f2", "comment": "Malware payload", "value": "58d8433e94af2814877f392feca92619bc502404", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766322, "uuid": "78a3b6d1-95f6-4001-b5fe-adaf13b50e76", "comment": "Malware payload", "value": "9ab2cddc62fc3b634114b2acee6738ec1fb66503ea1cb9beeb50150fdffaf7cd123468134e6c24eb10d3c63c4fbc1064", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766322, "uuid": "2fed1c9d-c75a-4ab5-90c4-44c047a844e9", "value": "T1A051757024F04C332E656580F3372BA6ABB7E95349E3618C35DE1E396F87B02A5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766322, "uuid": "dc3297e9-2f4b-497f-bf1c-c3ec42d4bf2c", "value": "48:cnRu9RVnB6gwUblrk+3l/BZlClrMZlClriZlClrXZlClrWZlClrRn:cRutB6oxTaxHoDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766322, "uuid": "7a5ab14e-95ad-4486-8ee6-03e7cefdade8", "value": 2804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766322, "uuid": "3fb294be-accc-4fd8-b685-e46476038a98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766322, "uuid": "6b38650a-e62f-42ff-ab7b-e24b5f5bc182", "value": "ad5c4928b38f87a07bdf6a44e46097304baef57c1ff2982ac2293a7bb9746eb1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b184a98-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770793, "uuid": "af66f005-4ced-4b98-b5b5-c832f10edb96", "comment": "Malware payload (Mirai)", "value": "1537734358d6e06b03357a200b13187f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770793, "uuid": "d32ce8ff-256b-4f33-8dc8-71c2662162d5", "comment": "Malware payload (Mirai)", "value": "ad9fe8cedab676a135208249602c65f13a7625f5460d756c8e3eab625b7e7700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770793, "uuid": "ad762dd7-5694-4753-8598-fd8a73deda2a", "comment": "Malware payload (Mirai)", "value": "b1bf78cfb221998e0005a6d9e07e49cb7c2e2d8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770793, "uuid": "1f4e53d1-a7a6-435b-b6a5-5d714523ae3f", "comment": "Malware payload (Mirai)", "value": "82bbbb9db8b7ea009d3bfea1ec5b148c3fd75a20bc99a0af94aff7f245e2f58740ef4b761fe71e659480b1c63153a06a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770793, "uuid": "a73400a0-ec03-4e1e-a82d-eda2e7dae674", "value": "T15363A416BF614FB7E86FDD3709E9270524DC541B21A97B3ABE30D818F60A25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770793, "uuid": "66815acb-0d27-4923-9252-2755e07c1845", "value": "1536:3ic5mAk09TobL0JPNuBSBsL3polf+FXax:3P5rlKIJPNRf+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770793, "uuid": "f03c2323-f7b7-4d20-8db0-1dfae868d200", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770793, "uuid": "5084eff6-587a-4878-8157-06435fd241d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770793, "uuid": "201572e8-c11c-4dd7-ae2b-bf9c144e6758", "value": "3atoNational.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddf1f51-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776837, "uuid": "28b0dd6e-a6d2-45d4-8179-8a86867c2756", "comment": "Malware payload", "value": "c8bebe85c93818d4d380a06642d84021", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776837, "uuid": "aa9d2605-75cd-44cb-b150-5130a7642c6a", "comment": "Malware payload", "value": "adb969e83441f6451f4d4f2c855b5843e96c52ec0beab27fcb39cd4334ad4128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776837, "uuid": "b43a253b-31f0-4ec0-b90a-d63010032291", "comment": "Malware payload", "value": "4427fd65c52cba825c8ac9f5831eb076817e206e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776837, "uuid": "a37e7eb4-a01c-4ada-a8f4-a73171632244", "comment": "Malware payload", "value": "a89f6b3c90baa3445315e9160a697f6f9329ce7b73ee2585a290e6fd3f7630229830e35887d2d239d01cc18c0d70aa8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776837, "uuid": "6b0bb11b-54d7-4674-8bab-09e0c8a5fdde", "value": "T1B3C3F100DEC6A4F6D6938533208BC7CAEF35CE610551CB53F7446B29ACF1BA6901A6E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776837, "uuid": "85ae19f3-6d2d-4369-9f41-d9fea963b456", "value": "3072:qa3z5a9yc6DpBlsoa3/FGbfy9rfPpfkd+SoAZHR:qqm103ljavwbf+jVkd7owHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776837, "uuid": "8b1b7d5b-1d61-46cf-b466-8d403bd3a69f", "value": 127081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776837, "uuid": "122298a2-5388-4ebd-b351-45f6f3ebe39b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776837, "uuid": "c54dfef2-f2ec-4e72-89f9-2fc72c8d19a2", "value": "ssozhasy24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e877fc82-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752535, "uuid": "2ef481eb-b676-4be1-9768-cd2373a20e3b", "comment": "Malware payload (Mirai)", "value": "0b56dfbbef7e4a7397a14e7dc82b9464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752535, "uuid": "c9bf8310-8685-4a73-8104-bc98c88a7d38", "comment": "Malware payload (Mirai)", "value": "ae51d17be1b85663706aa022946612a34eeb9571b1475187d757145c447c8e68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752535, "uuid": "7c7afe83-fbe0-4064-a33b-791668507d19", "comment": "Malware payload (Mirai)", "value": "a49f860f51971fe51d9cf89d50a0e9f656307b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752535, "uuid": "fd0a28ee-5853-4303-8b19-6c56afdf6ea5", "comment": "Malware payload (Mirai)", "value": "49a5f9a7a0cd8f6cafa59bc7055ef912f67783f8870c155a67fd8ba1eaf6de69ed2bd9f331042c5a226ce93851bb9487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752535, "uuid": "45042b54-657c-4dbc-8ad7-70b92824a747", "value": "T1F1B3B087B5917EBEE0546A3FC4134D1A93219F701A871B1AD1FCFA905E7A3D07292E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752535, "uuid": "5c175c7f-2099-4637-8a1c-05bdd69261a6", "value": "1536:O/D0K1/IBij4BDp5A09CZjZfLhx4VjfEdna9AuYRHq0KUJ7LTJlOcGgbTYN8rSA:e91RuDp5A2wR4VbEdae99J7NGg4NUSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752535, "uuid": "0ba47197-72f7-49fc-bb21-d8f780d89620", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752535, "uuid": "46c644dd-d675-4bdf-9d96-6cb2ec05ab3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752535, "uuid": "869e0992-146b-4176-9275-7d33b257a1ea", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fb25ea-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750294, "uuid": "9fa8c14e-65c6-4b88-a0cf-f2e650baf589", "comment": "Malware payload (Mirai)", "value": "6bbc7fd32207882d3e022adcb7acdda6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750294, "uuid": "7d889f60-49f1-40a6-8826-7b8d7ee1fff0", "comment": "Malware payload (Mirai)", "value": "af00e8b3f24ba4d386ab459e94bbe906043e4cd4efc3f5e8c2f8a89016a89039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750294, "uuid": "f91ed167-1281-4f2f-8908-c2df9c9c96b7", "comment": "Malware payload (Mirai)", "value": "09f526bedc163705b514dd1be16e90a7f0719c05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750294, "uuid": "519c825b-6d95-47e5-99b3-8a4b326fac56", "comment": "Malware payload (Mirai)", "value": "c770a3164de318f8ea9633e104c4b60b96f5afaac92d960e1fa6a00676a15309f72287dfb526e09b79d2f1a6483a1d69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750294, "uuid": "cf3f49ec-1ffd-435d-911f-962686bfa39d", "value": "T1C9E31A45FC518B16CAC662BBFF4E428D772B5768D2FE32039D256F20379B85A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750294, "uuid": "9dc2a37f-9ac5-4f80-bbc6-eb24f3485ab6", "value": "3072:De4xyQkeipAxA6qmXjV5hfmr49ErQ3qMgWHJLTpyn79/A4:i4xyQOpAxHqO/Or4OrQ6MFHdTkn7dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750294, "uuid": "5b1db947-ff44-4089-8ba4-d7345e826dd8", "value": 150200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750294, "uuid": "f0c2bba0-a6c7-4ba6-b89c-a62af704f682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750294, "uuid": "de0868e6-2aef-4abd-b2ca-4258ca6b2b9a", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ffadba-0fef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771765474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765474, "uuid": "9be75eee-f29d-49d5-bd8b-4b116271c2c1", "comment": "Malware payload", "value": "925baae8779911283a0b54eeb8f5de4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765474, "uuid": "ad1e4d78-395b-4dfb-9010-a0a04f26a8b3", "comment": "Malware payload", "value": "af03cc61d8e32a9334723e45eae150e19b2717dae9c80142d87f01caed74ad10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765474, "uuid": "79e347a5-dc8c-4f48-b890-4eb4d6e5b8d2", "comment": "Malware payload", "value": "7f2fda4adbe8686531d311c52930d193da06cb5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771765474, "uuid": "a9adfd3e-f22a-461f-ba74-3a9078316909", "comment": "Malware payload", "value": "4964e8b2c82f1a0e794996d4e05fbf70abb30157740dc8081b3e7ef8548302c0f8e1c2a9e375eaea76f85408281c7ee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765474, "uuid": "4a04beb0-240f-4c6e-814b-5cff4f83565a", "value": "T118935C02B71D0E43D1771DF02A3F27D1D3EEA6E021F4FA88691F9A4591B1E361986EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765474, "uuid": "d119bf2f-7fd0-4a4d-895f-d43af01a88be", "value": "1536:R2zOwaHwoTAorA4ivyLlLzLUWxaye4uWAIG/4RjXl+osllEJwmijZ:0zOwaLTNV0oaJ5cg4hlClEEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771765474, "uuid": "3c636c04-c288-4144-9668-acf1e61cfcc1", "value": 96416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771765474, "uuid": "927c30f7-e2f9-4c73-83ec-f4827e5cf363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771765474, "uuid": "3fa2601a-fe0d-4020-9645-85c98482c065", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe3d465-1006-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771775660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775660, "uuid": "f7e69958-8aef-48f6-9a3b-d7684c327aba", "comment": "Malware payload (Mirai)", "value": "e9b60ef24430a8f782238e96f9bf2c4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775660, "uuid": "ac0ecc5e-1954-4181-b7bd-a2e65443ed5b", "comment": "Malware payload (Mirai)", "value": "afc999b024b524e71a6ccb00e05df73af541698971090447d40d831d4958a111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775660, "uuid": "4e56c740-4bd7-4331-9767-325c7cdbf8ce", "comment": "Malware payload (Mirai)", "value": "e855da54e0474ca2a0c74c61dcd44d352f0d6901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775660, "uuid": "87f2229d-e4c9-4b0c-ab92-a9644f821409", "comment": "Malware payload (Mirai)", "value": "1daf558ca7b322e69ba90b2fc485d8750a97a77037ad67bc90fea6b14dc14d0605067b13d58917317821a6a1eac3c31d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775660, "uuid": "3801edd0-d63f-4ffc-b7ea-86cf6ea83f49", "value": "T1D9832B56F9818B22C5D512BAFA1E128E332317F8E3DE72129E205F2477C692B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775660, "uuid": "46d36e37-370d-4836-ace0-319a3e9ac6d8", "value": "1536:0on3rmUINNJzQRQ7Jc1jpswkuYua6AxlCxnuMbi2ICTUe5vYMAP:LmU6lQRBguYua69ICYe15A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775660, "uuid": "cb873a32-b645-436e-a6f5-663adfe72ba7", "value": 84540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775660, "uuid": "866e3368-b7cb-4602-98c4-05935bf90977", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775660, "uuid": "5fceca82-9960-4958-be7d-fd634463fad9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb37734-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766420, "uuid": "419c0801-b42d-44c3-a4ce-e52d1f5a243d", "comment": "Malware payload", "value": "0543eeaa6f3a6520a6b608f3ccce925d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766420, "uuid": "201118b9-ef2b-444e-9b4e-8eff0c4681d7", "comment": "Malware payload", "value": "aff1463c73b14f337f62021a3e232036daf9367d2fc04f461ffc81482a25321d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766420, "uuid": "a2310bdb-be15-496e-a16a-cd6a7f4faee7", "comment": "Malware payload", "value": "845f54edc0f1a86440b68e4456427b44cf545b69", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766420, "uuid": "b3f323cf-dc30-44d1-b7e3-448e72918e6a", "comment": "Malware payload", "value": "7ea0f2a7f00158f0da19ce3c97ae628af098cf8ebfb01c7bb13da7513c49a38388d201cab95fe69f363bc89f45fdbe99", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766420, "uuid": "7c23951c-ae72-48c1-abdd-62ac945c4f4e", "value": "T1C4415C7421F50C332E206680B2771BA67B73DC5749A3658C38DE1A25BF8AB13A56B411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766420, "uuid": "8f16a949-a704-426b-8f44-063728673bb5", "value": "48:cnRz9RCzyVnB6GpKg4r1+rRmlrys2oe89lwnpsR/38eYlrC:cRzGzcB6Vr1+enelzeKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766420, "uuid": "0e7619b8-dda3-4c41-8460-951af26262e5", "value": 2046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766420, "uuid": "47d8c25d-0d8f-46bb-a924-b1d7290892ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766420, "uuid": "0869a4b3-a5e2-4e85-8da4-68f2b766aee2", "value": "aff1463c73b14f337f62021a3e232036daf9367d2fc04f461ffc81482a25321d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1a7c4a-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759465, "uuid": "b9b4c3aa-d3a9-4025-ba83-900612a04dd0", "comment": "Malware payload (Kaiji)", "value": "002ce195e2bcb0028cfd10b0ab3603e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759465, "uuid": "e9b2133c-01a4-4d90-adb7-34799e7a4de7", "comment": "Malware payload (Kaiji)", "value": "b0b5bc89370f00b11f44d9a260bc0d234a94ab8c5c3d65eb3346488afcbeeb27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759465, "uuid": "9fdcc796-d581-4f8c-aea1-6d5dc94113f0", "comment": "Malware payload (Kaiji)", "value": "631ba3f4b7505c4752e835c1d9245d6dcbabc58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759465, "uuid": "7e36f8e1-7232-4e3d-91d6-3ab988ab9fb4", "comment": "Malware payload (Kaiji)", "value": "2c318f16d4edb84e211be5463fa0805286ed82c69d45256bdd99c4019231f0275d70348fb78b35ddd534e298aafd13a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759465, "uuid": "234380a6-5fcd-41d2-9ac7-c2708ca5f4ac", "value": "T193A50857B8918582C4E42677ACBE81C833635EB99B8653266D04FE3C3EBF2D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759465, "uuid": "7b3238fb-4cc8-4cc9-b722-0ecbb8077ec0", "value": "24576:gNwGGRggwEGpD5IaZIJzIDgliOAMUh1Rskiq1zpQHCaRU7axVL0rK7k3dVh/cviW:VrcNoL03z82T16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759465, "uuid": "c804ca72-316d-49ea-8dc4-cdf5e7d33af2", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759465, "uuid": "0b2d22fc-f944-4856-a6e7-70caf7dd025c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759465, "uuid": "2012e724-1dbe-4c60-8db5-e8d69eba7204", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a9f92b-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752939, "uuid": "ca21be11-7aec-416c-86f5-a66ed05d6ca0", "comment": "Malware payload (Mirai)", "value": "6753142be72f7db059cd1e99da61f43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752939, "uuid": "0a75b2ad-83be-4cee-a8f5-58e584e35208", "comment": "Malware payload (Mirai)", "value": "b0c6efabf811681bcaba46ccad839687c888389f8c712270b1c41a9000a1fdeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752939, "uuid": "9449068e-4e46-424d-a745-8c7e09ac9d42", "comment": "Malware payload (Mirai)", "value": "bfbd4f823945ad57eb1d24804c6c17e8fbbede8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752939, "uuid": "78de3ac8-1312-480e-91c4-109585f513b8", "comment": "Malware payload (Mirai)", "value": "74e85c14f16e00bfa7f3dece61690dfe3f50641699b7e6ae3f7370437b7432e9f2c528a683403f3283a85ffb70d31190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752939, "uuid": "1374ac0b-7f9c-4d6d-8687-ff142a05e270", "value": "T1BD431A52BC9246BAC5C057FABB1A978A33A323B9C2DF7353CD080B52668A50F4D77D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752939, "uuid": "97ebae64-ce12-44d2-991a-2b6feb2ec6b1", "value": "768:wYLUGrITsnbHMgTDkLAc+S0lm5em4jzOvQyeCwVBM5zFmx0nKz:wYLvITsbHTcLAjS+m5etjzOvQ9OAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752939, "uuid": "d520c176-48a5-4c38-b411-c34c1cd1b3f2", "value": 60376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752939, "uuid": "6d539452-fbfb-493d-9804-24455cf47292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752939, "uuid": "cbe99503-f2dd-434a-9777-b4a52d8ca3c6", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b28cc46-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771769048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769048, "uuid": "6dd2a704-8f5f-4d7c-8478-00b806e8e5f7", "comment": "Malware payload", "value": "da6cadbdf4b2202c20f6f73027a8d86e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769048, "uuid": "0d663f85-e8f5-4754-8dff-bbe835c1dc55", "comment": "Malware payload", "value": "b1833409c581ffcecdb29e9ebaed307a756d9faa37a2f0c16ef4ef045a5ab602", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769048, "uuid": "d441a599-53cd-40b8-822b-a7c424bcbce0", "comment": "Malware payload", "value": "6dee4c952eecb34c1bf05e6986476a1442ea43fd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769048, "uuid": "addb5a29-ae0d-4619-8015-07ead2406ad1", "comment": "Malware payload", "value": "fa5f8b5335e915303230752c650c935ff377df10ad2513c75405649b7a5a7601486ed8102a7630753a0d4b5c196a2d63", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769048, "uuid": "fa735f3c-329f-4c52-8be4-9f63b7c0b376", "value": "T1D8F6333EC328958171B50276B81F285721B9FD424954E00C99EE778F2D63A6DBF2CB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769048, "uuid": "94d6645d-92da-4e97-864c-f653f0795654", "value": "393216:W43FcgK998PXRPzKjC7OaH5iPBp3CZ5ti3:XVckPpeCaI5mX3CZ5tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769048, "uuid": "6c70e09c-6f22-489f-a109-45921a1e843f", "value": 16046473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769048, "uuid": "23724920-e232-4249-968e-95af574b490b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769048, "uuid": "19f0dc7b-dd11-4887-b3af-71b0a7aafa76", "value": "\u8c46\u5305\u706b\u9f99.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ac3ee3-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750295, "uuid": "f4b386af-547d-4403-9390-00f7cd346ff5", "comment": "Malware payload (Mirai)", "value": "f443d8eaf59757f01912815db2df016e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750295, "uuid": "2ed084ac-f11f-4a0e-ad24-063c6eeea34a", "comment": "Malware payload (Mirai)", "value": "b2c1ec5f468e7b2c6938fc46746d85c0adf717fa510fa4ba05a7c058de9cfa42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750295, "uuid": "eccc19e7-9268-4281-87a2-3db8a49a573c", "comment": "Malware payload (Mirai)", "value": "c4e687e6fdc56aaaf12664937e1fbdb733fd49ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750295, "uuid": "2a7bc4f2-2ca9-4c82-b471-8ea337ac4933", "comment": "Malware payload (Mirai)", "value": "e61b3a8e7d6fc2f400f5e1d25620a44c980176d36f61196a1a6e2d22caed2b14b9530f565ea1992ecf22253495a18afe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750295, "uuid": "81b01823-6430-4f8a-8001-b8c42b3f75a0", "value": "T16DE31945FC519B16C6C662BBFF4E428D772B17A8D3EE31039D256F20378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750295, "uuid": "909ed9b1-9200-4898-8c8a-c5e54bb3a6ad", "value": "3072:czBs49tbMgxKZJ9LwjJhMXXlE/bQP9EfSf4PTRoSgKuGnH64vk2J:uBd9xMggZJ9LqbMSUVi64bRo9Kba4vks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750295, "uuid": "a5c184d7-f2ef-4635-a087-662f5a1f1503", "value": 154168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750295, "uuid": "5a8b013a-2ce2-443f-952e-943b73a27f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750295, "uuid": "fdb838af-76ef-48ee-988c-861d4e86d3a2", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ca9a91-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766437, "uuid": "3e3f0ad7-efec-4327-b8e6-d9d7e180bdc9", "comment": "Malware payload", "value": "f0ef83d20e729fd589b6747c7deed0f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766437, "uuid": "38248943-24e3-478d-8421-33e1c696ff4e", "comment": "Malware payload", "value": "b2ea28f14feaf432bf830399cf98469708992ff025503f67053d561cd20c2bf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766437, "uuid": "b2c6a5e4-4467-42a4-800d-61add5684d6a", "comment": "Malware payload", "value": "9ff30575ba1d027ba8b2c88e214cd8ce1122ab5b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766437, "uuid": "adc310a3-517d-4504-840a-304ff87d1803", "comment": "Malware payload", "value": "0ca1abe9e9827e19b87dad500fa9b3417e73f1cc26e03177e3f2e3912f09dd28197f41bd6319f53fc7147b86cb5c73fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766437, "uuid": "73966cc9-7b2e-4cbf-a417-21300b7f7102", "value": "T1AF626B7621F08A335B9465C4A33717915FB2A61744A720E8F4FE1E359F5AB03B0FBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766437, "uuid": "50398e49-42b8-4c47-8c88-e281693d3ef2", "value": "192:cCu/K6nC4hvZ5mzj7V7jiDDDM79E44+Tt:+C4hvZ5mzjB7joDg79E4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766437, "uuid": "d391869e-6954-40f7-85bf-4968c7962665", "value": 14652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766437, "uuid": "b5eb5d2e-6a96-453f-982e-9e48a2994668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766437, "uuid": "d02fcde2-eac7-4188-b56b-2205ddab3d82", "value": "b2ea28f14feaf432bf830399cf98469708992ff025503f67053d561cd20c2bf6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6358dbc-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752531, "uuid": "dff8b38b-089b-4e48-8680-619fa0ca0181", "comment": "Malware payload (Mirai)", "value": "6420973fe5f79f16c9f4dcd7ce4f014d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752531, "uuid": "adc2206f-911c-44fb-893c-c207bc82063c", "comment": "Malware payload (Mirai)", "value": "b3587c6bf920a99cb29c0e8d899018be1b4c98a94ec6340a3882a989f1f9c604", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752531, "uuid": "b3dd422e-4178-4f6d-8432-85f574529d72", "comment": "Malware payload (Mirai)", "value": "22395a99954461f469ad20e7c634daa927476b30", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752531, "uuid": "34249216-4e97-41e0-b542-3eb34d8a3488", "comment": "Malware payload (Mirai)", "value": "987e96739e1dd7f942cb74ded106bacb8f8bcb52d789b035f67635b994074abddfc02a8d353d9b4ff0e8fdaf7e3edee0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752531, "uuid": "2a85ad70-3413-4416-b889-02986dc617ae", "value": "T14C01928061B4307274F6A8E68A335C5D318590573DCB2CFCBCE9B0DA99D5C04F0626AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752531, "uuid": "0d77227a-c3c6-4bd0-b7ca-7f301592e6cb", "value": "12:YkF1kcClZF70S9fQHFnfQHF0fQHFWGLkFS8+FM5gFN9GLkFSG+FMDgFNdA1LRPb:ZDkH/FbFQHFfQHFgQHFWGLkFl+FM5gFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752531, "uuid": "4aa3cb30-0fba-404f-bcf7-e2361926ab3a", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752531, "uuid": "1091a9d9-3229-444a-aedb-260da323a5cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752531, "uuid": "c41b632a-08a3-4db1-91e6-8d407474b110", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b3a572-0f86-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771720502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720502, "uuid": "13984610-5e60-4bcc-82eb-609e4e2e0acb", "comment": "Malware payload (Vidar)", "value": "31cae31577ae0648eba8c79a84cace9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720502, "uuid": "97301908-eaf6-4313-b65f-6a4136147c12", "comment": "Malware payload (Vidar)", "value": "b384ba0ad39c09ffe564ba247aef3223d6bf50ca3fc92201db4ed67ad0a1a4d2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720502, "uuid": "9e92bb37-0572-48e1-9cd8-b6e704f347d2", "comment": "Malware payload (Vidar)", "value": "82957cc6ee2230073765125db786d6376d0974f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771720502, "uuid": "8eda5278-244c-4d2e-bf36-9bfa06fb4c18", "comment": "Malware payload (Vidar)", "value": "e5806d92cb864d360d08376c3720217b089f5a7cb629b17b0a708e20eb69571f603dbf688119ad84e8b6a86bd537cc73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720502, "uuid": "d373f44e-29cd-49e4-844d-ad459f46316e", "value": "T17D24236ADB531E23FC6701741929F705F553686A2F7E472738346B8962ECD8ACB483B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720502, "uuid": "569ba16e-89e7-4c41-8a3b-d41fb5dc0044", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720502, "uuid": "e7a4e80d-5bf6-46bb-9f4d-e1d04852f844", "value": "3072:EX7TDNLfd0IuGsNgUIlcLds5GQ/cnb7Ukd93ApqAamXlrKpxSI9mTTs7YpM1SKt5:u71x02XrkdsEQ/EPld5AgBuWp+QYpOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771720502, "uuid": "6fdf32b4-b798-4658-8aee-699a9373753c", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771720502, "uuid": "1f8f0670-2f99-4547-95b4-c317074e97b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771720502, "uuid": "8fcf84ec-e2e8-4e51-ba2e-504b3e22565b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef391da1-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752546, "uuid": "6e37572c-4414-44be-948c-a3cdd7cae744", "comment": "Malware payload (Mirai)", "value": "e455b1c3e24c5cae920d513483d4bdf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752546, "uuid": "b996cde1-7509-42ad-8d70-83d4ee9678d5", "comment": "Malware payload (Mirai)", "value": "b3ca9ac0369acd596555a898d745d8d87cccb6f1aa4f246a0ec77933e094f829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752546, "uuid": "d0917a1e-559f-41f7-91f9-fa86f8ae2ce2", "comment": "Malware payload (Mirai)", "value": "92600db20de56320df7841545079ace507610e8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752546, "uuid": "9d8ef7d8-0385-4c13-b6ba-5b1ce88f980c", "comment": "Malware payload (Mirai)", "value": "c35c6b331ecf41aa19dab659723230d4e2d38f057a16c828b2abaeab554be0ed2264e1e7aca53fe5b4a0ec73a521ee7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752546, "uuid": "b52ffd27-a869-4ce2-9ff6-ba2026f1c780", "value": "T1B2D3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752546, "uuid": "a05b8a9e-62d3-4dd7-93d8-6b3f286bafdd", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zc6:xOFgpOEoVv3MXL5NhGOc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752546, "uuid": "a8af7cee-bc4f-439b-9c14-a780626b688d", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752546, "uuid": "eeca249a-f3f6-4589-bf9a-a7c16a5c36c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752546, "uuid": "40d39f5e-1151-4a5a-9e43-212f48196a9e", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa3225-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779383, "uuid": "bdc14123-9599-46a2-86c9-2dfecf29ea68", "comment": "Malware payload (Mirai)", "value": "917dc8eff902d3676ba051da23d9af7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779383, "uuid": "2ccdca9d-2c49-4906-8746-21e172ad3f6e", "comment": "Malware payload (Mirai)", "value": "b3ddf6a28356bfcc462bdab21d179a84f640cb2c702d9fb0e5ed8512985a5b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779383, "uuid": "f03a470b-be7b-4cb0-9d0d-2c5e5e2dff9e", "comment": "Malware payload (Mirai)", "value": "277d01848c2df2136558e3234552e0906af55e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779383, "uuid": "69b325a8-82f3-40af-a10c-f71dc5ea3a77", "comment": "Malware payload (Mirai)", "value": "3f9a9624f8d1d0b5e2d3ba012c59bec03f6000cd4170b793658ceb0d3382aa49f2ea17f234e7527092a3a36c3fc84881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779383, "uuid": "cd4034b3-19ac-4771-bab1-9954ad5a1417", "value": "T1F8C2C0322EEF39B0C29420B6FCB886D7525F4BB965F16521774056A1DEE100362BA8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779383, "uuid": "3ea2f008-b474-4eaf-82fe-ab4d8baec084", "value": "384:kXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9chHnhymdGUop5h7:AjKX9vt6GqA3Q0jzV7EUyUq9ens3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779383, "uuid": "4f69cef9-18d5-48a1-b189-f6364b33c175", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779383, "uuid": "8a8808fc-aeb8-4815-9dd4-16d1c26b9308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779383, "uuid": "825b86c7-9d42-4fb9-b8d2-f00a825bb914", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f537940-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766371, "uuid": "23118446-067d-4154-98ab-ffc4a38084d2", "comment": "Malware payload", "value": "40e3e08b9925d0f455af9d034de78a2e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766371, "uuid": "26c32d42-763d-43ea-8cd6-772e51844c74", "comment": "Malware payload", "value": "b53201d442d9758187e8023f03df77d6ad17c9fb825f1d9a125efcc3c9b1799a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766371, "uuid": "bf16a9d9-032d-471d-8227-3c9199b0717e", "comment": "Malware payload", "value": "b4e73c2fe856a0ed9b52128b3fc9006f437a97aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766371, "uuid": "11f25101-62f8-41b7-bb01-49ef64cffc17", "comment": "Malware payload", "value": "0604999a1c7917ed577deaaacaeb1554c177c16ca6e178f0611f63ec2b492ef41fad7775c1510692dc1f8a738f9f7d2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766371, "uuid": "ade48b61-433a-40f3-84a6-711c14f25e5b", "value": "T1D552693721F08B3297D0A5C462771B614F72970B456720B8F1FE1A269F6DA0370EBB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766371, "uuid": "50fb93ea-3450-4590-a116-fec48245057d", "value": "96:cCuRk0B6csht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvj0+7IB2IBOIBLIB2I8:cCueg6p4hvZ5mrFoKNpivgQlp8JUFRbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766371, "uuid": "a486f48e-422e-4f90-898b-ab9a3f41a742", "value": 13555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766371, "uuid": "2a80964d-70d3-41a8-9de4-b239e0e549a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766371, "uuid": "e730a7ae-e368-40f7-b8b2-f367117a5ca9", "value": "b53201d442d9758187e8023f03df77d6ad17c9fb825f1d9a125efcc3c9b1799a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4138fc6c-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778454, "uuid": "5797f645-89dc-4d3b-996b-35032f7e67dd", "comment": "Malware payload", "value": "0fb905a7239f07d59efbc36521859732", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778454, "uuid": "4d2c1290-2f64-4ea4-b022-dec783b02fd7", "comment": "Malware payload", "value": "b58d1caf222e764bf6b752b713774e5f56804657993c66193096163b1fa066f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778454, "uuid": "ff836e30-d4c5-426d-9b42-dbb1997e4ae4", "comment": "Malware payload", "value": "9ad60783971503eb035a61cd0b3575256bc28c0b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778454, "uuid": "58de97af-c31c-4a6c-aadc-a7d5b47f5bbc", "comment": "Malware payload", "value": "af295d2098d302073c139b5fea5f337475cc54aa49fdbf9589a11aba99af65acb0741c79c5cbcf9e353beb403f63df7e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778454, "uuid": "a19fc1a9-0b85-4dc6-85d4-c95d5a952962", "value": "T15541387450F21C732A586580B2732B96BFB3DE5346A322DC39DE1F795F86B03619B421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778454, "uuid": "b95b960c-f850-443a-8d7b-9d0cae58b1cf", "value": "48:chRu9RHnB6gF/iPdFHPwWYclwnmZhlwn8/bUyNl/F:cLubB6wioVBqQyzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778454, "uuid": "e3a5a347-8ff0-43cd-84cd-1d38b0d8487b", "value": 2365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778454, "uuid": "ed9a86b5-48e8-401c-9de1-e261b44d587b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778454, "uuid": "28af213a-2a87-4088-a46d-77002d975fa7", "value": "b58d1caf222e764bf6b752b713774e5f56804657993c66193096163b1fa066f2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b746d041-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750305, "uuid": "89d3d2cb-8a39-4d77-b427-4778fe8c52f5", "comment": "Malware payload (Mirai)", "value": "2f721b69b1384c1a7bb4c80956ad1f68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750305, "uuid": "fb1a6e97-8727-4e11-a797-2570f6dff861", "comment": "Malware payload (Mirai)", "value": "b6a9fd633492c3d43a91c1516e7e2f84e272c38b73355c886fba15ece5e65d9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750305, "uuid": "1e1943ff-4249-43c4-8002-d6a20ce91a2c", "comment": "Malware payload (Mirai)", "value": "90bd8d54926ff04be36bfe8b7b16647f8ee1e223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750305, "uuid": "47b96603-cd51-4c3b-9476-8e754103ebd4", "comment": "Malware payload (Mirai)", "value": "74f42c2aefaf506ecb7b948a0b6e791cfd80c73c259a5cd989cdbb5492476dd3908a0301758271a23c57301335427d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750305, "uuid": "656c22c7-cec0-4d00-bf28-809adfa8ad82", "value": "T179E3BF97B7475050C8E50BF84BCB5BAC292B21119E6B88F77D2E363A19775CB180B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750305, "uuid": "675e7b09-88d3-45b6-8b17-81238e4ede46", "value": "3072:yWISWAJ4dk7vD/E8W02yqq2XIDge7d6gXCZvCA+Gq:yZSWA2GDMn0MWn7BCZvCiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750305, "uuid": "cc533e33-7b2c-4bd7-a5c9-18d1bffccfb7", "value": 157140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750305, "uuid": "d8d5a5b1-be29-4d76-86c4-c4c27dcf9c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750305, "uuid": "724c0c76-2953-42cd-9f00-ae8dc4ef3a9f", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32059f71-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766402, "uuid": "25ab1508-af71-4280-905c-74a311a2f5b4", "comment": "Malware payload", "value": "de1acd296ba91a095b0b355f634c0eb2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766402, "uuid": "7043e5b7-57ce-44a4-852a-793782b3f153", "comment": "Malware payload", "value": "b7bf3176d28e9632d0193a5701b0a4bf1508a51676b021dd15b65928a99f2ebb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766402, "uuid": "475b0b84-c500-45bc-a52a-b9acb03c2f76", "comment": "Malware payload", "value": "2c98f729541fdce0354ce7a58084652e2fcec3c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766402, "uuid": "9a7e81fd-e0f9-490c-8e3b-146e6b109b35", "comment": "Malware payload", "value": "acd0531a66fa78fd70ff156790dc6fe603f18bb16013400fc40c875c1e00506ee51394561af7612e11902e6ccd9ebe0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766402, "uuid": "68e9d008-a249-49c5-b03f-439c420699d3", "value": "T1C742673B21F08B3297C061C962771B614F72970B456714B8F4FE5A269F2DA0370EBB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766402, "uuid": "0f832500-4db7-4e45-8d74-a471de16baab", "value": "96:cCuUk0B6csht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjqlY+yIBCIB4NIB4IL:cCuDg6p4hvZ5mrFoKNpiv5JNJN7LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766402, "uuid": "b9c5e3fd-8345-4204-8d00-96d455503e79", "value": 12427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766402, "uuid": "54ea3a6f-bccd-4168-ac28-941677de23c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766402, "uuid": "0ba0a3e3-bc29-4199-8263-ce27e4be0784", "value": "b7bf3176d28e9632d0193a5701b0a4bf1508a51676b021dd15b65928a99f2ebb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfe7b31-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759466, "uuid": "44625a6c-b9e3-400d-8950-787852749771", "comment": "Malware payload (Kaiji)", "value": "f917e4b714be613d75531efd532df4f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759466, "uuid": "c3876f0f-f5c1-42b2-aa65-088212a4dbc5", "comment": "Malware payload (Kaiji)", "value": "b81aab4eddcb6683f9446aecd376b050efb2e37a28d61a2c349d6a5bb82028dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759466, "uuid": "88bd3472-aed5-46ee-a54d-7cd4258ad21f", "comment": "Malware payload (Kaiji)", "value": "85f9cfc24aa3fc33b290598f1138c187c87c9e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759466, "uuid": "3db3ed14-3688-438b-b965-511ca0fe5150", "comment": "Malware payload (Kaiji)", "value": "1fc49ec052e7205a5d66d7548d5240ab9d721c8196232474b90ae7841f36423ab7d1b9f38ed9328beced594dcebddfb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759466, "uuid": "8280b874-8852-46ce-aac7-5f0fcbbf5419", "value": "T1D0B5F8117F49EE5FD69422354EA6C33833967C14C2A03133AB51F7292FBA2B88D5ADD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759466, "uuid": "708511f5-d511-4064-b4d1-8bc021bbd0c7", "value": "12288:WY8Zinp3M6B0XBgI19CUdMp3LAQh1CapAaxVX4ltPuMFLgbM8yn+kvgftZAMcq+:bm6WBk7XVX4lRuMFL4o+k4fcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759466, "uuid": "63bd1917-b14c-4fe5-945a-75a128562769", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759466, "uuid": "340daf25-6202-4fe9-a5e5-daa4bf9f5a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759466, "uuid": "1991551c-ad4d-4c5f-a9d6-d0b14cacd6ad", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4419a302-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753118, "uuid": "ecdd7f3d-17b0-4f54-9d29-fa45c244bc46", "comment": "Malware payload (Mirai)", "value": "8e23aab7baa656931cbee404289626ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753118, "uuid": "d4954d8f-49c1-4346-a152-8f6c82c789a3", "comment": "Malware payload (Mirai)", "value": "b8df72073674b33a20dcb9e597831f7926f8a0cb999dfd0f5d30d92f6fbd354b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753118, "uuid": "122e9c4e-2452-48af-9bc5-308528c1d386", "comment": "Malware payload (Mirai)", "value": "36be6fa1b10beafa23d1c04aaf8a1ceb924e07bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753118, "uuid": "1e129429-3d2c-4699-9a60-f993fdd7d8a0", "comment": "Malware payload (Mirai)", "value": "4396756714aeeca3cb3893e013af63021287f6e558e0c53eab2a2c9814afd456d34f04f8d300828a6552f6eb5e55a075", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753118, "uuid": "21f78b1b-aa47-4c90-a058-31cdb7c9e65a", "value": "T14F137C7AE8AE5E54C0060170B4A89F381F53B1C493532EF71E9682B15887AEDF914FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753118, "uuid": "07a1b547-75aa-428a-aeb1-56e86f6a0b5d", "value": "768:ia1gMeGYyAO+N392LrlWvCbmCAo1aTNmCEQw:iaSM//X+7EEvWm81+mCER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753118, "uuid": "c4ac525c-bcf3-40ed-834b-8317178f4ed6", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753118, "uuid": "13865e0f-58ba-4b9a-8662-f720da08aab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753118, "uuid": "63a640ff-4a15-4e8c-997f-a561d80ee000", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26acb2a8-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771770678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770678, "uuid": "a5428043-23e4-4261-84e5-5d0869a5e73d", "comment": "Malware payload (AsyncRAT)", "value": "b38af285f9feecb85884e8a5b8ecd267", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770678, "uuid": "4d097ff0-9347-4207-b4ae-a2d1c60d805b", "comment": "Malware payload (AsyncRAT)", "value": "b967332da287cbd15785cba96933b6dc429ee212e66c2a544764bf54b863b296", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770678, "uuid": "8a2c9a82-eff4-42a8-a0a0-32a8635e611a", "comment": "Malware payload (AsyncRAT)", "value": "ed6b2aee16914d0fe40675917f487b59332c225a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770678, "uuid": "4c124df1-a278-4662-902f-8eb1a7822aa8", "comment": "Malware payload (AsyncRAT)", "value": "d013d8841784acb5b35c989410834ffb78d4595239bc4dfdeca3b3c6d3221f245b987e78d7894660ebfd9773cd524749", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770678, "uuid": "269f95ed-ccb9-42d5-92e1-060370013b31", "value": "T1B0D23A08B3D88551E1FD57B94D7293048771EA4B9973DB9E1FC440AE2A23B88DF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770678, "uuid": "9d4694d1-f683-4e49-9541-6d85e23bc357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770678, "uuid": "64113156-ec6d-4b73-abcc-386854c61d49", "value": "768:NuGRXHMMVEo8Yg/cIRGqo+/Rb7fB/dT9/+:0GRXxVEo8B1iwRbN/T/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770678, "uuid": "65e26232-485e-443f-808d-7278cd83a330", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770678, "uuid": "da7b0a8d-ae3b-4930-97a2-0587c76cf482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770678, "uuid": "299952f8-802f-4bb9-84e8-e49bfc4259b0", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196a3f54-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766361, "uuid": "3c413488-0d19-4c01-845b-1de2eadcd247", "comment": "Malware payload", "value": "863b341339924ce20e49d3d01f2b6c96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766361, "uuid": "72b959ee-6da3-49f6-a7ce-d221eb856f51", "comment": "Malware payload", "value": "b9762acb1c10c05c202d031da5ca9acba484bb4f7c73b744ec59f0e9609a7dc9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766361, "uuid": "9ae38c29-42f3-46e6-b0c7-a5b4d3b55c91", "comment": "Malware payload", "value": "9801eeb7054e46422408d5ee359a4e2be2e1015f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766361, "uuid": "be77aff3-4ca7-4946-a668-1de494a6b904", "comment": "Malware payload", "value": "773a5b431f895d2e671baee421117d9b07311c5344b9031de57edd12d6bb10edabb2229668d808109d1d4dc88bbd2e3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766361, "uuid": "60fc6cc1-ac18-4d98-bc06-3af94f024623", "value": "T1CF32373B21F04B32D3D051C9A3671A614E72E70B456614B8F4BE673AAF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766361, "uuid": "f00215b0-d4af-4983-a734-7d5ee12550a4", "value": "96:cCuOiB657sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwaTNQOlHECx2x5W:cCuT65C4hvZ5mzjqKNp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766361, "uuid": "8533033c-023c-4928-b38c-040279982e81", "value": 11456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766361, "uuid": "956ba83f-ff83-41b6-9bb3-bb8efd8137dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766361, "uuid": "76d03c80-8613-4e48-9b37-6220a3ace00f", "value": "b9762acb1c10c05c202d031da5ca9acba484bb4f7c73b744ec59f0e9609a7dc9.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70276dff-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790558, "uuid": "e9c03906-d70b-484e-ac67-d72ebee1bc01", "comment": "Malware payload (Mirai)", "value": "25dba1846b0d578b65eab47cd50922de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790558, "uuid": "9822fe37-2f2e-48bc-9748-f28215955392", "comment": "Malware payload (Mirai)", "value": "b9d04b1654b54f6a287d31326a7ea5a0c889748cd36f118b3177088e72c81791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790558, "uuid": "4a9e6d7d-9def-4d40-8901-dd830b2eb1f3", "comment": "Malware payload (Mirai)", "value": "1f211a80b38922a6bc12663fa53755424b1a30b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790558, "uuid": "b6466951-ad72-4124-8160-366f25c9f9d1", "comment": "Malware payload (Mirai)", "value": "967fc4a0a1b77e18bdcb44a5fec3360fa8063b8e93467597f25280f2954c4d59b16e767d62e21c175724e93442d8c2bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790558, "uuid": "182bd329-5a89-43a1-8a68-d9e775cd63d4", "value": "T125D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790558, "uuid": "0d2c3e9e-e12e-48f0-92c7-dffa0d1ffb3e", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zc6:xOFgpOEoVv3MXL5NhGOc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790558, "uuid": "7aa608e1-5df8-4e5c-936d-b397b9f02613", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790558, "uuid": "844a97cb-50e4-46db-af29-4769f8d1e8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790558, "uuid": "bb6f96b8-15c8-4292-8c18-d95ecb18071d", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4d8490-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779390, "uuid": "1988be9c-7de5-4cd3-a124-e9c464b1545f", "comment": "Malware payload (Mirai)", "value": "47d5a3f6f6a4de6e2fa3b0d1be04f1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779390, "uuid": "98ccb0f8-e696-4056-82de-17709846914d", "comment": "Malware payload (Mirai)", "value": "ba09408dc4f226c27c16a83674f6dc15c0c70f251058c3b90eea87a43be3db27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779390, "uuid": "c082d043-a730-44d5-ac7c-434dfc7cf711", "comment": "Malware payload (Mirai)", "value": "bc18dc879cfc5881c51329f24baf15029de68129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779390, "uuid": "da790a97-6b92-4572-859f-56a1b45858d1", "comment": "Malware payload (Mirai)", "value": "2af9281eb806938f472887349cfa32f95275e7ee539b1da2c168c25c9d996f0e46799b853aee7dccc686783a2955fcd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779390, "uuid": "121e3f9a-0ac9-4067-b030-6fff20857a33", "value": "T107D2E1BC7B0149DBC66EA1B44EE10B262D708F72F0026C076595EAD7BB0989C3CA6DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779390, "uuid": "5828ba12-0084-43e9-a7bc-f1445751cf7f", "value": "768:H4ylAtv6pqLJM0RXaxGyUbXtheU/S3DTLJgGlzDpbuR1JX:YMBqTRXa+Zhr/EDTBVJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779390, "uuid": "e8166b72-0f2a-4483-aabb-0a7add5bfdd8", "value": 28900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779390, "uuid": "69428d5e-e27f-43b4-af7e-22b33f27ec1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779390, "uuid": "81506650-e890-4e6f-adf9-3fcf1e5e0897", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700abc3e-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779391, "uuid": "9c4ac3ac-654d-4ef1-b43c-5d2e496d81cd", "comment": "Malware payload (Mirai)", "value": "53fd632df96bff863eabfe4363830105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779391, "uuid": "d9483354-3b2d-43b9-88f2-8b94aa38f18d", "comment": "Malware payload (Mirai)", "value": "ba354eb064fa60160b53d9d2f1efe83255b0dbba4d1420b821815f845c93fd45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779391, "uuid": "a8733d87-f8ac-44ca-bff7-5a59ffe67909", "comment": "Malware payload (Mirai)", "value": "a7d313a625aae6c9470dcf44c855a69019e69408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779391, "uuid": "9fdd3a76-e6b2-468c-b832-7de232d63f77", "comment": "Malware payload (Mirai)", "value": "d9534cea0da790038026204e4d6532b2f4c5d7979defe9a5a2b88cac958d62b36bc555955d90c1a64fc87b98003b4bb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779391, "uuid": "d4c8a6be-012d-4adf-8654-14a12a8e8023", "value": "T10FE2E1D555B7A479CEB10D7AFC734B4E252EC5FC85FB1022ABF8372427B09A64AB0442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779391, "uuid": "fb098ba5-4494-4163-9f91-cf43f05ca00a", "value": "768:n8Lm6COq1fewdHy62pud4yNOYSOyB8LrtHlLH9q3UELdS:8LJCmjpkcMKUBFLWLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779391, "uuid": "017c5e60-cf26-4e47-bd0f-63c20978cbb9", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779391, "uuid": "2ae2aaae-4c63-488c-b262-57fa4fe0a9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779391, "uuid": "a588c909-0f33-4bfe-bc55-e568ac608e2a", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94002d5c-102b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771791477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791477, "uuid": "4226f8c4-908d-4e89-b65e-026dbb0b3e52", "comment": "Malware payload (Mirai)", "value": "d60a907ee19af6efc42c25fb1f72e9b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791477, "uuid": "f67d80a3-815e-4747-addb-fbee23d81746", "comment": "Malware payload (Mirai)", "value": "ba579ded648c531cd4e024854e227e2065c8f88e930046907281597d788cdc91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791477, "uuid": "199e08e7-d69e-4f7d-bbd0-2bafccb92346", "comment": "Malware payload (Mirai)", "value": "272e2c1c50e932f4bc4bc6fdb4640b001e1a635e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791477, "uuid": "78a67400-f7f8-4772-964d-357e3d2dbfdb", "comment": "Malware payload (Mirai)", "value": "37420808a3dca382ab8e407b48368e75738fcbd10ea9b612fd092b7d9983df8d500fdcd293678ef9aa9407ce74592d52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791477, "uuid": "2ad188ce-dfe4-4dd4-9f48-224f80513454", "value": "T1CDC3C70E6E219F7DF768833047B78F25979823D636E1D685D2ACDA041E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791477, "uuid": "890bdd99-726b-48e7-aed7-0a12f1b32c79", "value": "1536:9xi1Apt3pdC2+XzNa5k+RidzG1Mi4GBu72X6qSe5gfZguvKGeCDB6y4TPZb:+ktzUha5kbG+n4NSe5gfbvK7ywt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791477, "uuid": "2dd59448-eda3-468b-91ff-db5e4f80351f", "value": 126624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791477, "uuid": "ad74a3d2-75b8-4247-9d7f-623fc5782947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791477, "uuid": "1f787233-da74-491e-aa96-49891c53183e", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc2033b-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784110, "uuid": "6e602563-3e1e-4263-b756-a159a43d0b44", "comment": "Malware payload", "value": "00d323fe2e8d824f614e0928534bb38e", "object_relation": "md5", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784110, "uuid": "825cbc70-4780-4e95-85dd-2420fbd6f40e", "comment": "Malware payload", "value": "ba63539b4afa62a62f7084b5fd63cdd1eaea716660987dd52f0203754369dc7d", "object_relation": "sha256", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784110, "uuid": "70027a71-60ce-419d-b00f-f0a91ce3de8a", "comment": "Malware payload", "value": "51d5f41e0246c5dd32dc5f9352c0f2ea41c1b6ea", "object_relation": "sha1", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784110, "uuid": "4d01d721-95f6-4e76-8561-0c7c8e9e17f3", "comment": "Malware payload", "value": "3cd2f147035529463c251cc00b4129be29ca216f9be5ed33efcfb93a3916364f612151947729cfa45524a451783cafb2", "object_relation": "sha3-384", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784110, "uuid": "e679083b-cbdb-434f-8733-1ed1007cbb26", "value": "T15BF1222AC935BCD4476C36905B611C5F21A46A5783B39F38CA090CFB7D62782EF6968C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784110, "uuid": "06f7d8fb-d598-48f7-b88a-a7173947b4db", "value": "192:nu5JohlqfUUGUms9NB0AqBnmXgKQw+rwTFShd3E:n46hl8UPRspAm7+rHhdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784110, "uuid": "b0cb620e-600a-4329-a897-4c880fa882fa", "value": 7629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784110, "uuid": "635c4d8f-193a-4bfe-976f-d39e402be440", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784110, "uuid": "61b9b069-e8f1-49c9-81b1-588de1101ad3", "value": "payload.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3df78d-0fca-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1771749833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749833, "uuid": "75046801-63b4-4d31-b4f5-46323599a1a5", "comment": "Malware payload (Vidar)", "value": "a1e6e2d536593b08286e789b1e4f0525", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749833, "uuid": "4937b6be-4e0e-4cf7-8d3e-d9e4c963543b", "comment": "Malware payload (Vidar)", "value": "bac9e3ebeb6e4ccd3b6766fabdb8fa16cacb04980c81877ceab8c01f194c5ac2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749833, "uuid": "00577fb7-cdd6-411e-9c58-f5d1cf6fcba6", "comment": "Malware payload (Vidar)", "value": "b50eec23651aadf50c018b060c587f8a05807e31", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771749833, "uuid": "e3255c8e-bcbc-46c0-893c-3c8dd2614083", "comment": "Malware payload (Vidar)", "value": "528cb4a648b074c0db8dd0d47100a6c83bfbcd42cf8e917a619312b9bb83ab6f1d925aa99d045b1b27abd99c1464844a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749833, "uuid": "1d56eda4-4c5b-483c-bfca-872bbdbf97c1", "value": "T1C7E55C072CE499D5E0AE93359C66D192B7357C084B3037E31B91767A2E3A3C45E37B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749833, "uuid": "32cef003-6d9d-4114-95b2-8f7f15ceaed9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749833, "uuid": "59c5e391-1ebd-46e0-9f99-8a6d25de39e0", "value": "24576:L3NBfp53L4vcJThtGFKQc1wyXMP2XGJ8iRVN1JI6Ga2aGrS3qhelet29m9cnd4Cy:L3DfjL1ThtO3BbI61aad4CBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771749833, "uuid": "7db03bcf-aad6-414c-bacc-56de7b3f94b7", "value": 3078656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771749833, "uuid": "a60df831-b894-4055-8a96-b6549d361b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771749833, "uuid": "1b7030c3-47a4-477d-9b4f-293dbdb99a19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dd1d82-1006-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771775435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775435, "uuid": "19f7769a-b45b-4919-b0ac-1449a03bfcdd", "comment": "Malware payload (RemcosRAT)", "value": "3e2d917929fdf6bb434ef6ef548557ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775435, "uuid": "bd300a49-a1dd-405a-8687-7e34c7e2e1b2", "comment": "Malware payload (RemcosRAT)", "value": "bb069ae21ea35f433754f782cc0b4d2e8334e2e2ea435c2a5de49b6efe7a371e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775435, "uuid": "3f5f1124-65db-4f9d-a02c-23763dc14f6f", "comment": "Malware payload (RemcosRAT)", "value": "e56e50baf126498a7fb312d0c4eb24a65b6ad8ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771775435, "uuid": "db8eb3e2-d5f5-4799-9fff-867e0f9a207a", "comment": "Malware payload (RemcosRAT)", "value": "d2d8dcd2105f771d41b4b35729e1e7fbcca4a5f17d3774cc31ac9ac9111a221b61451b2c9eb5b921e37b903e64633251", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775435, "uuid": "d798b97c-9b4b-4163-aca4-2074ea4b70a6", "value": "T13E96125045B35BC788324E9FCAFCA1C5BA31477FD84B8559B4BDC7DB8A8629E31A0708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775435, "uuid": "5794d1e8-2a79-4577-a389-b89c2c68a886", "value": "3072:lh2tjJryxEZAjM3LbQbawLbNAaL/FRZAZr:lh2/bbQhbNAaRZAZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771775435, "uuid": "06fcf7ad-412d-4382-8560-bbd8c63fe98b", "value": 9024191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771775435, "uuid": "d5f4c9b2-abc8-4f82-a424-1ed0ef4d3fc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771775435, "uuid": "1a8febf8-9009-45ec-8872-cc8199c34ee5", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdefd84-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768729, "uuid": "b75d6056-036c-4ead-ab79-e1f45b25a9ae", "comment": "Malware payload (Mirai)", "value": "0e6f3df3500c3ae1343a1395debe31a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768729, "uuid": "e058491b-63c3-4353-8cf4-3c792d06a89b", "comment": "Malware payload (Mirai)", "value": "bb7fc9a9882e643981b9cd169226fcd35ab48d52f23da6940c383927d5128890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768729, "uuid": "eef60c44-b346-416f-a835-c71b5a9b2e7c", "comment": "Malware payload (Mirai)", "value": "ac339c34cdde8912f58a1329ced10c0d7308b238", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768729, "uuid": "a99c15dd-ac89-47f6-b639-87938e11fc49", "comment": "Malware payload (Mirai)", "value": "3cddebb083d02a55bc54c9904399a9e13297f8c18346a39b90b5a06dc794db365be66231324a63c82b66ffa03354bea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768729, "uuid": "41ea6566-7300-4d47-9632-b91ca3f24faf", "value": "T195B339C1BA43D4F5DC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768729, "uuid": "ca4bee08-c317-4038-8581-8d0486c73979", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wkzSr9bMFfla:Pbj4doYGFB0/45gdY9ula", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768729, "uuid": "f34698ad-6a76-455d-8132-9020e4305c09", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768729, "uuid": "d6eb57f6-c0e7-4914-b418-e63e7298296b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768729, "uuid": "69b58bfb-5213-4676-a81b-9f1cc073e0d5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4b0cd0-1009-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771776833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776833, "uuid": "1c2aecb9-8d89-448a-ac93-cea170afaef9", "comment": "Malware payload (Mirai)", "value": "7b6638396db3a5cdb99c01b4394bc94e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776833, "uuid": "37d8c203-e468-42c1-a7e5-4c6f3099964b", "comment": "Malware payload (Mirai)", "value": "bbc7cd8937f3e749f162870b0e139e39f8ad64b146c76a0d784ee0009551a034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776833, "uuid": "0d674418-e981-480c-9c9e-a3f464b69fac", "comment": "Malware payload (Mirai)", "value": "e0114f32b88e1b98302eaf3851c3328c384cd01f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776833, "uuid": "13d5d4d9-4c79-46f9-af81-3ff1b6a3e10c", "comment": "Malware payload (Mirai)", "value": "72617e5a5e3970e2d3ed5c8046605d247bfa438360fc01ed8814f40efe471134fa5cd447dd5663d8c3aa1c42818ca8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776833, "uuid": "c21fb2cd-88f5-4914-b0db-a637b7c0d4f3", "value": "T118E2E1D646B7A8B9CEB10D7BFC630A4D252DC6FC86FB112367F4372427B19964AB0052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776833, "uuid": "380ec7d4-77a8-4972-a543-20a83284fb8a", "value": "768:x8Lm6COq1fewdHy62pud4yNOYSOyB8LrC9q3UELdO:iLJCmjpkcMKUTLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776833, "uuid": "da0af5c7-14a4-4fd1-924f-9dcff23cae34", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776833, "uuid": "1eaba8c1-4cf6-4e90-ba5a-2562796490e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776833, "uuid": "c1f5feb3-ffc4-42ca-bb9d-db4f271e3da8", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eadc56b-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787871, "uuid": "fc7ec939-d892-4cdf-8dd0-d757884e37ab", "comment": "Malware payload (Mirai)", "value": "cc48e416bc53d64e6371afe18229f126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787871, "uuid": "0ff42421-1057-4368-9d24-785ca4a2fd41", "comment": "Malware payload (Mirai)", "value": "bc646b07c9d6d50f40fcb858b380fe8d89453e7af7660f11c96c0e2b907ba591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787871, "uuid": "e3de27d1-8856-4598-8327-db3e21a357e4", "comment": "Malware payload (Mirai)", "value": "e7fedb81445c8cce2a0c9e363b5eb544a558d1a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787871, "uuid": "29e7ecf2-360a-4a1d-aeb4-2e7410f46921", "comment": "Malware payload (Mirai)", "value": "b098dff28fa7cbf07f3ab635937f79007b81abfa5c823a592bb56fc8de9bb8941aee74bf33d633963d5c548472051d9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787871, "uuid": "96929242-1ccb-4afc-ad13-9c7411a0164e", "value": "T14AC3AFA7F78714A1C86206F003C71BAD2E972122CE5FD9F3AD5DB63B5A3A0DB0516385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787871, "uuid": "7c22e9ec-5f41-4bf9-87e6-f18e0e1918d1", "value": "1536:zx2xa35PqhcV/FrL5vHGWObAfb/DSLs5lp6HcAHgxxMZSgA2Er/LWS:1p354cPnJmvuCLs56HcAHgpgwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787871, "uuid": "ec44a806-a1f7-412b-a188-3496a49ae249", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787871, "uuid": "c979c3fe-12c4-457b-b0ee-74d0f1ced1bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787871, "uuid": "df7451b2-8643-48c2-8f08-7cc42dacbe85", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d96eafc-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1771768972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768972, "uuid": "2968363c-ce1c-4795-bd00-1ef0080ab02e", "comment": "Malware payload (SimpleHelp)", "value": "bc45a7c1d98686917919be60b4d92055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768972, "uuid": "ba4efb42-1102-478f-a300-21f17696150a", "comment": "Malware payload (SimpleHelp)", "value": "bcd9bdc30b2c961723e5354935331b648d87eb683c57b5c91088fc5f0685a913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768972, "uuid": "d2119557-4ab1-44c9-98bd-ec6ff913f4d4", "comment": "Malware payload (SimpleHelp)", "value": "5415142f9a03415047707d7136212bad6403e6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768972, "uuid": "babde132-e059-4d79-b0dc-01233d60c88d", "comment": "Malware payload (SimpleHelp)", "value": "73d3ef7feaae5495592fcf39e862ec7ae7105e016b61f4b5033e57a7bae4227a3664d22e9e4349216892726a96b04c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768972, "uuid": "3f34f866-c942-4408-9953-7fa222703660", "value": "T1A5873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768972, "uuid": "6db38a83-96bc-4a17-af14-8c8001b689b7", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768972, "uuid": "928af055-81e6-4302-b0e6-915d7d7e915b", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bJ:/uRf+nAu2FuQd73XyFeDMnKTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768972, "uuid": "73f76186-0bcc-4047-b408-f1d65aeabb4f", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768972, "uuid": "78a51443-c6f1-4b0d-9d9c-b4385883a5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768972, "uuid": "3034fbe9-cdd9-4be8-89b2-c31c7fbb7d3b", "value": "Concord Fax Viewer_2.0.0 .scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8bd1b9-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766393, "uuid": "846cb858-9842-4554-91ce-60e3ad574547", "comment": "Malware payload", "value": "d397a11c3c8f8543bc016295bcc648d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766393, "uuid": "8f92ef91-7d85-48c9-a58d-0a1c3ecd20bd", "comment": "Malware payload", "value": "bd03aa955617ad86e37e649e1d4c466a5666cb0cd08ea58d2aaf072ffa9ff3cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766393, "uuid": "4078aed1-fef7-41cc-9104-028ea2a34a4a", "comment": "Malware payload", "value": "c8cc7f5698db48bb57c3514032e43c040ed40f38", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766393, "uuid": "18f24f6b-fa66-41df-adbb-6df8a1e9bcfe", "comment": "Malware payload", "value": "b7b6c181ad8777cd6d1b9e23bfdcb73de202aa647b9f369178ba2dd388edf2fcc02d0abc1dd0a7df221b80921a21367b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766393, "uuid": "f3f61555-eeff-4ac1-88b5-a3a0179f31cd", "value": "T1D0F109B425F14D332E20AA80F33727B6ABB7D45349E3218C35DE1D25AF96B12B4BE415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766393, "uuid": "acd02d21-dd11-42fe-aaad-f90a7f8eb77e", "value": "96:cRuJY8kQX+YT++GkV4jJwIBvIBXIBiIBRIBsIyX:cRuYOdmGUIta3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766393, "uuid": "53755474-dde7-4b31-9dd6-24cbebb6e2ac", "value": 7543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766393, "uuid": "bb5b3662-0928-488d-a240-6e25b95f06f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766393, "uuid": "92a68cfb-cd41-4ff6-a697-b4fbf3c1a507", "value": "bd03aa955617ad86e37e649e1d4c466a5666cb0cd08ea58d2aaf072ffa9ff3cf.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6cd0d0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766473, "uuid": "c464cc03-6540-43b2-8e7b-b99555829bb1", "comment": "Malware payload", "value": "8cf588b798abac7028a4eea66ec4e03f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766473, "uuid": "f4946fcc-91d4-4dd5-9577-fb0d38e3cc39", "comment": "Malware payload", "value": "bd46906d64f2f7999dcf0e1f6620e27e53480cc6a4baf2770dcd4c67527c3246", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766473, "uuid": "da186682-3553-41db-9426-aa93b0a0ad0e", "comment": "Malware payload", "value": "37614f0c60b2d5d3def122c5dd4416b3be1ab44c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766473, "uuid": "ea0fa37c-2d73-4bb8-8e0c-a2ec193d431c", "comment": "Malware payload", "value": "df948c522de1956240e4f9a17aa7017f9c95c3d908284e43150a64620ded653765eb94ef75244881b229bc0ffdbfac3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766473, "uuid": "1d490c4e-c3f3-4228-99e1-955fb5d51aea", "value": "T108226E7025F04C732E316580F3772BA6ABB7A85749A3318C35DE1E265F87B42A5BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766473, "uuid": "61b4a66d-a919-4a47-8afc-81d16df9c28c", "value": "96:cRu4sjOUw5v+lkab1P14XsrGhtojq55+Whm6Q6fu6fX6fC2d0:cRuVWhh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766473, "uuid": "3defb69b-407e-4cdb-aaf6-5a79436e13ae", "value": 10474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766473, "uuid": "73c0058a-9ddf-46a8-a768-429aeca0dd25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766473, "uuid": "78b50b80-766b-440e-9c2d-58030ad07dc6", "value": "bd46906d64f2f7999dcf0e1f6620e27e53480cc6a4baf2770dcd4c67527c3246.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d6e641-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766306, "uuid": "03ef82c5-c8ea-4264-aec5-c41aeb3a08eb", "comment": "Malware payload", "value": "35361da2020078c5f766cfb9cc0a4b54", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766306, "uuid": "492ca169-0062-46d6-b579-7ee5ca2953a3", "comment": "Malware payload", "value": "bdec7d984271432108939a6364481bc52065ae266ff692169951838c178af10f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766306, "uuid": "e62b4f39-f86b-4727-97db-5bafbf194e67", "comment": "Malware payload", "value": "b6d4ecc1b308b53e2dd24e47f9d1957d958e1613", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766306, "uuid": "1bd081f9-d4c0-40b9-8525-4d9f23246ef3", "comment": "Malware payload", "value": "ea53c12b7885be3bbd8e1f8c2f0e9c645082a4c87d1e5381b41c70e1fc3ca5603d55832228dc1731569a5b8158b9c91c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766306, "uuid": "78a48b46-0ff3-4fc1-8dbc-32fa2a4ebc55", "value": "T1B03103B035F188332AA06A40F3732B6A7BB2984744E3218C75EE1A355F87B02B5FF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766306, "uuid": "2ebfcd8a-295c-454d-8739-df23c9d4d4d0", "value": "24:cniRHRURCxO0tbmN2M1sLobHxlc9HHE/XDCol3H/+5oXDCol3HVeN:cniRxuGRys01lwnE/+ol3m5o+ol3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766306, "uuid": "cb90dbe9-f8b5-4658-8c83-fd7eec768e4a", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766306, "uuid": "572eb849-b120-4967-a27d-c02233247a76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766306, "uuid": "c0a45d89-9121-4bff-ba39-5043d6bfec9a", "value": "bdec7d984271432108939a6364481bc52065ae266ff692169951838c178af10f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea860c76-1007-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771776161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776161, "uuid": "44f58653-1080-436c-b8c9-3d0772dbfd3f", "comment": "Malware payload (Mirai)", "value": "5d08ee73c89c626f61814124aa69d4b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776161, "uuid": "05e4a2cd-1664-4c20-b665-07c414721e32", "comment": "Malware payload (Mirai)", "value": "be0c40749c9942a0388decbd8616ba0a8715819923afeca1d7d9cd03ba22b340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776161, "uuid": "809f7f86-ebae-4c39-b872-26a2e4cd19c8", "comment": "Malware payload (Mirai)", "value": "e9d292396db7e87a03ebb5ea3656348f838076b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776161, "uuid": "aed29f56-a357-4be4-8008-2afb0a1592d5", "comment": "Malware payload (Mirai)", "value": "014da6e10f98361dee4148853e09fa48d939edea040864f89fbdd57be5199bf2f4de4cc228529ece9eb29865fe079e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776161, "uuid": "c9f8ab44-f910-47a5-8f50-a30d024d8b5e", "value": "T16DE31945FC414B67C6C212B7FB5E428D7B2B17A9D3EAB2039D255F20378B85B0E3A581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776161, "uuid": "ce05ee14-5265-455f-b97c-2cf07e0a0c82", "value": "3072:EquVG6Uy9Um2HcNbw4uFvlE9dpxp4Z6EQ6hh1xI:EquNUyGn8Nk4adE9/L4UEpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776161, "uuid": "99fa7f2d-dbad-4ba1-97d0-f42be22a537c", "value": 151072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776161, "uuid": "ab17653d-38fb-46fb-8ffc-039acf5ea3e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776161, "uuid": "d041a27e-8dff-46b7-a71c-dcd59fea4706", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a2501c-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779476, "uuid": "aee4e56c-0504-48d1-bfef-c8da4f7031ca", "comment": "Malware payload (Mirai)", "value": "543d0ca6668b750ce996d0fa326e36ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779476, "uuid": "49a6fe99-56f2-439e-8ab9-300c4cb8bb90", "comment": "Malware payload (Mirai)", "value": "bf0d0f573387501631acddf9206b507b6c59520b039329f0e43eb125d1f1444c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779476, "uuid": "e5db367c-9a17-42e7-b596-6b7ce207cd97", "comment": "Malware payload (Mirai)", "value": "d23fa76335bac1d880f8b86fcdba459d59ae5da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779476, "uuid": "4b51e95e-f039-4459-bf4f-a5c35fd639c4", "comment": "Malware payload (Mirai)", "value": "0c722720f317aca3589bc7f61d7bcfc71b236936d72946762ca014594813f4a993fdd000814ee180a44462d08f73c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779476, "uuid": "be293f7d-fb79-43d2-b157-30fa70045738", "value": "T1B233F7C5BD91AA28CBC04A77EF5F115E3300A7DCE0DA73438C0C1BA575CA90F5D66A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779476, "uuid": "12217941-34d7-4aa4-8fff-069f421741e4", "value": "768:xMZxWmICgvLEzFTd8tqCBnSbVB09GmXFVU9Y3W7wCVy/Jx+5H8hG1rmCd/574y70:2+hzEv8tbAH09GoVGYceZWW9h0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779476, "uuid": "58f03d8a-e0d0-4e3f-86a6-a7b7db277059", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779476, "uuid": "135c4960-ea72-4617-ac7c-f420e95e2503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779476, "uuid": "cf832df7-0be4-477a-9fad-82e0257769a0", "value": "purves.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f75befa-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766451, "uuid": "f13e6d3a-19bf-4455-a737-ad5184845081", "comment": "Malware payload", "value": "538d90c33501ded274678fdcd0646a25", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766451, "uuid": "32e8e29b-0b05-425f-80b1-d01caadcb9cb", "comment": "Malware payload", "value": "bf66395217e33389cfee68217244c9361f41706eeba8cb6ba40cf235708506a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766451, "uuid": "63ba6fb5-19f9-4984-b3de-3609245789bb", "comment": "Malware payload", "value": "71dafa3087a329719b1245049bd58f8f656d4660", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766451, "uuid": "24961b78-fab3-4d1c-b7db-0476b0beb713", "comment": "Malware payload", "value": "629c5da396808d2e442a7000efdfbb2f310ea079d0c30a6aee3cd3af2b1138efa0a6663a5a08830fbc3535b9276aac61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766451, "uuid": "6b97715e-b102-4468-b7c7-c01a25556a32", "value": "T16B32342B21F08B71D3C460D952A65AA14E72A70B992614F5F4BF933AAF2C90731D3F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766451, "uuid": "e73a8cf0-e12f-434d-b6e0-f6ac644e958c", "value": "96:cCuYJB67sht+O+v1fsn+h4+tIiKVC1ymyyQzuKNpUj4waYvjNioVPX:cCuY76C4hvZ5mu9TVKNpivBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766451, "uuid": "e2f49aad-4f08-49db-9eec-89df64e2a8c6", "value": 10942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766451, "uuid": "d1308bba-de26-4feb-ae85-13856cb66f6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766451, "uuid": "d529918f-9832-476c-a575-1be7f5bb7b23", "value": "bf66395217e33389cfee68217244c9361f41706eeba8cb6ba40cf235708506a0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fe7eca-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766407, "uuid": "a6bd949b-4643-43bc-855e-65c7a694cfc2", "comment": "Malware payload", "value": "8f08465a40e7ebf507724fe055274fa3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766407, "uuid": "a5bc3832-a480-41b1-81de-625735fe4d3a", "comment": "Malware payload", "value": "bf949f7ca54f37801b5ebf190792f2b3b858f3f535dd41c2005e511cab9dc819", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766407, "uuid": "f607d9f6-c321-4dcb-aa0e-a6e3d40d5be9", "comment": "Malware payload", "value": "57e4910a9ed6c8809165af3c6e41f91f3e22ea28", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766407, "uuid": "4060cfb3-2a9d-4438-b79b-b9264783535f", "comment": "Malware payload", "value": "9fb0a49af671c4447ec18f297ca67ff5b46d3de77f7be5e61834a51bbb65f18b2b2bb2cf7a3f6ebddca4fecb13257b05", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766407, "uuid": "734db70c-a3e3-4926-9c7b-84c229b025d8", "value": "T17622783B21F08B32D3C420C992A61A654E72A70F452614B5F4FE633AAF2D90371E7F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766407, "uuid": "e77bed95-24f1-43b9-b1c1-3869c8dd2e82", "value": "96:cCuisht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvj1XIZrCoP6fDpC:cCu34hvZ5mrFoKNpivJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766407, "uuid": "0a15db1f-8c4d-44bd-9fc7-adf1e891ce56", "value": 10441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766407, "uuid": "993fe39e-58b1-44b7-a482-e5c9c2308310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766407, "uuid": "e6c08575-9322-4881-bd21-6b0d5cb05559", "value": "bf949f7ca54f37801b5ebf190792f2b3b858f3f535dd41c2005e511cab9dc819.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c019e7-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768737, "uuid": "b01da096-3735-4263-8b1a-9873ed93e3e6", "comment": "Malware payload (Mirai)", "value": "473ac437fdefa993e875a67436fa6f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768737, "uuid": "ac07d6b8-7bc7-44e7-8b91-863274359019", "comment": "Malware payload (Mirai)", "value": "bf99f3fae41b891b7a76f6084a7b8ef40fd8f7a348f0a3caa78abb83b0e75d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768737, "uuid": "a94e2b25-8e51-4852-8d2f-e9ef05fcd45b", "comment": "Malware payload (Mirai)", "value": "6b3be68b25a12e5c06343854465aab851db0c699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768737, "uuid": "ecac30d0-e163-4af8-9a4e-8811e6d705f9", "comment": "Malware payload (Mirai)", "value": "c05f3110af787353aaae001780556b242c168648af35a842b68ee60407cfdd9a1df27ef7e434a1f044e58b6c4c52d6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768737, "uuid": "f7566693-092b-4cb0-bec3-a1196321f6b2", "value": "T1BFB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768737, "uuid": "ccb219c8-5030-445a-9c82-10ad5ebd9d0f", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wtzSr9bMFflX:Pbj4doYGFB0/45gdd9ulX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768737, "uuid": "9aaf82b7-c1c0-442e-b141-aa6f19e0bc83", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768737, "uuid": "4c396e05-5b6c-4a2e-95bc-1a202342b894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768737, "uuid": "5d104756-5fae-45cd-b373-d3246635e62c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4881d3-0fd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771753108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753108, "uuid": "792d7454-9f03-408c-b230-9a8faa24ca75", "comment": "Malware payload (Mirai)", "value": "c4cc85476684917668d4051a3ad20c97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753108, "uuid": "cf5d8b57-8cc8-4681-8cbb-064508ea855d", "comment": "Malware payload (Mirai)", "value": "bf9f9ce8bdfa8766baf6602c1d3ec01a309d6e7af6c25b6935b708408af947bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753108, "uuid": "beaf0eff-c2ff-4534-a5d5-fd03cd146430", "comment": "Malware payload (Mirai)", "value": "95c99f32641311917030b2b703e347f4a61b0332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771753108, "uuid": "87e3d6f3-8210-4f45-892f-8a008b7ff794", "comment": "Malware payload (Mirai)", "value": "c4da308b0c9f0c984054f794f6afbe00f497b500df90add7013b6d295eb768b875c0fac36af434bd492c79aad6d847d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753108, "uuid": "0fecb447-2f41-4ba7-b2b7-c0206c57b3d1", "value": "T19C230851B8818623C6D0127AB66E46CD372563E8E2DFB217AD221F503BD682F0D77F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753108, "uuid": "0bbf2d3e-c194-4df8-9c62-c5649d9ba977", "value": "768:k6pivE2+4ZNsNSOgVhtPift1z9EH/hgih55XiocsK3wn/N+2ZmmOVL1wK:avE2+gNs8zQ5URv9O3wnvZei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771753108, "uuid": "3cf6f0d7-565a-422a-a27d-3c818b56eb1a", "value": 46812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771753108, "uuid": "a91636b7-3750-4920-bbfd-09e458f3dfbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771753108, "uuid": "1ab05a6b-8551-4a39-acba-47ca724ed78f", "value": "bin.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7476b3-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771750075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750075, "uuid": "62e52e0d-fbcb-4611-81f9-4ea0ad9f6d56", "comment": "Malware payload", "value": "d31bacaee75573402048ee381f52b635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750075, "uuid": "76a7dcfc-8730-4530-927f-45dc9428d787", "comment": "Malware payload", "value": "c03982486831a46ffda259ab72db17bf4b4511a92deebe06b867d60583e2f195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750075, "uuid": "e11a4df4-7496-4e01-9cd0-8a7ebdce8bd0", "comment": "Malware payload", "value": "7844dca3e72a00e843163e89e3db57f40adb5402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750075, "uuid": "912ae91e-23b1-4a86-bb2d-c5465e1c1374", "comment": "Malware payload", "value": "5dbb0b10fd9c069ae8f25c597cc93ba879a3b1eb9d56e30c0cced08e78a73cb8ba261cd4413256c729e19fbb7db5ee3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghostweave", "colour": "#0E9018", "exportable": true, "hide_tag": false }, { "name": "kz-targeting", "colour": "#0D6ABE", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750075, "uuid": "32d7ea5c-c713-4a13-a3a8-b7af8a344357", "value": "T13C711AE61A1CF4E3DB4307BE5687521BB6B32832936383259218767C5006FDB1309F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750075, "uuid": "03ef2688-5337-446c-80ef-5c5fb36727c4", "value": "48:eZarhfx02nLNCOkyGN9qNo89zJnVdEZxXAx3ksh05IWzqL5:+cL0ELZ/0EpnjPOsqIWy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750075, "uuid": "d798680a-8f03-43d7-a20f-90774b00ce7d", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750075, "uuid": "d3953366-2bb0-4725-85a8-5ea9a122ace6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750075, "uuid": "01750b3d-d0de-4b5f-965f-eb2544fb94c7", "value": "winsvchost32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a15856c-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766416, "uuid": "df3fad71-38f9-4518-b858-b78f68d66819", "comment": "Malware payload", "value": "c786f62101db4c9e3f716dd1014f69d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766416, "uuid": "0b381504-8e13-43de-9e32-b40313840d77", "comment": "Malware payload", "value": "c04d029bbeeda1ae8957fea1291d5009bc6a0fa175f7af73f3e0c79fe05249ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766416, "uuid": "17546ec0-9216-4de1-8f97-3070d9a9f0ee", "comment": "Malware payload", "value": "13082558964fa731926027a87b3aee70ea2b2f06", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766416, "uuid": "8c94f296-11ec-49ac-9585-d9b31c9556ef", "comment": "Malware payload", "value": "801265c41ed0dc0a66affe37826307967a050fa799b2e4bbbfabde65f9e19b7a1ed58bbdcf1967dca29db86249ad13f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766416, "uuid": "ea0abf72-ac8f-4252-b897-da21fe041277", "value": "T1E621E97011F558232A146690B2731F56BF72DC474993168C38EF6A397FA7F43629B023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766416, "uuid": "f548bd9b-fc19-47f0-b563-f7962f1f2158", "value": "24:cnnRpR8fAR25H9HHIuCzCRpYdZUX32X37FgZNuPl/HUeN:cnRb9RCnB6/FgOPl/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766416, "uuid": "fbe2c01b-1d6b-4b3b-86da-ac195450b643", "value": 1145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766416, "uuid": "89f1b9b5-f13c-4a5e-b1e0-2d6df684e7c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766416, "uuid": "5992b223-904a-431c-b5a7-c08e48eae933", "value": "c04d029bbeeda1ae8957fea1291d5009bc6a0fa175f7af73f3e0c79fe05249ae.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523017e6-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784065, "uuid": "c026b6c0-7962-4c7f-a02d-87ec5aced238", "comment": "Malware payload", "value": "31eb70dc11af05ec4d5cda652396970c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784065, "uuid": "3d537662-4b53-4971-9289-c69347f7f4b0", "comment": "Malware payload", "value": "c0a7a797f39b509fd2d895b5731e79b57b350b85b20be5a51c0a1bda19321bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784065, "uuid": "92d54603-6e63-4517-a26f-07d712189b47", "comment": "Malware payload", "value": "2aee1f5306e38d080d16a96b6c23895ffc6ee2fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784065, "uuid": "85ca1d68-4a75-4c9d-b2cd-d4997c14c82e", "comment": "Malware payload", "value": "a8cdc7cc820700bd67993de6fbca1563397e88245f9d6b8d2c831b48004dea6a601ea11e386d11e95163b85fdcc612b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784065, "uuid": "199bc564-19f8-4ec1-b3bb-106f4c8b8c2c", "value": "T1E2822B86B7FC8725F8FD97B9ADB306114772B9629D34DB2E0089229F0D36741C412BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784065, "uuid": "6fd961fc-01f9-49f1-9a4f-e2f5aa2494e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784065, "uuid": "6b2cf147-a938-4604-8f84-f060f8eb93c3", "value": "384:roOvdiW1r56eepTYYmz5v+QZ3ENfK1SVqxd44VgW5:9se5GdhtWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784065, "uuid": "5212d401-491b-4aad-8263-507ec9306d61", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784065, "uuid": "34c86626-f976-4f85-9ffe-cb96a600d905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784065, "uuid": "ae748425-bb39-4624-862c-002f3512c2cf", "value": "SpoolFool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b25218-102b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771791478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791478, "uuid": "d51a4633-b658-4521-b2b8-d5f0e00de27a", "comment": "Malware payload", "value": "c2c5d00a64bf0eeeba6f13c14e904093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791478, "uuid": "ad09c4cf-c67f-45c8-9436-0087ef716b9e", "comment": "Malware payload", "value": "c0b79f73b2bccb431d42f22311f68eedeb14fb199fb32ab72c39125605a5f9e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791478, "uuid": "5c6341e5-1b9c-4a1a-b4ad-b43b3c247913", "comment": "Malware payload", "value": "dcf93a8cc6cd94dd9c5012e839d32bc6dce582c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771791478, "uuid": "9c6afd1c-dc8d-4056-9ca6-6303602dcb8e", "comment": "Malware payload", "value": "9b077f19eae5feb34e0cfe18d957dec0aac00e148739b39cfb1209f6a263531565c609d2487bc884196d01e44b9d6916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791478, "uuid": "31dae6a2-6c23-48ae-95b2-4c5755ecef25", "value": "T125935D02B71D0A43E1570DF03A3F67E1C3AA66E021F8F649760ADB4996B2E325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791478, "uuid": "6aa4df0c-c339-4c26-a4ec-9fda4818d77b", "value": "1536:bvOmIUYWYGy8srUqu46DSSMOjwLi4t+x78rIrDqQCTjNLPrzayBhmeu3H:NIUYW8/MpAi6+SU6QClPrTnwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771791478, "uuid": "219bf9e0-bd10-45ce-9733-e66ccd2f1aa6", "value": 97056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771791478, "uuid": "b40b2394-da5c-472e-8797-d82e36aa8397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771791478, "uuid": "b1d3bca7-daff-4fa7-8034-83f091a47e5f", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45318f7f-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766005, "uuid": "d6da601c-8b50-4e2d-a656-015e7e8eed01", "comment": "Malware payload (Mirai)", "value": "e6bd8f47de9aea402eb262461d247000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766005, "uuid": "8ba18598-25b8-40bb-8895-f6078b04085f", "comment": "Malware payload (Mirai)", "value": "c0da664038588c96533e4cabd3388a4f7045cecfe082e4a736bf7b795825fbd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766005, "uuid": "c08cae3d-ca0a-4374-b946-f03883b695e8", "comment": "Malware payload (Mirai)", "value": "8f4f8d1eca3846c94aa88fe78aec667c084b8750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766005, "uuid": "f6d76bba-2e46-404f-819c-2ae0afd8822d", "comment": "Malware payload (Mirai)", "value": "8e492f30fd6574af58dc397705596f403b0c8bf65a3d8094006ed4e4204a0e5b4278b645d0c6597d14c8590923d82459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766005, "uuid": "3686b45a-725d-4969-a46c-f4b97bc930a2", "value": "T1E3933982BD4F80F5D8174870416BF33FCB32E13A4065D75EEF5AAE26DA336426616389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766005, "uuid": "14f86497-656d-4eba-9155-42d57d986baa", "value": "1536:M2+CwDwMt6CP0RMZlfcP6WyK5BeT/w/FYm2qw9M:L+Cw0M0k0RMkjd5BeT/wdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766005, "uuid": "8a5ac082-27fb-414d-a170-dd3686d30ff1", "value": 91792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766005, "uuid": "acfa1b5c-0a0f-49b1-b0f0-e3e9d6c62aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766005, "uuid": "390d5ee5-7e90-4ce8-bb1e-a3deee2c7164", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae50cc9-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738714, "uuid": "c5ba2db4-bf37-4412-a1ed-f0a80232dda7", "comment": "Malware payload (Gafgyt)", "value": "11b0a29ffbad288dcd42ca37700872f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738714, "uuid": "c778d2b6-9c1b-412a-a2b3-b6d1e8b014da", "comment": "Malware payload (Gafgyt)", "value": "c102e0c11b3f3583156a1678e115476bf8f958472a756797544beb60319a1a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738714, "uuid": "10330128-3e18-4e09-977c-5699cbf23bad", "comment": "Malware payload (Gafgyt)", "value": "d2af6f6a5c6974cef9413908142359c76c7dbbf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738714, "uuid": "47f1534e-2e79-4895-9595-aafefe4a6834", "comment": "Malware payload (Gafgyt)", "value": "8f1855c78b0e437bfa5a162be60dd7dd4b18dd3f73fc84eda6b499a326a195e3eb5cd2d89e75150e0793f413bd595670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738714, "uuid": "055e0ebe-b9bf-44a6-861e-6d76dbbfccc0", "value": "T134833B01E643C6B3CC8307B2029BAE661931BDAA5E2A9F49F31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738714, "uuid": "4b242efa-7bc8-46d0-ad11-abaea3eca1d7", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8LXGDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YbGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738714, "uuid": "ee54a4bf-1cef-463c-807e-448b85c7888d", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738714, "uuid": "1fb33b0b-b259-416d-8c62-d52e1724f25e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738714, "uuid": "b82e1a58-d975-43b6-800a-f16b4d089bc4", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce56c2d-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769024, "uuid": "27bb8bf9-488f-4e2f-ade7-a3d8cd235a96", "comment": "Malware payload (Mirai)", "value": "ab0c83c0443daa151bd10c39d2b471b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769024, "uuid": "4710e9b4-e45d-421e-8e79-e21283dedcd3", "comment": "Malware payload (Mirai)", "value": "c106f6175e0d60396ce92b023c038e705c79a30b4aca39bc97f729d155a2da89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769024, "uuid": "e76a140d-e3d0-41b1-979e-29f75d9bbacd", "comment": "Malware payload (Mirai)", "value": "a2c991c6cf8ea7226884a4654e5e386ed2120c92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769024, "uuid": "f15d3ae6-e4ad-4e2e-bbbc-4314d06c042f", "comment": "Malware payload (Mirai)", "value": "3a801b94f810eb59569ab18312ffef273c0319ae68072d26d194cb56efd5d5369201593ba2fb5296c092c7335ebb811b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769024, "uuid": "b1a6b73d-462f-4d4d-9742-ce3fb8f9b152", "value": "T1DFE2F190A5C80E2FCD1E22F1975B915A84F87C06CFDA5FE72F551A9207C72249E36A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769024, "uuid": "b39dc775-1e5f-4ea5-9d1e-b904bf2db36b", "value": "768:7DwnFk7Eqbo5vYG9r2zoev9z/M2Zk4OnxR21Fnb94b:70ncEJh9Gxz//kp21Z54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769024, "uuid": "ddefebe2-9454-4a3d-bd6e-d3750c371630", "value": 32148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769024, "uuid": "dbffa838-f184-435a-a221-e16118c97aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769024, "uuid": "a367328a-8b92-4ba2-95d8-3e63cd6ea141", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d37242-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752441, "uuid": "1ac7ae12-d73c-41c8-8134-98c59d248546", "comment": "Malware payload (Mirai)", "value": "f996034fe2aaf717dd9a562133c1d675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752441, "uuid": "b6d1b6eb-8ac1-4ba8-ba1a-25907349a2bb", "comment": "Malware payload (Mirai)", "value": "c15457fcd80ef1c25bb7746a82848260a8c76f9da37c58a207ffc283f6e858b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752441, "uuid": "7b3042ca-c728-4499-9b15-7ee510b58804", "comment": "Malware payload (Mirai)", "value": "dd18f47c08b819e2ac9cc6011e4c32f2572a875f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752441, "uuid": "1ec1e0e2-aeba-450b-a6cd-0cce362c964d", "comment": "Malware payload (Mirai)", "value": "3443cca4cab7a0003ba0757094bc6d4b8f29fb6d24b9d770a3b68b7c80a75a8a14d37915d23eb1c01fa0415d7fef219c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752441, "uuid": "15ebf676-74f4-415e-a3fe-42dbe5e4bcec", "value": "T1756302CBBEF02B1BC0D8A1B5703814D69C39DDCBF243C6AD97E1E69607394725589B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752441, "uuid": "a565c8c6-178d-494e-9509-819e56113216", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMG5Ng:kaxZLmYKX+t08jmeJhYT5Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752441, "uuid": "38cf1989-17fe-4d4e-bd52-514ba0346920", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752441, "uuid": "17eaa5b9-5441-4242-96ab-9f4f684f5d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752441, "uuid": "3bf151a1-ed82-4b99-8d47-cee5a5fa4b0c", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9822aaa9-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779458, "uuid": "71ae2678-3833-4245-95ae-978965e20e4b", "comment": "Malware payload (Mirai)", "value": "4ad61e508d32f2b6db669d2c96ae7208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779458, "uuid": "1c4740ea-5f15-4609-af52-93f87774f1ec", "comment": "Malware payload (Mirai)", "value": "c182204ac157673c72541482c41479bbebe2f5858952bce75d95fd14fbc5f2dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779458, "uuid": "834ca417-0186-4091-8970-f3188fc8043d", "comment": "Malware payload (Mirai)", "value": "3bfd4585179d45d0a84d23fdc18f4c13a8a611c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779458, "uuid": "42ef7d63-a5bb-4d1b-863f-4c6772c87b12", "comment": "Malware payload (Mirai)", "value": "56fe307f2ac8ef518e5e0c4e9dc25471b70c9f35d555bd36d018b980da057d1b16898ce353d244f9e8e205106aecef35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779458, "uuid": "38e9d817-8f13-47ee-9601-df54fe4b6864", "value": "T1F0630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779458, "uuid": "add24e6f-e600-4526-afc4-bef747eb39d7", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779458, "uuid": "ebec790a-03e2-4971-8cd3-78c76a10ea3c", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779458, "uuid": "94f9dd15-3fe9-4084-b967-e8e9a37b63b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779458, "uuid": "73f64c7d-996d-4511-ab18-e8d08441cc78", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d34318e-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766394, "uuid": "c99c3757-0831-43a4-b9aa-55fa34f3b9f3", "comment": "Malware payload", "value": "a465b52ea783e8bcf6533b60bb2f5b09", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766394, "uuid": "ac60b5bd-f7f7-481f-92c8-f27b1db65c6a", "comment": "Malware payload", "value": "c1c19eb84182a53628ed9346a9536b4e5294ac2b0d514635959d92babae51f27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766394, "uuid": "0832c38f-94f4-4d54-abe9-cba523585b65", "comment": "Malware payload", "value": "02ea216f3a17275f2a3b02a2cc93cb0da6cd8f9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766394, "uuid": "a608db8b-b0e2-4980-b2f6-3bdb7db6edc0", "comment": "Malware payload", "value": "6088eaca50af31d55943e21436c2b761fb76e90890885d34d73c6a5eb46d9f074372aadf8140fa95ec4e0f72f6391888", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766394, "uuid": "6ac67e4e-953a-4714-8356-1b37e1d1d52c", "value": "T1D232553B21F08B32D3C051C9A2761BA14F72970B456614B5F4FE67269F2DA0370EBB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766394, "uuid": "ee39ab5a-8f29-47ec-b2d9-33f47fc8a267", "value": "96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjVMkQfh+tQIBPIBKB:cCul4hvZ5m5FG4j4HKNpiv57YWQEhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766394, "uuid": "98704875-989a-446f-91dc-dce2326d1925", "value": 11420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766394, "uuid": "241882f0-3939-428f-b082-266ec41ca81a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766394, "uuid": "c15064a8-cd66-44c3-af8d-fca1e509af87", "value": "c1c19eb84182a53628ed9346a9536b4e5294ac2b0d514635959d92babae51f27.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab6cb8f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766363, "uuid": "c1fda31e-85ed-4d32-94ab-9a77681e8dda", "comment": "Malware payload", "value": "33204a626b72377e18b3cc82edb8c1d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766363, "uuid": "6699e03e-86cc-438b-9846-653cedd56993", "comment": "Malware payload", "value": "c299c69b4b36e7201e7be9a10cab2408d3ce770bbca740c83f2f378652dd573f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766363, "uuid": "6c0594df-da45-44a7-b48a-e9e26b9ce768", "comment": "Malware payload", "value": "fbe0e8f258112e90f265738df83aff10cbd35621", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766363, "uuid": "84f9c58d-edbe-484d-a6cd-48f1f1f3465c", "comment": "Malware payload", "value": "6ec37508cf5a948ce12b818baa80847d0654fb879cfe963bc5bfcbfa94f8ca4fcb410bf1bf3f2f747d64141fe8a69647", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766363, "uuid": "8d7fb253-7d12-4091-b57f-f00ad71ff1e7", "value": "T12C427A3721F04B72D7D025C8A2661BA14F72A70B496714B4F4BE57399F2DA0374EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766363, "uuid": "284f99fb-e576-4dfa-85f1-53848b5b5c6a", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwauZow6fS6f16fK6fz6fOAAZ5:cCuOC4hvZ5mzjqKNpan6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766363, "uuid": "e4406bf2-3ba0-49a9-852b-0f7a7f5d1315", "value": 12942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766363, "uuid": "bd34686f-420e-4e29-b22e-76c10aa717b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766363, "uuid": "6982515f-5d96-411f-90ae-a8d2ada3be45", "value": "c299c69b4b36e7201e7be9a10cab2408d3ce770bbca740c83f2f378652dd573f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5611ccf1-0fe8-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1771762597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762597, "uuid": "3ac6005e-374f-4229-b6d9-2e715a90cf63", "comment": "Malware payload (PureLogsStealer)", "value": "4fd0dc0fbe64efb0437cc4872ce16866", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762597, "uuid": "f6bf920b-6315-456e-8135-a19a9996b551", "comment": "Malware payload (PureLogsStealer)", "value": "c32bdee0ec38c7821d026ecb4332082d3cfba71650424d853635828ed5a50fce", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762597, "uuid": "418fb38e-e07e-4370-b979-3d2d6cde4895", "comment": "Malware payload (PureLogsStealer)", "value": "5db048335e63ebf2cab1d24cc8ffc95dc3f5596a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771762597, "uuid": "5cba2bdc-b826-445b-995a-47c9532ae06f", "comment": "Malware payload (PureLogsStealer)", "value": "ef325365325b2fb440ff462a349395d33ad2a5495002e7624600acf8f4b01520694f4e77621f8935ad20b1f474407b02", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762597, "uuid": "c46d03ea-11b5-4ed6-8b00-b40ef8496d66", "value": "T185E633CA2B3AC0C1DD9A04347CE591B45727B0BCB8E1B2F03214EB45EA99D7E4D7176A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762597, "uuid": "0da704c1-bcfc-455d-9cdb-8496920e2793", "value": "393216:6cw2aky4UHWQT1w/YBMcPsx4/9kJIWIAMZZS7:6c9Py4qZwABMmYu9XWI1ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771762597, "uuid": "9c2b67c6-7aa6-4132-8f9e-034ff11308d9", "value": 14456832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771762597, "uuid": "cd38e5a1-aba7-47b2-942c-187549d44c50", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771762597, "uuid": "468ee425-d370-4eb0-a7a8-2ea0f02ee6a7", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ef2670-103f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1771800149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800149, "uuid": "8943c35d-e0aa-4830-8bb4-de3d02e2974a", "comment": "Malware payload (SalatStealer)", "value": "f0b781aedb8a2f80a0a89dea928f0921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800149, "uuid": "20930c1d-0e4a-4f87-8414-c405a45106e5", "comment": "Malware payload (SalatStealer)", "value": "c35376b13d938eb932192bfb57d38d6ae9384f070fb5ab4968ed75e3802551a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800149, "uuid": "b1a3f661-d569-476e-8340-dd9d53c6a45b", "comment": "Malware payload (SalatStealer)", "value": "98dd8b49084ef914d21c80d34b748e1a75e456c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800149, "uuid": "4717bb14-e88d-4074-ac2e-ee9f7bbf5a65", "comment": "Malware payload (SalatStealer)", "value": "0534824942b9057a7e5b875ab317de7bfcd9652bb59d9ec6abf5fa73d5a232ae723f1a4bebf47fe83a2c78fc6fff770e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800149, "uuid": "988708a5-02d3-4fc3-a8e9-89454ceacc2e", "value": "T11AC65B51FA8B58F5E9031831415BB23F63315E048B68DBEBFB147F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800149, "uuid": "c1775809-5677-4423-8e3b-143c44317d2f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800149, "uuid": "07f55e2b-c52f-4190-b831-20705f993321", "value": "49152:rHxEgc1eOEaaBUo49JzU5UMjS6yR3MHDdADKqcjT9lyCNW+nVvDNoxPBQIvdifOg:jigc10Bsal9lm+nN/IFcRen56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800149, "uuid": "37ea2b7a-f640-4e1e-87e1-956d5bfc186e", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800149, "uuid": "b9f784a1-a001-4631-a12a-40abd18b2b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800149, "uuid": "b6f967cb-04f1-4732-b1e5-cd1dddbb685e", "value": "1231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfabd6d-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1771779384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779384, "uuid": "9b210a22-dce4-455f-b451-58726ff37901", "comment": "Malware payload (DarkComet)", "value": "9ea1748cce3cdcc937d82ddaa4fb980a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Farfli!pz", "colour": "#73EDBE", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779384, "uuid": "6c1a4a61-15d8-4055-8dea-9e09bf0ec170", "comment": "Malware payload (DarkComet)", "value": "c3e552b187f95df1a59b2f1304c38caff54ce9e94688f67b52aad375ac7c610a", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Farfli!pz", "colour": "#73EDBE", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779384, "uuid": "9719b1aa-dba9-4bd3-962b-eca2802eea86", "comment": "Malware payload (DarkComet)", "value": "c027bd9a8e8702852e585e480cf4add7a4d459ba", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Farfli!pz", "colour": "#73EDBE", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779384, "uuid": "0c13ec3d-52e5-4181-bb61-9cba39116a3f", "comment": "Malware payload (DarkComet)", "value": "70276d82fdda2e5bb3110b22ba9783330d479db84d8aa00819dd9cd421414de3e3c0507a1a03358f908db4c05eeb665d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Farfli!pz", "colour": "#73EDBE", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779384, "uuid": "a16800e2-f1c7-45aa-a4a7-f6619d448f79", "value": "T13C7733617880C1B9D1629E387C377AAB73367F622D64B3679D49F9C41AF30E1CE26142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779384, "uuid": "1e11a44f-27d4-4d2f-b1f3-3de5d209a50f", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779384, "uuid": "6cb09dd2-195a-44ed-95c6-852186993063", "value": "786432:OOZJ5Rk8yMxNoUnSqwGwqGRlCZK2eG96m8ydWKpQY3RPOV:MZMxGOwtvlefeG96m5sKpQ2OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779384, "uuid": "1e5316d0-aada-4938-9c90-d37eab55c4c9", "value": 35405824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779384, "uuid": "1192be9b-d0fe-4211-8087-9b6bf07f0be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779384, "uuid": "734783be-9c9b-4a9a-a872-212e80a00269", "value": "\u8c03\u97f3\u5e08\u5de5\u5177\u7bb11.8.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d3b2bb-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771769039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769039, "uuid": "24202fb8-b877-47e0-b6c9-2f4595dc275e", "comment": "Malware payload", "value": "d18e7bdeec468ef7884eab5c95a5ab74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769039, "uuid": "7e150e4e-785c-4d5d-b2d1-ded4dca6118c", "comment": "Malware payload", "value": "c42b4edadcb0262d01060997d3fe26b58a2b3398aea752a4a3369a7e3d2d1cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769039, "uuid": "397f5a7a-09ec-45fa-a22a-1e747256b150", "comment": "Malware payload", "value": "cfff4c495a243e6c5417cb22c72ff0bd1e7ca0e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769039, "uuid": "06ee3643-0954-4671-9905-4af1561f291f", "comment": "Malware payload", "value": "6269395a1408740edba7e63d3ab5adf4b750e8460dcb1e4617320628511f4de15aef179d7cfbf8876de403544fc50a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769039, "uuid": "2e885e3b-cfa2-464d-a155-58d8eb12a187", "value": "T10FA6339C779402E4F4ABE23E58D0C96F6361B221176486C71BF90D711CB32E9EE76B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769039, "uuid": "68b2abc3-3985-431a-9d01-bb031d9eb693", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769039, "uuid": "6359a863-bf72-4b35-8b46-c0a26d4258f1", "value": "196608:zv90W8UAmAwrbW+t2PKMmjX5g5Y6K4Jkz9Rwpr2Zwl6Htmd8M9q0Zm9F:zuW8GbbW+tHjJp6KLwqdczwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769039, "uuid": "3b563916-bc9e-4c4f-bab9-f610e6a90846", "value": 10249675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769039, "uuid": "a3b76bc7-2cb7-4188-b28c-db8b9025733b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769039, "uuid": "2b8b0bde-86f6-423d-9120-dca35ca186f1", "value": "\u5212\u5b66\u53f7V1--\u7a33\u5b9a\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad35d527-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784218, "uuid": "cda8af05-1115-4a95-84f6-14bb6c4ee499", "comment": "Malware payload", "value": "ea34ec65732e63723618fbf730391cbc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784218, "uuid": "0af4534e-7706-4a29-925c-74bddce17853", "comment": "Malware payload", "value": "c4aed35c30c862c466e504ab4c0ebec8fb4c9a84e24ca02378378fb1693d1caf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784218, "uuid": "695bfe42-7d5b-4ecd-a6ec-ad969be65870", "comment": "Malware payload", "value": "d9f74bb87813ee934c0c8aee41c17b2b607ed9f9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784218, "uuid": "8b517958-bc0e-4344-8635-778c67cb901f", "comment": "Malware payload", "value": "8b1e4599c098f394e0eecc18859bf87c95ba6f9232d3a30ee244a59f8d97ccb1cbf0e8516062398152a9ff47e54acb18", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784218, "uuid": "3bb8fbfa-a394-4373-9786-a7a6a8795dd2", "value": "T13DF2E02ADBDB6631C347B77A20466DCCFD075E17E1EDB26A36A491CCCE22C514603A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784218, "uuid": "69b6eeb5-4628-45f3-847f-26a39bfaee6e", "value": "768:arQP+NAiJQucR7gWUU/A10wzOLJKbjtiTe1o2H3CrpR:aO+WqQuctgdrmwk09iTOXClR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784218, "uuid": "beef25ae-2d88-4d3d-8530-5f5ac24baa8e", "value": 34663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784218, "uuid": "3ca5dd3f-0ec2-4b2e-9b6b-0b3f1faa7b6b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784218, "uuid": "b9f7a4aa-e5fe-4493-b1df-c49780e458d2", "value": "shell5555.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56983a2e-1012-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771780637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780637, "uuid": "8654e909-2ba7-4c0f-978c-e2735292fdcd", "comment": "Malware payload (Mirai)", "value": "2766382ce67a7059008599462a413172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780637, "uuid": "1cf92264-6cd4-429c-aa8a-ff12757825d0", "comment": "Malware payload (Mirai)", "value": "c589bbfc6a883acd6e51b364911bba216f9c9f3a3430146ec64f6c41b81e759d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780637, "uuid": "a230c4f7-de24-4d53-a873-e160577866dd", "comment": "Malware payload (Mirai)", "value": "4497a3f0818aef1e4e5f7ca11873bf361aebad0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771780637, "uuid": "46bf06f9-59a7-41dc-8201-9e98e76e7159", "comment": "Malware payload (Mirai)", "value": "699849470a069816099dfeae217fbf1a4e31b097eb322b679c453b34a07daad8dd37c3f8590d018942e1b7d2fdde25d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780637, "uuid": "b6aa7347-c732-4a94-a663-4ab75ed4bd21", "value": "T125C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780637, "uuid": "3886c15e-0de6-4483-8550-bd2a21ebc6d7", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyyw:VoRNjmj1VGFVrRiyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771780637, "uuid": "cd55ddaf-a8af-4c7c-8b9f-640d54726b63", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771780637, "uuid": "2536149d-ff09-4410-9eb3-edee8886319a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771780637, "uuid": "faea2137-f2dc-46da-bd3e-31cb8bfa39b7", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182f3b17-102a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771790840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790840, "uuid": "7a9cd159-050a-41b3-91e4-8b6097bd9d15", "comment": "Malware payload", "value": "764f6e49b764b8183984ebc2697ebd1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790840, "uuid": "367d7c7e-7de1-420b-8f71-165503ea53fb", "comment": "Malware payload", "value": "c59afaf47e7dc6827286c7f053b5ba1c7df0cb8eae318bd643b68e95daeda453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790840, "uuid": "6e0e3d20-0473-4bbf-8cf1-874de54c3515", "comment": "Malware payload", "value": "763bcb142467ab74c9ca8e096634179e30b76c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790840, "uuid": "4e9d2c69-3582-4f7c-bde4-61cf8a2a49a3", "comment": "Malware payload", "value": "609129cb0fc6ae64947db68ab7d127e6481565663a307dbf6715958fbb894d07a171ba83b98d210bd34bfd634f676a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790840, "uuid": "f77ebf8f-d569-436a-83a5-cc6daa2684b3", "value": "T164F7337181E1045BF073D876A573CC748E5698568756D3FB8ACD8B8A2E271C2B83DBC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790840, "uuid": "6180b1a7-523a-48b2-82f5-b748b345790b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790840, "uuid": "0c7927f6-b1d1-4caa-9c7f-88ef69425e14", "value": "1572864:3fjqEqs/8+VPyAiF5R7mP9daWnp+AJvZlxq7OW7/Eoc2PQEQ:rws/fV0lm/lIAJvZlk7p/nhP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790840, "uuid": "7128a583-1335-4c2e-9763-599e6b357068", "value": 76985251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790840, "uuid": "558884b1-0d35-4986-b3b1-72869e130bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790840, "uuid": "3b94e570-7ec8-4e97-9bc3-d5e1ae3d67f9", "value": "ZcaLoader 3.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc92016-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766345, "uuid": "ffc0b045-0efd-42be-8e08-5f918514abf3", "comment": "Malware payload", "value": "9ab22d58efadbc2951d0b188a914c5dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766345, "uuid": "cb10731f-680b-47d5-87e4-df69052ff291", "comment": "Malware payload", "value": "c5dff53faba54cd3e807eacec317ba2bcd52672bc3843b7a7d9bedd6796d7eb8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766345, "uuid": "da3810e1-967e-41a0-9ecb-ed5ec1b14ba8", "comment": "Malware payload", "value": "826e910a01f4fea0c04057b75352c4cf18fbc4ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766345, "uuid": "924f015a-004d-4732-a9c2-e799966e620d", "comment": "Malware payload", "value": "0887517f8b0e62028d94f9595e7365f46f022983eca3b5050b982a594e9b7b970afbf015e569bd2e19c50ea42dd71cfd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766345, "uuid": "d36c555a-9721-44d1-b976-f3f0b7d57ee4", "value": "T14732B17125F14C333A706944B3772BA6ABB6D95385E3318C35DE2E366F86F02B1AE411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766345, "uuid": "fb6c17ef-f6cb-45e4-95ee-6224d07bdf48", "value": "96:cRuKB6es5FUJRxG22lQxfafW5SKSOSCgHSajmYmFZ6xz6fN6fE70:cRuu6ernThW/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766345, "uuid": "b667d7e8-a50c-4677-a7a2-92ff446eb7f1", "value": 11865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766345, "uuid": "97523013-ef5c-4228-896c-a9a5e7d7dd33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766345, "uuid": "85d7a652-9f97-4ee7-9523-9270ce220332", "value": "c5dff53faba54cd3e807eacec317ba2bcd52672bc3843b7a7d9bedd6796d7eb8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ad5f1d-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787875, "uuid": "86239564-ea4c-45f2-94f4-e7d9b3a560ba", "comment": "Malware payload (Mirai)", "value": "6d55bebf7c23d87bd266c9455561ea85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787875, "uuid": "3607cf13-3fea-4e7d-9702-294c598ef196", "comment": "Malware payload (Mirai)", "value": "c5e006434df7d644cc3f4369ea82bb0540b60a67ee035338479702fe61e9da79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787875, "uuid": "1a83a669-581a-45f6-bd96-2b50c5c63656", "comment": "Malware payload (Mirai)", "value": "5016ad28abefdc8c3946a2a0298dc01514d3d2bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787875, "uuid": "3342d943-2b86-47ff-908b-ca9cec3e1966", "comment": "Malware payload (Mirai)", "value": "e9ceeec085fd51f27bc3c475c421477838ed98e364e75ffff40f755f4db54597fb313fdb7577a9b83c554665c3538ae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787875, "uuid": "f339d8fd-9f40-413b-bb09-921be23324f4", "value": "T135C3B75E6E218F7DF768873047B78B21A79823D636E1D685E16CD6041F6038E242FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787875, "uuid": "d2ae9ea3-c5d9-4332-8412-dbbb512298f2", "value": "3072:v8bx0uMAz3+4iX7SHLWwqnCdAqOY/jw88T2:090uJzOnGHLWwqCX3/78T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787875, "uuid": "16d902ad-8824-4074-8398-97177d61e9b1", "value": 122540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787875, "uuid": "aa0b30c0-4d88-467b-8a19-2739f54465bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787875, "uuid": "edd85c51-b1d7-415b-ad3e-c6e46eaafd93", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c432291f-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771771801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771801, "uuid": "85b3673b-0230-4fe4-aba8-e32851cb9cb8", "comment": "Malware payload", "value": "22d0af801b124238a5675beb3518811c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771801, "uuid": "c031e645-ca8c-47d7-93bc-72fe875ca3ee", "comment": "Malware payload", "value": "c634838f255e0a691f8be3eab45f2015f7f3572fba2124142cf9fe1d227416aa", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771801, "uuid": "170d963a-63ee-42b2-92b6-3de45efdd690", "comment": "Malware payload", "value": "0d9dcfc457dc1133695fb78ce0281d38600dbdb2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771801, "uuid": "2cd1de76-4caa-4d92-8bc5-3898e05689da", "comment": "Malware payload", "value": "68a5a4ca43d390f99936c72573cf6115f2da0ba0e7a80bd55de35ecbc3c681b67d8eed0f52d507b063312d119bd9c7cb", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771801, "uuid": "578dfbbe-2204-4637-8c00-4523c1068fd3", "value": "T1C408333BA187941EE55B13393572A201983BAD617107CC9BA2F8F948D7762702F3EF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771801, "uuid": "dd1f6157-f528-4365-ab79-921c0b2e6dcf", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771801, "uuid": "8d367bd6-8c5f-4413-976f-78466557e2e9", "value": "1572864:kIkPXRgsTTjwAR/wFe2+2mFosxXYl/ZnDFs4+yUgxEhMFmmdTim+:RIhLzwSFymFosxXYbn64+yUgksRD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771801, "uuid": "9ad7de41-1d98-4a16-b06d-3400948b88b1", "value": 78304016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771801, "uuid": "ae48f060-e0de-4bd4-a3ff-97ed784cd07f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771801, "uuid": "384fb038-c613-4c73-a8cb-af56265cf5de", "value": "ms-update32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e7740b-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766382, "uuid": "20566092-20ec-459c-ae8f-7b95b3074209", "comment": "Malware payload", "value": "734f5dc6dec845320fad8f0f914501ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766382, "uuid": "190aecd5-7850-48cd-b1e1-775279a77950", "comment": "Malware payload", "value": "c65ec54f0ecbb7b522571dce4d407b2a40bdc5baa2686acd4b02031fec2e94ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766382, "uuid": "5496ddb7-ed59-4271-b369-71a9f26c1af4", "comment": "Malware payload", "value": "43f52322c1818ee84d1111ba36e64cd93275c056", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766382, "uuid": "11ed7c6f-3e71-4d8d-ad06-ccac354e6218", "comment": "Malware payload", "value": "83f51fe5e8fee21b50436b1bff0110f4d0fd1324a1f477e2b334d87ab81c12bcd336331c14e108fe96f721d2445eeffc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766382, "uuid": "ad8b5ca1-7fc2-4bea-a15b-ed2536319d77", "value": "T1F4215E7890F21D732A1CB84076F327857E73DB26965223E835DE5F974B8AA03625F830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766382, "uuid": "6c2c9a6a-7fb0-4388-b610-76ea741faa61", "value": "24:cniRHRUR6Lo/iPdFHjeef5uZW5FkXdflUlc9HHveN:cniRxu60/iPdFHPwWYclwn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766382, "uuid": "4ee6c4d4-35b1-4815-bc5d-f44cc6ef052d", "value": 1140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766382, "uuid": "4ad28158-3fba-4ff0-ab92-638141794122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766382, "uuid": "498f4358-0bcd-469e-9ef0-62d88fec2cf3", "value": "c65ec54f0ecbb7b522571dce4d407b2a40bdc5baa2686acd4b02031fec2e94ae.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d793ae0-101b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784433, "uuid": "d7012585-8e79-47ca-a6e7-5a4b72779944", "comment": "Malware payload", "value": "ee3280801a1d2678c8b615e43b2a294b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784433, "uuid": "5866dc1f-a85b-47ec-82f3-ac1cef7fbb14", "comment": "Malware payload", "value": "c687564ed6694a9ca13cf92ba21d6d8b3dbde6e6c91d639e7c3b2f99ee1cddd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784433, "uuid": "6fe2eaac-6656-4c3c-9184-147d40df3fb9", "comment": "Malware payload", "value": "559d17f235d88e12b19c21aaa5c9ef8b7a84487d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784433, "uuid": "4b0907f3-99f7-4a80-b516-577dc8204235", "comment": "Malware payload", "value": "c926476d010a688ba1fb0bf38b42bbe64bdb850419d43ad8665fe261bdebea2731ce77cd077d5ffa942a2c66b731f656", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784433, "uuid": "916fa315-9284-4c03-993c-2e905ff22041", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784433, "uuid": "d7437bd0-ca0e-4db9-8c85-b672400590e4", "value": "3:mKDDHD0rSLuDy:hv0GLuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784433, "uuid": "3f5224a7-1666-4530-8467-b3875c046e95", "value": 43, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784433, "uuid": "083b4fcf-5cc1-42cb-b6ff-b2742be597fa", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784433, "uuid": "c0135b5d-f8f5-43d7-a3fa-7dc71202ea0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb82324f-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752916, "uuid": "3ad12eb9-5113-4fc7-b9d2-13558fc3b9e4", "comment": "Malware payload (Mirai)", "value": "460055e2f334493b4eb3ae21a6f67d03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752916, "uuid": "44a79414-d0bb-4272-a970-abb7864ab718", "comment": "Malware payload (Mirai)", "value": "c7e698a05ce1f31a85c30c227ff9e25e83d5fd29d4a1f3ff8da9eefcdf4a1621", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752916, "uuid": "cc0d78ac-0c61-438f-a8b0-b72f48753e1f", "comment": "Malware payload (Mirai)", "value": "15d3d61dcee2d079d1d194a79d7354b6db0d01f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752916, "uuid": "cf8d2e70-4aa0-4102-b1a3-b605a64dbc95", "comment": "Malware payload (Mirai)", "value": "8af28eb47f7e2720b96b2f412612291a1ed925e31a32ac72e7865489d38b812eea0d4bce2ea734c1e34b2d6feea2116e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752916, "uuid": "b61af254-08c1-480b-af00-14c7fa2c98c0", "value": "T10923E707F54380FDC05AC274066BB93EA82675FE1238F2B67BE4E7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752916, "uuid": "8d3e4e17-0b71-46a5-853b-3903204edbcc", "value": "768:PZCjNaOeWibQfTlXmBfOIJ/c1cN9KFf8D+jDeuqxjik6BLv50Ynx2fEj1sxKhN:IjYOeWibihXmBfOIJ/c1cXK++/e5lO5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752916, "uuid": "e90ab337-2c2a-4475-94c7-0a25a12734ff", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752916, "uuid": "f860612f-5611-4eb6-85bc-3e19f71da116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752916, "uuid": "7a364e98-c54e-4708-8a17-960bca894a1f", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaf9d55-100c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771777939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777939, "uuid": "1e160797-3052-425d-9ea1-17e072923dea", "comment": "Malware payload", "value": "fd33b8bfcb90b785b9ed2ccd1e8032c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777939, "uuid": "02430d5a-a94e-4dba-bb79-1877b67d6273", "comment": "Malware payload", "value": "c842452c943346cf0501dafd913f5f891f68c679f7312a9a640156c67c4f1af0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777939, "uuid": "55e6c29e-1924-4966-b9bb-f5106d4be5c2", "comment": "Malware payload", "value": "d2f00d0f8cbcd3adff6c79d9fda056dea35fcd4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771777939, "uuid": "399bf421-ca20-45e6-8e20-c33adacc6fd0", "comment": "Malware payload", "value": "57fec50e82a626534b46ca7df65f2b248fcb81d5ec4d8df0e032ce5d6c824ded3821595bf1eb1b023598c7d112e3d24c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777939, "uuid": "bf3d7524-674d-407b-a1f9-09e9f41de834", "value": "T18DD3BF61F645AC9BD91442B15431C6B00750ACE103F7A2CBB4AEF3BC4AA7A907DEE771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777939, "uuid": "13301abc-a15a-42cb-a378-f58a3878d767", "value": "3072:zJy9aU5REflNsK7ZMmvnp5pAi65ffAzcN3njq:VApcflWUvfpA3AzcNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771777939, "uuid": "7f5f8cb8-715a-4b8b-91ea-7a7ffff6f5da", "value": 140111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771777939, "uuid": "4753ca91-72a1-4b55-a84f-d6287bae4bfe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771777939, "uuid": "11f4f574-d176-4837-adec-a5dab076fc3e", "value": "SecuriteInfo.com.ELF.Mirai-DBL.59453979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af97b635-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750292, "uuid": "8e25489d-29dd-4a18-8939-3943450bd209", "comment": "Malware payload (Mirai)", "value": "007aad8817251111aefb7b221245298e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750292, "uuid": "c9153e60-a4cf-4139-847f-ae58514f5386", "comment": "Malware payload (Mirai)", "value": "c8434d4800bf13bb1c4779ccfc1cf7d2df0ffa705d2d28c01d4bd69f8877f5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750292, "uuid": "04b0464c-daa3-4233-a034-0f8d96b6dabf", "comment": "Malware payload (Mirai)", "value": "b25aebe512c792b0a335b8438bb5591833c88f74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750292, "uuid": "9104da97-c64a-41bf-8ed6-0d646cc02f1a", "comment": "Malware payload (Mirai)", "value": "e6e1126dabdf3558c27fa4335db5701d981bff917c62c73e90e4430a879578d5dc8e43b39734308a3f130307eb452e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750292, "uuid": "862b3c06-4c05-4ae6-92ee-4eee8a4b5fe6", "value": "T1B6F31956ED819B11D5C156BAFE0E528E33131B7CE2EE32129D246F347B8A87F0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750292, "uuid": "af84567a-eace-4538-ac82-7475a70c3b36", "value": "3072:fDw5Qcqgs41ZXEPmFJ5QajQJXW7vLaIgEnFNZTfJ4jgU9TjHawjG:bw5Qcq41ZXEPk9KXW7Da/EF/DJ4jg6jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750292, "uuid": "1af2f38d-e69c-4c42-901b-d5acd92ca694", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750292, "uuid": "ad823e6a-bace-4c4c-aa87-66492bc2f738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750292, "uuid": "0d1d1fe5-aaa3-4bc5-bb22-1a2ddd1baaf7", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a13e05-100d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771778734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778734, "uuid": "56c3f5d7-46cb-4497-941a-2a61f314d70a", "comment": "Malware payload", "value": "c123fe3823803ae55b6f5d1eb4e70c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778734, "uuid": "f65a54a2-502e-4cd6-94bb-ea6970df5c60", "comment": "Malware payload", "value": "c865bf8e60d1774a4d5637d035651bb4b589e958235b12dd60a317b9f3c3d750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778734, "uuid": "1f8cd731-fcd0-4c02-9381-c21e73e42062", "comment": "Malware payload", "value": "a6b5649ce4adabc775b2188a8458717eb2cac9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778734, "uuid": "0dff0d24-5fc8-4924-8f6a-a941e9be5e59", "comment": "Malware payload", "value": "2a2ca7d8a0596cb8c39070ed542d58f9a01661828b1f885a3f31816309eae1367640a80c59282218bd3a65436744d57d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778734, "uuid": "33b07a96-b043-4cac-8359-e29d57698ea7", "value": "T1286628D7B8914942C4E83777A8BE80C872631EBA9B9652176D05FE3C3EBE1D90E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778734, "uuid": "d70c6eee-4a71-4235-aecd-b447ebecde8e", "value": "49152:WCzegw80bzbT72Vb1RLSX0PNW5mwXnR13E5Kii5ohpoMHvtyZ5EGD:WCIvT727ReXCi5rMHvgEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778734, "uuid": "a5d5a747-85f8-4ac1-ba9a-848ded54463e", "value": 7078036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778734, "uuid": "cf7b914d-f470-4f55-8c44-366c14250c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778734, "uuid": "2d54e0db-5383-4b7a-822f-dbb9c5fd18c5", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fbe47f-102d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771792101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792101, "uuid": "eb2de3e4-c374-41eb-92f8-afa80cf95222", "comment": "Malware payload (Mirai)", "value": "337b8aeb387c83a65f4e101cb7277e72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792101, "uuid": "a14d5170-dddc-4b66-b288-f6bc3ad28da6", "comment": "Malware payload (Mirai)", "value": "c978be9ac92513d30398ba5763d6bbb61f9d8da565102ea5f5337d1e119c0c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792101, "uuid": "c0fcf5e5-66cb-42c3-8bae-bc7fa8c25d67", "comment": "Malware payload (Mirai)", "value": "dd152a59d97929beaaa495090bdce1767ebec07d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771792101, "uuid": "7e6ac6ac-a1f4-4460-8e68-02b99b96cf38", "comment": "Malware payload (Mirai)", "value": "147c98fafce7c8d178e24e57e9eef8e8ca3feda5ced778f125ece00c3fa0cdf864ea31fe38b319c3769c550b3da038d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792101, "uuid": "421e9be6-5c86-42c0-a562-501888637d48", "value": "T162F34B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792101, "uuid": "b04f5472-7116-41cf-b3c2-686756315af4", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH/fam:9FJMgWPZr8IaCWReS1WpPeA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771792101, "uuid": "b8366ea3-6393-43b9-a5f4-89c6b2b2d052", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771792101, "uuid": "8f901504-110e-4420-b77b-ba4bc1f39ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771792101, "uuid": "676930db-59ce-460c-ad84-029f92e78e35", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337fd660-1040-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771800335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800335, "uuid": "7e9d6671-0acf-41b7-a8fd-bcd0b0ad4805", "comment": "Malware payload", "value": "ae061e067183c2448f4ece3f0292b15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800335, "uuid": "3706f1bc-e12a-4f9d-8191-696e01aaa461", "comment": "Malware payload", "value": "c9a732be5856bdcd58fb4587ef47e9e8b3efc27bed687460e475f3527ce25085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800335, "uuid": "c209fe2a-aa47-494d-bac8-0700bb91f6a1", "comment": "Malware payload", "value": "7db9a59836dd14f5ee0c908deb0f605c2ec2069f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800335, "uuid": "c3c2d0d9-846b-4c26-81cc-0da299fdc9a6", "comment": "Malware payload", "value": "c55d5a7c6af00258a284a6bc0c56d773bd57eb49e3cc01c9d362932ff5ae2e0a33c7ed9cf82532ab77f0c742c327c1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800335, "uuid": "bc999e13-25db-4095-84ca-4e76b5ec2fcd", "value": "T1AAF6339113940D61F9BEB2FD65C046A793A17C201B618A8B1BB07AD4EDFB0F1DE36790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800335, "uuid": "5ad8af1f-674d-4c9f-893c-5b14898fbd62", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800335, "uuid": "8ab1680e-e4c1-417c-b8ad-8cecfcae9764", "value": "393216:qFo1jUdq1B71YeXygVHsn4qSs50piKzw4:qu1jUg1HYaRgzSM0pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800335, "uuid": "44293d0f-09f6-49e7-a461-ac1cd8a6c22b", "value": 16570408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800335, "uuid": "c95cfb7e-8890-4801-a90a-3ccca0826479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800335, "uuid": "a3618765-5a85-4835-8e81-9b3c848ae40e", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1281edab-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766349, "uuid": "a49c3e83-7e99-422f-9c3d-eba26c826461", "comment": "Malware payload", "value": "6562310e1071998d20da5a38731d0309", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766349, "uuid": "e39ee02d-3587-41f4-ab95-0f7140955f5a", "comment": "Malware payload", "value": "ca05e83ccbd2466c707595073f9fdcb128faeaa8ef26fe50f6fe0071850cc0ff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766349, "uuid": "8581c8fd-de84-4846-b647-1f06d47140e6", "comment": "Malware payload", "value": "71fc357add9045e2716001b3847951d4f4a712cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766349, "uuid": "27c3d54c-5387-4c67-b4f9-ca5ba2e1b467", "comment": "Malware payload", "value": "de7289c6ccbe1a489d3b3e65119f77aea066e0e451ca7e5652dd9bb86b8e421ce37d7286c997387709ea53bd5f3e41af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766349, "uuid": "f369b707-7062-4482-8e6b-435adf12aa93", "value": "T12D82493721F14A33A6A055C4A3771BA14F72D61745A720A8F4FE1A369F5AF0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766349, "uuid": "f3abaf12-4940-4708-963c-315bbab9bf10", "value": "96:cCuhB6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwax7+fkxqH3CFHbISQgl9y:cCuj6nC4hvZ5mzjqKNpUPUHUGLQmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766349, "uuid": "3dfcb177-d6d9-4282-b43d-66ab07202ff5", "value": 18063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766349, "uuid": "dbd93b8c-9026-41d3-ab79-9d8613b09c2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766349, "uuid": "fdbf9ee2-4397-4906-8d28-fba8c85e32f7", "value": "ca05e83ccbd2466c707595073f9fdcb128faeaa8ef26fe50f6fe0071850cc0ff.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687469ff-1026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771789257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789257, "uuid": "0f14fbbf-621b-4b25-a5ad-7fe3ffa56986", "comment": "Malware payload", "value": "51006d557e94eefceb46612bdd8d933c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789257, "uuid": "7f100f82-4194-4686-b86a-9c7b32dbb9ab", "comment": "Malware payload", "value": "cb3d0a249fc1a7ff1a8b8e9d3d0697cbe1c843ae6ccf6ed7cdb03629b0767566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789257, "uuid": "2f6b7e8e-0810-4f1a-abcc-3283c40657da", "comment": "Malware payload", "value": "ea92a3a50f0bca996f65385969deb4307302e214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789257, "uuid": "4af71f80-c9bb-4f2c-88d5-9766550e321a", "comment": "Malware payload", "value": "a79d48afab61767c371325f80c6158af7f0826c58058532362ed5cec86a528398a14f9d3516b299236a862564a2a8366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789257, "uuid": "4b62085e-43ae-4c73-917f-995e5bc23bc7", "value": "T1CCD45BD1DAD7D0F1E56304F0106FEBEF5935A136801ADDFAEA801962B471B916B0B32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789257, "uuid": "0eeaf502-4c8e-4062-adbb-27ba7049c584", "value": "12288:iyZPhW5/aiAhYSh0/NxJQbZFUsd0F9z7G3KGsODagtup+p39U:LZPhWVa5hYShuQTUVF9XqNhDvIM9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789257, "uuid": "faf918c2-69d9-4854-98b9-e250b11949e2", "value": 632230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789257, "uuid": "6c7a65a0-15cb-40ea-a0b9-dfd0c0f39539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789257, "uuid": "3281675e-227f-42ee-a934-47025790b650", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a46a0e-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766413, "uuid": "c1b896d1-1820-49e2-a4be-d9657e977dbe", "comment": "Malware payload", "value": "dd588d69b9ceaaac48371de2defa6303", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766413, "uuid": "7ed68178-c070-4a55-a042-b9c9d71ef1c4", "comment": "Malware payload", "value": "cb798a83053a721cc06063443dd848ccde93705acb6fee86cfd05fd79b68c41e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766413, "uuid": "cfaa7642-7cab-40ea-801e-c8afd36e3261", "comment": "Malware payload", "value": "124bc2d53794b52cca2d5a0c3884571470c19d26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766413, "uuid": "01a28ed1-00ed-478c-bda4-e73b2c585c57", "comment": "Malware payload", "value": "b3eea6cfbac078cbe3ad14e9c4f40b573faa711016eecad8c8be0ac4f61abac89cefeace7856a216c4c1e023ff49896c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766413, "uuid": "2cd9943d-94eb-408d-b765-63a6565764cc", "value": "T15632883B21F08B32D3C020D9A3A61A614E72AB0B456614B5F4FE5739AF2C90375E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766413, "uuid": "ce47c15b-9eaf-4ec2-9d78-292871f5366b", "value": "192:cCu6W6p4hvZ5m5FG4j4HKNpivJVsQCGCndITZI:fJp4hvZ5m5FGGoKNpivJWQCGCndIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766413, "uuid": "bdd0b48f-046e-4b11-947b-d93ab0bc3cd7", "value": 11748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766413, "uuid": "14c9aeb3-5aec-4c30-94e8-4c09d1cc7d51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766413, "uuid": "58b2a640-7d07-4953-9d58-60a6f83831db", "value": "cb798a83053a721cc06063443dd848ccde93705acb6fee86cfd05fd79b68c41e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e37c8c-1029-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771790559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790559, "uuid": "204a55e5-ce38-493b-9174-715885542f06", "comment": "Malware payload", "value": "1cae580190fc114e239e9e5f260052da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790559, "uuid": "994078b8-c4ea-4320-aaaf-6426d87435dc", "comment": "Malware payload", "value": "cc00698aea05a07c23e69b257897aa5813bb37d41cd02e4c8d1ea62db0554fa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790559, "uuid": "0d0eb0d6-6699-4af0-ad98-5e0be51b2d2a", "comment": "Malware payload", "value": "5da226a50a78f9d14fe496a2c2e9e42d722d50c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790559, "uuid": "50fdb636-4eea-474a-a9b1-a9cd58ac090e", "comment": "Malware payload", "value": "687757ed73f41634b33b1bdef9252c080ebb2fa391d440a1885b9b79ff19777deb457794b7290e09405697f765d5dfde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790559, "uuid": "52620a7d-c163-4205-957c-7a9542057415", "value": "T135A36C85F747E1F4E94909B011ABF73A8631DC371014DDABEB94FE72BD22642A11A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790559, "uuid": "70043ae5-b9d3-48f7-a54c-bd97d0d9216f", "value": "1536:J1hQ2dgBnd4rFROszWnboM8htnzDxtoV0/htkUv31QwMgaJPr:JfQlBnWLWnbo1vImfuvgGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790559, "uuid": "eafa3a8a-a75f-4311-8b69-8c33b895b2d0", "value": 99572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790559, "uuid": "348c0a2b-27f0-4705-b3d2-f01720bed2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790559, "uuid": "d8909b57-2fdd-44de-be1e-155b48fb3be3", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717c2dd2-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771770804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770804, "uuid": "f6a500b6-f5ba-4dfd-a27b-5e8ee6839d31", "comment": "Malware payload", "value": "5ed37800ea9f63ee246e71dcbb74f558", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770804, "uuid": "0ad49ca6-e705-4eae-a654-2c4005ff5968", "comment": "Malware payload", "value": "cc62374e22a0bf799a0d4ce8f76222bb09b39576f184ee761eeb85a6a65e4cbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770804, "uuid": "76445e71-7b39-4fbf-a9ef-1c3029215e3f", "comment": "Malware payload", "value": "33994ded1a32af4e3b6f3c87a2e5b3ff7b278e68", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770804, "uuid": "82432aa2-27aa-46a6-8495-36b9a1468f30", "comment": "Malware payload", "value": "e3180fe80dcc6593a16200c6622f56e078ec188ae12c4fbb31353d785b6cdd69bd778485550c55680a52d4af65713cbe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770804, "uuid": "20907029-f35d-4d03-aa22-4e8d92003bc4", "value": "T1B441A5C7375A4A75AD63851F37A98CE4637CE8F5A0E07911A0FC6DE3815BE102985F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770804, "uuid": "deaa8829-5a59-48fd-a5dd-b2363ca31848", "value": "48:vWwPoOsWxjoOsWZ8BZjKEoOsWovsCoOsWPHoOsW6roOsWB4VyoOsW7RoOsWM3oOz:vPs4sua2ksw6sqszs4sOsRsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770804, "uuid": "1eddddb3-e073-437a-ba2b-f93d7cc3612b", "value": 2413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770804, "uuid": "94661276-a32c-4b54-b015-600021679b7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770804, "uuid": "21ab4eb9-18a8-4fa8-a0cf-4338c0442b0d", "value": "zatoempire.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb96053e-0fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1771738716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738716, "uuid": "a80337fe-b2f3-4575-b23b-4a8ae0961682", "comment": "Malware payload (Gafgyt)", "value": "f9649d3ad66c6834814a19188483d8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738716, "uuid": "13214c2f-3322-475a-aff5-5b8d7d661be4", "comment": "Malware payload (Gafgyt)", "value": "cc828ba2e3c4a5eca5f7bd69aa55f253245b984ba9fa474a68642a75c0029711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738716, "uuid": "6ef6d479-b879-461a-8f63-baa041b6d77f", "comment": "Malware payload (Gafgyt)", "value": "0f065dc7f094b4c1b873f4431f73916a030166a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771738716, "uuid": "fb2660a2-394c-44fc-90c8-171d28cbf281", "comment": "Malware payload (Gafgyt)", "value": "f8946465ab5bdac9a2733d673aa0f53707f68309a2e3852ddf989658bce5365030f9cae9ef8139a4206ee933490c7e8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738716, "uuid": "298d5526-3901-4821-a1e8-441c68f98cb0", "value": "T1E5933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738716, "uuid": "f0a263b7-731d-4604-9daf-0d0684667182", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8eMLumXxVqDrstKfz9e:99bzI9dtcaT00MLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771738716, "uuid": "a321800e-f422-4dce-916b-c13f0e8519e6", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771738716, "uuid": "14451a63-156a-4117-98f9-bb95a0bc2001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771738716, "uuid": "f6624990-dfd1-46eb-8e1b-7bcd1f695aeb", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33861435-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766405, "uuid": "f75dbddc-1026-4ad0-a952-5831c27e3679", "comment": "Malware payload", "value": "ed442c3eca2618c808bcc8bc702191d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766405, "uuid": "d1091b3c-fa54-4d64-9fc9-cc33b9a33aaa", "comment": "Malware payload", "value": "cce25fd82a74549fcf92edff10dd4d8f88e615471bdc6d673b68fcab63e9b6fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766405, "uuid": "76dcbbf6-f460-4b17-9c57-b8b3a964613f", "comment": "Malware payload", "value": "6c24ddf0242ea6a7b26fe88c99f072d9133c65f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766405, "uuid": "ee3e5b1b-469c-44a8-ac80-616d3f12ac7d", "comment": "Malware payload", "value": "e8035634121b3d2b8caaad279079c69fba8baa484c6494fe6c985a1d1dd9ec6dbb1dd2e983598517b4154bf52f61c71b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766405, "uuid": "8d308153-ec61-4aab-9d83-133c418c0cd7", "value": "T1C7528A3721F08B32D7D061C8A2671B615F72A60B456724B8F4FE5B259F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766405, "uuid": "d2901488-3d6d-47a8-a305-d6b01a4cfcb8", "value": "192:cCur6p4hvZ5mN9oKNpivvV6PFITVaHviF:5p4hvZ5mN9oKNpivvQPFITVaHviF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766405, "uuid": "9abf2c69-0a9d-465b-b781-d7963b8ec6a6", "value": 13570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766405, "uuid": "520ce430-8e87-42c0-870a-f240937cef7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766405, "uuid": "33fb2be8-2ae4-485c-bce3-cdf3a48e202b", "value": "cce25fd82a74549fcf92edff10dd4d8f88e615471bdc6d673b68fcab63e9b6fe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab86929-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766444, "uuid": "3d89365a-c404-4c8a-9191-8fee16c03dde", "comment": "Malware payload", "value": "6880564dc96593b1192cc3201c4b4af5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766444, "uuid": "8aa5adc0-84a1-40f0-bf14-a2ae2ae12188", "comment": "Malware payload", "value": "cd41362009cd7c72f7f4d8b8100da2dda244fda85406fee662c16a9814927e8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766444, "uuid": "a1291cf0-e941-4157-9696-0fb29276ebda", "comment": "Malware payload", "value": "1158b5b94149f5174d6b4087ceb760ab59f33344", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766444, "uuid": "1bde14d6-1e00-408a-a69b-42f9d999436e", "comment": "Malware payload", "value": "703195fe47eb65caf1be25fbef195d3e7f38729d10c2557fe16376520bc6d2b5c1364efe3ebfd5978bd553c1f1fda261", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766444, "uuid": "4c797347-c34d-4559-8684-4240f4d229f3", "value": "T174829D3621F04A339B9015C8B3771BA54F76A61B456720B8F4BE1B359F1AB43B0EB721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766444, "uuid": "f5d6376d-e5b9-4328-8172-b50262549c09", "value": "96:cCuVlB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjnWa3ImolVs76fqV6fs:cCud6p4hvZ5m5FoKNpiv37vMM0xj+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766444, "uuid": "7ee3ae13-5b39-41f4-9c99-9447624dfc6d", "value": 17654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766444, "uuid": "5544f692-db01-438c-821b-8de17d0106dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766444, "uuid": "6fdc84d3-2ea1-41ad-aa68-6a8c0b39173a", "value": "cd41362009cd7c72f7f4d8b8100da2dda244fda85406fee662c16a9814927e8b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b838546b-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784237, "uuid": "db3e4d36-1e3f-491e-9a50-1e0a4e5d7899", "comment": "Malware payload", "value": "c868690d159de45c5bafefae8ba60432", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784237, "uuid": "3427f8a1-09fa-4041-bc0f-1fc07a3b489c", "comment": "Malware payload", "value": "cd4d96ef363a0ea9718f3f1dbebe2953fb183ee4a5568ac6741ffe447b15283d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784237, "uuid": "9221ef7c-d921-463c-884a-5e2e4038dc98", "comment": "Malware payload", "value": "591b1ed51a8e185f7d38d31de61a9e7f6af86aa5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784237, "uuid": "ff9891d1-559a-4ebd-9b94-67c72bbd7c6b", "comment": "Malware payload", "value": "e42f648288a8e446f72779f5c6b560fd1f3fbc90e5bbb91beea962168fb9ced141a7b4cd6356bcc7e0e5c6b249968ca1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784237, "uuid": "63e95255-b338-4183-a4f0-2135a61cc233", "value": "T1023153643890D58E2DD08727C2A8FBB3746510E8500B276C5A008E68157A6BDFB16879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784237, "uuid": "f766c51d-2447-45e9-831d-cf4e5652ebe4", "value": "24:ELw1K2y2WO/fHsT2ZL3NVTxdeMKso9K09vENvztE3XSLGDJGumo9Hgu4JZZj7W:V1KyvsT+NVTfgEPMSLGDXmYL4hj7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784237, "uuid": "d6c8583c-46b9-456e-b016-ae805156a724", "value": 1515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784237, "uuid": "1714a77a-3e0c-4849-b8dc-eeac3403eb65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784237, "uuid": "497dd5a5-1e65-4fc6-9bdc-2d855a980eb4", "value": "write_and_run.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c3ff48-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766464, "uuid": "90c95964-d1c2-471e-8215-2adf75714ee9", "comment": "Malware payload", "value": "e3c8d3a5474d4e1e193b0e1772aab2fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766464, "uuid": "fd1620ce-048d-435a-85ea-4e7eaa275697", "comment": "Malware payload", "value": "cf3e850a0aeb66ac2cc121e102f448720dd69520aa3eeeefec0f020fcfcb8a79", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766464, "uuid": "dd033f99-8cd9-4468-a06c-633b8d1ad5b9", "comment": "Malware payload", "value": "24631711e4329b1e05caa360b626c6e250e651ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766464, "uuid": "d0d555a9-8a4c-4d86-a5e5-f0c7440a64c5", "comment": "Malware payload", "value": "1c884d2c063df3a53c0669a7f398bcc7c3fb58ec93a08f256d5d6c4a2e334d1139256cd9c37b206c5f92e5fb4284e468", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766464, "uuid": "4a5430c7-cc9f-4562-b27d-5ebaa83f6140", "value": "T14A52343721F14B32A7D054C8A2671B614F72D60B856720B9F4BE2636AF5DE0371EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766464, "uuid": "fae57f52-9509-4d4d-9692-57f5f6d19149", "value": "96:cCu4B6csht+O+v1fsn+h4+tIiKqC1yOysuKNpUj4waYvjmN0xOS+cBAAS12b:cCuk6p4hvZ5mrFoKNpiv7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766464, "uuid": "cbbf3f57-99b8-4e94-a49f-1bf50f301c5f", "value": 13262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766464, "uuid": "1427dbf3-04a1-4974-9bab-5df89cc686c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766464, "uuid": "c5ca8d57-6e61-4363-ad78-6f4db9b7f0df", "value": "cf3e850a0aeb66ac2cc121e102f448720dd69520aa3eeeefec0f020fcfcb8a79.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638cdfba-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784095, "uuid": "878c3798-52cd-4855-bad4-14db49600435", "comment": "Malware payload", "value": "b36523e7232dc4d777864995b32c7720", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784095, "uuid": "778468cc-b84a-43d6-9c22-1c4d294311b6", "comment": "Malware payload", "value": "cfbe6716fd8a4a39a17c9e7bbfe3e3baf48252d44bd4dcc91f77ebed5ae9c5f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784095, "uuid": "1d8b2ba8-f7ac-43e0-8a85-10d0f03b53bd", "comment": "Malware payload", "value": "bc642c4e29da9b16871166b851ddd154146ed718", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784095, "uuid": "82ac2acc-c856-43da-bd94-4cf5789d83be", "comment": "Malware payload", "value": "82ffb16288e8579dbbf9ce5e623ac4cc1af9e74c6b8e932c8ccd558903cd326fe4a452d11731bf2cfb99c8824b6e128c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784095, "uuid": "182e584f-e3f7-4771-817e-b1d9e7df292a", "value": "T1ECF2E129DA9A5565C387B3FFA0466D8CF9075F3ED1DE72A73AE081CC8D128924202647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784095, "uuid": "f150ec02-533c-4730-b54c-b6b680fdd9d8", "value": "768:iZQP+NAiJQucR7gWUU/K10epOL5gyFttihe1o2H3Crpp:iM+WqQuctgd9meOmITihOXClp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784095, "uuid": "102efbe2-4d83-4d3e-ba13-fb62c686b230", "value": 35255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784095, "uuid": "4aebbcd8-b853-4ce0-b7e4-58f76f045509", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784095, "uuid": "3d77a8cf-72e4-46bd-bdcf-18067c97e96c", "value": "final.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1075d0ba-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766346, "uuid": "3ef028be-dd1a-4789-af3d-04bc359f8a3d", "comment": "Malware payload", "value": "5f898b34303ff0e0f1e2dd360a7dd66f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766346, "uuid": "79818e82-3502-4d9f-a7ce-9a851408e7c7", "comment": "Malware payload", "value": "cfeda031e0fe5bd0e117386de2bcddf779e795f7e9c1721af96d26d4919e12bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766346, "uuid": "1e53acf0-da76-4296-a526-5862e76faf9a", "comment": "Malware payload", "value": "131d8fc465014652a680f2a2b04fae56435b4ba6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766346, "uuid": "2bc251d8-62f4-46e1-a3b8-402da76f4854", "comment": "Malware payload", "value": "806f6b8270d84a66f442cec7a985b6ab1541c88748929ee283b500ea237e0c53c3f675a0d6663c353beba1a070731aa4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766346, "uuid": "bb4296c4-c736-4aa9-8e19-cb0c6fbbc6d1", "value": "T1D941C97125F20C333A606584B3772BA6AB76D95349E3218C35DE2E356F87F02B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766346, "uuid": "04dc3898-247e-4222-90c7-1a5617df20c4", "value": "48:cnRu9RnnB6gZvYrmSJYlr8BsJYlriRsJYlrEsOlwnb:cRubB6TW0xkxTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766346, "uuid": "a4bef971-54d2-4b47-9a48-77e8ad878b86", "value": 2429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766346, "uuid": "25b94619-5596-495f-95df-e7fad6b26a20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766346, "uuid": "4b6b6bfd-2e16-424e-ba1b-080f07d6f77b", "value": "cfeda031e0fe5bd0e117386de2bcddf779e795f7e9c1721af96d26d4919e12bf.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0193ff94-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766321, "uuid": "fdb1e14e-d4b1-4486-b91f-7db1ee4f84ca", "comment": "Malware payload", "value": "8ebfad7a1df4d9f1b242d2c32695c29d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766321, "uuid": "e88b78d0-8b96-42bd-bf58-b925a4679c15", "comment": "Malware payload", "value": "d0cf1c9d099df3eadd520574b1721f8a01dcaf18afa31705e3b81d0eb13877a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766321, "uuid": "2a52d011-d6f9-45f5-88bc-847f57e7766e", "comment": "Malware payload", "value": "d594663ad0c94f4f2fa965a0e16ecde376d32716", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766321, "uuid": "1ec3e440-c619-4058-be9a-3fa2f3eb52ea", "comment": "Malware payload", "value": "895cda9357ea53bc50e2118e936c61361f2f9f2cff829f42b18fba7bd8030be247328263127dd5e436d0924cec8eaaa2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766321, "uuid": "f67fba61-2b91-456a-9f45-c60a0dabd008", "value": "T1A312572B21F08732D3C420CA53A64A614E71A70B592608B5F4BF933AAF2D90735E7B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766321, "uuid": "df18af1f-2f07-404a-b6be-04a1a20cb6ec", "value": "96:cCuAmB657sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwam0T/s7Fs:cCuAK65C4hvZ5mzjqKNpdT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766321, "uuid": "214b95fe-3e9b-4b70-8e44-80d8b53b4dd7", "value": 9539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766321, "uuid": "c869d708-55a9-4b64-adac-8768f114ecb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766321, "uuid": "e440fc29-f7b0-432c-bfcc-3537138d808c", "value": "d0cf1c9d099df3eadd520574b1721f8a01dcaf18afa31705e3b81d0eb13877a2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2a3c4c-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766308, "uuid": "d8ce821c-d662-4ba9-a265-60af577f820d", "comment": "Malware payload", "value": "cee5b30a5f8c6ba449d0473fcc55891b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766308, "uuid": "105e8f90-f5fd-4e9e-9944-f4ab1b91f9f1", "comment": "Malware payload", "value": "d0f735d775d6c9343f77ace7f87e13117ed22fc84441cb2ae294f8d0e9bb3d76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766308, "uuid": "3c7c2235-fac6-48f9-ac38-f876718d0170", "comment": "Malware payload", "value": "0b7438000b107b8082f87a09b18bf54fb89aee26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766308, "uuid": "a0c6565f-a415-4180-bbc0-3a8946be26e8", "comment": "Malware payload", "value": "83f86295d7cd4d5e63dac6b72e89fb173938128023b8db5153712d4fb5f1f9c04e13621b05cd5c05c44380ba8f2856c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766308, "uuid": "60e3985f-db0c-4c58-a559-a430d0f01f14", "value": "T14831597440F21D63260CA58062B32B857FB3DF534A5213DC35EF5EAA5F8AA03628B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766308, "uuid": "d4581d5f-6ff7-4840-adcd-e031479d339b", "value": "24:csnRUR8fAR25ob9HHIuCzCRpYdZeZ/iPdFHjeef5uZW5FkXdflUlc9HHUeN:csRu9RHnB6gZ/iPdFHPwWYclwnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766308, "uuid": "37ce7425-b6e0-49cb-85f4-c83edd5b89e5", "value": 1616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766308, "uuid": "294c5254-c360-49d9-a48e-c4676d75c8f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766308, "uuid": "1f66d5da-9144-4df6-b3da-d2d874484a18", "value": "d0f735d775d6c9343f77ace7f87e13117ed22fc84441cb2ae294f8d0e9bb3d76.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2c9692-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784087, "uuid": "f4a971e0-de5d-4f79-951b-7c79c271c4d7", "comment": "Malware payload", "value": "a842f3b57f9d1d6e97c63e8f226c3ab6", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784087, "uuid": "f370dbc8-7c74-481e-8f4a-292047315069", "comment": "Malware payload", "value": "d24d9b85fc0831c3adaadfa77f31051c9a5a39a1a8237ce3e6344b1e2d1a3e9b", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784087, "uuid": "397a0cf5-d9f7-4fe0-90fa-3e5e9d984a1e", "comment": "Malware payload", "value": "2c9e1fba55ef111474cbc8afb9a98e2fb605151a", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784087, "uuid": "d162322c-772a-4b4f-b13f-cc8eacf2bd16", "comment": "Malware payload", "value": "098db4598d6e0828a4e731853af6a77acbf18cb8ad8eef14e90e58181f5578f641ab683f5344bddbe4f213640670e94a", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784087, "uuid": "c423f645-50fd-47cd-88e8-d936554bb237", "value": "T13461EF02DC316CF1E3274899CA524681273B190347BCB83DF2EC8281EF55676B3A66B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784087, "uuid": "1525648d-6867-4831-aa24-a277151d9ffc", "value": "48:UahLk5Osz6+Esj0tsKMbYYisXczrz4TUXySqEijG2MJKgbqVSUR20oIJ5:PhLk5TnwsHI6ikGFrbINVz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784087, "uuid": "53e0806f-d26d-4f77-bdef-0784a45f0cd3", "value": 3203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784087, "uuid": "e72cc666-dacc-445b-9e44-f51134b61e55", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784087, "uuid": "de206e57-f668-4613-8a74-6681290afae1", "value": "cve-2022-21907.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664aa3ee-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784099, "uuid": "f47a449f-b7f8-446f-aa40-38dc1a06c5d9", "comment": "Malware payload", "value": "b69c6fe133e93a7fcf036967d9a73ac4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784099, "uuid": "51b2c5b3-28f4-4b56-898b-f845204ae2eb", "comment": "Malware payload", "value": "d372d58a85364bdce80030573a91c3a51d1e06b238e973cf66e31ae1c4c2360c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784099, "uuid": "21509a11-2555-42fc-97c0-8ef88439e4b5", "comment": "Malware payload", "value": "a08019e424d7a4b4c0a04bd354d53a4cb74e4a4b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784099, "uuid": "aabcdf00-3e5a-42b7-a9d6-62286a38f813", "comment": "Malware payload", "value": "bbd227c232140606c4b830c339d1584be475a1fb315922d0169a60a23cd34505fc6e2db6e03e9e70adb85602c46e9d04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784099, "uuid": "64a7a63d-f27c-414f-9285-abed9c25e749", "value": "T14D227D3AB11A1F30D96BA774E4945B5AEC0C148FF2562D60F315AFB3C5C22CF5264AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784099, "uuid": "4d5bd227-c7f2-478b-962d-6638a02f7723", "value": "192:eEhMOQfFUUp9264wpmGhejb8Q7Z/c+8poF1d3jvvtl8dwesrGxjPmgM:eqNQfFzp92hwYGAjbVcfa7pr1l6wesym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784099, "uuid": "54250181-3ef2-43d0-bc04-d0857641b129", "value": 10697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784099, "uuid": "24dca63a-92f2-4c12-8169-e5e5cc2d334a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784099, "uuid": "a7e9c5d8-3726-4130-93a7-ab080e655a12", "value": "follina_payload.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487c0e33-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769017, "uuid": "fd7d5c57-40ac-4f80-9f1c-1d1a0cd5f760", "comment": "Malware payload (Mirai)", "value": "98e875f6927f5dab23b9593b6df402dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769017, "uuid": "3d91fe25-4ed0-4b14-bd32-bb3bcfab9808", "comment": "Malware payload (Mirai)", "value": "d3ca8f48a6dcda865e71f2a546a150ac9e384dff8a509f0d492ee62e82c84932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769017, "uuid": "72c3dc80-af2f-4b6b-9fdc-03ee9b1ef0ad", "comment": "Malware payload (Mirai)", "value": "ab0624d2fb660e029a459e4a95194fbfb51965b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769017, "uuid": "0c2f41ab-8b70-4ceb-9fb6-ad634a17314a", "comment": "Malware payload (Mirai)", "value": "7ed2d7e6acc558d6545234ed990e713c331070c75a6493868e8edb132a6895a755d397137edc341a5f8986c711aac835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769017, "uuid": "9a905686-4f23-4537-9e00-664c2c6cc9b2", "value": "T152E2F179D424DD61D9FA0E362C5CA783F7B1AE42B3758CD355938EA06320C245C96ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769017, "uuid": "d6e87df0-233a-43f7-827f-a863c896c378", "value": "768:VRBDIocfGz5TRCMoXlHfcUpSwNqk4i4uVcqgw09Vm:VRBDIo01lHfrRci4u+qgw09Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769017, "uuid": "c2b83a4d-297f-433b-9d44-546cd6e0504f", "value": 32984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769017, "uuid": "2f64b6bf-99bf-45eb-af9b-53c4ee2e27d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769017, "uuid": "e8d999e3-c7f2-4cfa-bcd8-fb3f8dd4b956", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849b162a-1009-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771776849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776849, "uuid": "fd126772-5ca1-42b1-88a4-16adf1778538", "comment": "Malware payload (Mirai)", "value": "0458caf8fe409ea87a80ad63900f0132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776849, "uuid": "a9e4722b-b2f2-4dbc-a8cb-7b55a89f2d57", "comment": "Malware payload (Mirai)", "value": "d3f62856c616aba8e182df8c6e19a35ca1a001d24c5dffc431433a6eb5e0c6c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776849, "uuid": "4e2ff083-02b6-4456-b4d3-78b91e9a1145", "comment": "Malware payload (Mirai)", "value": "5c8db03ed8864f355b456e834f5d825b9b5c3aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776849, "uuid": "b5f2f1f6-0aac-4f28-b3ce-f78efb80f75e", "comment": "Malware payload (Mirai)", "value": "3cd19cc1d7a71d4db354258b8021c4d5ba2d16042c3b58cf6920c5b463774ce02bca8078e3b86a63d5fec1b45422f2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776849, "uuid": "abb5b430-52f9-4cbe-b043-8593af304712", "value": "T1A4E34A02B30C0A47D2632EF03A3F2BD1D3EF959221E4F681756F9A8992B1D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776849, "uuid": "1a2426e6-d213-4d6e-8164-bf3c112fbb2f", "value": "3072:e6k6mOxEco4YcIoW1Yiok1GaVK6N6hh1TTqS:e6kTOxEcscIoW1YVsGQkqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776849, "uuid": "104cd4eb-7ae8-4fc3-bb37-105ba7762bb7", "value": 153884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776849, "uuid": "5d0c94b9-b910-4556-b5b5-279311a36c2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776849, "uuid": "fe058b39-7903-4c18-ac93-9d8537de2111", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555a57f7-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766461, "uuid": "3a431c39-023b-45da-b176-b7bd499af7d3", "comment": "Malware payload", "value": "67cd1e669c4197bd02cbb9faa020337f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766461, "uuid": "5ec6e3f7-4495-4452-adc0-569beff3d7ff", "comment": "Malware payload", "value": "d4127b30b3ecc0707ec37128429e730d5a28c8a9cf90964c38682628c9cb1619", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766461, "uuid": "83459562-0417-444a-8dcf-80c33897f26d", "comment": "Malware payload", "value": "ba7c3380610a2fd7b31df61ad97d2f686fb7d05e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766461, "uuid": "c175632a-0c0a-4fe1-b24a-f9e6f686f74f", "comment": "Malware payload", "value": "ffdd25bb1ade9ff8f62d264b47c6b49cd013a7ff3363905a2c3d178f3a08cf76ae54086283316dc439d98747963e84c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766461, "uuid": "fcd1a754-9517-4655-962f-4aad11af0d6d", "value": "T12042663B21F08B3293C065C962771B614F72970B456714B8F4FE6A269F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766461, "uuid": "fce8ee22-952e-4f6e-b963-5983f4522a56", "value": "96:c5uUk0B6msht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjOBQIB4IB/IBbIB97g:c5uDg6L4hvZ5mN9oKNpiv6iTAoo7OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766461, "uuid": "36833251-3e1c-40b7-a2d5-f79b89bb119f", "value": 12545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766461, "uuid": "8dd704a3-1cdb-4f59-8899-9122f644b659", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766461, "uuid": "c924dd16-4cfe-4a6a-a261-b0f60711ab24", "value": "d4127b30b3ecc0707ec37128429e730d5a28c8a9cf90964c38682628c9cb1619.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cd7857-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766249, "uuid": "97b698b6-f4ca-4229-8139-ad059debb945", "comment": "Malware payload", "value": "30b6296331c84f03f42e5ce0a7d53e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766249, "uuid": "9b8e1680-6bf6-4bd5-ba23-7bf5811f53ee", "comment": "Malware payload", "value": "d4320f95c5f12a5ede1d8506aeede921720f067e4fd5636d915951c249f13cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766249, "uuid": "9b95d831-5866-4759-93e5-ffcb6d1205c2", "comment": "Malware payload", "value": "260871a1c563f569394a5ffcfea10c3b8df04f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766249, "uuid": "a378d2e7-031d-4639-bae9-e8595be4f9f6", "comment": "Malware payload", "value": "730501cd7dc9b4cf87772a2f822db68f025fb17056564f636366405e74f0a669b211630dacfbeff7940c99d89965546b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766249, "uuid": "b41878df-d47b-46a3-b345-ea29803dd1a8", "value": "T14C9602D771E3A67CC00EC07E8242BCBEB6A7F5690163AAF74754A6326F5AE103750B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766249, "uuid": "746d0ac1-c401-458c-aeda-cebad2d4d0b0", "value": "c49b4a54626f07bbebcf76bd519a86b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766249, "uuid": "4a745afb-70c3-40c1-9d57-16bef620ff67", "value": "49152:3mirCOffk3hmzYSvq6H2UJSjE90Q2yB9m7dJHNFPykqqNV+x57p6wy3xmqqRNEZ:1DzlvF2zjEmQvnmpJHNtyg2xFmxmjLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766249, "uuid": "f99bbb29-9a49-4c5c-a62b-437604f163db", "value": 9135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766249, "uuid": "862c36ff-4cd9-4deb-8c91-588f91964254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766249, "uuid": "fc28d02d-5c05-45d4-b6f2-69f29b5053b6", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bbf868-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766356, "uuid": "05505598-6131-4027-8d29-f52bd9402a4f", "comment": "Malware payload", "value": "1f292e81746436c6c8ed7a833a267a8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766356, "uuid": "eded814c-e034-4f7e-8904-9295c7ec366a", "comment": "Malware payload", "value": "d479800e8d2056d244c73cbbe5893dbe105eaf968ad2a43142c0486732ba6d9b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766356, "uuid": "bf711d54-b30f-4473-b38a-6734f51dd382", "comment": "Malware payload", "value": "4561de0d3687ca4dfa9e2725260d0d580c2a0904", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766356, "uuid": "e4320cda-74d9-4aed-b51d-71ba19ed93b4", "comment": "Malware payload", "value": "c827bec137aa7343116bd819249f75209e4d9d0b01d1778aaa1965806fa1ef48ceb41aad9558ffeadd7212f122fb1cc5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766356, "uuid": "712ec0a9-eb8b-4a42-b99b-5a36fe46acc1", "value": "T18642087425F00C332E605A40F27727E6ABB6D85349E3258C35DE1F35AF86B12B5AF425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766356, "uuid": "6f7e058e-c9b0-499c-bfd5-184a808dc6cf", "value": "96:cRu7B6WxWxJx1x71N2Rr5djGjmpRTmHWI1iza15J31aLtYyw7fQ2POYI6pbMtwHu:cRul6wL3//LLt+DQpYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766356, "uuid": "915e7da9-42cf-4a9b-b37e-198468d3abfc", "value": 12619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766356, "uuid": "8e54b808-304d-4e08-ad80-99324c753bcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766356, "uuid": "02bd2fb2-828e-4631-9fe0-0304e864622c", "value": "d479800e8d2056d244c73cbbe5893dbe105eaf968ad2a43142c0486732ba6d9b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d4f273-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752587, "uuid": "7722adf9-ef0f-4cc1-b7ea-4559ceccb779", "comment": "Malware payload (Mirai)", "value": "7e9e988de7b01bf3f2cdc8a69f12b88b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752587, "uuid": "08a608d6-bb38-4740-b5b4-0bf44c863ceb", "comment": "Malware payload (Mirai)", "value": "d4859efd4470828e91b4516aa2e7223515563faa918cbd54ae8187958844ced9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752587, "uuid": "72d73d7f-1fd0-42ab-a594-0b6135eb23ad", "comment": "Malware payload (Mirai)", "value": "7c2201c714cd892bfa17aa85be307ad593ab7adc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752587, "uuid": "b59973df-68b9-4b7a-886f-4982fda41827", "comment": "Malware payload (Mirai)", "value": "dbca13cc958369bb4faa67a4b397ac2aedcd5c09a2868f304b37f7a656cecac47666ad9964c861e4beefcb903155ea6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752587, "uuid": "ba05dae8-15aa-4b35-83f9-777f62cb5e9e", "value": "T149145A16FB0C0463CA931CF04E3F0BFAA3621A9215F9911124197F5E5A32D77A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752587, "uuid": "a98821fe-34c9-4bb0-b2c5-c56ac4320da2", "value": "3072:vdv70f0DXg4Brc/BJjZ50+v91cKq2gQUa8:18IQAg/BJAGKKby5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752587, "uuid": "ff5dbb60-6e2e-4931-a2f0-e1f23ab360fd", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752587, "uuid": "d9cea2c5-9b98-437c-868d-0ad944f7dd42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752587, "uuid": "53b9758c-c2da-49ee-a23c-384576c7b491", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623749b6-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771784092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784092, "uuid": "dbbb58cb-9e91-4992-86d1-c17b0588437c", "comment": "Malware payload", "value": "2660e4fbef73c6468addab2842939010", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784092, "uuid": "48a3d001-060f-4232-a5b5-3893e959333e", "comment": "Malware payload", "value": "d49b1a337270ff054da831cd3fe657c4fb885f51d0ab4aadb7fa2788bae29fa7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784092, "uuid": "7e06d09f-2fa0-4981-bd1e-9e3594413602", "comment": "Malware payload", "value": "9cead7718edd690526ff6bbaf25b298aa37474c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771784092, "uuid": "79c700ce-7684-49e8-8cfa-076fe1493198", "comment": "Malware payload", "value": "3ed5b07c4e0d4d41198ec2e51f50c7d014c51595b27c8659cd8dd2171f83ee6a94ab877fe2f7b4d45c973b496553c138", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784092, "uuid": "aa0b5d84-5254-445e-9dcb-d1fa3c99d9ec", "value": "T1CB03D600F3DBD91AF1AA95710DE3C6D6B23ABC299D2AD24B32543B1D7C35B708E21B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784092, "uuid": "d78c2865-1b48-429b-982a-a269960fffcc", "value": "192:gAntnJaoZEvAqh3FtAL0Tqdnoq6/6rr109FvleVqJNOl3b5YNJOtpnOrbpfXfNoU:gIPphiSif5i3STOtgb9+5d2ZPk4ejtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771784092, "uuid": "4313f8c8-3d50-4ec3-bdb7-abc0f811336d", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771784092, "uuid": "4bb0702c-fc1b-4e77-b005-2b4de5b138c4", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771784092, "uuid": "4eee3009-5dec-4f8c-bf9b-69abae59e01f", "value": "doc3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec94ca8-0fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771755606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755606, "uuid": "8324b6ed-eef9-4a9c-9f3c-dce888d6e8ce", "comment": "Malware payload (Mirai)", "value": "3407350e74d08dbce042bda25f558125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755606, "uuid": "d2ead298-77dd-4c69-9741-ef8af0ec50b0", "comment": "Malware payload (Mirai)", "value": "d4a013cc43df68e54e4315efc5ce4cdbe22e387d22cb4895d51881c7ed2e6bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755606, "uuid": "e852ac84-4f1e-4817-a80b-1cbf89c6cbef", "comment": "Malware payload (Mirai)", "value": "331a70cc64dd60559d0abd0d61a20692e492f033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771755606, "uuid": "45fcc239-0ceb-4822-8926-6aab6598d836", "comment": "Malware payload (Mirai)", "value": "b7af75d7122175187a5d1ab9000e0d60634512e4a4aae898fa002931f2c102f83c9b00c8a60f4a14693f50d3bf3aa3c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755606, "uuid": "c403cab8-52cb-4a7e-8310-d179eacb5b19", "value": "T1BDE30946F8819B12D5D111BEFE1E128E33231B78E2DF72129D246F64778A9BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755606, "uuid": "fd478f40-f8d9-4f6b-b8b9-9eec132b0392", "value": "3072:HjxHwkUhXM97XM/bz4na5EueJKrdCRby:HjVwkKq7XqbzSaxvdCRby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771755606, "uuid": "7842f463-0378-499b-8ba8-7504777c5410", "value": 147388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771755606, "uuid": "6035d4fa-e61a-471d-b7ab-9cd62a4b3e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771755606, "uuid": "95a4c062-2304-4822-94aa-f04ef0946b36", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00415f65-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766319, "uuid": "952ae663-3761-4899-b23f-1a2536466bcf", "comment": "Malware payload", "value": "21e229f6b5bebb7c75ad1735813cea07", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766319, "uuid": "bcafb47d-09d7-4a1f-a179-9d3bc8332a93", "comment": "Malware payload", "value": "d4ae4ffec8132298dd27bccca3847690b1900480c92d8ce7a716d26a020f26f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766319, "uuid": "01b8fb6f-47cf-4683-bb06-2618378e6d98", "comment": "Malware payload", "value": "e9e369f721895ab73ca95f0ea87418cdd5207e7b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766319, "uuid": "3c2c8754-32d8-4dc8-ba20-929b40df556f", "comment": "Malware payload", "value": "88c3186bf5e6372b4b7fce526865fb6b2192bd63bd7d26d439a23199b3d005d0722097395e02235c984e203c4f53dbea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766319, "uuid": "7f46a06c-2bb9-4874-9904-51ad020068e6", "value": "T1ACD1C47125F14C333E606980B3772BA6ABB6D95345E3218C35DE2E366F86F12B1AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766319, "uuid": "596b8ea2-d241-4532-bc17-5f1000a45b4e", "value": "96:cLu7B69xiUSUOSCx2xkStgFIrOIB6IBOs:cLul6CUCha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766319, "uuid": "dc8b92eb-76ce-48d0-88f1-a56f94df8e8d", "value": 6289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766319, "uuid": "aeeffce1-ac25-4d45-8e9f-205427e5d084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766319, "uuid": "85d2a35a-02e1-43f7-8ba7-ff56411fb4e1", "value": "d4ae4ffec8132298dd27bccca3847690b1900480c92d8ce7a716d26a020f26f4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d117d11-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776836, "uuid": "38b32ff9-b97c-4267-9595-66e42a56063f", "comment": "Malware payload", "value": "930741b69505a58959a8aa4ace75aa28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776836, "uuid": "17d4d19b-e6f3-4429-b81d-ca3d6175b66b", "comment": "Malware payload", "value": "d5712e8a2bf6b885a300cd15ad9f9dac7a2c2e6d367c5256eedc18b613a0176e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776836, "uuid": "b33f22fa-cfbf-4d7e-ab76-81876b328c91", "comment": "Malware payload", "value": "bec8abf76ebfebcf540b453639773e547e3d1849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776836, "uuid": "181119a5-7e05-458c-a761-c09c4303c091", "comment": "Malware payload", "value": "9306c77f6a727c34e3d09eaede1abb1c16ede2317e9557406d3847a8615955bbdd83e1d784815599dc8d4060c65d4f4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776836, "uuid": "a309730d-b81b-4e09-8e58-95e5ef002ade", "value": "T166B3F116E18120BFD56BC275468F9B37B77278D43254AB2B3751F9332F27EA0264CA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776836, "uuid": "7a4f05dc-eb39-48b1-82cf-f224cd0485d9", "value": "3072:Nov4QV8UqUc4Abi75iZf2/xUax1bDe0eEQHf5+MFq8pqPLtmN:Nov3OUqyAbe8qfe0eE+f8l89N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776836, "uuid": "4282f46b-a878-4cb4-bda2-f0113ce7d051", "value": 115539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776836, "uuid": "a4bd77b9-50d9-47ed-a610-2d97c4169862", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776836, "uuid": "245406bc-7c00-4498-8d0c-acd6582023b9", "value": "eq55pytnsz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b080daef-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779499, "uuid": "bc897f35-504c-4fb6-9aaf-65f79c933876", "comment": "Malware payload (Mirai)", "value": "85af51ac52f989a87bda801c3ca8da11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779499, "uuid": "84623483-9728-48e6-b491-a298a615e977", "comment": "Malware payload (Mirai)", "value": "d59af7360322fe82947f6cfaf0c829248a08f3e7d3c6adf8bc565563dd4f5a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779499, "uuid": "8c14d401-4228-488b-b1f0-b07b08e0d9c7", "comment": "Malware payload (Mirai)", "value": "0644ae0a8e803c17acb967fd77240969e7849768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779499, "uuid": "efdfa036-867d-4c9f-84db-678396cad0ee", "comment": "Malware payload (Mirai)", "value": "b294b9730221231214196f5269ebaea02429a1c1cbe1d4b0851590cfa78759542150f0bf83cc6dc309b098f4a47130c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779499, "uuid": "12e8cdf7-12a7-40b5-91fb-94d7204220da", "value": "T16873624D3E715FBEFBAD82398BB75A20924523D623E1C684D1ACED021E7034A741F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779499, "uuid": "7eb97c48-2d76-4f3d-834d-ab3851a9a98d", "value": "1536:/NhsoRuiOPXMi0vhUk8APg0eACCI6I707yvjzP:3sdMi0p18mfCCI6I70Wrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779499, "uuid": "e077e57c-6d6b-4f0c-b5f2-9bcd8067baaa", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779499, "uuid": "559666e4-aeff-4e2c-906e-bf80b9fbafd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779499, "uuid": "5245adfb-b6f5-4d54-a1a1-7e374f7a08f9", "value": "purves.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d2e87c-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752930, "uuid": "83c16080-a318-435b-af0b-3339950fe477", "comment": "Malware payload (Mirai)", "value": "6a0110403c822b86318da2bb8e7ad6ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752930, "uuid": "cc9bce64-dbf0-49df-bc53-ae4c3a4aa6fc", "comment": "Malware payload (Mirai)", "value": "d5c9fca326e5157fd60b1e8bca867b3803a121795a4ab737765e9198a593b096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752930, "uuid": "0d6da535-e19b-4112-b5a1-abebed39ca28", "comment": "Malware payload (Mirai)", "value": "a73b76bcdb3edf5145dc9953e2192eba7b302dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752930, "uuid": "a5f0189b-31bf-4634-9290-4a17c1f0cbe3", "comment": "Malware payload (Mirai)", "value": "98ecd7a8902807eab3c6c8528203f56e57b7ba01551bcfec17e38c454bc23d4ef2fd8a8c041166ee1fcf06d6b15d09c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752930, "uuid": "0bc3e527-8f01-4158-89d3-bb2d678417ca", "value": "T16443521E6E228FBCF75D873447B78E269A5833CA37D1D581E25CD6006E6064F241BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752930, "uuid": "b9c6a952-e254-4417-b1d6-c0d8b9d0583d", "value": "768:SEBm51E3/4cvjYJNu9ZgNIbWPDE5kJ2Yu+Z2SRX1qXQZXQ5GtMdO5R4blZpEGyw1:0A/Dzg5k/+0SFRAvpEGLTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752930, "uuid": "6ea70c34-ffc3-4b2e-924f-644c57f9201e", "value": 60108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752930, "uuid": "553fbb83-e1b8-46e6-a94f-0612068e8b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752930, "uuid": "81af7d7b-8d0e-4362-93e5-4e31b75c25bc", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126d4fde-1040-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771800279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800279, "uuid": "cb21ed5c-19d5-48e4-9dc3-6ab75a4221ac", "comment": "Malware payload (Mirai)", "value": "253cc30da487944178189e7df52b11ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800279, "uuid": "11ff7ab8-29e3-4c24-bb22-831dcd6759c8", "comment": "Malware payload (Mirai)", "value": "d6255403de03844cb890416421203116d8061387e4278b7d02cf423c696d15df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800279, "uuid": "139943ba-b6d2-4e59-9915-75bb65ace0f4", "comment": "Malware payload (Mirai)", "value": "d96af817098d2bba845c1f4af4372f021be2f9f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800279, "uuid": "c47814df-c859-4f19-857c-632634bafe78", "comment": "Malware payload (Mirai)", "value": "21d7e4bc19aa3732bef4dedae9e00424ee290e03976538aed149304c39c57a4a2dba50d5210f4961af740e18b5d274af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800279, "uuid": "709ba1f7-1d01-4ba1-a50b-196f33d83f3d", "value": "T1F8835B12B71C0A83E1531EF03A3F17E1C3AA66A120E8F984750EDE4AD6B5E325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800279, "uuid": "b5b37fa0-0576-457d-a919-56eafbb27cdd", "value": "1536:4+6dYB/InuHte6vghDz3Y9aUXvtMRBgBd2IIA8rQ6oMGq:Md4XJm3KawBd2S8rjGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800279, "uuid": "228bca9e-dc1e-485c-a61f-dee7d7163a9a", "value": 80808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800279, "uuid": "c38a79cf-5df6-4249-b398-f11587b2d8e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800279, "uuid": "5bfaebe6-c016-4f3c-9ff9-3eb927fd0989", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e20df4-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769019, "uuid": "6e080ef4-539c-4131-808e-0d8f596e898b", "comment": "Malware payload (Mirai)", "value": "4d28184d625ffcfdfb6205baa66b5fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769019, "uuid": "6dc5548e-62e2-4c3f-9e6f-7a84ff4f6d10", "comment": "Malware payload (Mirai)", "value": "d63c3e05ca8193f1501a6e9e8fa16c134012a80e3c481bb5c50ff392c9e71cde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769019, "uuid": "6e2e5ec4-8c51-451a-b2cd-a0f435fd0849", "comment": "Malware payload (Mirai)", "value": "c6a0432cca83b283b41a5983456e56f5e8fca270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769019, "uuid": "568fba22-36ca-410c-9709-60525e2a6918", "comment": "Malware payload (Mirai)", "value": "0aa85b2582dfe5486da77e47abe306d14ff88fa13536ff3b9f7910b7c3016bb43ef36fd57007c0e43d84cb7c8bdd3774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769019, "uuid": "090f3d18-0b05-47d3-af5e-72d5e0ae5f05", "value": "T1A8538C3BE51A5A84C04785B074B95F352F63E1C482932FBB6AE285796483DACF901FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769019, "uuid": "de23ee34-b8db-40a8-a3ed-4c34a337ab99", "value": "1536:sa0UNhW2wXZ40XXK0K6qXs27eYCdD5znt:s+I2GDXXK76a7eYKznt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769019, "uuid": "b19f7b5b-a8e6-4bff-b743-b6f3dc828448", "value": 63020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769019, "uuid": "558af2a5-c47f-435e-8bdd-d80d6714d034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769019, "uuid": "e1ea3f80-47df-46a7-88fd-8403cf6f0a86", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8532819c-0ff2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766971, "uuid": "a919a641-c78c-4426-b1f3-766e533a0cf7", "comment": "Malware payload (Mirai)", "value": "466a3282265dfb9980a4712833309b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766971, "uuid": "30246765-1720-47ae-9afe-2818ea46ff66", "comment": "Malware payload (Mirai)", "value": "d697a5af9b5db47e3025798df2ceb90c23b3606585cc5cbd87097257b28c1933", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766971, "uuid": "fc249899-f95f-419b-b0ee-b7e7775a1e2e", "comment": "Malware payload (Mirai)", "value": "52070e82c98fc66ad5e5134476efdd0cd14838b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766971, "uuid": "41c5c8a0-70da-46de-be3a-ac4c980bf8f2", "comment": "Malware payload (Mirai)", "value": "70ac4b28dd008cf64e29bb0828c93b0f486bdecb6187cc5421040d1c588b9911399f04bdf3080681315516b99329acc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766971, "uuid": "9262f4ec-15c4-4263-8611-9d6afe5dec59", "value": "T10CC3AE97FB8718A1C8A206F007C70BAD2E932121CE5FE8E37D5D663F5A7A4DB0516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766971, "uuid": "144e7358-92fc-4b90-9cea-a25f677439d9", "value": "1536:hY7P1LZLsN15/PBeJAJANLWVuAfW8RJJ3lZqY0/Pl7g6xMZFgnWEH/LWA:KJZLe50iAp9uDJJ32/Pl7g1grq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766971, "uuid": "b40ccf21-9c68-4dd5-892c-1347ce9e2269", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766971, "uuid": "4c84de93-51ce-4bd9-b2d3-2c9fd5479252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766971, "uuid": "ca5ba762-8b98-4af5-a908-ed39fd442359", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67091d6-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771766732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766732, "uuid": "a98f5084-a571-4fe9-b6bc-0f053a5da501", "comment": "Malware payload (Mirai)", "value": "6d4a9e4921016941644674923415e2ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766732, "uuid": "292094c2-3e64-41d3-9a89-dbd058136c78", "comment": "Malware payload (Mirai)", "value": "d760afe777906bfc0e2e1e6de839c96d5543ba909d0522586ebfd2f382dd7049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766732, "uuid": "c293399f-a044-449d-81ad-1c84a13c81c7", "comment": "Malware payload (Mirai)", "value": "b0b0769ccbae53dc783fd4db044e2362af5d3c2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766732, "uuid": "5a9bbfa3-2d28-4582-8ea9-32635e7f6938", "comment": "Malware payload (Mirai)", "value": "8882197238c0c09b28c61e0c6c028b1d1b62745bbacc8e31c212176ce8d37a92a24bd4772c23921fccdc4bca19684834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766732, "uuid": "af262644-fa7e-44d6-a42c-40a12170212a", "value": "T18EA36C8AFB43D0F0E94509B0116BFB3986319D321024DEABEB94FE72BD72643911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766732, "uuid": "33329970-989a-481a-bc51-ec98edaf802f", "value": "1536:z62p/bNWBthdOZNZAAh8GrvbY6o+i8R7ZUg31QUHPBwU7Cr:m2dbNWBdOZ3AAO+I+/uWV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766732, "uuid": "09b6c91b-e491-405d-b31d-ac919d8e833d", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766732, "uuid": "69b8ee45-b115-459d-ae12-78e2e13a304e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766732, "uuid": "58d64b81-3a5d-4d05-8122-1e42d49b8640", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5010ea87-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769029, "uuid": "c582ddf3-9729-4540-92b5-80588508e90d", "comment": "Malware payload (Mirai)", "value": "7a9c563f2750ed10e419fd15a4fbd85c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769029, "uuid": "35c95509-4dad-4f5a-b1aa-c1f95ad9d26c", "comment": "Malware payload (Mirai)", "value": "d797a31918bb43d16740f03e1c53be7b54321f3077e10b521fa5f4e2c36d602f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769029, "uuid": "17b7a00e-114a-461b-a94d-704713387dc1", "comment": "Malware payload (Mirai)", "value": "098b4fd8437f9f25c50c78539d08003be205a599", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769029, "uuid": "5a6e808c-b93a-4168-aca9-e72c904c7184", "comment": "Malware payload (Mirai)", "value": "e4083157bbfdd2d885b855c1339b3adcd8250e33cd7acceae492a297cfb06a63a1194421971dfad27fb04209cbf79a02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769029, "uuid": "c383b608-8a9c-4469-a28c-e57e9d052300", "value": "T1BD713E8B78A27570278F807A5B0E65C27442462F0024AC6C759FBD35AF389B0F5F9EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769029, "uuid": "5a5d1ccf-0539-4bc3-a05a-497a78792513", "value": "96:KtkL1FczktwERVdXRifawcV6wpJayyr4SfrzIpM:ZszTERVd1I0SjcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769029, "uuid": "54d23b18-d8a7-438c-8e8e-2498dbd0c61e", "value": 3577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769029, "uuid": "e31150d5-e39f-4638-902c-8d2eaa91e2c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769029, "uuid": "a2882ba9-fc3c-49d8-86b0-55d428909e7c", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cac5e1-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766348, "uuid": "894b4536-7653-4884-9613-2bc2591bf659", "comment": "Malware payload", "value": "461fbaae1996d4d2882917b8096e4cf4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766348, "uuid": "f96ee7c6-74bf-4812-a893-4e1ef0cd1a6c", "comment": "Malware payload", "value": "d7bd4289c31142abf8f27949986e13b7848d77efb5807a5ec57c6e4cc6b37d17", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766348, "uuid": "a0ff6453-eece-4152-8df5-08d38faaa761", "comment": "Malware payload", "value": "11f6abd47c169963bbe6d818acb86ce95e3df45c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766348, "uuid": "0a1048c5-cc83-46b1-9cfc-9074caf022f2", "comment": "Malware payload", "value": "c5997e8b5c7f6a32c7bf3c97e985da847d706e015bc6cd7d4c38bd85db4bff04b3dd43a665805c0e7c28e50ffa89d5be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766348, "uuid": "85daf708-fe90-4a5a-93d6-09e6bc18bafd", "value": "T14721667025F189332AA05544F3732B59BB72D8474193218C75EE5E321F87B42B1BF412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766348, "uuid": "d06b3bee-28d8-4f38-9c92-00265f1889ba", "value": "24:cniRHRURCxO0tbmN2M1sLobHxlc9HHE8zS8N1lDHUeN:cniRxuGRys01lwnEOVN1lrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766348, "uuid": "32318029-7b11-49cb-90d0-2c4ef874fb3a", "value": 1155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766348, "uuid": "53c1e067-8698-4ec6-b057-216845291c85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766348, "uuid": "f1a799d4-3a08-448e-82fb-fd5a512152c5", "value": "d7bd4289c31142abf8f27949986e13b7848d77efb5807a5ec57c6e4cc6b37d17.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ea87f3-100f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779262, "uuid": "bddb512d-0325-4f2d-a516-cdb142db304e", "comment": "Malware payload", "value": "c20ff11b2c07aa1f3a71643965fee8ff", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779262, "uuid": "453057fa-82ff-4b8d-84d9-b7295747c8d0", "comment": "Malware payload", "value": "d80119e2594df87d9719eb97672c18dfd663654847c7def1c91cac374a720cb6", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779262, "uuid": "e42b7081-130e-4815-bf16-96965b525490", "comment": "Malware payload", "value": "e32362f8c2dd35394a4ca59c16e9ae243dd163b1", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779262, "uuid": "20f46465-021f-41f4-9812-d4497b9d133f", "comment": "Malware payload", "value": "6bda755c1199f2ccf60e7c5661f7648a509606626b1e2b8a288768d7d6847b421800c56a8a084f350f135054b0f8be30", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779262, "uuid": "b10484ae-311c-4ce5-ba20-c022bba3e89e", "value": "T1C965E422E141C03BC2F34635F89EDA686424FDD1CB2F254A27DC3BD82A3AAF155D519E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779262, "uuid": "a93b1fd5-bdf3-497b-9009-9438b9c14b5f", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779262, "uuid": "cea8bd41-abae-49a5-82b9-c91936b17413", "value": "12288:sMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9pRvJZtqNl8GkWnUYQ4Dj:snsJ39LyjbJkQFMhmC+6GD9Gl8GVUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779262, "uuid": "64569e9a-3ec7-4c6d-bae3-a5e3d1df29a4", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779262, "uuid": "1d2fd6d2-c1aa-4f30-bf09-5dde00242f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779262, "uuid": "23d84c8c-71f4-4968-9d39-d17352b0aaf1", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cb7a41-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752926, "uuid": "34b5b739-08ec-4de7-bcab-a81ae424df48", "comment": "Malware payload (Mirai)", "value": "cc0b2705e59d8e12addf3c0df9711026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752926, "uuid": "d420556b-010c-490c-b642-1e3a0bb0f502", "comment": "Malware payload (Mirai)", "value": "d87f2a572097b0c2ac088e029904820a47bb353e4cb29721567d2bf67ace29d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752926, "uuid": "0ae86841-e6bb-4677-be76-562dd24dad83", "comment": "Malware payload (Mirai)", "value": "1287af29c991e79802fc2cfc73c6c6be0755d373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752926, "uuid": "683c290a-99c0-49ea-afd8-14370ae14f31", "comment": "Malware payload (Mirai)", "value": "8ca8207e91ec00c4d481115c991399361d78155fceab83b23cebc0495499be48c6cadd6d6f16b3518ef2bd74bca7dca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752926, "uuid": "c98fde0c-2751-48e4-8d11-0165bd74b36f", "value": "T1C9C3F80AAF614FFBE86FCD370AE9070525CC651722B87B7A7574D828F64A14B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752926, "uuid": "71069870-c7dc-40f8-96bd-777819378798", "value": "1536:dGCzzWbixRdPLzS0qa6UGD2+2OvU+QnfQraTip2wYpE23ATrZtthG7KkWwwRRv59:dGCzzWbYjqtUGvHYpEyATrVhGcPpdGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752926, "uuid": "66e23b6d-f0d8-4136-942a-3ba298e0135f", "value": 126616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752926, "uuid": "be57bcc7-ad39-470d-b008-32a2d95a84da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752926, "uuid": "ec77ac0c-75f6-43d6-b4d0-68e1bb285e49", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d83501-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766482, "uuid": "f96abef8-936c-403d-8618-ef881a411cae", "comment": "Malware payload", "value": "5b14d0b3f2e3629e5b8e0fa04c66a1cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766482, "uuid": "1596d5f3-9c55-48a1-a4e0-ad3d50695076", "comment": "Malware payload", "value": "d8f74b998efbe802ac8ca9a3b66abe104ff01bd71d5e393b186844030ec01deb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766482, "uuid": "0e4d45da-7c32-4af2-9746-c3545835ba1d", "comment": "Malware payload", "value": "284850db1471f632de71cccf9f21e104ba3a3da9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766482, "uuid": "1e5ee500-414e-4612-ae8e-dd0a9be03505", "comment": "Malware payload", "value": "1ea6f0ff69c66a931e63dc431224865fb70ee2c772e0d25dea0c5d837ed5dd2d478199a089c03db85cf123101da00f8f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766482, "uuid": "df4d4dc7-207e-41fa-a11f-904da7a7e8cc", "value": "T137627A3721F04B339BD055C4A3771BA54FB6A61B456720B8F4FE1A259F1AA0370EBB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766482, "uuid": "9fc2d5c7-8661-46a7-9188-ffba120a970f", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6mkQdG/NBr+E+C+OP:cCu34hvZ5m5FG4j4HKNphvUZ/lxuP+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766482, "uuid": "42a47654-c814-4428-8889-f50eab532c34", "value": 15896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766482, "uuid": "0194f194-0910-42de-b021-cf82b39c9ec0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766482, "uuid": "4cf1ee42-6073-4662-a7a2-ae163fb32a21", "value": "d8f74b998efbe802ac8ca9a3b66abe104ff01bd71d5e393b186844030ec01deb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d939581-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768730, "uuid": "cf48a4d3-25e1-4411-bc82-35a3631e45de", "comment": "Malware payload (Mirai)", "value": "0d9025ccb621f4ffcb4951b54e1d928b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768730, "uuid": "f43e2e8e-6557-44ea-82fe-9ed683fe1552", "comment": "Malware payload (Mirai)", "value": "dae71356958d8c5292cd3387093ce49e0ef48e8a6a2f0b38f52343b47e332d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768730, "uuid": "bf5d5ce5-c153-4dfc-8d1e-43dc3f353e0a", "comment": "Malware payload (Mirai)", "value": "5a3179d3cdc9a9fe14cc57a50eca3dfdc98d685e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768730, "uuid": "3fb85f37-9608-4aad-9b6c-923a9f7dfb0b", "comment": "Malware payload (Mirai)", "value": "5f7786e894e6035c072292c9a53b286ea4250cdfdbb02380020f70c90107176739fffb58eaa4236e95b9d73084405a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768730, "uuid": "b8f53558-e48b-41de-b8cc-6db781e01857", "value": "T115E34A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768730, "uuid": "fac387c3-fff6-4386-ac13-fa8673edb7a2", "value": "3072:ENUkePbhroLLyLbPDADuOu1sya89LjPEKe2+IOkB:weRoLLynPD2u6yawpe2AkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768730, "uuid": "cc9b73af-31bc-4ba8-982e-d05f95f003d4", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768730, "uuid": "adc38b22-d417-4c24-b4ba-261917880618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768730, "uuid": "825d6f0e-01ff-43e8-a047-c82481cc3437", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79215f9c-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779406, "uuid": "f8efdbd3-6163-4c1e-a37d-8c05f0f6cac4", "comment": "Malware payload (Mirai)", "value": "b55aa4a2e5a89a385df045c039368b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779406, "uuid": "85c7ba5c-a735-4b82-8696-85dc8a5cb35a", "comment": "Malware payload (Mirai)", "value": "daf47675231e33e98675ef40a8225a7a0cfec51551a16f3d332488f184baa395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779406, "uuid": "d2496d08-037e-4b48-86ca-65a8e7c04e3d", "comment": "Malware payload (Mirai)", "value": "2e16bc4b01a4221abbb719953b1b4840468dcada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779406, "uuid": "633c5433-00a6-444f-9104-a62d24be83fc", "comment": "Malware payload (Mirai)", "value": "fe9c9e592cc526c1b1caddfdfb25fa57a868d848851a391e5ce08876d759e588b3ee2ba3b2922855a71a2f79939617f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779406, "uuid": "2bc71daa-930e-40ba-a708-23f641a98d04", "value": "T188C2F179E551090EDA2FE532BB9CCA2FB2B9981173B592E142D821B7A03C11DB81CDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779406, "uuid": "07f0ee9e-62ff-49f5-af51-5d57e69c40cb", "value": "768:dYCTXXYNqXaPBIEPAF2z6zXMAHIfhw72Qf5/NPWNw:oi6uEP622bMAHIq6S/NPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779406, "uuid": "8907f797-ee7c-4240-b6fc-43649e4958d0", "value": 26092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779406, "uuid": "af0dd15d-1407-4577-b0d6-08fdcc21b2e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779406, "uuid": "783cfec5-9bcc-4398-b81c-3c9be88cea37", "value": "purves.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e58862f-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769027, "uuid": "6bdc8f80-0e73-47c3-b9cd-aaebc90997c0", "comment": "Malware payload (Mirai)", "value": "c5db5acadf41bb8a2a48c81a0dc4673b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86-debug", "colour": "#5472EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769027, "uuid": "b9644cc3-e0af-40fd-a2c1-d8514ed7147a", "comment": "Malware payload (Mirai)", "value": "db8a63f2bac4185e2a7bd2990a76214cb4f0b5e84279695d94e7514707ad2def", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86-debug", "colour": "#5472EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769027, "uuid": "c24f64bd-2b38-4663-a617-80090c9cde73", "comment": "Malware payload (Mirai)", "value": "e527d4b36b36c28e0e6c7ed4dcfd265e98c6b09b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86-debug", "colour": "#5472EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769027, "uuid": "f478322f-b69e-4c6d-a916-8bdefe72738f", "comment": "Malware payload (Mirai)", "value": "9f2444696f3267f07a5c89195409410476cdb9a275fc1ae7853c9bf97de2545440d5ba13820a79e8f1632922b1839f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "x86-debug", "colour": "#5472EA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769027, "uuid": "f1cf5045-7069-4b46-84f5-7e2093e8f7c7", "value": "T143E2E16C71CE40A2E0014172C11E8779F960DCB8E8879DA11F1A6D4DE3E32B47D7AFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769027, "uuid": "9a7f3432-175c-445e-89d6-cdf5814c0927", "value": "768:0HQ7WUx5TygVxDfxs3oguz5uE4PhY8ZBb87Vj:8uHTd3Jsrq4PC8ZMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769027, "uuid": "348a0545-508f-4e5d-8b69-19dc142e733b", "value": 33908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769027, "uuid": "9fe009cd-024d-4d86-9b7a-57c1531a75ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769027, "uuid": "56e9fc22-9152-4e68-8151-b002dfa829c0", "value": "boatnet.x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f4e78f-0ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771767781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767781, "uuid": "2813ae12-f54d-44c5-aad5-5712618eb65e", "comment": "Malware payload (Mirai)", "value": "b55ef786832b656db09a5053be0f6b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767781, "uuid": "454f3756-3b4b-4481-81a4-75a85452f143", "comment": "Malware payload (Mirai)", "value": "dbc14a2f5c882565ecbf9599a4029fe6d6bec764850767eb6a67e6ab7ed929fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767781, "uuid": "a3cd0564-09e9-4189-92b6-a98b582fe066", "comment": "Malware payload (Mirai)", "value": "53fa47f5bae352968ad9516838bc72d14b752c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771767781, "uuid": "21dfbe32-8826-4aca-905a-2f2df18491a8", "comment": "Malware payload (Mirai)", "value": "a462de9e42466cc25f18f1850ac62ef86b61f26abe941456c88690cc1eda1c4a5f1742004beb389871d2a04f17efd008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767781, "uuid": "8c39c3f8-c132-4aba-a74a-8b92c208a8a9", "value": "T1AE433A03A5BC292BC5D0E33321B34362F1E61B9D51C8D68FBD264E4E9E953541AAB7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767781, "uuid": "0edfb0d0-76fc-4ae4-89c3-c9891200ae80", "value": "1536:A7jbYSVZNLXFNlfEypWWj3uO4xPMw4cbh+3t8SBIcKKO:A/bYo02barv8qKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771767781, "uuid": "2427dd20-ef04-4750-8466-99b715803dd8", "value": 60060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771767781, "uuid": "70d7a59b-1a2a-4a4c-8d58-f3a359eb7213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771767781, "uuid": "7975f923-ee46-45a6-92e9-30212a18cbe0", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f700fb-100e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771779023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779023, "uuid": "060c7589-7bc9-4194-bacb-b6dc0f03a322", "comment": "Malware payload", "value": "20cfdb7f02614de14343c7e6b328fd1a", "object_relation": "md5", "Tag": [ { "name": "Asruex", "colour": "#4465BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Asruex.A", "colour": "#390A2E", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779023, "uuid": "0772c944-9ba3-46da-9ea5-88f3c81265cc", "comment": "Malware payload", "value": "dc2140458c110ba1695bf5f8478a1385d48db45cfe97cbf71d2fb8cb7d1d7e9c", "object_relation": "sha256", "Tag": [ { "name": "Asruex", "colour": "#4465BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Asruex.A", "colour": "#390A2E", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779023, "uuid": "de79feb0-e22f-42e3-9dc0-2f376b6369e8", "comment": "Malware payload", "value": "8d61253cc2e079d7b3893b6656bb5164b680f2bc", "object_relation": "sha1", "Tag": [ { "name": "Asruex", "colour": "#4465BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Asruex.A", "colour": "#390A2E", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779023, "uuid": "b7897a2c-66be-4eb8-bdcd-49f52e0d27d3", "comment": "Malware payload", "value": "0d9c9d7fdf6104d3929e8d483ded7e5d274285c8b45afdcdf12c6a6b6fd5f384aa63caf64e47b43f3690be391b1102d1", "object_relation": "sha3-384", "Tag": [ { "name": "Asruex", "colour": "#4465BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Asruex.A", "colour": "#390A2E", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779023, "uuid": "cfdcd2dc-ee1a-49bb-83fa-8a54ae3f0551", "value": "T1905523C0F7D4C0B3D42A243ACD8A8B359726713B2B65D2E377646B7599122805B3B3DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779023, "uuid": "6f943350-26c0-4db7-b06a-d118e74acd46", "value": "f37295a71096ccb7f8bd10df4a9c36a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779023, "uuid": "32807a95-1bcd-4e36-985f-3ca8838189dc", "value": "24576:KkIT2GNzn++GpF7usg5l7figQ5DXByXXKAZ4DDz6Z2nGOxsKdt4:ZITZznMFqsg5Q7DXBsKM4DDz6Z2njxsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779023, "uuid": "84483852-4376-46f7-b4ff-fc8b9e30cb70", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779023, "uuid": "9f8f3898-47af-472c-8d51-c07dc8baf79d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779023, "uuid": "bed5d155-8788-44c3-b7c9-928a0e40b5c0", "value": "cache_7ad15a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be49299-0ffb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771770794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770794, "uuid": "b59670c7-dd27-4881-b5ed-e540aa5538f5", "comment": "Malware payload (Mirai)", "value": "b7f55c100de89550457ff3e28611fd73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770794, "uuid": "ec48047a-26da-4bc2-94e0-d6984db6bfdd", "comment": "Malware payload (Mirai)", "value": "dccf1c250a821d1ea82a2f3e410c19c01f0779386d44cbf2ab5eaeb095750edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770794, "uuid": "5f892bf1-c4bb-46a1-a472-d3f0ce7827fc", "comment": "Malware payload (Mirai)", "value": "a593b7a17782ce02fed7c904d9a9496d8233112d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771770794, "uuid": "7e0f124c-51cf-43ef-a473-beb2d18d3292", "comment": "Malware payload (Mirai)", "value": "9e35163823361701d4c2a4b6a9eef064f57504e11ad53eb6362685003c7c086a93ab82bdd15eb56043bcc6d973e4bbd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770794, "uuid": "738e0c01-80da-4d17-a87e-b5f1ea330057", "value": "T1DF2308817891AA39C3D063BBEE6F018D3345A798D1DB3397C8241B947ACB90F0D57B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770794, "uuid": "8fbc9068-4e43-4d7e-8a20-60141412bd63", "value": "768:WV9JdEjLgSXoEai9bFvFbZB7QQEPJddnj0eCSGFu+JNrymyN/jhLwCVy/Jx+5H89:aJ2/gHm9bJ4ddo9JNrynNbNeZWm22W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771770794, "uuid": "741e927a-2f31-48e2-98da-dc84aa3bc7d9", "value": 48176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771770794, "uuid": "fc87da7a-817d-41a6-ade5-41b2b9f40b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771770794, "uuid": "025daf58-b44e-46b4-a1ef-a4ea8ab8ae13", "value": "3atoNational.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1562c8e8-0fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1771752610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752610, "uuid": "ad9a8c46-77f4-486d-bfd4-77ab3d1abf11", "comment": "Malware payload (Formbook)", "value": "40eb9e9a6b95dd8ee39cf3d61d960908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752610, "uuid": "bbf532eb-45f6-4663-81bd-e5f4e644abeb", "comment": "Malware payload (Formbook)", "value": "dcebea4a67a8b967752120dfd00e23a2c8b13dd3c52cdf46f7bb541a44e2ef27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752610, "uuid": "83544d67-3df3-4081-b3d2-80943adedb4b", "comment": "Malware payload (Formbook)", "value": "c33f59bd3a3de9647acca31c0659c1338a1ca8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752610, "uuid": "183f10bf-0c2b-4baa-a253-748489a8c2f3", "comment": "Malware payload (Formbook)", "value": "a6054ede0d6dab9fdbbe7cf1349afa0f596698966078c2b9aa251a22b674930a2fed6646bae7ab20f09c86b670bfca7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752610, "uuid": "8b9db719-f5a4-44c5-b31b-5fcef47b9d0b", "value": "T19745BF0273C19062FFAB95334B5AF6115BBC79260123AA2F13981D79FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752610, "uuid": "318c680e-bf4f-4cd1-825c-801ce7de44d1", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752610, "uuid": "f28a9d1e-e4cc-474d-8394-68422e904d67", "value": "24576:45EmXFtKaL4/oFe5T9yyXYfP1ijXdaZ91y66qqFX8IrnUpWkYa:4PVt/LZeJbInQRaZ91yKqFsIreWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752610, "uuid": "c6fbb6c8-83dc-45bd-a42b-de0cdebe81bd", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752610, "uuid": "38f8baf8-f31f-4147-9238-d0c52bca7ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752610, "uuid": "49639716-3d8b-4927-9983-e463ef6c6728", "value": "z1844DHLFORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a8995a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766353, "uuid": "78507f0e-f614-47c8-8660-4ae4812c04fe", "comment": "Malware payload", "value": "3d3d2466a6d5f6c57820ca1ae502d202", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766353, "uuid": "0a21d9a8-91e2-42a6-ba18-aac6b216a2da", "comment": "Malware payload", "value": "dd03c2bc55c3d4fc739f3584634772d71a0465d1b0f85a22022cab2da643db34", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766353, "uuid": "f63ee36d-df69-4351-bc44-45edc8395835", "comment": "Malware payload", "value": "9bdbd977c11674a4be24a4881624a64f27e1dbfa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766353, "uuid": "7fead675-4212-4a8f-84b9-2c40852935aa", "comment": "Malware payload", "value": "3e85aa3a08a4b6cb726d804fe537536ea94daba3479ea57a4ed9d17d89f52d03485124f13776d447d1bc2182d98b0f84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766353, "uuid": "143bf2f8-b778-4a7a-b07e-f84c89a43d2b", "value": "T1CE42683B21F08B32E7C051C9A3661A614F72A70B456714B8F4FE5B269F2DA0370E7B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766353, "uuid": "68d2a00b-53bf-4a65-927a-65591e5f1a50", "value": "192:cCul4hvZ5m5FG4j4HKNpivINuVskuX97IhBWiE:a4hvZ5m5FGGoKNpivINuWkuX97IhBWiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766353, "uuid": "8ba989dc-b860-4eb6-9fa5-8aac9cf93b8f", "value": 12703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766353, "uuid": "c3d167b1-0a6f-4acf-b90b-d2c987f201ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766353, "uuid": "f094a6a4-3d4c-40dc-883b-4ebe3fdc2269", "value": "dd03c2bc55c3d4fc739f3584634772d71a0465d1b0f85a22022cab2da643db34.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0629a175-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766329, "uuid": "b5ba6a72-12b0-4146-85df-5ce04df04309", "comment": "Malware payload", "value": "f369fa8ca094ef131fe9d2bbd344023d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766329, "uuid": "64e543f1-a6c9-45fa-88f6-0cb21d56f657", "comment": "Malware payload", "value": "dda2ab64783beae5cfdb2f3dd22726a550df1a97eec25c285a53b64a61f543c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766329, "uuid": "b20590de-e539-4ab4-bc83-5effa406e736", "comment": "Malware payload", "value": "85076ee5f708c7717124331cbe2ee0a3536cb859", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766329, "uuid": "8f4b3a1b-2e98-4f46-8cc1-9e393a7a9eff", "comment": "Malware payload", "value": "f8c7c50e93be6620ff6fa135d0776199daa6387086ef355f5a7d826493b2e5d06b0c5a1dca1168477bbfe08394b1944f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766329, "uuid": "e2954bc1-9bba-488d-9659-ee8dae569c82", "value": "T16F22463B11F08B32D3C460D952A61A614E72AB1B852614F5F4FEA32AAF2C90735D7F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766329, "uuid": "bd956b47-b335-4eae-98b4-ab9594ac2462", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjcMioV3s:cCuYK6p4hvZ5m5FG4j4HKNpivdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766329, "uuid": "bd99517b-14c3-44c3-b741-c618fb9d9885", "value": 10420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766329, "uuid": "4f72b8d8-0a41-4292-a5d8-f55efdbc32d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766329, "uuid": "45304c45-ca6a-4e4a-9e96-5ebcb47c0da9", "value": "dda2ab64783beae5cfdb2f3dd22726a550df1a97eec25c285a53b64a61f543c6.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd619e1-0fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1771759468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759468, "uuid": "9b7a5457-08f7-43d5-97c3-2bfc70d241c1", "comment": "Malware payload (Kaiji)", "value": "00cf276afac080bf18003d588fb2ad87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759468, "uuid": "df8c921e-90c8-4365-b060-c39963985e39", "comment": "Malware payload (Kaiji)", "value": "ddb124c4b980091529a01dd544c0dc6b278d48b376ad1a313bd11f3e54a0f31b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759468, "uuid": "8215caa0-55fc-4531-898e-1d2ea50c6826", "comment": "Malware payload (Kaiji)", "value": "4cc322ba36820ac8967b4483728a314efe12e1b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759468, "uuid": "3b5961a8-a47a-4323-b4a8-8d5a64d084ee", "comment": "Malware payload (Kaiji)", "value": "9d423134a7ae9bd80a0c3d080eeec545a1c150cfeed3c5b2ce814d9cacb70c73033200f5db4e66fc3129285f70966ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759468, "uuid": "d14d1120-1953-434e-8f20-87aa78258a29", "value": "T151B5F80ABDC16F7AD59C03354AEE165A23513E495B91072327A4F7B83A7733CAF1B488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759468, "uuid": "7ece0ba7-831c-4ece-bf63-f1d02c3e8632", "value": "24576:mU9tyqIId8F9/dQbZ97G8JRC0OVXc8RuMFLGk+koAe0G4Zz1v:AqIIqrlQtO04uM9Gk+CeCZz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759468, "uuid": "f53e6062-af39-425c-bab2-38ce5fec61a7", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759468, "uuid": "95beb938-b96a-44a8-8cbd-392e99d63bea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759468, "uuid": "ce5decef-352f-4fb1-a1e1-e918992e99aa", "value": "linux_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3624fe-1003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771774236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774236, "uuid": "75e65367-1393-43a0-8d74-bc7ae821aa7f", "comment": "Malware payload", "value": "8b0845d093e3718472a1a25c10a45dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774236, "uuid": "7b21bd54-99a6-4340-9b05-8244a268abcc", "comment": "Malware payload", "value": "de0668e16a6e3e14d2e5874a771fa7e4333c15e036aae11736731b185fa14c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774236, "uuid": "1207ea7c-3161-4154-bc54-d1ce331d8acc", "comment": "Malware payload", "value": "844beb1e1c09e8ab7454c361866efc2d5737a4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774236, "uuid": "a9573dd6-6ea3-4532-aced-262efff45780", "comment": "Malware payload", "value": "9ecb633199262a19f92634f411a35537f68bbc76b89e7c69aff6903a83b893b41edc673c84ef11389362191b40c6e826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774236, "uuid": "de291fd3-532e-4c18-af5a-119c351a4857", "value": "T10E871256E2F900E8E97BC0B8C6575517EBB1344517309BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774236, "uuid": "8122c337-e979-47be-a2ca-a45bf9279d5c", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774236, "uuid": "6c8b4903-b5aa-41fd-8e24-71eb4d7b626f", "value": "786432:i5dchtzhWNsKpjGct8To61nEPwd49C880XsChW:MchtzEnpjGi8T1nEPtw8z8Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774236, "uuid": "4350462c-9dc5-4e51-9366-4c76c52f1ee7", "value": 36214120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774236, "uuid": "7dd206c7-cb05-4629-bbd8-037ffa77b1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774236, "uuid": "5186b897-7c15-478a-9500-3df2ed581185", "value": "AxisControlAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746b3430-1003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771774244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774244, "uuid": "9c36f6e2-0c7d-4f23-8b60-1a1ddc5fc6a7", "comment": "Malware payload", "value": "8e0a715f282a3bedf27954f9372f4d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774244, "uuid": "bba64302-c35f-4e31-967a-a88fea1d2acd", "comment": "Malware payload", "value": "dee64b39920c45f3f833185178a6490e9f35c2229a3ab911b4c1698e03bad8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774244, "uuid": "c6f1ad88-6837-44f8-9d5c-d5ab48e8bc7a", "comment": "Malware payload", "value": "93a04133ef50668fdb3ea140344d16c1442dfcb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774244, "uuid": "1d41ed56-7c3e-4c3f-9636-e729e313c923", "comment": "Malware payload", "value": "c7cf9a60d8465caa46fb860927f501e2a4b67282e48ef6b8363bb6218a8f465f54ed48859346a65d6ffa207ca3e26b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774244, "uuid": "ff264091-f6f6-407f-9cb7-e9e764bb8d5e", "value": "T106871256E2F900E8E97BC0B8C6575517EBB1340517349BEB52A48A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774244, "uuid": "78c10dfd-2d8c-4a9b-afb6-c3027a344760", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774244, "uuid": "7be28bcf-3139-4927-8c17-b1067120b01d", "value": "786432:P5yXhtzhWNsKpjGct8To61nEPwd49C880XsChM:gXhtzEnpjGi8T1nEPtw8z8CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774244, "uuid": "2b60596f-d719-4c6c-a6e1-3378fb286045", "value": 36214128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774244, "uuid": "b7db6285-ddc8-4876-b5ea-921f0b1fa255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774244, "uuid": "817a60e3-0183-4610-bb0d-3b9f40ee51e6", "value": "AxisControlAgent.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e666cb5-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766450, "uuid": "196a1c2e-9811-4fc1-80e5-b45486350804", "comment": "Malware payload", "value": "6b0088d089632382d9cfa893a80a3fbd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766450, "uuid": "edbc7c6b-2a48-4b75-b67d-dac77aa3088f", "comment": "Malware payload", "value": "df324fc70c37ddefcdb74feb66c68a42ece374505eff57e8f2bc49a628bef7b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766450, "uuid": "ee0fa5ec-4f88-4687-85cb-8695847218a6", "comment": "Malware payload", "value": "85a9f21f1aaa561ce48bed74e0445b77baa80987", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766450, "uuid": "7e511847-e38b-48c1-923c-a08f0944c261", "comment": "Malware payload", "value": "ef4506c5252d228dc1cf64119da99848f4c8d4a8aeed1e101a4ba6e97f20cf0df9ff64cae51ee15a170f7f9c74d0b4b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766450, "uuid": "42aa79af-9177-452c-b8e8-ecf265431a13", "value": "T11211E3B001F1086326102680B2372F46BBB2EC474993168C38EE6A296F87F13A19B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766450, "uuid": "7c44e0f1-86f5-481b-b660-acbd97b78d6c", "value": "24:cnnRUR8fA+25ob9HHIuCzCRpYdZeI3fdGL/HUeN:cnRu9+HnB6gI3fdc/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766450, "uuid": "0eb4e8ec-1764-447e-bd83-62af4e06b0b9", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766450, "uuid": "b2fef02b-6deb-4e74-b10a-81a0acc6d2af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766450, "uuid": "e4cecd86-b693-4f55-97b7-868076bef4c9", "value": "df324fc70c37ddefcdb74feb66c68a42ece374505eff57e8f2bc49a628bef7b1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41559cfd-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769005, "uuid": "8d781ee0-138a-43ec-917f-ba4a24efef80", "comment": "Malware payload (Mirai)", "value": "92e46a34d9c88cf10fca081f7cbd8027", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769005, "uuid": "52fda014-a7c0-4397-a6ec-c03260f77633", "comment": "Malware payload (Mirai)", "value": "df4261dfbc546eef3eb4c349680b3b0e1ef14dc404bd9d71051e8dbec2def082", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769005, "uuid": "992d69f6-1e0f-4e46-84a7-32d4d2190b4a", "comment": "Malware payload (Mirai)", "value": "9d9fef7a581467e70e47eb18bdf3216e0300403d", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769005, "uuid": "b33891fa-7a44-4377-ac1b-44484553d3f6", "comment": "Malware payload (Mirai)", "value": "5f6231ba4971504e58d4fb13938281effff445a46bb889805c4f1bff77f260bf5ab8618207b9e14fc8bed8af5f568c76", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769005, "uuid": "3b4efdff-60eb-4937-9433-79e2c06f2852", "value": "T19603E1106FA26A55C5B03A37EE650EC1FD09397CE0F6BA22508813F87ED54D9BCF6981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769005, "uuid": "fc673512-fff9-4c45-ae95-7f6d2d220952", "value": "768:xnq6CSA+gICyThftXfSyzgpCIOpBi7C9txTz7I2VtUjnTZN9q3UELOQ:xnRdA+g25tfSA7IOpBAgZE2V+zyLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769005, "uuid": "98730ae5-2043-4199-8c33-adb80c55879e", "value": 39208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769005, "uuid": "cce160d3-e6c4-4867-bef1-4fdd17f88b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769005, "uuid": "8f61f241-ffdc-4708-8e23-b4136475716f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96db2a4b-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779456, "uuid": "e0547eae-8dca-4cc6-b13a-31a2d55ec9f3", "comment": "Malware payload (Mirai)", "value": "c8c7000c91e099420c10b4e793cf8f70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779456, "uuid": "71c7cc76-390b-4b7e-a881-6674d5c1c61f", "comment": "Malware payload (Mirai)", "value": "df59c5b4476abc6e8d205f66635d358308821a31279af62c344e77ef827867af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779456, "uuid": "cc48764a-bf96-4679-9960-abb9052f9803", "comment": "Malware payload (Mirai)", "value": "2081106445242953945f4cc59886a9b9f792068a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779456, "uuid": "aac084fb-6769-4c3b-a5e5-3b11d5b5d3eb", "comment": "Malware payload (Mirai)", "value": "72c7f5789115acd2b5599db3cd4ccfdda271255e4a41275f5402a21247a8fa26f6f0c4a6c7d306cf0ac3056df086a4a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779456, "uuid": "1390a223-bd30-448c-a0e3-172d60bbadc4", "value": "T10A533C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779456, "uuid": "2f966099-65f9-456b-a763-7e078dbadd19", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6iGe:BET6Rq1gSmQ+LzDIiEbW/ogI9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779456, "uuid": "a704c8a6-c97d-4da9-80c1-2ca744d423a9", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779456, "uuid": "6759c4d3-09b7-490b-a997-0142c0dbe2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779456, "uuid": "0b595383-1829-4d24-a4f8-1eb0b3f69773", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f482bd60-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1771769305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769305, "uuid": "5d1a1eaf-d831-4ab6-b7be-2a1fcb37fe7b", "comment": "Malware payload (ConnectWise)", "value": "a67588428f0a77662d5fc44480e11db5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769305, "uuid": "3132f2ff-a56e-4ce4-b931-158cff8d7af7", "comment": "Malware payload (ConnectWise)", "value": "df5e5e3138ed79f15b0aab5b091ca9809f9d839ee21a90d80a587e9cf2a13423", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769305, "uuid": "cb1fb83b-96fd-433e-a500-617bf0ada618", "comment": "Malware payload (ConnectWise)", "value": "8fe9d22cb37456022fdfc7f884d4ab747067d8e2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769305, "uuid": "459f05ce-6218-4eb5-a592-8fc7f77f35c0", "comment": "Malware payload (ConnectWise)", "value": "9b63a2560dcef36775ad73aea0cd7b199b72dd6210cbcc449151339e2acfaa546ea1feaba0c70a4a506c5bc5add6d5a1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769305, "uuid": "a4f397a8-81d5-45a0-b329-bcebb606ce6f", "value": "T16B41755AFC0BA915C5B1C6D2B9267E0FEBA40417152060A8F91CC99ACB349BDDB7C1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769305, "uuid": "16f71561-10bd-4b39-9bfe-cc2135e93afa", "value": "24:PXCjMmu5FgKZhs3TcAzSG9QdW4ahMYkb9/ROMx1AWqSMqgX6pMxZcrkezaGoHJVi:PG3RjcAzpKdWzC71AWdMWQ4haGEs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769305, "uuid": "d1790d6d-c944-4dd3-a4b6-d6641a296a8b", "value": 2357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769305, "uuid": "4f845cd5-4bf0-4adf-bc6b-280c7320590e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769305, "uuid": "b8bb4a1f-42df-4d82-b365-006552c98e66", "value": "Google-meet installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41bfd67-0fe0-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771759373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759373, "uuid": "1c5951d6-5539-4f2b-bb77-fa3bfab803db", "comment": "Malware payload (SantaStealer)", "value": "93538418fc4ad9956ca9cac3e35fc2e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759373, "uuid": "0f531e1c-5255-4b30-a3bb-350063236f96", "comment": "Malware payload (SantaStealer)", "value": "df6e6392dd182395487766acac3a90d2ce7c08b3a7760a459524475b0c8565cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759373, "uuid": "9b2a7134-68ae-4e7b-8309-1de81b7c0cc5", "comment": "Malware payload (SantaStealer)", "value": "22a57030a45a41f402909a37fed2f3cefab540da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771759373, "uuid": "855f6076-3aa6-4f81-8121-75f878e06a6e", "comment": "Malware payload (SantaStealer)", "value": "53f04affb3087002051ee9f018e70c9ebdc223c1e7d09203a33cbfda47c1c55225e0e38455c269e08d52ee76160b6d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759373, "uuid": "6e3fa273-178b-4c27-aabe-1bdada4e194c", "value": "T14406333032C349C2D566917BA8273620EED41CB9E75A9EFF269BEC67B6212D0DC04E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759373, "uuid": "40b944ef-d4f9-4d4e-aede-85707dc18ac2", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759373, "uuid": "bdca56a7-081f-446e-89a7-e728b8743ba5", "value": "98304:ikgmF6nPSfDN/d/FL6HqUjwLKPxjsyrZrStpAVjTG76:T98nPcVdx6Htj3PSyVr9g76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771759373, "uuid": "ad53fcae-e345-4db2-b2c2-8cf2ccb57963", "value": 3834368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771759373, "uuid": "c3b7f0bb-1d8e-4bda-9852-505ab725a65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771759373, "uuid": "6b8e0eeb-fa09-4048-9dd2-4c3748f15029", "value": "SecuriteInfo.com.FileRepMalware.29938447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcef621-0f94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771726479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726479, "uuid": "bf74ba2d-2244-4782-9168-8b9921d5ba3c", "comment": "Malware payload", "value": "6eeb342c5bdb7caa7bd5c64419cf38cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726479, "uuid": "bc5519e1-e1a5-4d2c-9eb4-b0a7c7fad54f", "comment": "Malware payload", "value": "df76fbae5cfef242cb86d0f96e7f640735aa598e149dccf6febb0e5098a93478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726479, "uuid": "520486b8-d9df-4e94-9dd1-b79c8f778dcb", "comment": "Malware payload", "value": "27984e3e7381a5bbc03559da23be69d6443ca071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771726479, "uuid": "15db81a8-78de-44f6-88aa-8a11157ea5a8", "comment": "Malware payload", "value": "e5289aa26ce42682479700c8ab4d2d381b617292451584f642dc49fe62a71d6259ed14ef4a4ca76dbe4f986b1922c52d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726479, "uuid": "1277405d-9859-4e04-a18f-8fd6ab19ddd0", "value": "T145F4338589CE63B7FD8DC53CCF750B8ABC2D86B0411950B848B9252CC3F7D5B961A9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726479, "uuid": "c93ff27f-b15a-4c81-a8a5-40bb6d87897c", "value": "12288:aLmITlpPzLodbbF9N2lKseK+IKkqprTDmefhkBQJ4orKfTaZECU:aLmIzLYN9ElKKlKkqJPlhkYrKfTaZECU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771726479, "uuid": "68340675-b4b9-4996-8df7-5c21441f9735", "value": 727055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771726479, "uuid": "37afbf87-d4ea-4532-8f26-f8556cf86706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771726479, "uuid": "5ad781e9-ebf7-4894-bae5-2733858eac25", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2cc5fd-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771769051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769051, "uuid": "a3f7057b-51a1-451c-978e-ca6736e6cd60", "comment": "Malware payload", "value": "5422f4d9b05b86ee00afa7bcfe09d195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769051, "uuid": "15678b62-86ec-4134-b1da-471360d84c90", "comment": "Malware payload", "value": "df7a49deb5d95c723d52a6d01d691b9511070e5f6444e85614fb3fb7efdf5227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769051, "uuid": "b3edba0c-4ded-48ec-883d-df2db8954d32", "comment": "Malware payload", "value": "3b501a959b3872edb72793a1a1f8745d7d654ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769051, "uuid": "817ec7af-a9b3-4f2b-a91f-2ae067b7cb40", "comment": "Malware payload", "value": "700b88bcb1785876b34239d442ee0545ac664e3e6e260be10e958f8f765956cb8023de6192b865aaaebe43beedd94693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769051, "uuid": "2ce82f72-be11-4a68-8d9a-2ff8f3879c34", "value": "T111F633409667EE2DF624933ACE8AA970341928E9E5C00DB71D83E714F179347BC5BB39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769051, "uuid": "7afea2ad-1e0d-4aa4-acd4-246a77d6d349", "value": "88e9ba805693c0535a772c31c6feee57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769051, "uuid": "dfb398ba-c586-4062-bad2-5a1db4c0b653", "value": "393216:l/U+C8/nhSolJa4HPyW36IPhlbqO1oUtjNIVq06wYrhUIm:lcX8vgkJaVghI/owhW9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769051, "uuid": "012749a3-a401-4fd5-b51d-cbe6c3737e9c", "value": 16135894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769051, "uuid": "8aa73110-0582-49d6-9d44-6aace7b0cc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769051, "uuid": "ab80e673-b077-4c81-bfdd-6c5ac50ea3ff", "value": "\u8c46\u5305\u706b\u9f99[2.02].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffe40ab-1023-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771787874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787874, "uuid": "3f0eddd2-3981-4012-a6ba-62fe447f2f7c", "comment": "Malware payload (Mirai)", "value": "ca5978162db6100174c5ba94610d187d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787874, "uuid": "d9619d28-8650-4a21-903d-5fdc606f66e6", "comment": "Malware payload (Mirai)", "value": "dfd6febb39f5871c9674093a722c76d4f16c2380e211c45b83d04704579020b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787874, "uuid": "5372a206-6854-4e06-b3ed-60bb06cffd41", "comment": "Malware payload (Mirai)", "value": "a0abe5ad7ca90ac338b63a9997b2ac50ff0c92ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771787874, "uuid": "c05c63d3-529a-4484-b5a9-adf170b9295d", "comment": "Malware payload (Mirai)", "value": "00cc95a9f0f5e0407d8953e26f16c0246c4ceaf2275560c11c45b9401c5bfc8ba2c869596f196e02107dae69259028fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787874, "uuid": "00eb475e-55a2-46aa-9e0a-5c8b540af3b0", "value": "T17E934A96FD818662C5C112B6FB5E028D3B2713A8E2EE73039D256F2133CB91B0E77951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787874, "uuid": "ac136318-4788-4dea-97f9-4d65817eb5e0", "value": "1536:TbsG0TQa0InYlpQmdv4BL2tHIBdjToPdGHQDD8y2HlMZTgziwhvUfeyWKTT:TbH0TnQQgv6AmoV2QDQy8GZTklUT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771787874, "uuid": "2fbffa56-cd1b-4c34-9340-b740016a9ad9", "value": 96044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771787874, "uuid": "bb8ce17f-dd88-45c6-b081-22de0630bd6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771787874, "uuid": "e075f6eb-cb1d-49aa-85cd-d923861e39a6", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34740163-102a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771790887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790887, "uuid": "885023d5-e63c-49a1-8a26-343a6bc7f911", "comment": "Malware payload", "value": "10c944e640886b76c05f28c044c018d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790887, "uuid": "fb39b44d-0055-4410-995a-dda249fd064f", "comment": "Malware payload", "value": "dfebc7ecc5c40ab4cb11f24b94007bb5d496b6925f04ff428b305984ab6abd74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790887, "uuid": "a6026780-07f5-4c23-b526-4a5a60b0400a", "comment": "Malware payload", "value": "37261ffb0b2ae18a0cbb634ecf8d3ce47bd53223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790887, "uuid": "0d27211d-528b-460a-87b2-8c43895db08d", "comment": "Malware payload", "value": "6c8ce2da80ebca378669c9f03625274e2975879db5dc07b8724cb3356a0fa1aced0f62ef932948452541d62526aa85a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790887, "uuid": "be598775-607d-4d50-b24b-16cb62129f8f", "value": "T1E5934C02B31D0E43D1671EF02E3F27D1D3AE96E121F4F789691E9A8591B1E322586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790887, "uuid": "fe7839fb-a5ea-4695-a828-df69fa5fca32", "value": "1536:VZCb1FAtIYTLcr9N0PIbyzee4kffvzkQZKswNbCrgv1TRwovviDEmvXNg:aRFA3T42K0fwWKnJCITZvMNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790887, "uuid": "5d34f8e2-fba5-4513-a1fe-e75f6801b3e5", "value": 96984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790887, "uuid": "76ef967b-d48d-48a2-953f-e907b088b02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790887, "uuid": "ff3b0956-74b9-4ce2-b443-adc101b6ca0b", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24af1f72-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768957, "uuid": "a10dea42-8d1e-4388-a59b-9a0c0238a9ab", "comment": "Malware payload", "value": "950f47f5da4d9e8ef202c8ffb5950c22", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768957, "uuid": "822d4c12-179c-4642-aff7-d813dd85048b", "comment": "Malware payload", "value": "e04ef421c1337398d527a3708ea0f87353486aafe9d4560d22ffc9b59562e28e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768957, "uuid": "583c6478-f12f-432f-8737-38265a573331", "comment": "Malware payload", "value": "bd2b5ece4ab8011e888fc21ef343c844288449a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768957, "uuid": "5cc498f1-1f7a-49c0-8698-0c6beba69159", "comment": "Malware payload", "value": "f25f2c53db7b81c668a9adc8f792ad410b3cf58d959708fceae4e86966a85a8c48e7ece0678d615562aaf97bd1da166a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768957, "uuid": "f1613615-1241-4d0f-a20d-d8713a549738", "value": "T102C733863E49CC19F0260B39AB778195F5644FCD5502F4EFA458BB903EBBE805B01EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768957, "uuid": "c79e50c5-64f8-4237-b07d-81037abcde7d", "value": "1572864:+jEzikGSi58H03d7v1efc9xVCgQiaYRqSjc5:+jIiENc9xVt7aYIQc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768957, "uuid": "5c05b3fb-f716-4dd0-b7fd-f30140f00acd", "value": 57622331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768957, "uuid": "aa73f2a0-cbdd-4cc1-8907-eaceedebc128", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768957, "uuid": "4da2f8f1-0a56-48dd-b4d4-b2ee0978620d", "value": "20180724185728_PetK_UC_1.4.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72428a95-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779395, "uuid": "e3dd0c47-bff5-47f5-a0b7-9249b5c891d8", "comment": "Malware payload (Mirai)", "value": "09b11cc0155bf28937e4fc591c3b9e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779395, "uuid": "96f21809-8d05-4b14-9506-135c0c49559a", "comment": "Malware payload (Mirai)", "value": "e07711d44c3106393a82af3b978f54af56a225fb705afa31b675f82b789a9628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779395, "uuid": "cab9434b-81fb-48cc-898f-816a6a21dfa7", "comment": "Malware payload (Mirai)", "value": "0e60809b88fa9b942bef86ffa4e4705c6031105b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779395, "uuid": "924770c9-1232-4625-928c-d59ec2daf63d", "comment": "Malware payload (Mirai)", "value": "5545bf46b275c6da3a96d82e1a56f2cfc6e3aac10ded26592e6c6d22ed4dcb1e29cccc246d16e5fb5a4752c47a187ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779395, "uuid": "ce6cb773-663c-4a1c-b250-99ad3c345f1b", "value": "T12DA2D0366944DA26C1F0083ABCFEC1DBA2D146B8E277725B271097F0AD8250FB1A55CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779395, "uuid": "8d52b355-b695-4d3e-bbb9-c776d064ebec", "value": "384:c0CLEvw8wFSVcdHwdc9qXtbymSOBB1U0dlDOrgr9njV4wVfoUqEo5hymdGUop5hU:c0SMw8w9H2c9qP1rFRxoUqns3UozY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779395, "uuid": "cd158cc2-e154-436d-8f24-47eb127b1e31", "value": 22724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779395, "uuid": "4aebb3c7-86ab-4e84-8a9f-b1b446de9e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779395, "uuid": "c866f023-8497-49f7-afae-d17c6657f3b7", "value": "purves.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc7c515-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752540, "uuid": "05905e05-1e77-4226-bfb1-7ecb00cbe2df", "comment": "Malware payload (Mirai)", "value": "f50ed1fc3074b297a667b235ebbe15ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752540, "uuid": "e204496b-e1fa-4487-98a5-12ffff9c896f", "comment": "Malware payload (Mirai)", "value": "e08dd2ae48eb72bfece0c3739daa38f9b1e5ef43ad1f5805314abf6d916900d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752540, "uuid": "c44d5c4d-bf01-4d9a-afc6-5da9ca490082", "comment": "Malware payload (Mirai)", "value": "aedc425f4fe3f1e510c05fbd2d0869f448cf99ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752540, "uuid": "6417c790-72a1-43e0-aebd-080d156dd60b", "comment": "Malware payload (Mirai)", "value": "72d990a7e5cf3792346c4a153dd0a64a93e135d37e598c903b22104cc126975a7ddca5c2ee197b5b62d591f39ac896b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752540, "uuid": "8d596bf5-e489-48ae-831c-168dd111128c", "value": "T1BE5302E660D87DCDC1999730020F4A473E86B7B86089693AB2C5F6694BF2740DFD8BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752540, "uuid": "c3def482-91ae-4919-83ff-88ce1106b882", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRltyK6Lkg4azHI:CM5az1Fy0oPgdZX6hTo8RpyNLGazHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752540, "uuid": "3cb738d4-f2cf-4c1d-bd86-21d10b2f2633", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752540, "uuid": "55478ff7-afb5-4de0-8cc0-f9a0cec20e2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752540, "uuid": "15ce7f64-3178-4b14-a9e3-0e212fee322e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd20c627-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771789, "uuid": "663ecc10-10d6-40c0-b86d-2a523f0bb425", "comment": "Malware payload (Mirai)", "value": "0b15626e8ff376639bf467f9e46e9c8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771789, "uuid": "f744eaa5-d012-4096-bb3b-c2faa529a581", "comment": "Malware payload (Mirai)", "value": "e0aa2740d72df4bf227c0e5313225a116918c57e9b031cc2391fb042384f9fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771789, "uuid": "dfcaeda4-0801-49e3-8233-5fb1c381cb8c", "comment": "Malware payload (Mirai)", "value": "fe851397e885d1359ceab8d6283f9904cf77d82b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771789, "uuid": "6f781eef-18e5-4734-bfa4-9860caaa00fa", "comment": "Malware payload (Mirai)", "value": "33003a892e4b791ecebd860016be7169492fb2a3f28ffcd80759e673d6f9714c4edb41c3eb95965ff1b55e4587a15240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771789, "uuid": "e58e0258-3c92-4c69-adea-4e6dde3806fb", "value": "T18DA338D7B801DDBDF80EDBB744530506F531E3A219831F36626BB967EC391A81826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771789, "uuid": "ca09decd-6918-481b-bf7c-d6ff37cc1577", "value": "1536:Nw3pWv1rOLbQYrLDeXdY1Tr6B6k28IxTLgOelRUepbf2TyNo4SN4xeY3:KLMAU4TOB6k2ORtpLHSN4xH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771789, "uuid": "1150f39a-8ad8-4046-971d-e835630a77b3", "value": 98704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771789, "uuid": "8891b850-a4b0-4b74-95cc-2129da811687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771789, "uuid": "ee7ca853-4961-477b-bfec-842311b2f22b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f49cce-1004-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771774898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774898, "uuid": "2ce76fdf-a51f-448b-bc48-74a67a7c3154", "comment": "Malware payload (Mirai)", "value": "130f62cbd62e7926a31afd8dd35968e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774898, "uuid": "1aa82d33-9d64-4f12-ba78-319c81cc7e5f", "comment": "Malware payload (Mirai)", "value": "e0e634ceaad091162884be235054d332ae422e84713145b8c4f2c55a4172b487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774898, "uuid": "9eb5aa51-9f7c-433d-8a1b-e6aefe37507c", "comment": "Malware payload (Mirai)", "value": "5cbf6b66521650672d7eb6286fe1ca32b6650549", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771774898, "uuid": "70bfcfe3-aceb-4417-855f-9818b5ea1614", "comment": "Malware payload (Mirai)", "value": "52588577bf002a11bbcbbaeaab9a6efb1d6ead6b3714c2e3a73388309975d66d97ae66766d8d6f678a47bad3206e1776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774898, "uuid": "bf204b13-ca6f-4ff4-a73f-c0a229f3fbb4", "value": "T124F31A56F8818B16D5C211BAFE1E124E37131B7CE3DE7213AD246B707B8A86F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774898, "uuid": "75655800-43e7-4dce-9e8f-ac1752aaafea", "value": "3072:+LhJ7HL7ZQvlA3dXro3rOwaS2Kxc9+VJMVnLmxEYC1P6hh1Zde:+LHLd0lEXrOTaRS7VJMtmxhYYde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771774898, "uuid": "91a6feea-9a93-43fc-a252-d16d895839c3", "value": 164636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771774898, "uuid": "472d6d4b-0673-4ba5-8628-f80640e3e019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771774898, "uuid": "4ee27fac-5a4d-470f-a396-0d6a491d6fea", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afee698d-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766184, "uuid": "34ebf545-3221-47c3-b729-8bcc6614603f", "comment": "Malware payload", "value": "93bdbb3953c87194273d6b0ce61d464d", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766184, "uuid": "f1bdff9e-39d2-4471-bff1-847fc8de2730", "comment": "Malware payload", "value": "e104807d9f850185a28f59b340ba691acb6aa1a760bd2292ab5612208618d688", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766184, "uuid": "c8ef9a74-613f-4091-bc5b-c678af9ccd8c", "comment": "Malware payload", "value": "f8d518b981f57c89bf329837d496ceca3ada8305", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766184, "uuid": "3d71ba93-5323-40c7-98e8-360dff021d2f", "comment": "Malware payload", "value": "637e25d75d253c4720227532e1f3343a277a4e62adcc64fed23d6176a1478b94bdbe4cceceae189a1621e1f633e0502e", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766184, "uuid": "b557c54c-25fd-4ad0-b5ae-5090377b4f17", "value": "T1F887334894353C35846DC2A7E41DE54728F08AD2B7F2C658CF4B75A7A183B8FEE4CA94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766184, "uuid": "c9fc5263-4a1d-49a6-b7ac-02a7c01ece8e", "value": "786432:pzAHEv9/8qA/M9rOH1dS0P++98H2k6wqRZMIi534J:pzA89/8JYfMh55AXt4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766184, "uuid": "41d9c815-fddb-43ec-ad89-1103aef18445", "value": 37528663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766184, "uuid": "1509c497-ca18-44d5-8236-f08d1286839c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766184, "uuid": "04a91dbc-a279-4c35-8e38-4004416cccd8", "value": "KMSAppSetup(MID_FEB_UPDATE).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60766ef5-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766480, "uuid": "6f43969a-c398-44e0-b3f5-8ec471d669b0", "comment": "Malware payload", "value": "81efb11e351ea94de661d47b5e72dc8e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766480, "uuid": "d6fbca59-ed58-4f6c-ab8f-adf03972aca8", "comment": "Malware payload", "value": "e14130094a158ffd604b6dfb5c01cebbcf8d9143d8a56fa5b9a8940e4171e131", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766480, "uuid": "6154c680-aca4-4e58-bfec-d764b78c0d5e", "comment": "Malware payload", "value": "8d698ef67aea1a3b3ec9be5b92d44d20bf80fcca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766480, "uuid": "2ae36d2e-c12a-456e-943b-f12f61a77ae6", "comment": "Malware payload", "value": "06ff18f81d6c2be91d1144382b976e60c1ce2fae3946096f8132d485237622db4932e50af63dee6e94a2944ec6eb5f51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766480, "uuid": "c44ba7a8-f2c6-4c93-8344-96c212825bfb", "value": "T11C31593440F11D632618A45062B32B817FB3DF535A5213DC39EF5FAA5F8AA03628B831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766480, "uuid": "fade3dd5-8255-48ff-99fd-81467f412ff8", "value": "24:csnRUR8fAR25wQ9HHIuCzCRpYdZeU/iPdFHjeef5uZW5FkXdflUGL/HUeN:csRu9RLsnB6gU/iPdFHPwWYcc/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766480, "uuid": "c9235d85-e45b-4690-ae68-ee9c529e0448", "value": 1614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766480, "uuid": "22233db9-0c07-4c14-8457-e823494c0dbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766480, "uuid": "215e34ea-004b-47f3-90d8-9f7ad2333dea", "value": "e14130094a158ffd604b6dfb5c01cebbcf8d9143d8a56fa5b9a8940e4171e131.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cf9f97-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776847, "uuid": "92c0fe43-18b5-4987-9902-235dd708fae3", "comment": "Malware payload", "value": "aa555de8a2160b51a099653e8299178e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776847, "uuid": "8b404e11-d4a6-4f24-8726-0b58ee95585b", "comment": "Malware payload", "value": "e1e780b435b4e12571e2e5510ebc705549b6058fd0c6899ce0341031b3b01f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776847, "uuid": "10559665-a789-4de8-8eb5-96abb953a836", "comment": "Malware payload", "value": "61edd4f78874f6ec76198de2db7950b5b4d5491b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776847, "uuid": "db5b2e92-2e88-4a7d-b1ab-b565d899184d", "comment": "Malware payload", "value": "4748d3c75b7100d8586191c1c0765f599642da183bcd67d7c0cf78ac035b633553a4412fae96284ffce0829925484f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776847, "uuid": "f0d830d3-b831-41b7-b763-2acedff93442", "value": "T12604F18777015F61C22A853219FFC691AFFA26D71AC29946B32CDD10AF4174CA82FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776847, "uuid": "f8619c45-d224-4d6d-95b7-66a8858ecd58", "value": "3072:kgfKVeEOH4lcgjDxMT58MeGN04+T2fPL79o1yCW+owCKoOlkeYkmhaQlcV3dNPxl:kbNR1weGN04BPtDC5owCl7eYh0CcV3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776847, "uuid": "0c5cb76d-bb0f-43fb-8e5a-5ca7051d5a0b", "value": 180671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776847, "uuid": "798e4ddf-9658-4f61-aa4e-25f4305d5be2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776847, "uuid": "bc44b138-7c51-4beb-8e2f-693ac7c2e830", "value": "j6fhfiq96m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3957de8f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766414, "uuid": "e4736d10-a5e6-426d-9620-e034acdbb789", "comment": "Malware payload", "value": "f03d09e398e0e6de4c897785286b2f4f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766414, "uuid": "2eed618a-9db0-4467-bbad-90a7a56d27de", "comment": "Malware payload", "value": "e1f562de3b415bcca5b5fbbae59cb76b1514330a7e6393a0b2f2eea4b92b6e6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766414, "uuid": "0cd95429-5f9a-4bd0-b22f-160467d508f4", "comment": "Malware payload", "value": "f3dbc190959821ec316e3ed3e4a2a8f175a16131", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766414, "uuid": "04ab5463-ebd2-4393-9d03-055617db803f", "comment": "Malware payload", "value": "05fa03272328e88a7d0939f4742438e3b525714fd17b333b34d003fb294708ec01cd7b0787705f0a55080a0f721d4987", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766414, "uuid": "b0901e37-85bf-4764-94ed-3a53b6a87997", "value": "T10742487B21F08B3297D010C962B61BA14F72970B456614B9F4FE6736AF2DA0371E7B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766414, "uuid": "df3dc8a9-ea51-47ec-ba87-7775fe824e8b", "value": "96:cCuiB6csht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6NCxml1lJje4Vx:cCuW6p4hvZ5m5FG4j4HKNphvMNLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766414, "uuid": "897e916a-2bb9-4a29-a469-d0e9c41fa109", "value": 12195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766414, "uuid": "f07662e7-3eb3-4bf7-9c02-0b3b1197148c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766414, "uuid": "623ef454-b379-4083-9801-9f23ff193fae", "value": "e1f562de3b415bcca5b5fbbae59cb76b1514330a7e6393a0b2f2eea4b92b6e6c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb2d3b5-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779496, "uuid": "c2e53370-c91d-409b-858e-cc3dc82d2b73", "comment": "Malware payload (Mirai)", "value": "47befa3e81f718756a67bc825342ed91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779496, "uuid": "35b14eed-cec4-4d29-a835-ad9ea2c8d001", "comment": "Malware payload (Mirai)", "value": "e23e70cf7a9991e311ad291870c363097599ef29ae04aaee7635be17118cac41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779496, "uuid": "be45805d-24d2-4663-9340-2d17a6aeb11a", "comment": "Malware payload (Mirai)", "value": "a4133cb7c2b0f80378069e955a41846b28c6773b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779496, "uuid": "35a42595-8adf-40a0-9dfc-f1d9436c9db2", "comment": "Malware payload (Mirai)", "value": "bd360402f7024a626a25d67a12e63e0feee20d5defc6fd005f22a594820c171e7390ad516f41bce8fe51c5bee87c3c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779496, "uuid": "ea86f428-20b8-49e6-a099-a6b088a29132", "value": "T1283339C8E0DBE4F6EC10197D307A7B62AEB3E63F7975AE8AC3D85033D501602A50665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779496, "uuid": "c1fd0f51-085b-4f63-82ea-408a8e787ca8", "value": "768:xXcKlB52VkxIhAvY9bHRWnOj/pONuQ3BWPEFy5ud/2fkWSlQPLYy5D8/FSAROh:GexIh5HRWnOjSWPE1/bWSlQzYytQFSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779496, "uuid": "a08739cd-523d-4592-bf71-bc900c36a9bf", "value": 54624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779496, "uuid": "2c118198-ced4-4c25-bf28-901373785664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779496, "uuid": "869c1540-b57a-49a4-9eaa-a172b334ca33", "value": "purves.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa1f84e-0fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771760117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760117, "uuid": "62314c98-581b-4247-8bf7-5b1aeac460e8", "comment": "Malware payload (Mirai)", "value": "74670c013b052853add5cbf608ad20ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760117, "uuid": "ce661391-d0d1-4c65-8952-172a05b7b6de", "comment": "Malware payload (Mirai)", "value": "e25cf2975c9b954f57f9806856751985b482070d836f26ccd8431fcb5f030e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760117, "uuid": "bb14f1db-c8f8-4177-810a-2422ff845ac5", "comment": "Malware payload (Mirai)", "value": "207e857ead0fbbb38ebee47e3a0d063cd47e76b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771760117, "uuid": "d9310f69-53b3-4030-91fa-29fe0758b059", "comment": "Malware payload (Mirai)", "value": "d6285fb9c43f9e130f179ab5b45645f9db55f6aaa6404be99035a1868d2959c28b4da0eec0f873cf63f4c115e42ef53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760117, "uuid": "3d4e0884-2e27-4d2b-adb5-84142526a9b7", "value": "T194934AC4E683D4F1EC5705B56137F3369732E436202DEA47D369AD36ECA2950DA0B3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760117, "uuid": "b9563e49-a7f5-4366-b8ae-378bbc19771b", "value": "1536:5jjgcjCiP5qc0iY9pPMzJrdCTAiPq7RcPWivzNosjq9KQvOTSTflHuI1:5vZjCiP5dFYjMzJwdPEwWivBjK/O+TZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771760117, "uuid": "a1d1027d-02c6-4f25-9f92-d57a15f4be26", "value": 94252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771760117, "uuid": "89aa0078-51e0-48c0-a4a5-5a7002243773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771760117, "uuid": "5e327204-3444-46e6-97f3-7a6007c6af58", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6915f76-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750304, "uuid": "84bd6738-9675-4480-9130-1c643167821b", "comment": "Malware payload (Mirai)", "value": "ea34516e4ff72bac034e6ec67acec61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750304, "uuid": "575925b2-f9c3-4816-aa77-23dd8c016916", "comment": "Malware payload (Mirai)", "value": "e35d6edd468c3b13c909bd91c7bac21491acfea4e9a43387770b5b82f06280f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750304, "uuid": "6e090095-b2cd-4f69-8a06-45dc34208993", "comment": "Malware payload (Mirai)", "value": "816d806d5e8799ee831d42810a230756d2d461c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750304, "uuid": "00d2cdcf-1500-440b-8226-d44a5fe0e068", "comment": "Malware payload (Mirai)", "value": "6098aab2f9d2c73cc5f11e06bf7af2647cc63e5f30bd1393565d52eb9facd71375576bfe8ebb04a1fbf0a44460075787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750304, "uuid": "121c15ab-377a-4368-8ed2-44ddbd38c570", "value": "T1F0146BA9BA0F6C41F2C2D3F8DE4C87E13E1B35E3C7768971791212EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750304, "uuid": "b1a6c160-f3c1-4d43-b684-32ea91a19b76", "value": "3072:Qxm5+DWlIzP1l0N26fxiqH0QwO9O7grSaioRplMlEN7oq:8m5+DeIzP1lq2qxVH0L7g+Epl97oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750304, "uuid": "8d4002e0-ac4c-44ec-b6b5-d0fecfb32f25", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750304, "uuid": "0389c493-ad1a-4cca-a071-b4a775c94676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750304, "uuid": "619bfa33-9946-4d75-a194-cfdb2d7dddd2", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766aa5bb-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779402, "uuid": "35adf50f-c0d6-4459-80e6-1df85b8405df", "comment": "Malware payload (Mirai)", "value": "3ffedb7754d29a2dfadf533189f206f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779402, "uuid": "f4bc5842-db73-4268-a6a7-3fdadd14e0f7", "comment": "Malware payload (Mirai)", "value": "e3f03f49ae30ee155f92f96980319576e19cce0d853befbef88d3a60ec01835b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779402, "uuid": "195d3b74-975d-492e-ac47-0f7146d29f9f", "comment": "Malware payload (Mirai)", "value": "d2622a3af07eeabab2101f304ad22527e0342f81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779402, "uuid": "c6a353d2-1dd4-489d-91f0-4ddaa7109ac5", "comment": "Malware payload (Mirai)", "value": "33197a3cd3761ff0538558724f5b9dbc092a217a3e2d1ce594f1e2e41e04d4f8411147c9e9bc40dfefa2da91ea663114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779402, "uuid": "57d21fac-7089-4d12-afbc-9482163b3193", "value": "T189132A9E64512D6DDAD36CFB42634F0EA970122094D6432BB3B7EE873933264FE1991C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779402, "uuid": "685930b7-da78-4e4a-8f22-2e2155d73c12", "value": "768:wuGjnCVRsumIeKWSaeekVNcdW9/h/kZT70+H25+f1prdwa4t0eHlw:wuCC7shIeKWLlcOT70CWg1pix9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779402, "uuid": "4123918d-164e-4b79-bfe3-e65a5ff5bff6", "value": 43576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779402, "uuid": "c3448675-f895-4212-acac-a3e558991f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779402, "uuid": "0b772eae-3930-4189-a22c-6db1247dceb4", "value": "purves.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5839e361-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766466, "uuid": "90dd3031-13d6-4d08-8806-1eb54e51420a", "comment": "Malware payload", "value": "fc6777efe38727706cc33d49eb17496a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766466, "uuid": "ed4e465b-88f7-4f5a-85d5-516ef5ec5412", "comment": "Malware payload", "value": "e4d107cbdb63034ac126cc7ae70962efde44074aea1b9a4cafa3c68ab2bc722b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766466, "uuid": "b8958dc6-bb67-4595-88d3-32cfa1d3e3dd", "comment": "Malware payload", "value": "7ca16b88c45ec4520f36ffeb446153f98b0938a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766466, "uuid": "09420181-51a8-48be-94e8-4d9de6583b3e", "comment": "Malware payload", "value": "4277091939bf2d8219fa5175fdf5e2d1bc34644eb3c5028d8c2a52bd094bf84d636f1f84f00d5cb001fab0535c2965ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766466, "uuid": "1975b2e6-131c-4884-b003-51e4dff6b9d6", "value": "T1106236B435F04C732D601941B2731BE6A7B3D49349A3759839DF1F31AF86712B8AE512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766466, "uuid": "8f3a2c41-e6ab-4264-a7f1-9e0c11681c63", "value": "96:cWu49lJVU1Ey1QH1H1VL1iliA1dkI1aW1Lgv1Xsm1hM1fnK41yn1QJK1ZLp1B/1a:cWuwLtIa45coY+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766466, "uuid": "59201571-5f72-4069-8e4b-e7f00345ea0b", "value": 15051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766466, "uuid": "d73a8b69-b584-4cb3-9286-45a6bfbe3fa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766466, "uuid": "45e1fcec-8c3d-44fb-b56d-d36ab60faf32", "value": "e4d107cbdb63034ac126cc7ae70962efde44074aea1b9a4cafa3c68ab2bc722b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e113fb-1029-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771790564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790564, "uuid": "735f21c0-07d0-490f-a1a0-6f6cd7d2b8f0", "comment": "Malware payload (Mirai)", "value": "833e8423e396618a26e37f3bf1a81bd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790564, "uuid": "1727c599-55d2-4d33-a150-fff5f2bc9f43", "comment": "Malware payload (Mirai)", "value": "e5466bbc477e15c405dcfe6b479795b1b57719974febe64b6e61b77aa4aee798", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790564, "uuid": "aba6f7fa-7603-4b29-bb90-d999a227cf28", "comment": "Malware payload (Mirai)", "value": "2dd180912bae9f26e340a3be7356b330d3cb6723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771790564, "uuid": "398cc27b-6393-4563-b030-cdac70dc9f1a", "comment": "Malware payload (Mirai)", "value": "0f29bb079a6748ec265b6b3a0ac6d59b7f0e3f849a26a244f10f84a8b17324a5b586aa2b501e0d28e3c271e002d5e074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790564, "uuid": "73749417-fb61-42f2-8207-c3ab03e82724", "value": "T12F147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790564, "uuid": "890f4e2d-bd9c-4824-9733-76aa33ad579c", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRNUKG:IcY5JpMByVs9jSEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771790564, "uuid": "1ec22261-0b71-4c7d-90a8-74bb1e062f7f", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771790564, "uuid": "18a59753-0f09-45a4-9d5b-54cc860d159a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771790564, "uuid": "163d0d1e-9e0a-49d0-9121-ee8c453d40ff", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be9ad30-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766150, "uuid": "19c5f422-0f29-4730-80be-66529ed1c569", "comment": "Malware payload", "value": "973162adc63ff13a237b79f48b3f0874", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766150, "uuid": "662a7c43-3ba5-4107-b297-e7dc3cb55e3c", "comment": "Malware payload", "value": "e563153d05e101e3b7258e604e7986a2fad7fa0eaadedf1d27a746af61d30fb3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766150, "uuid": "b9655e3c-ef2c-4f45-98ca-75103b6ce39e", "comment": "Malware payload", "value": "9ff03f8e5eca4bdc19e2ae77d3185c652cb8b47d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766150, "uuid": "e2b5c14c-a22f-4138-ab8c-19b8b77bb431", "comment": "Malware payload", "value": "334b21b4e2b9787cdcd559e0c699208a8ebc00f0e4a8adc616975d70c750d404f1334126c628cd75bddc18c51d00b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766150, "uuid": "d7455ec1-d35b-44c2-b3f5-d6ff804515a2", "value": "T18D02E4B025F18D732E24AA80F3372BA69BB6951345E7318C36CD2D265F86B12B0FF415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766150, "uuid": "7ca172ce-7ddb-46c0-88df-6fae6f6c6d73", "value": "96:cLuckQdE3bvbxbL+Y9t9y9N9qIBiKIBRIBIIBKIBz6IBWIBMMIllIiHv:cLuLBrFXbnonIIyDFJFUun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766150, "uuid": "6c11964c-bc6a-4165-b4ec-63925d5ef251", "value": 8716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766150, "uuid": "69259e79-727a-4af8-a18b-2e2318c4bd12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766150, "uuid": "c02eea5d-de4e-4834-bbf6-20ecc6d974f0", "value": "e563153d05e101e3b7258e604e7986a2fad7fa0eaadedf1d27a746af61d30fb3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b534c5-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769180, "uuid": "37b70f78-d132-4f41-886a-ba21595926d8", "comment": "Malware payload (Mirai)", "value": "af0545797423e93c9906843ec513e027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769180, "uuid": "c34a20dc-944b-431f-975e-1e14e4b4cff3", "comment": "Malware payload (Mirai)", "value": "e5e90e29aa8231943dc665f81ded9eb0124ec6d920449079d38c3878742c0bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769180, "uuid": "ef23601c-e74d-4d7e-84d6-444c749db7eb", "comment": "Malware payload (Mirai)", "value": "1f4a7358acb21489ee4577cebae9b48ebd159ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769180, "uuid": "5ac9582d-4f4f-491d-9cc0-abc9fdccbf8d", "comment": "Malware payload (Mirai)", "value": "a46bef53604df36153f57abd32fd22129e96f15a667975e7822bb77d29da2542e79e3295aa89e2e321dd1ae9202492ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769180, "uuid": "ba3c47b6-bbcf-4889-baaa-7a51d130fa34", "value": "T1BFF33C56EB418B53C0D6177AB6EF42453323A7A4D3DB730699286FF43F8269E0D23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769180, "uuid": "6d7bb475-49cc-49a2-980a-496ef652d8ea", "value": "3072:9X8CrDuFvE16aVflFnIDQ0YZULoCplRiLwJUM/99Pt:V8CrDovW6aVflFnIc0whilRiLwmM/99l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769180, "uuid": "a0d4f974-7421-4f64-b279-34cdbf008e43", "value": 157468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769180, "uuid": "2db732bb-2a40-4743-afad-84337eccf21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769180, "uuid": "9ea17b60-3177-4225-9493-e15e3cc81d34", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9655418e-0fbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771743807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771743807, "uuid": "c1333539-7279-49cb-9bcf-e5d17c487453", "comment": "Malware payload (Mirai)", "value": "2f6e0ec4e28d6bd227a8d796ef439358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771743807, "uuid": "d8807417-27e4-465b-9599-6732ca2b815d", "comment": "Malware payload (Mirai)", "value": "e5ecc2b34bec322665d61d8e0c6e02c64c33ac98f9612b71cd0b114c1f1b4a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771743807, "uuid": "6a08c8b7-a6da-49be-9fa1-2d9e15be65ae", "comment": "Malware payload (Mirai)", "value": "bb2991a1e9eef3a301cc37f79004fa4d6b3804ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771743807, "uuid": "21e7bbc2-30f6-4aa1-b360-579139e66316", "comment": "Malware payload (Mirai)", "value": "5060c9c247a9b120f198bda5135a96d2d9a8f6f6be614a42d5dbe8b3cc228dd8bdfdfbc5b49b703bb21f1a2177c77f32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771743807, "uuid": "001ffa98-82d4-4e1d-89b8-ef2d1777fab2", "value": "T1B3043A46FB408A17C4D61779BA9F42453323DBA4D3EB33069928ABB43F8379E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771743807, "uuid": "e8c14d52-5800-4c6e-9c7a-2469667fc079", "value": "3072:ZK4DBaE2qz02fa+iE9FCgfr5RMPPrIvLSAL/KO+xWu:kaIP2fa+iE9F7fnM3rIvLzL/KO+xWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771743807, "uuid": "6fcb8859-fe4b-4032-ae8d-415efc986e6f", "value": 174843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771743807, "uuid": "2334a76c-a054-4bca-a55e-0308149ecb9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771743807, "uuid": "c15307c2-e8ec-42b0-ae9b-91b8be581823", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6c49ee-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766445, "uuid": "d6f611c6-1b69-407d-8b67-2489c560442e", "comment": "Malware payload", "value": "1bc03a6a3246eaf855146bc6d4545f0c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766445, "uuid": "abbb745c-c6f1-413d-aa3c-b57630199536", "comment": "Malware payload", "value": "e65db1814851599f059eda0a30698708015321f2f75b105474f5a52ac42cec03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766445, "uuid": "fea6e997-bc64-469d-be26-f0764e4e0c68", "comment": "Malware payload", "value": "eb3f8b4c8afbd9391cb8270a00f37906ceacbc44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766445, "uuid": "e07107ad-38bf-41d6-a287-758ecdce7322", "comment": "Malware payload", "value": "4cb8a9ce6f3bbcbac6beb4ec856b9952afb555634d6ddfda0986431f908008341296cddb4d3747abe8311c57ae212473", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766445, "uuid": "5d541836-2177-47d0-a55a-994c93b2d65e", "value": "T1A752483721F08B3297D055C4A2771BA14F72A70B456714B8F4BE5A369F2DA0370EBB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766445, "uuid": "41235ea3-a612-4342-9df6-8f7eaa616aeb", "value": "96:cCuGB6n7sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwaV+I+j+3+FIBmIBGIBXgl:cCuq6nC4hvZ5mzjqKNpHPQsmJ1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766445, "uuid": "be05d195-4f0c-4ddf-b11e-3412dfcc1b47", "value": 13433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766445, "uuid": "c35a9ebd-9019-480c-acfa-23ccc4af95ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766445, "uuid": "8c5af900-047f-40e1-8fd7-f107c5ad209f", "value": "e65db1814851599f059eda0a30698708015321f2f75b105474f5a52ac42cec03.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0353d125-0ff5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768042, "uuid": "db1d208f-cccb-49b0-9446-3277ebc967cd", "comment": "Malware payload (Mirai)", "value": "d65599916e096c56d9e4a404b8d6892a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768042, "uuid": "cc145d6d-413c-459f-98ee-792d481884a3", "comment": "Malware payload (Mirai)", "value": "e6d899e70e513e2d28cc959eee284198ecb84d730981688553126fff3bc2d5a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768042, "uuid": "963bf379-5fd8-4d04-9740-bd10be85fd56", "comment": "Malware payload (Mirai)", "value": "59a06f61c4fd37ea86c0378c11f188efae87f6d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768042, "uuid": "a3a64270-6afd-4c72-8d29-4126f0605b0a", "comment": "Malware payload (Mirai)", "value": "e9762cb165b8b75ce011ad33957ee5925e0ae3fe90b7d1b41dab1f5b7de44c3d94da735c749853acba315a4d8a06577d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768042, "uuid": "1fdff269-b242-4fe6-b644-855a2b61be5b", "value": "T17C53F791B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768042, "uuid": "1e49e851-3d29-4b0f-b9c9-8f8c4f99f8c9", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pXY:dn3QxJpRISDMKf5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768042, "uuid": "0356ab7e-3f34-4c67-93cd-70e5c741cc09", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768042, "uuid": "08184c5d-746f-4a3b-b129-7affc9ef8443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768042, "uuid": "84ab1a75-5575-4c93-bbae-6ab41003a7c4", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e886ae8-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766396, "uuid": "28d897f7-46d3-4c70-af3d-43cf9af76e18", "comment": "Malware payload", "value": "7f84cee1e843ca3110304e3f9acaa115", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766396, "uuid": "3c06d0ee-34f4-43cf-8cb5-e5b11c6e71a7", "comment": "Malware payload", "value": "e84d645141a713999109711635587bcdbfe2d9edb54deae3546dc3064ec78728", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766396, "uuid": "f30a185b-eecc-4f95-b87a-c4ce24d78ac4", "comment": "Malware payload", "value": "ff9432b61c96d6c330808a0c2f8b9bd7f56a2ec1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766396, "uuid": "d19fa450-528f-4faa-99b3-99c97785713b", "comment": "Malware payload", "value": "87689202edb31c7320993acd086092e6c8a2734d5c6aaa9a6d61764ee6943b49a46a7e83ae3f28eddf20796a5be8d630", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766396, "uuid": "7fb945d2-e2e2-43bb-a1d4-b1cead4de96d", "value": "T1DE21E47012F14C63265466D4B2731B567FB2ED4349A3528C39EE5A392F92B13669B012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766396, "uuid": "c70a737b-cb7d-4121-937d-68e366797694", "value": "24:chnRUR8fARW5ob9HHIuCzCRpYdZeC+Whl7lc9HH2919HH8miseN:chRu9RnnB6gC+Whl7lwnGvn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766396, "uuid": "c33e6b93-f4b0-4114-b56a-8f57264f9125", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766396, "uuid": "f12e618d-8a3f-4994-82aa-631a5af18bb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766396, "uuid": "7ef8e3a3-f7a8-44a9-8a7d-5dc95a1febb5", "value": "e84d645141a713999109711635587bcdbfe2d9edb54deae3546dc3064ec78728.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62b5900-0ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766302, "uuid": "5ebd0daf-5cf9-485d-b39b-39a5665b10d1", "comment": "Malware payload", "value": "ee43079e9c9cf66a1af9e2b3a93cb049", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766302, "uuid": "78ba7fd6-5dd7-402d-9c9f-c48c44dacb03", "comment": "Malware payload", "value": "e8bf3d5969454c8d5b031f9aabc11ac623f7641e8b201d20e3b629fe68915f2b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766302, "uuid": "e439e14a-12cf-403e-adc5-578a0196686e", "comment": "Malware payload", "value": "9b01fae0f395a272db9585225e8c98089f5537ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766302, "uuid": "a0a64e30-d34e-4664-ad3e-de287be1abfd", "comment": "Malware payload", "value": "10d09843ff009fe1a3f3c6d6cc3178746afca8450226134507689c2efe225e06b12c5b6b190d33080ae076e3ab4567f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766302, "uuid": "3a4257e5-0e0c-4ca1-ab71-23b492b6013e", "value": "T1F842683B21F08B3297C461C962A71BA14F72970B456614F8F4FE57269F2DA0371E7B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766302, "uuid": "b8de904e-df37-46c2-9a39-13fd6cf7f39b", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvj1XioV7+d+C6IB9IBCY:cCuYK6p4hvZ5m5FoKNpivdVGOyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766302, "uuid": "67c36718-43da-48db-94a0-a002f80989eb", "value": 12320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766302, "uuid": "e54003f4-276b-4d2d-add4-c4135adeae43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766302, "uuid": "a44c4b84-9fb1-4891-938c-30e16d4e4c58", "value": "e8bf3d5969454c8d5b031f9aabc11ac623f7641e8b201d20e3b629fe68915f2b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694deed0-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766495, "uuid": "9d45815e-de8d-4efb-8e9f-a1e2658c75b0", "comment": "Malware payload", "value": "9a3b0f673ca65f35435ad3a209c6b5e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766495, "uuid": "68d8301f-0b7c-4d9c-af20-c3c3c18e4b27", "comment": "Malware payload", "value": "e9028f077528dd0caad80754d233cb0bea313f2bb2c8a4b8cd37dfeef4df005e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766495, "uuid": "12b7f8ba-2697-43ce-ab4c-8826c99d9de9", "comment": "Malware payload", "value": "020f8b69ef2975839dfbc527f209bee97802dc91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766495, "uuid": "ead4265b-1988-4360-ba8d-17ac0f40369c", "comment": "Malware payload", "value": "79ffe8a116e77fb8c3e2f161641397c947f2b34eada176a8c90e95caf544ec65d8e3c6054bf6e0360f46f287f077ea4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766495, "uuid": "783c2ffd-e6df-42a0-8de0-6b19877d0495", "value": "T12222473B21F08B32D7C420C993761A654F72A70B456614B8F4BE573AAF2DA0371E7B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766495, "uuid": "714469e0-8d63-47f2-a97c-eb59e8e354f6", "value": "96:cCu17sht+O+v1fsn+h4+tIicqbA/GsGCuKNppjrwakoR0joKAOxhpb:cCu1C4hvZ5mzjqKNpy5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766495, "uuid": "c13090df-09e7-4da6-b620-a907bf88ce0d", "value": 10467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766495, "uuid": "bf911dd8-0be5-4758-8f41-b1818ccf3fef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766495, "uuid": "f09890bf-8485-4e8b-9705-6cabd0c338c6", "value": "e9028f077528dd0caad80754d233cb0bea313f2bb2c8a4b8cd37dfeef4df005e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c80b49-103f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771800196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800196, "uuid": "1d953396-b2a0-4d84-9595-5c3800753598", "comment": "Malware payload", "value": "7352fbebadd35a4f301e5b2a122a242d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800196, "uuid": "3dbd94ae-44a6-41f8-aac0-f2a572fc86ae", "comment": "Malware payload", "value": "e90f3ccc8a6db21c0e498f7b1f076b95d1a18c9ca055eae6daba585e9c612e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800196, "uuid": "f00b3f7f-616a-4295-b2d1-d0911e50abfc", "comment": "Malware payload", "value": "4d45e03ac605fe69fcc02c11f0ba8f8053ac0e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771800196, "uuid": "dc81d330-e1b9-43ca-8faa-b40bd3220b1c", "comment": "Malware payload", "value": "317a46b459fc678f21cd27cb8d1cbca6dd94d8785cc508baf2246955d71a6fae35ef7d0776fed428db77259b465d4950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800196, "uuid": "f0673819-0627-4046-91b4-8f30aeff23fc", "value": "T14F345B11B3F95A19D1BF4BB8A8B15D0547B0F41ACC67EB9E0D9160ED0D7A780EA00FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800196, "uuid": "837494b3-5a37-4514-b0f1-0c94cde998cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800196, "uuid": "cb0c19a6-4736-47d1-ba22-37703b818fb4", "value": "6144:lDN8KIEfOCTvUqjZCwOoItlasMWGYsb7r5oqxTa6kXGoCI:RN8KIE2ejZtvItWWGNFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771800196, "uuid": "5ce457fa-2b88-4ad2-8376-0a404afb95df", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771800196, "uuid": "6414e919-b08e-4846-bcb8-1c0c89de676e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771800196, "uuid": "6ccb9ada-8a74-4fa3-9fa4-bd2af4559cca", "value": "FinalMom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd9efa5-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752544, "uuid": "de216201-e0a4-45dc-b21c-03370ab8e8ad", "comment": "Malware payload (Mirai)", "value": "109893fb0ac3ccf233ff0632c6ad779f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752544, "uuid": "dc0e81b6-d975-44e1-a9e3-e5c824e97fba", "comment": "Malware payload (Mirai)", "value": "ea11768cc3692c563b2826811dba0c07f21883a6e933af55df73dad00fc11049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752544, "uuid": "5331ff65-c868-4eb3-b372-b69ffc3c541b", "comment": "Malware payload (Mirai)", "value": "debc1dd3ca653149abb3d515cf5dbe3526c77d26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752544, "uuid": "6615c4ce-0641-4494-8556-1a53117006d2", "comment": "Malware payload (Mirai)", "value": "0f6a67f1a27d13c9665f32f9aa490db7e3548ff5821dadd850db1f3d2519d9f66d6076d1205360202ab1f865f33ed964", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752544, "uuid": "550efff7-2427-4cb4-bab8-14c74172dc7c", "value": "T100B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752544, "uuid": "5c766ffa-388b-413b-b151-2e9dc7606b2a", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHz/8rSR:t3SrlGWnKTU83AQB5A5Liy36fTUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752544, "uuid": "32860741-f74d-4983-b57c-61379a3cc11b", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752544, "uuid": "9bfbd1b0-f7c7-46f0-b71a-7342d0e9337a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752544, "uuid": "f0c042b2-6d5d-4fa5-9463-092fcdec5e0f", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254bc4d6-101a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771783990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783990, "uuid": "511d2052-b16c-42f8-8202-1ec10f7c7768", "comment": "Malware payload", "value": "0add16e3e96c888ca55a4566e04c000f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783990, "uuid": "51f3e644-2946-411f-9851-ce240386857c", "comment": "Malware payload", "value": "ebd21ac4ac71e466c1441dd998895dc5f9567d3ca999a30762f6028dfc59b4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783990, "uuid": "003bf8dd-78dc-4cce-9c65-01023e20c58b", "comment": "Malware payload", "value": "fd67dfbaf37099e17778f405c4db8ccf03b18325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771783990, "uuid": "58edd843-f0da-4f81-8852-47e666108656", "comment": "Malware payload", "value": "0e1d5011ef29219746a1b5eb93d1aaaa8ddaaa0345d8368d11dac3fb65064d647a4ae322ada76ff884d1f078ecc67aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783990, "uuid": "d0944b99-d6e8-49f5-9761-aa60418ba85b", "value": "T13D265B4FF89141B8C4AED634CAA59E527B31B884173123D72F71A6B62E33BD45EB8350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783990, "uuid": "9e193d51-bec5-4d91-96ad-31c094b02a62", "value": "49152:YqCFngKJITFDv6Vrb/TkvO90dL3BmAFd4A64nsfJQ2UnN05yOs88rQdzVezf6jI0:YHqKJGbRrNnAdhWELZkj4EQ0DLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771783990, "uuid": "f66faec2-e7f6-4d80-a710-082eb60bad89", "value": 4859392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771783990, "uuid": "2aacb540-0cfb-43e5-ab40-08af24bd5f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771783990, "uuid": "7397470d-4aee-40e6-8b4a-18dd774e3cf2", "value": "DavRelayUp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551cdd2c-1047-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771803398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803398, "uuid": "4cfc497c-5810-46ec-b8b1-6190f493f012", "comment": "Malware payload (SantaStealer)", "value": "e061a25c073ee0a22c20ee151fe8a695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803398, "uuid": "ad1370f6-cba3-4cea-8f28-a05ff1755d9e", "comment": "Malware payload (SantaStealer)", "value": "ebedc903b7a465da9d5e49f6bfa415c127376a29975a200c94bab54bdb5906d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803398, "uuid": "6eea8b59-281b-4021-97b5-d14787506e5f", "comment": "Malware payload (SantaStealer)", "value": "b52e93f730e979c3832979d4b212504cfa842adb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771803398, "uuid": "590fb2ca-d265-4782-ac3c-272ddbfc07da", "comment": "Malware payload (SantaStealer)", "value": "37fb9d4890d344614eed7af8c8237214f942632d1ab2ecc97deb88db8a461ae7e41af4846879fbcccd820e4ab0c542b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803398, "uuid": "d69e6e03-bc2b-4d32-b206-176087d075f1", "value": "T1A89623BE61583318C41AC8399537FD85B3B6551E17ECA8BEF1EE7AC0A79E811E502F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803398, "uuid": "4705bd61-71f4-40d4-b43e-fa372facaeb7", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803398, "uuid": "8f668923-e6b6-42e3-a7eb-641500ebd368", "value": "196608:NQV0/8yA+2mpCjHDSh7QJC09wg5HsP/Bj5+YuAw0z5pWBRnJ:2VY8zIPh7QcA55Y5Vnw0z50Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771803398, "uuid": "d1404b1d-ff14-4985-bbba-f7380135045f", "value": 9324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771803398, "uuid": "b6166e50-b9b6-43a3-b9c2-3aabcd69b82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771803398, "uuid": "b5aba6c0-bca4-4ddf-ace8-304ac18267d0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.69743391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80269f9-0fcb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771750306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750306, "uuid": "b674c8dc-4625-4ba8-9caa-d6d0f2816067", "comment": "Malware payload (Mirai)", "value": "13be65ea39298d389a92b09d23f55add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750306, "uuid": "c6cc21f4-a4ce-4aa9-91c5-e7fc12756d94", "comment": "Malware payload (Mirai)", "value": "ed2a969282cd755d934c153096c680a4270633e4a92a39703c086ecd9e910fb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750306, "uuid": "7437b4aa-e38f-4d26-9160-b983473575d5", "comment": "Malware payload (Mirai)", "value": "013007514f40b339f7e37aa33755f9841d4d7b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771750306, "uuid": "eae14e2b-659a-47ae-be32-9db1c165d2a4", "comment": "Malware payload (Mirai)", "value": "37df397264073ca1e2fc908e15d013c1b633e30457fee033598f35b0bc68f268c12c040727d77bcdc88932d65947bfc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750306, "uuid": "4e01650a-121c-44d6-a0a4-38d8061fdbfe", "value": "T1D5E33A02B30D0947E2632EF43B3B27D193DF9A8125F4EA44355FAE4991B2D32158ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750306, "uuid": "c8ef1e13-6ae6-43e4-9f0d-cc7b4a88da54", "value": "1536:WXLpS5y3Rcf3AbQcqfbnxC5nMAZ9GxTK7NNvyEvWGfqPu7cuN+LXQBozMGCW8d1T:WbpS5/vAaxFudhdLvldozmWCJeeWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771750306, "uuid": "bf2ace21-2dc4-4f69-ab6f-043edb1f0212", "value": 154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771750306, "uuid": "6f138f76-6c3f-4524-a870-174ae86d855a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771750306, "uuid": "2321d629-216a-480b-8f3c-e2765ea2efdf", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8044940b-1009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771776841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776841, "uuid": "7f56948a-4e8a-4ef8-b28b-7a0dbc427f9b", "comment": "Malware payload", "value": "61bcee0e368ec72aaae4bbfdad540f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776841, "uuid": "bd386ef4-4142-4348-805e-7b5c630496b0", "comment": "Malware payload", "value": "ed431fc3720a0b62c3a777ac0b2bb7eabfbdb0d1455fd59d0979973adb0f430a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776841, "uuid": "1916623b-c706-4252-a1cf-e582bc263cd2", "comment": "Malware payload", "value": "58d3153e5b1d610e5ba0b93d1b3cab11a17d7896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771776841, "uuid": "19a2dee9-91a6-459f-a5a9-b94ab1939f9f", "comment": "Malware payload", "value": "1bce0fc1a2f9e7a3b75f9394de2dcd8c26e39a9e45603ca701e66c5459fee2432e2942d8c5a94f513044f96d15e668f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776841, "uuid": "59addea5-9c92-4a5a-9eb5-e5749da0d48e", "value": "T1EBC3F141F782D2B5E1838A32908AA7DF1731DF17000DCA4BF3487E346DAA295A51FB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776841, "uuid": "60bb069e-d6c4-4971-a8d2-4b4b3171c452", "value": "3072:qa3z5a9yc6D6ZRQIFT3p2z6YPTbuGM49FAfEObk7qMbtVUB/mcPa44j0AWd:qqm10aRQIHmTPfxM4MfS7q6cot4456", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771776841, "uuid": "34114a56-e1fa-4c23-8fd5-7ab8f9fdc744", "value": 127081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771776841, "uuid": "53130c07-df3c-42c4-ac64-ad8f22ee885a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771776841, "uuid": "359e8545-938d-4b67-bd30-757faf5f4b23", "value": "a071zmil6o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7880f81-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771780, "uuid": "a2b3b330-e33e-4952-9e43-6648044f9995", "comment": "Malware payload (Mirai)", "value": "a99564954a404cbb0e6a0ceda7489410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771780, "uuid": "257f40dd-7c83-406b-8244-1eba362ddc34", "comment": "Malware payload (Mirai)", "value": "ed7d7b625e820d8ad336faaa62251ea03bc155bd5f2a23193ab154ae9212f4a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771780, "uuid": "866c3523-12a9-49e2-b6ef-070d6a0a05e2", "comment": "Malware payload (Mirai)", "value": "4e0e90b40660733848769c276f25ec10f645d2e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771780, "uuid": "48455ac1-cfc2-42d0-a0a3-01c4aaf8ba26", "comment": "Malware payload (Mirai)", "value": "8eb1de1b2afd80ab98e32a978ddac72f88c404cc183dc2f814cf98d4c77f197060b4a14af6bc90ab8bd1d6bc9ea61355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771780, "uuid": "aba06b71-4409-4b7f-828c-bc0b0dcebe18", "value": "T189357D5AF2B371BDC067C030839BCB62A935F47541322D7B25C4DA352DA2EA41B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771780, "uuid": "e39f4cd9-1a36-46c4-8d52-483e75919007", "value": "12288:jp3A2TlAeoYp7tClG7qfnjxvNpTTmyDD2ptJ65kpZSQ+szMbG:jp3A2TlAeF7tCg7qfjx/6pPBZh+sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771780, "uuid": "120a63f0-b86e-4bdb-b5c8-cd28e37ac024", "value": 1127456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771780, "uuid": "c7f929e0-b60a-4ca7-9962-0b6c1fdc7be2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771780, "uuid": "c72f9c4d-e6f8-4183-9224-c6b5871570a1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5345af-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766367, "uuid": "40fa81a2-7b0a-426a-9a0d-7addc0b0a198", "comment": "Malware payload", "value": "27ce3b5d511752f16100ac6ece3d7256", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766367, "uuid": "0921e763-6768-4ca7-ba04-b9e4fce9c4d2", "comment": "Malware payload", "value": "edac6c174858a6c640ca16099e7a7f0514a041777526fe7e9c67d877cbc7f73c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766367, "uuid": "bdcfa934-aa7b-4ac6-9f80-68384e8fa9fb", "comment": "Malware payload", "value": "a9c3442465e4656c569416d015ebb3e3f42e86e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766367, "uuid": "90163140-b99f-44df-9242-9b610e253448", "comment": "Malware payload", "value": "85ba9fed6c7bed203f0cc920eba74ef4d7ab64e4d6995fdae1b717e5dcad250bbc3d9a6f5e1853b787b31c4e218a04cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766367, "uuid": "e5807b16-7b66-4e7a-854d-5bb012da7583", "value": "T16D825B7621F04A336BA055C4B3771BA15FB29617456320A8B4FE1F365F5AB03B0EBA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766367, "uuid": "f3d83c54-f3de-4340-b479-4f87c73f4411", "value": "96:cCuRk0B6csht+O+v1fsn+h4+tIiKqCTyOysuKNpUj4waYvjzzNGyUfosIbIbQuTh:cCueg6p4hvZ5m5FoKNpiv3tz0EfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766367, "uuid": "d93c86c3-2e05-46a1-be98-71cca476a34c", "value": 19223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766367, "uuid": "8f3296b8-aa50-4b92-b6db-10c16bafd876", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766367, "uuid": "566116ff-cca1-453a-9199-76f854600c22", "value": "edac6c174858a6c640ca16099e7a7f0514a041777526fe7e9c67d877cbc7f73c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405e31ea-0fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771757836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771757836, "uuid": "6d8d1adc-8d8d-4849-9d59-a9fbea231b26", "comment": "Malware payload", "value": "4e5636a99d96a3738fe5496b7a625142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771757836, "uuid": "78274af7-c7d6-4914-8d7e-61d7a1b6df70", "comment": "Malware payload", "value": "ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771757836, "uuid": "fab9a556-997f-41e0-a3da-4f7744ba53bd", "comment": "Malware payload", "value": "868c67c34c890e038e1ba06ba6bd5cce7c59360b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771757836, "uuid": "e21da44f-1fd3-4efb-b64f-67bbff060a1b", "comment": "Malware payload", "value": "1c5e77a013c6d24b592882e80dd6b5da3edf361eb2f5a5b5e71197365acb242c76196449839ab311a2223ed669cb494d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771757836, "uuid": "9f9fcc67-4c0a-438c-987f-3c45ce4dcf18", "value": "T1BA835A0433EC1119F6BF4BBD99B460410AB77A17AE71E74D4D86609C0CB2B81AE24F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771757836, "uuid": "515aa01a-0b76-4fe2-9802-7d20f6d8ad26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771757836, "uuid": "30190b0b-d831-47ef-8b5b-75270bf589bf", "value": "1536:IC0lB4H00wz0epKV1Tsqa4tsi5lRjTnwCbTtlbe4CUBoJWs3:IxlB4HWzPC1AX4tndnwCbTtlbezUB6WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771757836, "uuid": "0ba7cfd8-56a0-45df-9bce-7008b84905e1", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771757836, "uuid": "13e8c0c5-9fda-4d10-b306-c6cb85f395ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771757836, "uuid": "7a6d81e7-2376-4f33-832d-b5f423865c00", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731560c6-100f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771779396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779396, "uuid": "0b5704a6-bc3e-4b73-abd7-35b921b36b71", "comment": "Malware payload (Mirai)", "value": "0aa79c01b244eee895e2db6d0cfd1538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779396, "uuid": "5f658c2b-7244-417e-936e-eb5d6b766a40", "comment": "Malware payload (Mirai)", "value": "eef884224d560ae35f9c5bb8a2bcc7d443164ddb9be1c217a7d7cdeceb26a858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779396, "uuid": "929d659a-979d-410d-a8bf-3a237590d024", "comment": "Malware payload (Mirai)", "value": "da3300a51c44fad596f1871bbbaf52bcaf9be209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771779396, "uuid": "b76d312f-2a48-4ca9-986f-c1217cc9050e", "comment": "Malware payload (Mirai)", "value": "c7c8204f1326ddaf4204d90877494d873393f8c61fad66de844d4080bb29e33f614f3516b4b0d3bfb3e4a88053a75a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779396, "uuid": "a65de793-9a81-4029-a00d-322ad1b14918", "value": "T16B23F1BB9E6278B3DA204437C9500E8950471E30D1E975560234A77C6FCB682F6F6EEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779396, "uuid": "8817fdbe-45a2-44a7-927d-ad1beb70ec3d", "value": "768:dnvTKML5+b1+IXQAu2hWFKBYdI7zr/fH9T9q3UEL5SSXH3KLDhRZXX:dXLLqQN1IWaz/IL59H3qhRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771779396, "uuid": "73893ead-6de0-499c-b1f7-3738384cf432", "value": 49896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771779396, "uuid": "f3b1b856-d3c6-46d3-8fc1-4aeb77999909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771779396, "uuid": "5953afdf-da1f-4be2-9726-06994c1ec6a5", "value": "purves.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a5c40d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766428, "uuid": "1d8551d1-1c42-4783-9136-7d96b41a44e1", "comment": "Malware payload", "value": "6a069188ab1b255cf84d37a16b4e8133", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766428, "uuid": "7badb490-d6a3-45e1-b2a0-f1b1db710165", "comment": "Malware payload", "value": "ef60a31fe250518f1872643afce029ba147b7998b2b26bd69dcf3d9d8b8a3413", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766428, "uuid": "c1199a9d-61f2-49f9-bd25-72d8c5b9c1a6", "comment": "Malware payload", "value": "c1bf94d2c3af4fb4315393bddde1a94bfe90e340", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766428, "uuid": "163a843b-dbda-4b44-b861-43c0f0d346de", "comment": "Malware payload", "value": "9b57ed0a9706a62a21ce77ac5587552e7ca1e1f328d535cde45ed534f9591bfcfb0385bdc0e53552c1cdeceb06c7441a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766428, "uuid": "6ffb7dba-b7f3-40e1-81e0-13bb58a12db8", "value": "T1A531AEB411F1A9332A1466C4B3331B54BB72D8470AA31ACC78EF99746F87F06B17E046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766428, "uuid": "c44d7277-3356-4179-9aeb-2e1af04b235b", "value": "24:cnnRUR8fA+W5aS/FFwFg/FF+WpJ9HHIuCzCRpYdZKZMsSipqlc9HH/qddSipqlcC:cnRu9+b0IYTnB6sCslpqlwnyPlpqlwns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766428, "uuid": "3eb640e7-7e89-42f6-a6b9-97f3ffca9e5c", "value": 1737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766428, "uuid": "413e5002-3742-4c74-a9c8-89c4d6dac40f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766428, "uuid": "97f7ffc7-48cd-4e60-94e0-d483315c6dbf", "value": "ef60a31fe250518f1872643afce029ba147b7998b2b26bd69dcf3d9d8b8a3413.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f467ab6c-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771752555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752555, "uuid": "1352c850-0164-4e98-9d7a-0081b8cf98d0", "comment": "Malware payload (Mirai)", "value": "e70cc3db3f8c698ee17bfab3bc8b2378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752555, "uuid": "06fe0396-ff9b-43ab-a2b1-972fdd5d5539", "comment": "Malware payload (Mirai)", "value": "ef6704d360061f6a38574e663608c744760ebe41851648d22e142ec4fa464383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752555, "uuid": "dcdd8ae8-aca0-46df-b270-f52033544421", "comment": "Malware payload (Mirai)", "value": "9a577557102e0b8397663265ded7d32772b87bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752555, "uuid": "547e1cdb-d51d-4a00-93d0-fd2de6bb9709", "comment": "Malware payload (Mirai)", "value": "1e1424c58034dbc04ea6978a2d69f9031fd7362f9ba6d358f82b3c3e8c114a39d42368387e4daeb1332d30d4b3102a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752555, "uuid": "ab415dad-91d3-4ce9-a631-d92e883cc3a8", "value": "T1B6C3E096FB22A691D0B302BE64C10AC387615E368FD217440298F77438BD9FA0F65ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752555, "uuid": "e4a35e25-c2f1-412d-9be9-922d61a9f899", "value": "3072:8BdoeH4EGPfIKnBX9OZOqSFxSgzUvX0atRB3JMMTnH:4oi2PbRI4FxxzULBZxTnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752555, "uuid": "f15ab223-e601-4b99-a6a0-72f0eedd3f0c", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752555, "uuid": "b6fa7a22-7acb-4fd2-932c-5ba51c74d743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752555, "uuid": "e76ae793-2fb0-4c39-a9bc-3335a432a9c8", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a30d8b-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768988, "uuid": "6c53f987-21e3-4d2e-9147-633112ba5b7c", "comment": "Malware payload", "value": "55aabe1018c2008524e05b08c3eec6f5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768988, "uuid": "f650916b-7e92-4b68-9910-910a531324fb", "comment": "Malware payload", "value": "ef7d3d7481359435d297b9cce6662d5f8f8b6a6c54bf08eabbcdbb3286fe6f59", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768988, "uuid": "4964c63b-b094-44fb-a995-8302e06ac5da", "comment": "Malware payload", "value": "bebc019ea48a8eb0d2b21ddb2b779939bd9f29df", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768988, "uuid": "d9722548-1e81-4247-b98e-af30aaa6d3b4", "comment": "Malware payload", "value": "0bcae1783982469f17c9133855eb08048606b6056061c3cdb94e021ccb7a0f0d3a9d465628461fe2156afa5f31b5ec92", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768988, "uuid": "bfc75c33-154b-4e5a-9e35-ed597f8de926", "value": "T1E9D6239FFB585B2FC8B304320D5A423127278E16BA43A6075858762C2977ED85F8B7DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768988, "uuid": "6fc5e9b3-6199-4243-9580-58f989d26cb4", "value": "393216:rQLvqzWQpoygOnIittMfuBcZxpPJbm2/Z+ukL:rQLqr2ygOnPLMWBOpP5m2/ZjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768988, "uuid": "056c1f7a-633f-4548-9fc5-df7b8a6e634a", "value": 13100782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768988, "uuid": "73ba26a1-f1f0-4dcc-93d2-1997f5742ccb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768988, "uuid": "2afa1b15-4eb6-4751-99e0-845c470a12fe", "value": "TVBox_q215613905_20220918-2031.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8778cd99-0fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1771752372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752372, "uuid": "bb8dc71f-c170-4611-83a7-f34f61a163da", "comment": "Malware payload (OffLoader)", "value": "4040259cdec07f8d3266d536b1231282", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752372, "uuid": "bef0c48a-6b23-4fd5-ba26-cbaa55d9a460", "comment": "Malware payload (OffLoader)", "value": "ef96b8d7d5ab8c2cc37172aaff79e088efab82a2b31b6bbd7f40cd63eebc45a1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752372, "uuid": "8a1cccac-3ed4-4251-90d2-e3bc17ede07f", "comment": "Malware payload (OffLoader)", "value": "1a1decfabb0eed1e3266b8f4c8092235efd5822c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771752372, "uuid": "090c99f0-a1a1-4328-94b7-3ac88d632574", "comment": "Malware payload (OffLoader)", "value": "546ea12651f1480f4c940b7ee46e707de717890c9073f3acba87669c1c59e7f858f9b09f8e9c24c118763eae3713c0e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752372, "uuid": "3f19ec86-cbc0-41a4-bb3a-d9ab737cea89", "value": "T15C762233B24A633EF46E0B3B09B6A2505D3B7A51A41F8C469AE40C4CDF7E4601E7F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752372, "uuid": "6f575956-de87-4d09-a8de-4da3e9715fc5", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752372, "uuid": "470604e6-6a24-4ebc-9f4b-70135c15f962", "value": "98304:GN661ACr25WKwHwRwGLAAm7Z+aCobOP8IMUhjEkVOqGVXCR8GNWzkcUR:W1AZU4wnAq42bOP8RYEk3xRyUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771752372, "uuid": "ceb17d85-4517-4e76-8599-40e4f6f8325d", "value": 7624484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771752372, "uuid": "daec3947-3b63-4edf-a462-2fa2021c3d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771752372, "uuid": "c6c23a77-4164-42c8-a9ac-5dec725a7f67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cd0489-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1771769042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769042, "uuid": "6535e8bc-c659-4974-a222-e8e8b6df9879", "comment": "Malware payload (PythonStealer)", "value": "0634347fbe9ce0093c7cdb1574779318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769042, "uuid": "f30ccb07-d90f-420a-af7b-802a3389fb33", "comment": "Malware payload (PythonStealer)", "value": "efa140583463c8d3b8649f180438b30f6678f46fb0fbe302be7e2b86b3727e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769042, "uuid": "54ef3a91-a29d-445e-b280-dd14e8c8e651", "comment": "Malware payload (PythonStealer)", "value": "6cf7d7b561f95b7f3d5c696e8daa74248cb2ab31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769042, "uuid": "de5609d3-573f-4854-9b07-c485a7ce01bf", "comment": "Malware payload (PythonStealer)", "value": "f301aed7b6b2d0fe1f74d8325ba1379b7f9e607ba95e7f55ee46e00de29705bb043fe1cd5c2e7b0103225ed074db9f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769042, "uuid": "5b798869-0bed-4d27-b409-9ab3ef0f0449", "value": "T1D196330BA8D3E3A7CA07D131569BFD61F9388CB80395E8FB1595877820978E3AD345B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769042, "uuid": "65603d51-649e-4d00-b0f5-882f05064959", "value": "6fd4e80d3e91d12ab030b51ab5fd817c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769042, "uuid": "1022252a-d801-471b-a1a1-356245da5fd0", "value": "196608:luNdhPeaJsb7jL3bKVkS0GiBCQKwOHVYoDMXqR:Ssb7jLLKWJCFHSXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769042, "uuid": "142ac734-6f25-4614-bc64-591f1203224e", "value": 9051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769042, "uuid": "1e1e6ccd-bcc8-474a-9c44-22b5beefd3ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769042, "uuid": "53413ec4-f981-4793-953a-2a6b3d3c1583", "value": "\u5212\u5b66\u53f7V2--\u6781\u901f\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257c1bb1-0fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1771761227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771761227, "uuid": "1ac93a7e-329d-4827-b676-2ddfb912b4b6", "comment": "Malware payload (CoinMiner)", "value": "4cc7ff30a24e18106f3f0fe5d4fdeeaa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771761227, "uuid": "7c4ba63d-f37d-4513-bb0a-4b67e0fd58f5", "comment": "Malware payload (CoinMiner)", "value": "f03f175facb93c6f2056578e337b86a2baf41492892eac97b0535ebbf9698866", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771761227, "uuid": "118f7ce0-e6d3-47b2-807e-33b8632ca3c9", "comment": "Malware payload (CoinMiner)", "value": "1f9f6e348e926f724372647b124aa60bb50b8904", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771761227, "uuid": "76a36aad-8f13-478d-8db5-ad9cf5dbaeef", "comment": "Malware payload (CoinMiner)", "value": "36cf4b5c7f0587d448878d5bd29bbe181669f30e3e0b464ed0b036fa6e34c6a7e8b6a9327e8b8b1acad6b430382c83a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771761227, "uuid": "504af2e1-4473-4934-827d-8c830076c784", "value": "T1BDE613F502B5ADC3F5BFD56C02589A8154D1B8CBEA7C3CE83ECCA91F0A59E8D8E45244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771761227, "uuid": "b3ad4938-3d2e-4ca4-a38d-111416c3ec18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771761227, "uuid": "1aab4c6f-03dd-4626-b40d-138259a414c0", "value": "196608:WqUE6wG+87p4NVj2s89A8TWbNfstDq5/rtsWukGFASEljB0zeXhGrwNK:Wdo189BTW5fQ25/3ukCASkEuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771761227, "uuid": "341dcfd4-0c90-4023-b8d4-008a82f6c498", "value": 14356480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771761227, "uuid": "a06cc401-7170-4d5f-98bc-23b2e12e2d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771761227, "uuid": "ff366504-0704-41c2-b411-868d7e48bce8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293ad108-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766387, "uuid": "1e85521b-b96d-4ef8-88d8-721607aa617b", "comment": "Malware payload", "value": "9a67ae699fb8b732427e58980e78f433", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766387, "uuid": "f205d60c-bc05-44ef-aa67-d3000e33f648", "comment": "Malware payload", "value": "f14b2abe4e337cf6a5a042f360ab298aeb33f64da35ef752afaa85c1394081e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766387, "uuid": "01aec807-832f-4b6e-afa3-919c5fddb67b", "comment": "Malware payload", "value": "fa82b2a5ea264c68ed7b197756149aa728d59244", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766387, "uuid": "8bf0ffee-3679-44f0-a106-e05c8861cef1", "comment": "Malware payload", "value": "6f059f251e53290fc0aa361a8f2b81bbf0d4337e9d0dc244c4366fe4787bbc8d5e783f7ae6ee4a14c4fed23382f9c0cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766387, "uuid": "8b2e01f0-ca55-4d62-a73c-c6e8ca0cecb8", "value": "T19341887021F259332A916A84B3332B46AF71DC4788A311CC79AF6E397F47B5362AB011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766387, "uuid": "f39dd83d-e663-4269-8b76-b5da38189b8a", "value": "48:cnRu9RynVdvnSfranB6/szlwnmZcVlsYrs:cRuCk0B6X3l9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766387, "uuid": "dd9d9a19-501e-4f4e-b21e-efe7d7a0e899", "value": 1913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766387, "uuid": "4ad77f25-61a2-4e38-b11a-7010cfb2bab0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766387, "uuid": "52725151-33d4-4c09-8892-de2c78d5403f", "value": "f14b2abe4e337cf6a5a042f360ab298aeb33f64da35ef752afaa85c1394081e2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e73840-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766459, "uuid": "cff219f4-07b3-4585-b8b2-971feb1f9610", "comment": "Malware payload", "value": "96f1b7e04b9963d36072fcc9a177ca70", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766459, "uuid": "034883dd-a116-4080-88db-de2bdcf85272", "comment": "Malware payload", "value": "f1569fcf27fd0fa357465ff58521942e68e54faa667accc7669da48dd9a6144d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766459, "uuid": "ea960fce-cf06-4c64-b440-34985c111890", "comment": "Malware payload", "value": "17ffa0494ecd6bd735562390306f569808a565ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766459, "uuid": "b7676fde-d2ea-4958-b110-f7943f78d3e5", "comment": "Malware payload", "value": "f91f478c819e51985e2385de1468dc7d6bf67cc6bd0a61385c53fcb719eb6ee7b90fb1696c7050ac7e7b2981c6284a16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766459, "uuid": "2ed14704-d5c7-476e-8e48-db74b558f929", "value": "T10502057025F08D732E20AA40F2372BA5ABB7A85749A7318C35CE1D265F97B42B0FE415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766459, "uuid": "6f6596fa-591e-4319-ad1c-3d818c2d02e5", "value": "96:cLuP3B67IBZIBuIBvMIBoItIiIIf6f06fOn6fg6fx6fp6fgHfZ8U2:cLu567q9vD8nhVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766459, "uuid": "d5cf64e9-8342-497c-9ed1-7a33bb589362", "value": 8601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766459, "uuid": "c6202e94-1e79-4126-80b5-85e1336969ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766459, "uuid": "2f16b0a9-d178-403e-854e-42766eb5bed9", "value": "f1569fcf27fd0fa357465ff58521942e68e54faa667accc7669da48dd9a6144d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428e1242-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766430, "uuid": "8ce49e5d-5561-409b-aaf1-dda1277e8876", "comment": "Malware payload", "value": "72b48b1633d883831bfd9c89e8c3470d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766430, "uuid": "0456de29-16c6-49c3-9f15-85258b1fdce7", "comment": "Malware payload", "value": "f1580170e6372cb9165f54aae6bcb16f054eac1668d2aad141622edbc714d1e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766430, "uuid": "4e8f81a3-52a9-4015-94c2-6aab6286a97e", "comment": "Malware payload", "value": "928d3788c9964c95c71d8be49210003a68a0e2eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766430, "uuid": "31418f22-6955-4634-9a10-d6f16501a300", "comment": "Malware payload", "value": "c801cccf9635ad5ea61f3750fef0d9ba7730f179a035e450b0cf1425f0f908a129fa3e72ce4b2d940d35a448ba3c960e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766430, "uuid": "e984cfb7-6017-4446-b65e-c16b6e8ff46c", "value": "T18C523B7434F04C732E206580F37727E2BBB6D85349A3258835DE2E35AF8AB52B5BE415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766430, "uuid": "f3315733-42b3-44e2-8476-af03922c18b7", "value": "192:cRuF67DFO9Qw9UR6oj4p6p07g4dIgovsEkX51Xr8I9TaWES2rNX4ierJ3eZ:s/phI1YWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766430, "uuid": "6bc1f380-bde2-411c-9c7b-f5260b042190", "value": 13258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766430, "uuid": "5c168aaf-7bf5-4237-b60e-7328de31d655", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766430, "uuid": "c3e4db93-d3d5-4326-9f06-96797e13d8f9", "value": "f1580170e6372cb9165f54aae6bcb16f054eac1668d2aad141622edbc714d1e0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0f9e9a-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766471, "uuid": "2c09ed1e-ff5c-498a-9bbc-fe85fa2a6e05", "comment": "Malware payload", "value": "3f66c4be994e7670de6e0059ab39e650", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766471, "uuid": "c984afed-7d87-4cef-99c2-11564cdb14e4", "comment": "Malware payload", "value": "f33f91e10ea49a8f059f2328f5f6ccf1ab47642bb56f276fd094dc604a75bb3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766471, "uuid": "6659fbb1-e989-47bd-9598-3a7a284f5d6e", "comment": "Malware payload", "value": "a70fff3b09672534e400b1527d2b8ff26504942b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766471, "uuid": "56b4f96d-f5fe-4af7-b2ee-dadda918b69d", "comment": "Malware payload", "value": "b265c933124a4bfbbc3af1f924c8b397ce215fd7478c760a89af2656ca679d52f0e5d39a3ccf2883517a3e7c4b6f4dd3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766471, "uuid": "f53a26f4-da9e-4140-b1d4-d5834696dd9d", "value": "T14422453B21F08732D3C050C953A65A614E72A70B492614B5F4BEA33AAF2D90771E7F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766471, "uuid": "a07265e7-2d84-4db6-982c-802e1379d285", "value": "96:cCuYmB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvj0zCZ1F:cCuYK6p4hvZ5mN9oKNpivl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766471, "uuid": "bbc6949e-0c9d-43a2-a8bc-fd92eedaddd2", "value": 10060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766471, "uuid": "155e1b6f-53e3-446a-b48c-19b15fea7bd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766471, "uuid": "5f243db1-0195-45bc-b53a-6ffed6c562b3", "value": "f33f91e10ea49a8f059f2328f5f6ccf1ab47642bb56f276fd094dc604a75bb3c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a12988-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771784, "uuid": "2e75de47-dc2e-4f18-b009-9c0d9d1a21a5", "comment": "Malware payload (Mirai)", "value": "7ef8b07a98579bcf724ae8d13c5a0c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771784, "uuid": "5a8f789c-0a3e-482a-88f9-37f7a423d8a0", "comment": "Malware payload (Mirai)", "value": "f382191265fb58efbdf592a740f280003d932bf3b647b033dea29d1f27c21937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771784, "uuid": "56dc7b75-c1cf-4d60-a4eb-cd5c0304bf83", "comment": "Malware payload (Mirai)", "value": "8e027cd51a74af2a1e81a6719435632499789665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771784, "uuid": "1eb57c04-7917-444e-b278-7789a4100b37", "comment": "Malware payload (Mirai)", "value": "02afd6d0b8b996a2d776d6abbbe01f233c60b82701ac3a75ea7f9a83b71ce3f745ede7638b55f3e2ecbf6756e76ba3b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771784, "uuid": "a35ff857-ba90-46b7-a106-b375add55d4f", "value": "T11C13F1AA630E46BDC022CAF6D0052590FC72695BD59383AA408771BF9CFFADD2D91721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771784, "uuid": "0a9d8c33-3f84-40ba-97e7-3d28ffb0c987", "value": "768:Yq6H1Y2jiF1D/2Dysfw3JqP6upHIc+SQbYqhkCiDCgGmxx07qp:2VNq2Dy2w3JupHa3XgGaOqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771784, "uuid": "5601c9d6-a3f4-4ed8-9e68-6793394f9aca", "value": 41900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771784, "uuid": "d3784c45-e131-430d-951b-8c179f1584c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771784, "uuid": "b3e9403d-7269-431d-8b4a-c6ab9d67a0b9", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4859c34f-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766440, "uuid": "378ae4f1-efb8-4b15-8feb-23a90e1344ff", "comment": "Malware payload", "value": "3eba703fe107671f189222336603e466", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766440, "uuid": "f5ad268e-be23-4eab-beba-db09cbc1bf68", "comment": "Malware payload", "value": "f3b3ee9df1b5ae1e3f08908e6c55f87a5f9e2ecd357e5e6fb577ac395cdb96e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766440, "uuid": "2540ebf5-4a92-4be4-80f3-25118305a2bf", "comment": "Malware payload", "value": "5c8a529a02e94f9f4b279aa28ab270ecbb7ed8fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766440, "uuid": "9272171f-bdff-4d7e-bb88-dd419cec6f0a", "comment": "Malware payload", "value": "5b2f3768d2c20f98c964dde23c62dcd54e77981d41c08af4ec74328a4f38878b622d570cfc40ccf25acd2281882ab7c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766440, "uuid": "7f0317e5-ee98-4c8e-9997-5199d751c6fb", "value": "T137F1033B21F08B31D7C021C9526656664E72A34B956A18B8F4BF573ADF2DA0370E7B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766440, "uuid": "500af5e6-dbab-4ba6-9452-8cdfc5092bd1", "value": "96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsG66+p1pHpmqb:cCuOC4hvZ5mzjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766440, "uuid": "137348f0-0213-482e-8cf6-84ab4fe9c0bd", "value": 7990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766440, "uuid": "adbda389-fdb1-499c-81aa-bd99c7b0c2b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766440, "uuid": "06ce87ae-dad4-4bf1-b2d5-62c3dd5abf20", "value": "f3b3ee9df1b5ae1e3f08908e6c55f87a5f9e2ecd357e5e6fb577ac395cdb96e1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfeb90d-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766365, "uuid": "cf41dda1-b09d-4f75-a29c-12b98cd8ab98", "comment": "Malware payload", "value": "ff8d633d7ce6c9aafcf62437d199e286", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766365, "uuid": "4d76cf2c-d4c9-40e0-b6be-b3b094c52142", "comment": "Malware payload", "value": "f4a0124caab5ae0f22c174fa6d4c6bc5da63ed1e23d534e6e782d8ba3359a46c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766365, "uuid": "1b8355a4-693f-45d4-a0b4-c8adb486699f", "comment": "Malware payload", "value": "d13ddb7a5b7267721b7a53a20420fc8b1e15d824", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766365, "uuid": "34cc2781-9bb3-4971-ba74-849d453dd9cc", "comment": "Malware payload", "value": "ebafe5bf2aa5ed11bb9c750fc327c647846fe625d14239f6ba92d7f54e5264f931ff3785ebfc7a7f2608a8675b554556", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766365, "uuid": "35b53867-3716-4f9d-b11f-4449d1e558eb", "value": "T14E61D97024F04C732E205980B3771BA6BBB6D85349A3758C35DE2E39AF87B12B5AF411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766365, "uuid": "74499aba-8a65-426c-b0aa-ca4ae4f3c07d", "value": "48:cnRm9+p9nB6gUIdlFmRpkdl/81lNN1IGYlrk91QRp1cychClrFs9ClwnEZvYrxZH:cRmSB6qXaN13K4Kp1p98XhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766365, "uuid": "ad5a040b-eb80-4dbe-bf7c-a34b52529d9a", "value": 3310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766365, "uuid": "d12c8e4c-3c74-400a-b03a-69dbf7999032", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766365, "uuid": "da9452ab-aa39-4825-837a-7278c282007a", "value": "f4a0124caab5ae0f22c174fa6d4c6bc5da63ed1e23d534e6e782d8ba3359a46c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393fd750-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771768991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "503c469b-be99-4049-8868-5ad72fdd9476", "comment": "Malware payload", "value": "28900c28195201a3559472230bb012b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "91e25ec0-a78c-46db-bb67-169397325228", "comment": "Malware payload", "value": "f4fbdd1877e4ab82978a14474e0c823aa7ac8dd7bd7fa6b23ce9a20dfe47fda0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "c75544fc-444b-46ec-b4ce-d183ad27f0ed", "comment": "Malware payload", "value": "f84d998ae12c8162490e7b300ee73874bd595e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768991, "uuid": "52135e0a-2520-41bd-af23-05d0c74df03a", "comment": "Malware payload", "value": "15e36c98bda6489c6e8de76f72b23fe573533ac8a142919cd979d1dbe1dfccfda4feaf6072f8affa623a5df0bf10e349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "e343012d-24b7-4198-9381-43edca2bf6e9", "value": "T138F3129055201D95F048B0F2636335A5063DE6B143AFEB5E3BB3A23C3DD9AA54CEB760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "1149b4f2-1ac0-4277-8cd6-b2f9d7b7ee4a", "value": "63ef7b39c5b13c332cf9f67aa8171bba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "173cfe8d-301b-4e33-a870-dc87ab49f9b2", "value": "3072:Vo/lri4GAA94d2glr1Ap87V4g6Duv6Thx9iw7xe1AqBRqNGuVfJExk:e8d6368tv60seaqBRqNGsJE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768991, "uuid": "ffea0d4a-39cf-459b-bb54-041c524f126f", "value": 168813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768991, "uuid": "70d4cf6c-1026-4bc0-88d4-24e6b893f910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768991, "uuid": "32e74662-3a40-428e-8e9c-aeb4ac8df8aa", "value": "Qbix01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca53cdc-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766366, "uuid": "3af17211-a0a4-4930-b6b1-0bdc93605ef8", "comment": "Malware payload", "value": "8b5d595f6052140081f8603f45344e8f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766366, "uuid": "f0766b82-7524-4445-ab3a-d9be641ba27f", "comment": "Malware payload", "value": "f5cf341e5df3d8e981f8f61acf717adf36f7e56dc52f725ad8ccb80211d4176f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766366, "uuid": "ec3a5e83-c500-4037-abdb-76da0f7979c1", "comment": "Malware payload", "value": "55460f8abc84f2a077f6c6b6fccfb54c9adafce9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766366, "uuid": "c9265a73-4f37-403a-93e3-07f3bc488364", "comment": "Malware payload", "value": "09505775a1e105cf850a1e2b631c22bb0f9a9743c8ab3c789c09d08f0739a8984c644c10e132e7738a33a35d5d572a90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766366, "uuid": "453e9180-2f6c-4df6-a8fb-b9a237202752", "value": "T1E742673721F08B3297D051C9A2771B614F72A70B456724B8F4FE5A269F2DA0370EBB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766366, "uuid": "11040903-8ec5-4038-8e79-56df3b96b01b", "value": "96:cCuisht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waYvjskQtoxIBmIBBIBUZ:cCu34hvZ5m5FG4j4HKNpivXd5W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766366, "uuid": "ffe67d62-e7dd-4284-8d0f-f5a7dc955292", "value": 12470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766366, "uuid": "a9d8c2f7-28d0-4bbf-8953-0133a5687be4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766366, "uuid": "41a0d9e6-3759-411a-87e8-93038224c972", "value": "f5cf341e5df3d8e981f8f61acf717adf36f7e56dc52f725ad8ccb80211d4176f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5f1b81-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771769082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769082, "uuid": "2f8d9815-fccd-4e0c-a1e1-2d828f1e6542", "comment": "Malware payload", "value": "202e7f030f8fdc15e5fccf3c2c1f8798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769082, "uuid": "09adc3ca-36f9-4865-955a-49e0ede331c6", "comment": "Malware payload", "value": "f5faef66d2e30fcb98e7dd2928ea8429fd2c54fa152f6d34ffcbec117f7ecda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769082, "uuid": "37036f1e-7d92-42a5-8a4a-095be2a206bb", "comment": "Malware payload", "value": "edfbe2763507a830c0053b48cd69811df05ac1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769082, "uuid": "6324d791-f560-47d5-a4ca-b48889b15f4c", "comment": "Malware payload", "value": "21a874e67fe1995695be886b25637c20d0583229caf24db6536085a1d6208dab9d3e5f2f060c8de6ce31d7847103b93c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769082, "uuid": "5c8ffdbe-e1db-4c8d-900d-bb01fdacfd2d", "value": "T19924D02039E8CDF6E2422471DE593BE5E1F4D3680E2649373794492C7FBEA46C106FA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769082, "uuid": "bfa4a4b1-724e-4094-9cb7-9b3b78be0410", "value": "d5767c61bcba8fe60f19ed4c2a80639b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769082, "uuid": "6167acdb-51a1-485a-9f55-e5112de624d4", "value": "6144:uRgym92YGB+40vPLfmHA368tv60seaqBRqNGsJE+:u6fu+40vPDFvnBamqQ4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769082, "uuid": "a55fb14c-d51c-4d36-ba52-8c8f33457e78", "value": 222573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769082, "uuid": "f750398f-a1c1-46eb-ab30-abb69b61a131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769082, "uuid": "d17453aa-42b1-49fd-9525-1bb7fa94d3a8", "value": "Qbix01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5996fb-0ff1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1771766364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766364, "uuid": "bcd142bb-7ddd-488b-9e5a-c4aceb15c427", "comment": "Malware payload", "value": "60f1d861fe4fe8cc5d8643211d6d452d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766364, "uuid": "e9540563-2202-4d1d-909e-189fe0d34a89", "comment": "Malware payload", "value": "f656eac8a3e1fcc04cdcb3b7eaddc0689fa99b67d0bcd75389b1922e7e65d39b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766364, "uuid": "3a258b20-07f7-4a8c-a66b-a01c2dc89821", "comment": "Malware payload", "value": "8697c88325294be6515ae31500a94b40b09e3122", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771766364, "uuid": "c1facadc-9802-4a2a-8d78-48c0469794d0", "comment": "Malware payload", "value": "0cc1074c3b3fde56f29dbd306ed6146c7131f8b306b945f4de37e5695db6fc580728421745c81fa1b75ee330aa56bceb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766364, "uuid": "8e7ae20a-0cbb-4afa-add2-3f36b5f2c411", "value": "T132512DB414F00C332E6156D0B2732BE96BB2E94756D3A6CC34DD1F392F9AB13A19B421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766364, "uuid": "c32af882-d02e-49b0-b5ba-dcb091a7749e", "value": "48:cnRu9RZanB6FwUblrALUblrGLUblrIeIUblrnwUblrX:cRu9oB63xvxtxDxxxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771766364, "uuid": "5d9d6f9c-ddd3-4f6a-ba5e-1169362ad70d", "value": 2645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771766364, "uuid": "fcdb5038-c41c-4bb6-a6c6-8118f5bd2b11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771766364, "uuid": "a81e7b34-943b-4a67-8fff-f821ee73062d", "value": "f656eac8a3e1fcc04cdcb3b7eaddc0689fa99b67d0bcd75389b1922e7e65d39b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab511050-0ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771769183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769183, "uuid": "c82c2421-b0f5-4e94-a00f-65b5fd4c8de5", "comment": "Malware payload (Mirai)", "value": "d5cda78473bba597838ce3cf561510f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769183, "uuid": "eb2bcce4-d8df-42bb-9738-f3a1cb2cf316", "comment": "Malware payload (Mirai)", "value": "f6b1593e126e53f3fc1d2730d3503dc68f3b4b349755c97fcdc139cb3ed7fb9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769183, "uuid": "aa427fc7-3108-4ddb-bc9f-8b961e30cbfa", "comment": "Malware payload (Mirai)", "value": "c2f2c90936752a4040e4b6b471c74b909a9cd2cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771769183, "uuid": "7eddb9d5-2cd7-48b6-b4f3-97b07a145940", "comment": "Malware payload (Mirai)", "value": "5440fc6301ac74de3bbe90211d667752fb57f37fb1cf4a2d9489a57ac63130ef89a20d905f5b781d99c56ac259340895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769183, "uuid": "319d2679-1450-4bbb-ba12-c2de8d496b94", "value": "T14593C81E6E118FADF759873507B79E25A79833C733A1D581E26CD2102E6028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769183, "uuid": "dda143d5-e5e1-4eb9-8ed8-fa0ea5d611de", "value": "768:Io8JaY/G1h4+5BN0Nlb/apie/jO9GzeN2QbQSW3zvAJWu0vKe4DSAd5lMYFyPZ5N:3o+x6CHjOkzO2OW3z9u6KeKkBeR9NVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771769183, "uuid": "3326b057-56df-49f1-89b9-fdd4c75fde16", "value": 89104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771769183, "uuid": "281d62fc-3824-46d8-a4cf-acfba80193fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771769183, "uuid": "4330b87b-3443-483c-aa20-cbdb644df0c6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495b7bf2-1026-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1771789205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789205, "uuid": "1379c8a9-1a63-4d72-b366-e5f59bec3808", "comment": "Malware payload (SantaStealer)", "value": "8945880f1b4515d234e458544b86423c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789205, "uuid": "f66ecda5-cb5c-48b5-bf3d-13c31789280c", "comment": "Malware payload (SantaStealer)", "value": "f7686a11c32fd322dd9c466ef5157901b08ae047c856f0fb42b4858fef9ae8ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789205, "uuid": "d56ade44-8ab8-4dea-9f3f-aab891123260", "comment": "Malware payload (SantaStealer)", "value": "5b28adebd18ac02ed07a87a9c57c17889c96c341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771789205, "uuid": "3d7747e7-3e5a-4c27-83ee-75b48965f439", "comment": "Malware payload (SantaStealer)", "value": "115b6b00feed7d502f88451c5b508f5cb627d471fb2e21a6c5108dc79caeac4a5f8e735757206362d5b8c2a22a163aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789205, "uuid": "a0f7aa7f-597d-4a05-b44a-1d2d61787ef8", "value": "T1549623AD625C735CC40F80359533BC88F2F6622D06F9959E72DBFEC077AA825E502B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789205, "uuid": "26419003-89b2-49b8-a89c-6d1bb077f54b", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789205, "uuid": "b39a3bc8-4a11-43fe-a7fc-a65d0dde6c43", "value": "196608:/ngAaM4iyukwLhHSlXpGkmYwU6D5gQ93u2qAn/+2MhBN2X5a8DLO:/ngJM/yJwZSnUUc93uQaN2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771789205, "uuid": "e3e77599-d589-4706-9bc2-7349195acf7d", "value": 9311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771789205, "uuid": "4f0770d8-346c-4885-a79a-768e51d9c490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771789205, "uuid": "185dc663-4bb8-4b5c-b1cc-c59712a1b20b", "value": "SecuriteInfo.com.MalwareX-gen.54553139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b845bc82-0ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771771781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771781, "uuid": "e4961f07-fa78-42d4-aa02-3a23dc02229e", "comment": "Malware payload (Mirai)", "value": "6fdafa3e5e4c1752d01564a7cc9fe376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771781, "uuid": "4d311afc-ac87-4cf5-849f-e71beaba296c", "comment": "Malware payload (Mirai)", "value": "f78c72f80214a258dc7e69c06bc84f3175f69d7b5e49abdbcae67a9c225ca386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771781, "uuid": "0895aca7-b9cb-4db4-83ba-f96cfc48ede0", "comment": "Malware payload (Mirai)", "value": "df5d827d13a487666cffe3d39517f9be943371c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771771781, "uuid": "6fbb5f4e-1c69-4e4a-9249-8d3becfc02d4", "comment": "Malware payload (Mirai)", "value": "35cff3371648432553c028e2cb5ff5aba92e120b7ab6d198a6059193c63a59ae697159564bcf076516584df6aa2c60bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771781, "uuid": "3f19b949-425a-40af-8f74-8bf656029f9a", "value": "T1A713E12C6E7E54FDF85ED4FE5B7C1B112E4902A960425C0760A5D58A864FA3CF483ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771781, "uuid": "a6497cfe-72d6-4c94-a21f-149048d46da4", "value": "768:IA2vqoP2Dt4eb/u6phzxIW42kcwk2DztHJZEafJgGlzDpbuR1J7P:IVv122Wm6p9N4owkYtHfdVJuBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771771781, "uuid": "fe48aa47-f6a1-4fbb-a9ea-3aecef357c38", "value": 43244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771771781, "uuid": "837ff841-bb32-45d5-8b1f-356de93be487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771771781, "uuid": "671b6279-d8b5-480f-b604-8cbd0077f00e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a12c362-0ff6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771768724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768724, "uuid": "5c91652b-6639-4b69-8aaa-6c53e6ebcac8", "comment": "Malware payload (Mirai)", "value": "11dbcb97c6cbaccfbf842251fbc73544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768724, "uuid": "221cf8c2-e367-4631-8e4a-33df854499bd", "comment": "Malware payload (Mirai)", "value": "f7913860d82ca6796bb098fc36beb7eb3b1940b0aa71ed55d3b1b569285cf5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768724, "uuid": "464a5716-ed83-424d-b578-46a4dcec9e8d", "comment": "Malware payload (Mirai)", "value": "879d1df046c54d30f42d3e11f37fca22e31f47d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771768724, "uuid": "42574cc5-2cb3-4b87-9808-4502298a2b85", "comment": "Malware payload (Mirai)", "value": "d047a65e6adbacf685eeb2c5ecaa7d4d709d4ad10a16d743939620c51c5f4e9b42f6a440e6204a97da3d957245701501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768724, "uuid": "809ffb0f-977a-433b-bbee-a2b4fce18152", "value": "T11ED33841B9829A27C5E123BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768724, "uuid": "aef9013a-e698-44d4-ab7f-3d38435b38a7", "value": "3072:snFif7apx6XS+kUgpjWXlsCMobmaY0qhzCQSJ:sn8ZS+dQWXlsC17YbOQSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771768724, "uuid": "d2398973-f97b-462d-a0de-af8d23d2c5ef", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771768724, "uuid": "26d71cd2-adf7-4736-a253-b48e18b3055d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771768724, "uuid": "60be103e-78fe-4cc8-8695-3d54405b47d0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1299875f-100e-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1771778805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778805, "uuid": "7570568c-e0f5-4703-b42a-1686eba6623e", "comment": "Malware payload (Cobalt Strike)", "value": "e793900a404ca106d2fe9ce3926d41fc", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oauth-openvpnet-com", "colour": "#9E7EA5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778805, "uuid": "1e6de73c-6423-4f04-b413-e8a1e789095c", "comment": "Malware payload (Cobalt Strike)", "value": "f8219f79a7f0af8eda4338a026b6331717778de14813a3a3ff921b42a636bdd0", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oauth-openvpnet-com", "colour": "#9E7EA5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778805, "uuid": "53be82f7-213f-4e43-b7bf-4c21cacea7b1", "comment": "Malware payload (Cobalt Strike)", "value": "9bb79ee04762fc0b47756ce569201ad9d4185b66", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oauth-openvpnet-com", "colour": "#9E7EA5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771778805, "uuid": "6697a0b8-d475-4122-b7f9-a03dbfa47373", "comment": "Malware payload (Cobalt Strike)", "value": "afdd3f97209e88f1572201be4c79382830ff480f471313a386edc0c7221a0120dcba78dfef01ff0b422c3687d21520c9", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oauth-openvpnet-com", "colour": "#9E7EA5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778805, "uuid": "5f1cdcf5-972d-4bd9-8003-44e2383d1a22", "value": "T1017728116BF80709E7BB1B34BC7172A19B76B9576A12D21E04C8D15D3CA3BB08D217BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778805, "uuid": "29a8ad0c-479d-4e02-81e0-7718b1300512", "value": "6a91eb82bfd19d2706c7d43c46f7064e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778805, "uuid": "0674ea0c-9197-48a2-8b77-e82d4bd4f534", "value": "196608:u0KnwxtlK7e1HMJDDOzVZqHI3L7BVLwxtlK7e1HMJDDOzVZqHI3L7O:gEI+QDDOzVZoIYI+QDDOzVZoIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771778805, "uuid": "0ce3a9d6-c803-4224-94d0-7fe1fe897236", "value": 33966088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771778805, "uuid": "1b87872a-878e-4c96-a97a-01204bfa74cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771778805, "uuid": "bb54e408-05a0-4f1f-bb8d-fa20f20233ec", "value": "f8219f79a7f0af8eda4338a026b6331717778de14813a3a3ff921b42a636bdd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512cfb0b-103d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1771799096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771799096, "uuid": "f7b1bc5a-fd63-45f9-8720-20e46f7d87de", "comment": "Malware payload (Mirai)", "value": "41e567dfbfd16f3997df3567799f31f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771799096, "uuid": "86d13135-d748-4642-9a09-5d2a85781be8", "comment": "Malware payload (Mirai)", "value": "f8dfba02a391cd2c5728d4cb243197c2e06e3a286637b2803efece23b6b0b8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771799096, "uuid": "20b23ab2-4e9c-4083-8b26-a116e1f10d13", "comment": "Malware payload (Mirai)", "value": "6131d9daa8c4a17984659daf4e556176d3a3468f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771799096, "uuid": "43b24ecc-72e2-49e8-b533-a39941062083", "comment": "Malware payload (Mirai)", "value": "76be02101963e8eebd6858bbf7f6ecfca97193e3d2739ebe5044017d32eae2c26d31c6332708a6022618a606e4ff5d39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771799096, "uuid": "37a87828-f670-4c5a-8548-839d3e271b1f", "value": "T102564B19FB8789E6F3A355F0134AD273693050099077B6F2EF8D3B65743A2416F2A22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771799096, "uuid": "75fc73d8-ba67-42fe-be6d-4877e1639846", "value": "98304:Zeny9BsK4u+31EtyvS40il4mofVVsW3g07gAM:goBs4YlFQV4mgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771799096, "uuid": "51ac98ba-5037-4e7a-a2b8-1a1d7c20f67d", "value": 5907480, "object_relation": "size-in-bytes", "disable_correlation": true }, {