{ "Event": { "published": true, "date": "2026-06-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-29", "timestamp": 1782777782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5343acf8-12fa-4883-9650-d0199539beda", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda94264-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762209, "uuid": "0fcbb7ff-110c-4e64-8a44-a315f1b88792", "comment": "Malware payload", "value": "652ae1f3dc1433dfd3b43055d20591d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762209, "uuid": "f788c4a2-e56c-4308-bf8a-e3f96e5effb9", "comment": "Malware payload", "value": "0009534cebeaa3494dc149295b1b3de97829f0b44ac5c6adc5c6e4ec8a0f4062", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762209, "uuid": "25c8fe34-d3a6-4564-a845-3b2c483248db", "comment": "Malware payload", "value": "29d6f187355570d4f388c1fb427ac30e5ac8b002", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762209, "uuid": "bf314d5b-e562-4a82-8f1e-6bb70762ff16", "comment": "Malware payload", "value": "15ebce641ce2bb011293e6e041c4c274824a62c9aacd9f15c955a007a418407a1cf55ec1c3dc6159abd3bcb5f31d0ebd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762209, "uuid": "3586305f-3667-4fee-8f06-d8bfdafdb2c1", "value": "T1C0A29E4FA378B4F69B7100DAB8BE08E821F7271A4291394DD74BB47E27B6941B1E50F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762209, "uuid": "0eea2f93-1700-41ba-9b04-54a816ccd95f", "value": "384:tWHkCKmtuWW8UUyWFcPy1t6iRzQ9GN2VVTwqFo96P7HoAVMUFIAR2wwvXTBT1tus:tW/KmYn8XyWFcgDRyMqFoRAuUFI82wwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762209, "uuid": "f6dcc13f-90a8-4e7c-aac9-e0c9c75e4a7e", "value": 21519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762209, "uuid": "596b5c50-5fea-441b-901e-d1da10dbf783", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762209, "uuid": "2b394901-c699-4a89-a4f6-50bcc733edb4", "value": "ubasa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa595d6-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737696, "uuid": "675fc9d2-abdc-4798-a71d-1974db08b3c5", "comment": "Malware payload (Mirai)", "value": "5ef34e30f23aaa3d334273ddaaae8c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737696, "uuid": "7da34f5b-7fc0-49fa-9f98-bb84e192a82f", "comment": "Malware payload (Mirai)", "value": "000d4a4b5135df4d0b404ce5c9cea4b7440eef5fa5cab482d8c2043725bd1d92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737696, "uuid": "3db04e2a-801e-4281-b478-76375c2b1524", "comment": "Malware payload (Mirai)", "value": "2ef9678e39f832aff66bf0f274d3f49952107f01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737696, "uuid": "54c191ab-5f34-4ad2-a722-a6cd5bbb6054", "comment": "Malware payload (Mirai)", "value": "d07c2798c4dacc54572de9f78a83e86472c5f4e6ba6c00d2a5b7d5bdfafa467c8bdd9d3248b8033734485c878f93c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737696, "uuid": "3bb7a94c-d8e3-4c37-8438-c0ff4f1cf14a", "value": "T1CC630206A14974B6CF328EB3F1E584E5F93D2EB8D5FEE0913978764612E1A03B5B6012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737696, "uuid": "c913aa71-65e9-4da6-ac2d-1a036cb21036", "value": "1536:Hwa/7W2fqAKwnf3OOUkQoyuLLBEcnewAmLaB9GMpl:HwE7hfqAhnf36kRLB1emLYgMpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737696, "uuid": "841e43cf-b0e9-42f1-90ee-f05bab8a88a5", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737696, "uuid": "7aed1a3e-78b9-4ba6-a93f-f50aaaecaec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737696, "uuid": "681fdb06-94bd-4d4a-9093-4f527342c45a", "value": "000d4a4b5135df4d0b404ce5c9cea4b7440eef5fa5cab482d8c2043725bd1d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4271d6a3-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756821, "uuid": "de64875b-5988-4e4b-92cf-3dff12322edd", "comment": "Malware payload (Mirai)", "value": "24605fe2431848359bb0e57f017e28c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756821, "uuid": "2280e05d-2ab9-48f5-9804-eb585c6bc9ed", "comment": "Malware payload (Mirai)", "value": "001390f30eeecb4719b07166d7dc05b4aa8ad1bb3d75bcaaf8ef65d880b8004a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756821, "uuid": "580ddb9b-b053-4806-9895-ee6972ec73eb", "comment": "Malware payload (Mirai)", "value": "24c9f8b15e068a144832fa535732410c504a199c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756821, "uuid": "c8b97008-42a4-4d0b-887f-ed2781bb4823", "comment": "Malware payload (Mirai)", "value": "7d74a9d63e379a32a58682177cc0923cbd3e0a96809a9395947105415bd079dd40ddc271274cdcfd34e1e1d7843c2643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756821, "uuid": "285e93d0-4e47-4ad6-b851-3d198a2f77fc", "value": "T1CF630299D962B820EFB40737D88F026A13922FC8B6B1F6E9482BC54A75D154363FC0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756821, "uuid": "8d397335-b8fb-4718-9908-8e2c81150398", "value": "1536:9ITaJpP5/wwkkHBEfdd5uQqwoVx934Mw95LmsPXjkRStGxCaJR0lM:eGz/DH2fsjwg54MKLmsf7oylM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756821, "uuid": "6159622a-037c-4d5e-8ffa-094e983832d3", "value": 73168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756821, "uuid": "4c3b86b0-dc23-4814-a44f-a7f13693dbf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756821, "uuid": "f5daa358-a00c-480c-ab07-a5ad18b21cae", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701d0897-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775366, "uuid": "98ceec9c-0731-4089-aef2-76899f5375bb", "comment": "Malware payload (Mirai)", "value": "c3fa1f394201832fcd88c141378d1422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775366, "uuid": "f2cb068a-107a-46f3-a0c5-a9762bcb22e6", "comment": "Malware payload (Mirai)", "value": "00a5bb1a22bb63d4f94c09a5dc748260b0710129874ad38cd38bed68120c2cff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775366, "uuid": "39e5dfc6-8839-4acb-a68a-204171ac7cb3", "comment": "Malware payload (Mirai)", "value": "ad4bd25c3534c0912e774ca0c6aa68027d8fe3e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775366, "uuid": "909ebb82-a550-4d12-836b-a65b4e974655", "comment": "Malware payload (Mirai)", "value": "ffb2a5b541cac4d614e802ed432f5706a1abfec6e8935717f235558b9106ffca793c667b4fcb363b7c99689d861d2316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775366, "uuid": "0306786b-c5b4-4117-b2f4-d8a7d332fa70", "value": "T12EC30886F8824A22C5D712BEF92D118E331217F8E3DE72239E245F25778661F0E7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775366, "uuid": "c8e6cc1e-4332-4f5d-b20e-ebaba24da0dd", "value": "3072:uqCLzmTWBda4qhYolgvLQaVlQbdQxABt+Ys:uqC2TUda40YSgvEa8SxAyYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775366, "uuid": "61034ea8-99ff-44bf-9891-1d7d805461f0", "value": 128480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775366, "uuid": "46d217c5-762a-40f4-892c-4c71a5502a4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775366, "uuid": "1b0f09e1-434a-467d-a1fa-9c436d5bf9bd", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debdb0a2-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742051, "uuid": "613c3053-c958-433c-8807-385f88988492", "comment": "Malware payload (Mirai)", "value": "31271d5fd04234331a78a8152b870096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742051, "uuid": "9be3c289-ed1e-4c2b-b6d5-d2e2264aa077", "comment": "Malware payload (Mirai)", "value": "0120fd818e4ca578ab31e162b26673330fd04defb6a016dd773ea56fcadd075a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742051, "uuid": "93124336-0f68-4c6b-acda-1bd60656e9e1", "comment": "Malware payload (Mirai)", "value": "8278db4c6c55e939b5066a1a63851cc82f4aec49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742051, "uuid": "8086898e-4d01-4054-b48c-1501feb67e5e", "comment": "Malware payload (Mirai)", "value": "992f60cc57e9fee159ac324ce12ea94e1536b0c189d8ea9e7f924e3479b37447837af24e2237eb7a87789a51ed8ad689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742051, "uuid": "e00ef3b8-6c29-47cf-9f54-401a5dbc3d0c", "value": "T1A4A36B46F692D1F3E09306335053D75A4730DD35414ACF0AFB193A399E62A4E8A6FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742051, "uuid": "1673a410-05bb-4db4-b185-e6f870491dd4", "value": "1536:Zz7GT6q75F0daH/K2g6OZIsbO096TcowQR7boPorhkjO3sNSl:ZHG75FgaH/KtzG55TcowQ5hkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742051, "uuid": "1ad8d64e-3748-4078-b381-d2e7a304a2d0", "value": 101364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742051, "uuid": "8dfe76b4-2516-4d5c-8c30-a764e6525211", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742051, "uuid": "a892957e-ef93-40cb-84ea-ccb73e90e7ef", "value": "i686.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e3a3dc-7409-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1782771908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782771908, "uuid": "c24fe735-e45f-4aa7-bf82-9cba5af8222d", "comment": "Malware payload (AveMariaRAT)", "value": "2df7867dd2af4783e4881d38e5901f5f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782771908, "uuid": "79e4b1b1-d3f3-4739-b811-42bde18486f7", "comment": "Malware payload (AveMariaRAT)", "value": "014f3accbf588566489bb34bd21402c1ab70f70448f818ba817b7db2d6e21122", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782771908, "uuid": "a03ada52-3b14-41af-8fa4-f78e4b65f243", "comment": "Malware payload (AveMariaRAT)", "value": "4d7d1e9a64f5f4262fa269d5df819411aa31bfaf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782771908, "uuid": "8e64adcf-3c9e-4657-9705-421b1dd18762", "comment": "Malware payload (AveMariaRAT)", "value": "d0012a941f7c5e6543a4b7f20715852fedb5e23cb161d983dc18b27c7c2ca3c16d0ed49166912321eaa9cc8a6167d116", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782771908, "uuid": "74c26f79-57b4-453b-b66c-aa53f2367644", "value": "T140845A88728039AEC857CD3145641D7896136E6A7F1AF203AC277DB77B3F9C79E110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782771908, "uuid": "e3175955-e541-4bc1-b50d-cd0d69ff9b63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782771908, "uuid": "073b8283-3c10-4fab-baeb-165fe2267b05", "value": "6144:yvsIu8/bUtPXsNPEjsIad+Zj/Thoeem0Lr0ftEdRsIaTmSHCX3YhOI:ya8/bUC7lufmr0ftEdRsIaTmSHCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782771908, "uuid": "06875728-343c-4d17-9481-2f9f479dfd5b", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782771908, "uuid": "d6267090-6a98-4a56-a6c7-7f064b7cd38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782771908, "uuid": "bb4fd465-e656-4596-b451-7c6629d2d95f", "value": "2DF7867DD2AF4783E4881D38E5901F5F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eb14fb-7390-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782719974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719974, "uuid": "a947225b-454f-4c71-853d-cfab3e6f5f39", "comment": "Malware payload", "value": "d95f95a79f33ffee1e3eb2b940554d40", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719974, "uuid": "eff8d9c5-ecfd-4a3a-bfcb-b7a4ecc3dba6", "comment": "Malware payload", "value": "016cc7ef5a4b175b20a4a149d16afbce2e1919bcb8420df984a415b778a8ba1e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719974, "uuid": "f78be7fe-9cb6-49c0-a41a-b2e592b51940", "comment": "Malware payload", "value": "76c93523022405be8b1e6d471ae88688c914d5ef", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719974, "uuid": "d28339ed-da29-4bc7-b811-b57190ea2997", "comment": "Malware payload", "value": "42ba30b13c677c39ebeef8c19b4553f010d9880aa8ce6a308ec2d47e13ba40d98c026cea9a9cb7bb80d1e7a5607ae6b1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719974, "uuid": "c3413b3f-2d05-4821-bfef-a364e681d5db", "value": "T11FA35B08EED3A8F9D87A86B48EBB92177531BC144524A21F1708FB7F7D35A81DD2A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719974, "uuid": "e23a414c-41ff-4108-b631-1b11afd203e0", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719974, "uuid": "4788a96a-5bc6-4e05-b38d-754de65c59b9", "value": "1536:MVTwJp7gmtbVIdcsGfLRTuZwCbAf+5Ug4LHy+FHqee4Romu/t71:h7ggVI2DRTuZwkAf+5Ujy+FXe45S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719974, "uuid": "69a100a3-e9c8-4c57-be4c-025378b40741", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719974, "uuid": "c5a3d50a-aa0e-4e0b-a274-29f134d2cb3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719974, "uuid": "7d354141-5fa6-45d8-8060-d164ff60b39c", "value": "SteupsHR-V6.5_6.27_canwo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8888f6c8-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760375, "uuid": "c87056a9-e248-4822-addf-40e9d80724ee", "comment": "Malware payload (Mirai)", "value": "3cb0d939ffbf4eb379cec09ff941ad4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760375, "uuid": "6bfedfa5-cc21-4b2c-8020-00f37af2aea5", "comment": "Malware payload (Mirai)", "value": "0202321c9326d6013039deadd9c3994ab8137637206b32f1e131dc870ae6dbe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760375, "uuid": "ae70e7f8-62ef-4731-9508-b8b0325ed08d", "comment": "Malware payload (Mirai)", "value": "b12eeff4a27ebeebf78595142f3cf2821dc1f93d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760375, "uuid": "8970519e-d3b4-448c-8496-aa81d0744e98", "comment": "Malware payload (Mirai)", "value": "2d569678152968a40afe4cbfd8f0c25e3bf98c135990b64ecf8ddeb00057f69df7416efc14dcecf6588e068aba596488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760375, "uuid": "bd60429b-1864-43b6-9ea9-cf55e5826a6d", "value": "T166D2E1BD45B34072CAB2C537AD2ECED23BCA1FB461C977220400576C9D872A919F168F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760375, "uuid": "7b3b9ea5-3226-40ff-8755-75eb1476b198", "value": "768:D51za4QwALuGvlmYP0XfSmwMRla4SmxR2qyjV+s3Uozgb:Dm7S0lmYPuSmwQaUR2qyjNzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760375, "uuid": "f9437d22-8149-47a3-a447-048ea9b72107", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760375, "uuid": "c6c4b0eb-5e2f-41e8-acb4-63a2d46535b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760375, "uuid": "86a7cfb7-9a58-44ba-bc6e-8ded0fe9562c", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62516c8-73b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (751Stealer)", "timestamp": 1782734735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734735, "uuid": "7bf5db78-eccb-4056-969a-9c13cea84c1a", "comment": "Malware payload (751Stealer)", "value": "0730b4fcad7df2e64f5fe70e67d9d9ab", "object_relation": "md5", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734735, "uuid": "368b13a3-cae9-43c4-b273-bf6e99521fd0", "comment": "Malware payload (751Stealer)", "value": "0219224c51d8bb89c231f16bd9993773af87f2fec19776a069e06943f051d717", "object_relation": "sha256", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734735, "uuid": "e9b63555-d680-4ea4-8002-964c28600e9a", "comment": "Malware payload (751Stealer)", "value": "0d29370dfb949637dd2f812f5532a96220d26e0b", "object_relation": "sha1", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734735, "uuid": "2e7c0b95-1e1f-4086-b36f-680fd592e085", "comment": "Malware payload (751Stealer)", "value": "341e14b042cc755099196248f8f7dbeb0a69f54ef156e3c1d73b8bcca2ee7448ad4da2b1887ef3598cc158a6a87f620f", "object_relation": "sha3-384", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734735, "uuid": "5523f891-0087-4561-b02f-1dfee2905bae", "value": "T1BF85F106A7E114FDC1AFE134CD625502E976FC9747649DBF43E899A12E333808E7AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734735, "uuid": "0ff05e23-dacf-4596-a93a-caf46aacc38f", "value": "8d8029e87dbf652ff8d7bb1768ceef69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734735, "uuid": "e126772a-539b-4a6a-aa16-2595fb3c1737", "value": "49152:lxmWKdEuKOulAvMaHVv/1kBtjUHrF8GB:lxLyKOusMapKB9QF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782734735, "uuid": "eed8f550-583e-467a-aaa1-823b57c1e7e6", "value": 1719296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782734735, "uuid": "13e834ca-5119-46fc-adb5-96cd393799b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734735, "uuid": "88923160-43b1-4c29-8cf4-294a9b1c2304", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead77dbd-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769559, "uuid": "ca2a5549-d56e-43af-9aeb-84e0deab42f1", "comment": "Malware payload (Mirai)", "value": "c6bafeab0d23ca684579f526267e184c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769559, "uuid": "ba76c32d-0704-47d9-a385-488bb1478372", "comment": "Malware payload (Mirai)", "value": "021e270da6c04c37594d7ab97a68f9430340b56ac3973ea3ccf2ff96cc22eb5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769559, "uuid": "0ac2afec-7c5f-419d-bbf7-06aef4c68a00", "comment": "Malware payload (Mirai)", "value": "17ef456cf5372626cdacfaf70790a400ad8f6dcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769559, "uuid": "08dfe82c-2611-4547-93b2-034003ee0e4f", "comment": "Malware payload (Mirai)", "value": "ee55e509bb194105c82a1343685431d5d7c72ea4c38c7e3e3da2bc2f298c16ccaf926fb750316b2310fe3475efc636ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769559, "uuid": "083b7016-a108-4273-b73d-fac0d03536af", "value": "T1AA230263C2BEBE3EF467DA7750EE8981DA2B4D069100936A5DF46315CC97C9A3D21F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769559, "uuid": "2d9bba28-cce7-4348-b08d-72f6b6621a64", "value": "768:p+an3RY7qKS4o2SeAgPBOAcLolAvqXpR0ngr9yurX1pqu/vedxVRLncix0YH:J3+7k4oZCAolAv6mngFisvSjxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769559, "uuid": "541e655f-1604-4a92-8dc0-63abaa6a6242", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769559, "uuid": "c71d2091-d8b1-4253-9ee2-aa33133b8aff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769559, "uuid": "54f20e19-013e-4de4-9a05-a8e0c328df4a", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bf179c-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782713267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713267, "uuid": "ad213f70-496e-47d6-b588-143638d1e9b6", "comment": "Malware payload (AgentTesla)", "value": "2549c327e62c45f7f5ab4ec7eb0ba5d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713267, "uuid": "b3f6ac28-79ac-479e-b2de-12494afad4a5", "comment": "Malware payload (AgentTesla)", "value": "030b02ee930ccc6aea73af78613c596fb73ead75f08b2deb79821bebe31e9858", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713267, "uuid": "b5814cd6-cd2f-4fe5-90a9-a40b39a616ed", "comment": "Malware payload (AgentTesla)", "value": "53cf56ee12ed2cfa37814e4409af9a1f2b24c0c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713267, "uuid": "76002c75-dcf9-425e-9201-57ccb1fd6cd0", "comment": "Malware payload (AgentTesla)", "value": "781902129125f75bd7e4b7c6aa31165e8a0b826e0605cbbd706ceb780c26aa7d0aaee954356cf38159d94030afd242d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713267, "uuid": "61ec9c40-2380-451d-a380-0e60ca18a9bb", "value": "T1958354416AD0E8AC07E39F7E375FB0D4F4AB0CDB2988844AD211F990F4B061AEDE5675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713267, "uuid": "b8750181-a0d3-4036-aeb9-71ff4109297d", "value": "1536:N03g+0PSqLBoq9ANNnOOU+/OdNh6TGrdXmCrRZ:y0PSaoq9ATOE/OfAardXmCrRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713267, "uuid": "57bc7b55-e6da-4768-9904-d2bc086857e0", "value": 83010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713267, "uuid": "d7f917a6-72a8-43f2-b3f9-85c09cf181bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713267, "uuid": "c8333c50-1989-4d77-8413-bef5db945d4e", "value": "Directrices de pol\u00edticas para empleados_2026.pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c38b35-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699600, "uuid": "ebedd3ff-8b6e-4eea-ac9c-0690e2e396cb", "comment": "Malware payload", "value": "81af306b503fa7e11c557f45e14210d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699600, "uuid": "eefe98be-f6c0-45f9-a45a-93c9253bb83f", "comment": "Malware payload", "value": "039fa0f67bc01117564798b70ef5aa35446d3ae9176a17a4a5bb2a47d911c2e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699600, "uuid": "bb21c169-6433-4907-acd3-60eb8a66d148", "comment": "Malware payload", "value": "d0d705cc012359b832b8e295b2c9907ac93cbed3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699600, "uuid": "0667f228-221f-44aa-8fcf-5d58afdf2c54", "comment": "Malware payload", "value": "01b4436434409b1b4e0d9daa87a8c8b8d0ab841ea012972989c5745eaafe114d9e6c6b92d73209a6714674f7e22c4411", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699600, "uuid": "76ac9972-1c1a-46cb-a9ee-c27b3599cf7b", "value": "T13F139E5DB2459AFC4F564D13B02A53C68A4CF96FCDD86569A78A20080CC9E34E3BC6FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699600, "uuid": "a8feebbf-7cf7-4d31-bf86-a3a4f8e9accd", "value": "768:uIscgbDnV2BNHqosiAGZTW/bHN0PsNLvInvTYp6Oeq4evQIWEdgEz4f0r7Mz2d2t:3W7V2BNHq6AGZyL/LAje4No8sr7m2PBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699600, "uuid": "bef76110-13de-4825-aad1-c0e2fedd9532", "value": 42384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699600, "uuid": "afea3c73-6a01-4b62-a3a6-0aeadc7d5c45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699600, "uuid": "4a7cb432-c1f2-4b39-870d-6334d994209c", "value": "afujo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3594845c-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775268, "uuid": "aa3886e0-32c3-464f-8a25-21f23299e1c7", "comment": "Malware payload (Mirai)", "value": "21f5d9921921ccc076b4fc46f09d5df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775268, "uuid": "9b7ae54b-e2b5-4274-a470-242631a04b61", "comment": "Malware payload (Mirai)", "value": "03fdc64c672dfa7a9a5e40ec87643037db26c9c52f7236655560a8a9678d6d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775268, "uuid": "c760f38d-9965-47ba-a9b8-b10123fe6607", "comment": "Malware payload (Mirai)", "value": "39f3535ba0ce5b2d3263b57db9564908a4192310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775268, "uuid": "14dc3f2c-e4e5-4fc5-af92-f0f648d838c3", "comment": "Malware payload (Mirai)", "value": "46783ae1699854d47fea519fb420b56f67293a105d65b26218e184e6748266d983b4d14126893afd87037b66076f6bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775268, "uuid": "bfb8ecea-eb94-4c44-9d73-9b2e8c66c3a1", "value": "T15AC33B8AB402DE7CF90FD9BB45674D0EBE30939156931B26639BFD93AC321A47D02D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775268, "uuid": "83b5e60a-8038-4884-8c99-eb3812532fae", "value": "3072:CkEjP+TNSqyagYFpqHUzNzaKx6tit6txu:2jP+TN6mgHENh6ti4Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775268, "uuid": "7194fed0-fa57-4f0a-a214-3cc5ae284a80", "value": 121132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775268, "uuid": "0bde70be-182e-4dc8-89e7-92478cb5bac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775268, "uuid": "d5b9a2c6-118a-4556-8916-a368045c9ed9", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95262c74-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765121, "uuid": "6a9c9f7d-cead-4450-9b4a-79d764b52418", "comment": "Malware payload (Mirai)", "value": "d10d70a26498e9e4633fd041cae6db10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765121, "uuid": "c7b89276-b3e7-409d-bb6b-4a31d4157af9", "comment": "Malware payload (Mirai)", "value": "04405dfc22769c2fb9fac127f666f6c27be18a1aba9a159497ebbb9c02ed9d23", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765121, "uuid": "ae90ff5e-b780-4aba-972a-1df92bfeeea2", "comment": "Malware payload (Mirai)", "value": "c93bc4fc1dea4523e7cc8c9843de7847a3e0bb4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765121, "uuid": "0a002a17-c537-4be5-b2e3-27a26eb89ec2", "comment": "Malware payload (Mirai)", "value": "014a3b44363f893b293258fbc5332dad6b37ca3f225cb2a2834edb1815a6460ced01ef2af88c739a44fdb29e2e48a1fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765121, "uuid": "2cf96be5-4940-46c2-a97b-baba823c75b5", "value": "T15304F742FA43CFB3E15300F102B787214E71FD7A6C66D582E3A8BDB4A9656C1A61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765121, "uuid": "3990ced4-30c6-4055-9aa2-b473125c3c6d", "value": "3072:nfmM6+MPh2OlLP3ldPTc6AIFX3PENuxR32qhryZt7yEXUlpOe:nxIh2OhreIFxz32Gm//XKOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765121, "uuid": "c94bd4b1-7850-4e97-befe-8b0e1c354117", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765121, "uuid": "b4f25071-cf7d-4a0a-83db-c221d3dc369c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765121, "uuid": "774fe830-5049-40f8-bbe7-1e8e37eddea4", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8645483c-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760371, "uuid": "ec4daa4f-7569-440b-8b18-80a3d7622bfb", "comment": "Malware payload (Mirai)", "value": "835a479a48c44aa7c16dd162185a8172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760371, "uuid": "6b5d1931-fa04-48fc-adfc-57088c31eb1b", "comment": "Malware payload (Mirai)", "value": "04ab704b35793a3418fd722a6b0842d03702de20cddd1f8509f71fd91c97879a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760371, "uuid": "d48f39b7-d471-481d-a7c5-39a7d7ba6ad0", "comment": "Malware payload (Mirai)", "value": "594dc1f5a40d9ef0f9afc16e812c462d150a2b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760371, "uuid": "c631236f-ebe9-49f1-8595-4614ef6a51cb", "comment": "Malware payload (Mirai)", "value": "089155d80a7312df30d38abcbcf1cd21bf52914f9790d2f64c53ad94274b4e70b0b8322b87a31c640a850123eb868644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760371, "uuid": "b58f08f0-9ec2-4013-b73f-1aa0dc32c7c5", "value": "T18A23F18F689DFBDBD235C63182CBBD5C04D069427270015BBEC055FAADC336D3A98A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760371, "uuid": "78f4ccd8-32b0-4456-949e-5bc7ae230516", "value": "768:F5/4H8HnhnwBBYycAzs8FCdpIlKZlw4XpOmTAWgeeVe5Ktz0/i0oec9nbcuyD7Ur:gcHnVwxcAAeGIlK0UnPgeb5Ktzei0oea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760371, "uuid": "1c02ab10-8a91-4542-8f88-2938b44561e0", "value": 48036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760371, "uuid": "ff781698-9448-4fb2-b9ba-2680543168dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760371, "uuid": "dc225474-7172-4dc5-a98e-51d94393ffcb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9713a7-73b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782736978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736978, "uuid": "8fa0fade-3932-46e3-95ae-98e91a4c3813", "comment": "Malware payload", "value": "66cb900d2543b4995af0ceb95c8b540c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736978, "uuid": "c8e61654-0a13-4aa0-9ed7-a7a5859ff8d4", "comment": "Malware payload", "value": "04bff0171f60b04c4654daca79dcda612bb9aa501d4d4e12cf8c8f0efa89b03e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736978, "uuid": "de3b8d61-f10a-4efb-b79e-48d17f11c2ef", "comment": "Malware payload", "value": "ff7f3caef660982ea2d6ae9eb265f10d77d27f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736978, "uuid": "6393f82d-a9a3-4f28-8ab8-3a69059da59b", "comment": "Malware payload", "value": "7adbc86998e0c785374dc1347d7f1d5452c99ac83ad3177cdd9ec18b2945f972d8fcb0cd2196bda967fa15c6daaa8b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736978, "uuid": "4d23ccfb-cfc0-47ff-8d72-3b23d01af93f", "value": "T16FD545BEBE7A501B0CC1A86AFD6CC83CF3B8B6436214928A28591743737F549275736D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736978, "uuid": "4716ba52-c8a7-4e03-971a-cbae916e1331", "value": "384:5mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmp:wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736978, "uuid": "21a12da3-c725-4432-9944-911f3bb70509", "value": 2899469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736978, "uuid": "321d2078-fef5-4c73-8f93-683e1499f0da", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736978, "uuid": "21632cc0-2b39-4690-838d-9741a5e88d77", "value": "BANK FORM.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fc89b4-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762216, "uuid": "7a0faead-00bc-482e-a060-2dc862825466", "comment": "Malware payload", "value": "065e0985978a9e8ebbc053911a550023", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762216, "uuid": "42d098af-8ca9-4f92-8fc9-c51037b99920", "comment": "Malware payload", "value": "04e8c66ee0f927111d8399c14901c2aaac5adf5ac3a2980458e8f9d9c4e9f7b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762216, "uuid": "91c759a4-c056-4309-aa4a-d49eea013d62", "comment": "Malware payload", "value": "f9f1a6fc3156fe5de9fe76d45e1b9bbd30a159c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762216, "uuid": "f00e82cd-5ef8-4f7d-b466-424dfba8fc47", "comment": "Malware payload", "value": "ed19ee9eb9ed8761ebddd69c66bc92924d4e15225231d5d654db77f6ed544a0c1cf74f6e82abfaa2ece4521a440109f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762216, "uuid": "33b2c981-989b-4d2a-89e4-899fba05654b", "value": "T121E2CF13E3EA8DEC17908AD6EC5B0D52835854D900F9FBFE52187A478DC9E13F9B6098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762216, "uuid": "f0d91441-8104-442d-9b11-2283dbb75236", "value": "768:8hW919HU4PG5vBCapIWVc3OTOzBu7ktw6HaTrmZh:WiW4PGdBhpS3OTOzBu7swkaTrkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762216, "uuid": "0dd0f2cf-0a12-44ed-8af0-569a1127b9d9", "value": 34151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762216, "uuid": "595ce311-6cd5-449d-91ab-03c97ba670f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762216, "uuid": "2c31d3d6-4bf0-4362-8d9b-62c339fbdab3", "value": "ubiba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66e41e0-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721422, "uuid": "19199ac8-628a-4681-98e8-cc2dca9f1598", "comment": "Malware payload", "value": "ef729eaf8fc8410ba5502a6540521d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721422, "uuid": "9273e511-600b-4667-a292-e83aee7eaf73", "comment": "Malware payload", "value": "056ad4072ab0babb9d473f876b3adcbcd1da9eb3fa6bbd5b7d7ca5e4451f0ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721422, "uuid": "e6d63028-42ad-4d47-acaf-1af0ce68b4ad", "comment": "Malware payload", "value": "3cbd3d3132a2bd841db74fbfa2d262d5f7ff0e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721422, "uuid": "2098b0ab-2485-44ed-b7a3-90dd8fb6f731", "comment": "Malware payload", "value": "5fbce54e1ae4352efc52ab838992faaaaf8fb66f8beda4070a59efffd5f3d04e372c2737cf96fcc1442a2f8eebe63c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721422, "uuid": "c24c316a-cc95-4c0e-bff9-ea5430f85076", "value": "T1C2420AD975D3B4FCC07C4278CBBA4262A696708A17254FBF99ED980026C3B4168BC695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721422, "uuid": "8131f488-b462-43fe-931a-20ae2b6abac3", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721422, "uuid": "37bfbbab-cb10-4946-89c5-7336174b336d", "value": "192:OABMsc9INofJ2DJJJLYkyaQFgnM7OAXonIiFjtb3V2W:OABMs6ISfMDhL1nM6GonRFZbl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721422, "uuid": "d921f5ac-971e-4761-bc7f-6d5c1402e875", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721422, "uuid": "b6ec1457-3e1a-443f-bf22-312e20b98fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721422, "uuid": "c1029bdf-6296-473d-93bc-1b8aabe02cb7", "value": "ef729eaf8fc8410ba5502a6540521d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05105adb-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782755430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755430, "uuid": "23aeb811-584a-4308-969a-bfa664f59857", "comment": "Malware payload (Gafgyt)", "value": "16f927c8e97c403ec59ebb197e2037f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755430, "uuid": "eec43253-7bf1-416c-a9fa-30bd255be469", "comment": "Malware payload (Gafgyt)", "value": "0628b4908a495c89d58975e4e48db7b0fffca8d00c23d158e19ae9739960c525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755430, "uuid": "89bb1137-9b87-4b1c-b92b-d6c793b2feb1", "comment": "Malware payload (Gafgyt)", "value": "110b98a356a4517928c9ad021fdee0a0fb34904f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755430, "uuid": "888b087d-6638-4dd6-97bc-47add608f669", "comment": "Malware payload (Gafgyt)", "value": "2d398b639bce24240f6cef5edf09e295d3438f3550f471c6bae1ff4d30f65284cd8bbb3daf304e0a6fe4129f8156df85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755430, "uuid": "8624a99b-597d-4f0a-92b8-f5983526268e", "value": "T10B834B03ADA0C0BEC09AC2796BDBD262B732F8955211371B3388A9363FA6F55171D359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755430, "uuid": "b992f148-fa4f-4539-9623-ebf7f44a6bcb", "value": "1536:XYTeGdsIeUPZBv4fl3cHcJDuphza1/WqNbowi0Tor3VBXdJ2WfS2zb:WeGQIZitsCu3zahNbotpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755430, "uuid": "eee2f1da-3fa2-43b1-afb7-f22c27bef457", "value": 88296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755430, "uuid": "ffb2c388-1c24-4071-8171-92eddaead369", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755430, "uuid": "609d4094-5f0a-4d70-bb51-94226c982403", "value": "SecuriteInfo.com.ELF.Gafgyt-MV.84142497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77efe4f5-73dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782753046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753046, "uuid": "4074f935-721e-4bfc-adaa-98fc2df5814f", "comment": "Malware payload", "value": "4469566bd670fd05f111ee9aa1b58727", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753046, "uuid": "679c7ae4-0330-482a-88a5-871138fdc452", "comment": "Malware payload", "value": "063ec3100b9cec2cc2c42988485921182c1b5ae32ce71df84f9ba7415d491fea", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753046, "uuid": "52f4428c-2175-44f7-8a80-6b8317a77d02", "comment": "Malware payload", "value": "e0a804559e932da765d5029e07fbaba68e3643aa", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753046, "uuid": "c6b874d9-5f80-4085-88af-d771ca0a2f93", "comment": "Malware payload", "value": "24ea1fa4755fcbe4da2881a6aac1aff67dd435a68b07e35c8c3c58c9c2ed73300ef8db18938dce228a9de4a36e3b31b9", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753046, "uuid": "4bebe317-548d-46d0-aaa9-f20da770f87b", "value": "T19E66335451753EAEE81C98B5BAA42B63E201FD1D3DD16410582FE0E2FB926C9BFC035B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753046, "uuid": "50a9f951-023e-4e5e-94eb-397dd0e005ae", "value": "196608:DTnY2/qlLSDlI19xwy3FZ/CSpHUx3lBkCk0y9rOhua10gtHa:HNGSDWLiy1ZRpI37khkhuaugA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782753046, "uuid": "14a7d006-4a1a-4ca7-8a99-b737f7a2ddc1", "value": 7000969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782753046, "uuid": "0ac524c6-e729-455c-a927-f8da53aff823", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753046, "uuid": "389e9ad3-a3de-4e56-9619-3570697261b6", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95d5bc6-738a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717615, "uuid": "bd9187cd-7a0f-4d13-8518-8661f682803e", "comment": "Malware payload (Mirai)", "value": "79ba151afe11c506495c3600d44479a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717615, "uuid": "c5901e35-8533-494a-89b6-c1268eb82738", "comment": "Malware payload (Mirai)", "value": "064f5b90600f2d6f3eec4b451fd7f09df15ddab7ac4c7d84c6f8a1141ae99831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717615, "uuid": "7693ad10-c566-49a8-b173-8659e59e5b5e", "comment": "Malware payload (Mirai)", "value": "00122d66f9f7865859baf2749b5170b31b0867eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717615, "uuid": "59c67302-93d5-4651-b752-3a247be9c3cb", "comment": "Malware payload (Mirai)", "value": "f8b2d86795d8b8542da573cbe283a03a20418d5242f172b2c16b4ff9372c678a66ce9ff054d5903c9214f1e728db291e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717615, "uuid": "c93d7259-3a2e-4eae-8810-826af3d242fe", "value": "T1118302814D165923DF952339543BFB2CF2A9A49C1D9ADFC2340B8CB8EED5457686C8F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717615, "uuid": "210f7f3e-51e8-46c5-b7fa-8fba7b5553f2", "value": "1536:UHzkBUO4rpsQl+G1prfa9nybTChnNPB8P44+AsbdMcEWgmEAe3UkAIHDjSoDnb:UHzZOvQlTzrju244QhpEaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717615, "uuid": "b7143460-0664-451e-b2e1-a752dbb91016", "value": 84252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717615, "uuid": "a0ff3e70-5fa8-44c7-ab9d-0030713e4d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717615, "uuid": "7acba39a-6c6d-48ce-8207-79929e870938", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12970988-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782716798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716798, "uuid": "5387ff43-16fd-470b-ac2b-20ff63f07fb2", "comment": "Malware payload (Mirai)", "value": "bff834e103a606d7cc07634badd88e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716798, "uuid": "55a2182c-d048-4c46-b352-d4c18dcb4116", "comment": "Malware payload (Mirai)", "value": "06787088081f0addf88e08fdd3d7279847b83c3219d91f5c30bf822916a488ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716798, "uuid": "c8bc6b78-2423-4e65-9f00-4b6da03a7e4c", "comment": "Malware payload (Mirai)", "value": "ddb0ddefb5f78cf8b096d9427378819183d9341d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716798, "uuid": "33266b3c-3457-4798-9695-02952487bb2a", "comment": "Malware payload (Mirai)", "value": "e0ba857eb464f1c770f9f291621e9332025eaf94d4787e3f0cde2afb70bcdabb8c8f3bd4d3251062824a8fc993c3def4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716798, "uuid": "f4617f09-4bed-4280-9211-d0bbae83fb6b", "value": "T1C644931F2E12CF7EF3A9977007B79E20975C36DA2AE1C680E16CD6115E1028D651FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716798, "uuid": "517dc24b-20b7-49b2-8a06-e8d4eb6f8f70", "value": "6144:AFGTsYKSALhgKOV4pDhMaocZ3b8Spv0Vs+ljW:AFjDhTb8JjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716798, "uuid": "60f3935e-0547-4232-a22f-8a27c723c6e7", "value": 258312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716798, "uuid": "5674f11f-6975-4ddf-8776-335268d66674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716798, "uuid": "40cfcc9f-88f3-42d6-a652-368d26ea4bcc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a193cb3d-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782736365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736365, "uuid": "9cacfbca-73e6-4f42-9b77-e3d97888c2d9", "comment": "Malware payload (AsyncRAT)", "value": "b950d4671c9c3a723aff0bf8b27e563f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736365, "uuid": "748995f7-7013-4df0-8663-8d831e92102e", "comment": "Malware payload (AsyncRAT)", "value": "06798ab00b4cb050918236f0ac5c3a30252dadfe6c8e7563e276966e7727c055", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736365, "uuid": "c4ab3b30-969d-4a4d-b7df-a92d992b4d9d", "comment": "Malware payload (AsyncRAT)", "value": "dc9d8c742c301901e832f34781f9eb0ccd5204a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736365, "uuid": "3c231446-9ead-4361-b4cf-8b2bcf9ce855", "comment": "Malware payload (AsyncRAT)", "value": "694555a1328a240d75b70a465f2b550eb90c4966ffe418a041e6a64d7798eb9b02682ea1e6cf988acb932e6779d8214e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736365, "uuid": "8bb0806e-6056-4e56-956f-e9d7565eb92a", "value": "T13FF402280963824AE8B96FB41DB1E1F057717C66B671C5691FE21DEBB6B7300BD4032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736365, "uuid": "c3c52d1f-b13b-4448-94be-051ab65d3257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736365, "uuid": "87f24e4e-e543-424e-9305-6c483ffaa50e", "value": "12288:2TP3ygG8xQui240D1Bo59nUfozq1C+4TmOhGA+jVsbdNZEuniKc9m:mPCDJKD1Btb0RLh5bdNZ+P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736365, "uuid": "d3fbc909-8542-4d65-ad8c-10c4d167b75c", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736365, "uuid": "f54d9f11-b279-44c0-b644-3d680c23e8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736365, "uuid": "d2600c51-3c72-4620-970f-2fe7de999de6", "value": "COTIZACION.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01141103-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782718057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718057, "uuid": "ddb4dd4e-ce6f-4473-afeb-7f18a3a0416b", "comment": "Malware payload", "value": "f42eeedffd3101f60d60e1e14866d561", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718057, "uuid": "9dcb87e2-a183-4783-a0fc-9ea9eaad7d24", "comment": "Malware payload", "value": "06bb5f282a222f454503e08d9ae77340b936db6b15800af0550b13f87af1e432", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718057, "uuid": "3eb6348c-cfc1-4f87-80c9-d0ea5761f83b", "comment": "Malware payload", "value": "c3ef06e7d8d83efa6db194f2def5d5b01e2eae65", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718057, "uuid": "30bb8972-801c-4811-aaed-a5d549308243", "comment": "Malware payload", "value": "673ab1fad2f1870c3125419601ff115d68033e5658dc289581f16eefca758fd1cd1909c5f8622aa81f1a7974211a2f72", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718057, "uuid": "d6539359-804c-4755-87cc-32649f8497fb", "value": "T1CB5193C675A137313CF758A7337D582831D1906D6C87EE9A94E8F8F889DDE0939801EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718057, "uuid": "f9a907bb-36ca-4cbb-a8c9-2fed6af4fd8c", "value": "24:IjGR0VhIhOMJxxA8CP0GVEGF7H1GACdMNINk0li9Ok8V9FVyct7J:bycqCGFE9FiULRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718057, "uuid": "a72acc6d-fe48-4395-b549-7d8443ad9f2f", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718057, "uuid": "83588d69-0040-403c-a3be-427586b3f4fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718057, "uuid": "6f0c3b66-cb84-4100-8522-ec36d223e88c", "value": "06bb5f282a222f454503e08d9ae77340b936db6b15800af0550b13f87af1e432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9f0f8f-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737508, "uuid": "31e34e3c-5d69-4f0b-b99c-8df6433ee16b", "comment": "Malware payload (Mirai)", "value": "f51026732f20e3fb5bcc7ea0b0b7c9e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737508, "uuid": "cbfc29cc-387f-465a-b674-393c269405cc", "comment": "Malware payload (Mirai)", "value": "06fc8c79a6bd19b128f47154f85622f9906e6cff2c640ba9f0a45cfba9767286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737508, "uuid": "b978eec2-3f95-47b6-91ae-2df317ac25dd", "comment": "Malware payload (Mirai)", "value": "19962fe1598d81a9b61c7ba45666d31c45f1f64f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737508, "uuid": "2557776a-1a8e-4a68-87c6-c36604b8ac2f", "comment": "Malware payload (Mirai)", "value": "eb698596b5cd5109bc65e758b3125adff2ed7495f869c535a9e3ba9649f6168afa1000dda0f292ac2065d9cd8a63f27e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737508, "uuid": "9c119049-47d2-493f-a8db-7a644e272abe", "value": "T1CA736DC9E983D4F6EC130A351136BB3799B3E53E2169DB83C3A8A525DC125C2DA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737508, "uuid": "fb44f702-994a-4177-be18-54e23ff8b920", "value": "1536:9sXS6v5iR8mBos1LNxVZW9Z3J8h3qaccSJZ4:9sXX4BBokLNx+9zs3sZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737508, "uuid": "fef406db-d59d-4dc1-b3fc-b0b661a2c2b3", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737508, "uuid": "0f10a636-ca79-4fd8-b078-97bb42393fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737508, "uuid": "1db524d0-850a-4ed8-8ef1-aeddc1d3c8a8", "value": "ab22ceeebcbc149dda959f5c29571f40a06830871a9be9a2f8a76a3e106c37b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b39cfa-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782755428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755428, "uuid": "9d0b1455-17ec-46d5-b173-b3f711add9b6", "comment": "Malware payload", "value": "5f0b2d10df2021306cd260a89fda125b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755428, "uuid": "03fbb2b8-c6cb-4230-b500-92ea441260d9", "comment": "Malware payload", "value": "071b29d176e2b5e1d8634ec20b08dd386964b38dbc7ab08540c73a85fc365791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755428, "uuid": "580479b4-7e32-4383-8d80-20f016aabcc7", "comment": "Malware payload", "value": "21a251de448a84ff37378f9755cc54d15075d9a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755428, "uuid": "65e7e3e3-5853-48c7-98c8-97c9ed59ec7d", "comment": "Malware payload", "value": "3909e4361b88d2750289ec4a2619f867a4335c87e88a4e08b05c89d86d6990dfc0c84cc141cbb823a514d1967bac98ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755428, "uuid": "2e5db2b2-dbe1-4451-aab9-0b699e7e2d32", "value": "T1C9B3F85DF4508B27C6D0223AF69A424833B35B65FFEE370599186F3837E36199A3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755428, "uuid": "79332a25-bc00-4924-8ea8-145c44503eaa", "value": "1536:5T1YUg+orjRLtvjOmE6KPyPn4ADu+FSym2iWv1+FsM3H7zU0PyiU3IrU8ACISu0g:5s/4vjAnu+QrCvgXUPidFKpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755428, "uuid": "c304615f-dbb0-43d8-b46a-6501f7ebe92d", "value": 112616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755428, "uuid": "a5d17284-a357-44b6-aeb9-753e68b3877d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755428, "uuid": "487263a5-efd3-4412-8932-449460f01e72", "value": "SecuriteInfo.com.ELF.Agent-EJE.71398862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7c72a6-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765103, "uuid": "7cd9b3d3-6f94-41cd-88b4-60ad9990a182", "comment": "Malware payload (Mirai)", "value": "20137e0ff0c353922c835e204e46f4d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765103, "uuid": "dc9792b4-e6a3-4095-bf2b-71d26038cb16", "comment": "Malware payload (Mirai)", "value": "07218e876e68d79f36154c814a0520f626d7f5e759c737b90228795adce43fc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765103, "uuid": "19a366d3-0a64-46a2-a763-77c824260027", "comment": "Malware payload (Mirai)", "value": "15d9a7f98bbd6c1b78d7b54824db1063537f0497", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765103, "uuid": "4a0424c0-4478-4a6b-a63f-c86ea92b4c9d", "comment": "Malware payload (Mirai)", "value": "7127d594d4842d1db89890e7765bc7be3d8c0a1791f366ded822a0d3518b5aac420f149dbe1147b7205fb3d94bf216b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765103, "uuid": "7276266f-3f3f-4ddb-b2c2-90a13f1d5280", "value": "T1E554D60A7B519EF7D46FCD3305F98B0128CCB45335642B7A3670EA5DB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765103, "uuid": "12a797f1-0591-4786-8f5c-3f47093cb387", "value": "3072:FXb0Lv2FoAuINHwtxiN2asQdzD7WPtOrTqBkE7S6Vj9pnGqpLmT4Zm:F8vTAuINHwhEJDx/JEFjBJmTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765103, "uuid": "8f62befa-d1bf-411d-93c7-d8d942bbbd80", "value": 305548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765103, "uuid": "352382f5-4611-42a7-bd12-9d3b160bcb5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765103, "uuid": "336f2129-055a-490b-a2ff-8e2d9d4f48ec", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342fb013-7372-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782706976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706976, "uuid": "38ca92be-df79-475a-b906-b9c38bf144c9", "comment": "Malware payload", "value": "3e10ed795cd53130b94c1b40e9353003", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706976, "uuid": "659b9498-1c46-435c-8764-876255fa0a8c", "comment": "Malware payload", "value": "0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706976, "uuid": "c6e4d9ce-fedd-43ab-a810-a7ce73dd8bef", "comment": "Malware payload", "value": "105882ea5c74b45ed2ceec9d23eda328167f4038", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706976, "uuid": "7a4ef41f-d749-4e32-a10e-b313525a3009", "comment": "Malware payload", "value": "f0215512235be4bf9cf4382cf1ca58023223a1af23698ae7b665f60754379ec262d96c90acdcf5b804f3d2ba90039262", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706976, "uuid": "33a8c614-cdaf-460a-8e5d-8aee72829648", "value": "T1F166F103E1E78EF4D12BE67D46629373AD2470885E33B11C29A5F36A5FE0938A15DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706976, "uuid": "1ce89070-7c71-4e78-979d-0e43862f7ca7", "value": "ffb5c52510590f5ee669e71a9d4cdf52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706976, "uuid": "696b2cd7-c796-49e6-b504-a52b9199a523", "value": "98304:sUvL6+huAt1wTFHNxZemyphjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInEf:sY11kdemyujpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782706976, "uuid": "f28c4125-bbe2-462c-a2de-fe668ac9fc21", "value": 6547456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782706976, "uuid": "006b4bf7-c4be-46ee-9117-a0e31be8d905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706976, "uuid": "b012a690-5feb-40b9-9f54-f106adeb8492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ff98fb-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700084, "uuid": "dc3fd988-c77b-4781-8402-da8e67b2697a", "comment": "Malware payload", "value": "531979e027ea25a5e76b8d678d4bab78", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700084, "uuid": "ebdfe7a9-316e-4cc6-9171-2bfcf7e71057", "comment": "Malware payload", "value": "084d71df66c97d5f949f28a18ab81be412244bc831f6d52d5fbcdf0d42fc7b40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700084, "uuid": "07c8629d-ee7e-4125-8f43-08e48f58dd99", "comment": "Malware payload", "value": "604275af73a1f2054fd0fabb162fa9319f2ec2d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700084, "uuid": "060f7412-2dfa-435e-aee5-86d953366864", "comment": "Malware payload", "value": "55a1ea3fc720f4fc8bb3dd71be480d829a84ece8de1787639531d2aa3e6325dd9351fba1cffe53082bd80f523e58a97a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700084, "uuid": "39f11699-2afd-41ec-8b1e-7947aa100073", "value": "T1C1A27D09B71297A403E65BF5213508ECFBAAAE4D7CCE706D839437500AAA70FEA75474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700084, "uuid": "ac4b4ca2-bb92-4919-80a6-8a9e13563482", "value": "384:uIs7jj9NShBrO+YbLk9YFyn+3vwuHA5prlWYiyoyjn76T2NUKFclWM1c5hYtFK:uIs7FNS3O+YbiaynixCXjnw2NNylWM1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700084, "uuid": "597258d2-9d06-49d2-a517-8da069807de3", "value": 23248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700084, "uuid": "d0008013-8f1b-4277-bb86-95a4ced60afa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700084, "uuid": "59291dfc-04d6-48e9-bb76-4bdd802fc085", "value": "inotu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab55395f-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1782758715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758715, "uuid": "89727a09-af8d-471a-9fcf-44719c24fb40", "comment": "Malware payload (AveMariaRAT)", "value": "b1341da78ca16f4d04cb56d05c63a821", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758715, "uuid": "2eab5f77-71cb-4dca-8c55-4121e26cde74", "comment": "Malware payload (AveMariaRAT)", "value": "0911748a95f6a362d1ed8d6fcd1a7889167520cdd506522658d84a69c9a088ab", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758715, "uuid": "0be3ff77-ebee-4a8f-ab5c-d1c50e514b0a", "comment": "Malware payload (AveMariaRAT)", "value": "2a43e2b7dea9979a803c300b5b9638f5d4ae2f64", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758715, "uuid": "5c8f8ca9-b22a-43b4-a6f1-a22881c2e084", "comment": "Malware payload (AveMariaRAT)", "value": "d05a4f449f0c46c4861480ae78f73b0b5b6af23b7c381d8f010fcf865ce8568998932ffa3c38308151b33def5f6abf08", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758715, "uuid": "4e6f991c-66ba-40bc-b965-fc5d18efd313", "value": "T191845B88329079AEC857CD3185641D7896136E6A3F1AF243AC277DBB773F5C79E100A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758715, "uuid": "29b31600-4a3a-481c-8786-972954416ce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758715, "uuid": "c1a0577f-86d7-4ab6-b566-73487b56bf6d", "value": "6144:XqPyB0HQijAYq/iFEH0Qhdx+IHU13euzEORqwBjpC/t1SZPp97mSHCX3YhOI:6Cn/XUodYIHUrTBs/t1SZPp97mSHCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758715, "uuid": "20b4b231-a886-47c5-86e9-9ebe357a31c1", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758715, "uuid": "7c31991b-45bd-41f2-bdfc-b6fbf331e9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758715, "uuid": "2bc5e944-1314-4842-a01b-af8f6c4199bc", "value": "B1341DA78CA16F4D04CB56D05C63A821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd6078-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775371, "uuid": "35e3b10e-1ac9-4be9-b001-b0f6633fa4cd", "comment": "Malware payload (Mirai)", "value": "6310c4425cc824212c955d100c8da450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775371, "uuid": "06708ac5-880b-43ff-aaba-e31ef21a61a2", "comment": "Malware payload (Mirai)", "value": "0967707c5308593cb114117b5489c6f004f656810ab0616680d9c7c1277c661c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775371, "uuid": "ccf3fd3d-5ad5-43a6-8d21-f6f27a022a07", "comment": "Malware payload (Mirai)", "value": "40b79180daacd73c32fdce349717ebc02d1b4902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775371, "uuid": "48a428af-94b9-4901-b92c-40142cd2f2e4", "comment": "Malware payload (Mirai)", "value": "f86e9b8437830ef285d456a72d565b3e7c18b4e22896805b3d1a072935f2a72dcb06a71dbe5e8e191841adc8fc1178ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775371, "uuid": "e7cf3bd9-e806-4a49-b10c-9647b446350e", "value": "T1D4E3C50EAE259F3DFB99C33447B78E26965833C727E1C585D2ACE6011E6024E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775371, "uuid": "a499c69a-15fb-4c70-99d7-b2ad8bdb1ff5", "value": "3072:3DVu6G8ZtEwUGbZipObqR2q88JQXU4B3jHfWwLAH5yUtHSppNpKwdEc35XZWAypR:TVu6G8ZtEwUGbZipObqR2q88JQXU4B34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775371, "uuid": "2b655cd9-a250-4584-a3a4-17703320b0ea", "value": 148800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775371, "uuid": "bf8810a8-6df8-46cf-b254-6fa039f3607f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775371, "uuid": "dc1ab9ab-cd91-4f9b-b725-572984ecc9b0", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b11ba45-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713054, "uuid": "1c729ebe-9275-4ce8-a087-62ca47ef1d45", "comment": "Malware payload (Mirai)", "value": "9e87e63e2d0b205768afbc0b82126abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713054, "uuid": "438c19d5-b1a0-4ddc-8838-590219781bf6", "comment": "Malware payload (Mirai)", "value": "0998a444bd04a05fb3229e7a2eb0cc6baecd3373f666f0d44883261c41437159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713054, "uuid": "6e010fd4-d306-4950-afe8-1a030bd459fe", "comment": "Malware payload (Mirai)", "value": "52d54487b31854223a810616e02652a8ee127417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713054, "uuid": "6618ac6c-7799-47f3-a6d5-b9f4cdfed92f", "comment": "Malware payload (Mirai)", "value": "ffb150f7b6745bd8849f3784df54910479383cc0cfe26a31b695795d2b7856fe733dc8d216e011e900f86367d519eece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713054, "uuid": "e1af5220-80ac-418b-974d-2d4eb64ad81d", "value": "T173832A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713054, "uuid": "554d5f12-9f0b-4ee7-894e-7298e05d44ce", "value": "1536:quKG91h4YgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTTxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713054, "uuid": "40f2ca68-5790-4f2b-9268-19f41f3d28ba", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713054, "uuid": "3373aa35-f558-42f9-b304-f59530d3b43b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713054, "uuid": "1cf59acb-abcc-41b3-bc9c-424d995ba0d4", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ff8a38-73cc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782745771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782745771, "uuid": "b19fa6c7-0c7c-426f-9742-4c688e2aca3b", "comment": "Malware payload", "value": "13cc3bda0189a216b10fd5d1c9bf2be9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782745771, "uuid": "c7dd9d06-61f6-487c-a3c6-df127d8efbe7", "comment": "Malware payload", "value": "09ef9844a513935d4dc54a35f6151aadb1228d683f421af121902c6adb7990c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782745771, "uuid": "a64f1f04-1f88-4dbc-a262-90a871ff48b4", "comment": "Malware payload", "value": "2a7fd54ea966df50d2c2c3ff0de15ebae785f872", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782745771, "uuid": "e4fa7029-a31a-4bb1-bcde-f88dbd657fe4", "comment": "Malware payload", "value": "a5a63991ed1f9bf63f7155bccbb62297da754b7eb36d8b7569ca2fd35af8664869977d77e6ab4a14efca3c6837d4f828", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782745771, "uuid": "02305728-9a0e-45ec-a29a-c3bfccb9ec2a", "value": "T1E5E612236349563DE02986751672E21F683F6E706DE28D0DD6FC347CFBB6270293A642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782745771, "uuid": "c67e46c2-0262-4439-8717-0c9a5cbe1a35", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782745771, "uuid": "2a234560-546f-4e32-b652-286e987cbff4", "value": "196608:kxzsrXpqJbs5dOjBnVFw6bio/C1x+HCXtwvhr:kxAdlGbw63/4Levh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782745771, "uuid": "c8d90115-dd0d-40be-9c09-f8d3f6c54d84", "value": 14399903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782745771, "uuid": "39a6ded1-f7ad-405f-a287-120a67421d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782745771, "uuid": "5d719856-0926-4b80-af7a-cfb80a84a611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc08366-73bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782738560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738560, "uuid": "c718748c-56ce-4592-90fd-95207c30ab4d", "comment": "Malware payload", "value": "037bd459c8b8b9e3815b32a145c84a7c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738560, "uuid": "2fafee1f-18d4-40ff-b8d6-c83907d26193", "comment": "Malware payload", "value": "0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738560, "uuid": "30bfc429-e37d-48c2-a878-897b436297f0", "comment": "Malware payload", "value": "8baf1a60b11ca0f1aa46d887cfc88e353319907e", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738560, "uuid": "af256026-8f87-4b55-a5ae-9a9c72154230", "comment": "Malware payload", "value": "1d121d78b864e16739b423b343fcce25d4363faf795da745b74eff76b32d976725670aa5ce373a3a83d4bdcdff863501", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738560, "uuid": "a85e76fe-7ea5-4012-9ff5-23aa9c960d84", "value": "T1756633E53C24284BD1D9327566D404B39320BC4E4AD47E62BC7B7B6D6532BC68A6B3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738560, "uuid": "09b4bd1a-7b87-4bc8-94ce-bd6f074e8db7", "value": "196608:MgrSSDlI196toOSfy+S9Y+UxW2VVpNFjmqFZb0:MoSSDWT6OOGy/9SH1FyMb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782738560, "uuid": "2ad66ff4-7a9f-41aa-b2cb-e3152e0ac507", "value": 6961104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782738560, "uuid": "5633b12d-050d-4361-bcbb-cf861021d282", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738560, "uuid": "ad500ac3-1adf-4680-ac39-68c4a494d411", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04290770-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718062, "uuid": "ff430f20-7de7-49c5-a588-b3536302cc24", "comment": "Malware payload (Mirai)", "value": "e345b81e00d017f969fb39795829aac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718062, "uuid": "00df3c03-1ad0-4aa2-bdf4-303a2a081b5e", "comment": "Malware payload (Mirai)", "value": "0a9e7aac7014a3ec0a78b3885fec5d2163193a66a864633e688a20881d290b23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718062, "uuid": "704f47c3-008a-4310-9996-11a2d037120e", "comment": "Malware payload (Mirai)", "value": "39c841544e532183cb6c04c607576112e1f5d877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718062, "uuid": "cd63d42b-fbba-4e9b-b13d-3fd3933c51a2", "comment": "Malware payload (Mirai)", "value": "27060bda9ce45f174b84dcd55ee839a9b65eee2bd69a424bbd3e6dc0da8c9e8bf77b5e5ccccbc38c5361b4764ba6be4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718062, "uuid": "cf701da4-ed79-4d59-b947-0ef710946a7e", "value": "T1A213F286E76436F64D5D1C7C86EE8076661CA092B28D97C8B20E844875CEDCBEC1723F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718062, "uuid": "afc20b2c-1772-4401-9fa2-f7eea07b29cd", "value": "768:Ax4mYFF++yYR7GkHOKv3BhUrRXkbA96j8NTRJyRnMGNttUnEd6TAAo5abbgBxMNK:AxhYLDyS7OK/UabY6jOUn9YEd6TAAo5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718062, "uuid": "2a047007-062b-41d9-9b6e-e4a02e94200c", "value": 44556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718062, "uuid": "da3fc1e4-107c-4043-8405-8f2cafde390a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718062, "uuid": "6ed30a06-d224-47f4-b734-5f543a819072", "value": "0a9e7aac7014a3ec0a78b3885fec5d2163193a66a864633e688a20881d290b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732d3d3e-736f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782705793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782705793, "uuid": "b28c047b-dd69-4519-a268-ffe738d48895", "comment": "Malware payload (RemcosRAT)", "value": "10a1adb5a55d92f28d41295b9da01876", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782705793, "uuid": "27b606b8-705a-4210-9a10-5c9aba7b1b55", "comment": "Malware payload (RemcosRAT)", "value": "0b7ab84a7c3ff996e4e546558b91dfd289cb3888f45127f14b2f26a2090dba61", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782705793, "uuid": "96dfa90a-93df-474f-8b37-8a47f07339db", "comment": "Malware payload (RemcosRAT)", "value": "75a7ebc449cad9063d953f3094f394daca48e23c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782705793, "uuid": "8a5b36d3-ae62-4050-91bc-823a6ca4cb95", "comment": "Malware payload (RemcosRAT)", "value": "98f4bcc3a57dc55422f7ef01ad7d492451e51ef8313bc741a72ec6d63e6aaaf64f93d564d039a29e98f62bfb5c82ad6e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782705793, "uuid": "bffaaf48-3c6a-4592-8f52-3b3eb0ceb055", "value": "T1C5436C60DDD5073A1E431BEDBE405A30C1B88678563A80ECF9ED371E551266CEB3F2A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782705793, "uuid": "c46b1b4c-11d6-4e9a-8b52-8bd28e21a110", "value": "768:CC7TMjXa/Ph2hqi54p60DYCWgsxUeqSYdhtZyp08JpEm96unQmDopOw+xmyN2FeA:J/oaP4Kg0DYDY560apWYpN2FePjCu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782705793, "uuid": "88200b0e-86f7-41fd-a80b-a485822848fb", "value": 60400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782705793, "uuid": "aaebcce0-25d6-4cb5-be6b-e730e3f48107", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782705793, "uuid": "70d229c1-3240-4bba-a919-756ec93b7dbc", "value": "Hematemetic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5470e43-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737687, "uuid": "cd5af8d9-90b5-4a0e-8238-9ddb149f30b0", "comment": "Malware payload (Mirai)", "value": "2abaa392607ce414c3c0ac06c7f39f71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737687, "uuid": "e58ca51f-92d1-4ed6-ae58-2d442bd091d7", "comment": "Malware payload (Mirai)", "value": "0bb5f4ead4969e06720243a6cfb9be2a6aaad2de11d506f04929bd937081b939", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737687, "uuid": "89fd6715-4f46-483a-b147-a5b2df31158d", "comment": "Malware payload (Mirai)", "value": "911674f00e07f19c0561c9d3bc5d66bb9a1a0afe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737687, "uuid": "4721a7d7-4734-40b6-b17b-33f55da0a50c", "comment": "Malware payload (Mirai)", "value": "08788d30d15a004683aa18a82177bd0cbbf20842acc026e3168d93ecee4b6ccddb6eaf299c0f9b4c13ef3cba57a7a502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737687, "uuid": "cf31d5d4-8c62-4615-aa4a-7b4ccf89d269", "value": "T10803E096E94CA507D25DD6FA52AC798B4514D58CF2A0C55F7BC0307C2E1AF4B3A282E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737687, "uuid": "8bd498cb-50cd-451c-b777-ce0877f4ec6c", "value": "768:iI6Iak2KV6lFoUiSRq/4OrE2i3MZQQNDeTvSPKRtAnbcuyD7UHQRji:x9akHcvZzq/NrFivQSTvgkAnouy8Hym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737687, "uuid": "503977f0-4245-493d-ad5c-918acef835f0", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737687, "uuid": "eb619b80-e543-4835-93a1-110ff99efec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737687, "uuid": "54f41751-6148-4a97-a64f-04bb686ad589", "value": "0bb5f4ead4969e06720243a6cfb9be2a6aaad2de11d506f04929bd937081b939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a74fdcc-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775276, "uuid": "73edd870-0396-469c-99d0-828b9499edb1", "comment": "Malware payload (Mirai)", "value": "f7a6d425e99629401dfb4df121c701b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775276, "uuid": "3ebdbd4e-8392-4094-9516-f280911f1595", "comment": "Malware payload (Mirai)", "value": "0c2d1a47fbc1c6b887afa8dcd96e2becc7b52154295ded81d3d1ea259fd29910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775276, "uuid": "7e0cf37d-e9a1-40ba-96ea-f367747a4f4c", "comment": "Malware payload (Mirai)", "value": "edc6fdd2fbdf73a9f345cf4d0491a2ea24f3ab35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775276, "uuid": "abe5c1d5-9d5b-40ff-b01d-1d307f122053", "comment": "Malware payload (Mirai)", "value": "7e5a0ee1a3fcd6a1b7ad4e14fe9766fabc0d16480fee48baff1c709cc911f100695dd37ee809802d16535545b2b5e10c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775276, "uuid": "c274f46f-6029-48ce-a272-513b35e833be", "value": "T18C23F1B761DBC93CE031F5B2117AAEC5D1B5642972CA27EE084EA23B1DFED503550790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775276, "uuid": "dc23e487-473c-4438-a1bd-7ede51db1d0f", "value": "768:QEkTK0B51hHgK6PW8aaCTqs60mgLDlW856fc4b79+nKjJXJFmJHiwMsKMJ+9AhA7:XeBRHgKManTqsXtlfH4FiKjhm5lMsp+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775276, "uuid": "95648417-60f3-4602-8eca-d965eca6d686", "value": 48400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775276, "uuid": "13584609-daaa-4c5e-9a7d-ceeb4b4b3559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775276, "uuid": "82c99c4a-4044-4fbe-b8ea-9703a4f04a6a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01be9d87-73b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782735668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735668, "uuid": "87b8f91c-ae30-4692-bcaf-a5887a87ed16", "comment": "Malware payload (Mirai)", "value": "96cd0d5f5fe57353674f3923e126666d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735668, "uuid": "c4ea7739-bf49-47df-8fa9-d0a4742636b9", "comment": "Malware payload (Mirai)", "value": "0d9d4704bf1b7574a2bd1a973c28f84f2c9e864b3b615db8a05e5246994db83e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735668, "uuid": "3cdde3b3-3766-439f-a20a-4002163c3db7", "comment": "Malware payload (Mirai)", "value": "479c4af6235fb590cfae6441bfdefd4aff856273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735668, "uuid": "2be0a5d0-c563-41b2-b34c-cbbfd95a8926", "comment": "Malware payload (Mirai)", "value": "e613fb7bedfd4556dd7ffcf6ff9997b4906dee48e4726bdf30cfb94012e97a940cf3f240bc7de2bccba00cb22ca5e7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735668, "uuid": "49c1f149-ae35-414b-bf38-8525e35bdecb", "value": "T1ACC3280FAA2C0B47C5975AF03E3727E087ADFA6611E453C1A41AFEC147718B62126FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735668, "uuid": "656024af-5967-4e69-99ac-25d48ef13550", "value": "3072:yyJu2u6emCG+GcRsI8m4hQTWk2aN/nuD0H5h8p/pN:yyJuhdyQ5TN/a0H5hiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782735668, "uuid": "9e2156a5-a563-445a-9abf-03d90d354ec5", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782735668, "uuid": "44fa8dab-4841-4f87-a481-07c61cd81bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735668, "uuid": "02ee6745-8160-46da-b506-4c534061316a", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4d0777-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773459, "uuid": "d95bc174-bc12-463d-a2c3-e43c58e07d63", "comment": "Malware payload (Mirai)", "value": "a6c2690b8736aec358e41b9d30d05ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773459, "uuid": "cb2ca74a-908c-47a7-a629-a9647dc93151", "comment": "Malware payload (Mirai)", "value": "0e3e1d057c4a85536e64c991f239b51961da39fe677bf72014bc96ffa0d21bbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773459, "uuid": "12b8ae37-88f1-4441-a2b9-121ce0215248", "comment": "Malware payload (Mirai)", "value": "89d1df638589ae628e3d13ba77f0f4a68e66ea7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773459, "uuid": "b9cc213d-c34c-47f2-bc2a-1cbbc95bdcd6", "comment": "Malware payload (Mirai)", "value": "4a864de9ea5a33cb9e2cac03f791ab02b494b9cc6becbe28c1bb2ecbf50ca778fb32e3d1de05feb917ee17bc8e8c75ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773459, "uuid": "3a4ee0ca-8feb-42ce-a6de-0cb0965d6295", "value": "T16FE32C46E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773459, "uuid": "fd82a481-8079-4674-b610-044a93c6b864", "value": "3072:U+UgVWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UzIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773459, "uuid": "fb9e0fc4-ba0d-4e38-b765-4c012dc5761e", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773459, "uuid": "b9da2925-2607-4410-adf6-bdf32ed7120a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773459, "uuid": "f4e99291-6ac3-49d0-b5fe-13556ecc6bf6", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a17f31-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773260, "uuid": "9cb5de0e-d334-4175-99ff-ffeeb4eb60ba", "comment": "Malware payload (Mirai)", "value": "d206f2fdb9aa531b3bb7c0bba5dd94ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773260, "uuid": "045e7caa-2960-4a73-b8bc-64ef0d03af5f", "comment": "Malware payload (Mirai)", "value": "0e421c747565b1a178ac468d65a55d4e998589ae91181ff134a9473c9b653de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773260, "uuid": "4926d94e-7d7c-4838-94b7-61e647ee754c", "comment": "Malware payload (Mirai)", "value": "6587877cd2d7920a206d7937d1d2bc124954f2d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773260, "uuid": "22f8da67-8c30-4f0e-82df-78f7b5fa6efe", "comment": "Malware payload (Mirai)", "value": "9d95844890c5f7f41da9ee2a056df22a5ce2476de99690ec08452ea7663b31211ff4032efc41f9c297b3d9285dfd3942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773260, "uuid": "06b1cc47-1321-4e53-af37-c0dac7e4d5be", "value": "T197A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773260, "uuid": "1f884846-a5c0-430f-8ca1-756f5e03527d", "value": "1536:yk8NZJjWAavP4cve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBavgzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773260, "uuid": "8ace13a3-43fb-473e-83f3-778985b633e5", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773260, "uuid": "9594d727-b396-4a08-81c2-80b7cefb2d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773260, "uuid": "6eba9402-bd78-497d-835c-c6c78a2f4523", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653687f6-740a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782772342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772342, "uuid": "82aa44b4-df4b-4c7d-a5e4-21bedd7e3e39", "comment": "Malware payload", "value": "81065487899b565f1d8cd282b8d80782", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772342, "uuid": "9e629d28-2e6b-4210-b131-332e8f8580ef", "comment": "Malware payload", "value": "0f451ed1c1a487f63d83620e0e3fd650e8d982098864c7c96013f3213204a2bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772342, "uuid": "c28ba6cc-5005-4d86-beb4-4a85e44c8de7", "comment": "Malware payload", "value": "268c98b0d984ed402fbfd53f403229323613e16d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772342, "uuid": "56b95b27-5ebb-4811-a315-5206d0f3f489", "comment": "Malware payload", "value": "e523e97cc605f4e0fff435a52412761408f7eadb6a8de869c9057a9c83fcfcd453b241be32d3b1acaaf2baac63f81449", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772342, "uuid": "3b3e83ee-d632-41fc-8e13-e9cc219c0ec4", "value": "T1BC415CDD80766A926DEDDC11707BD96160A3DD926CA84B0AADDC7DB1CC89E00701AF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772342, "uuid": "f29c9965-7de0-46b3-abc7-1e60576e7eb9", "value": "48:9XJ2pXJ/XJhXJ8XJfpXJ2XJKXJPXJYXJ1XJuQwXJ0XJtXJDBXJ6i8XJ4XJw:9XUXZXfXOXXXUXoXFXaXnXMQwX2XjXTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782772342, "uuid": "5aebfebf-cdb2-48e0-8482-9c6e313de5ec", "value": 2027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782772342, "uuid": "728e0b4e-0b61-4e1d-bf2d-406578d496bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772342, "uuid": "11a03e4b-38ce-4ce9-85a4-69500b6b5cbc", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270cbda4-7387-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782715973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715973, "uuid": "9b46e94e-398e-46aa-a2d6-235b9363e3fb", "comment": "Malware payload", "value": "733a6c25627ce54ebe2ffec74486a42e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715973, "uuid": "9a724ecb-396c-4117-b42a-5ffe7f45941e", "comment": "Malware payload", "value": "0f5cec99c7f2baa151631d3501782d08ec8d0e193440f94205a44c872b095a84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715973, "uuid": "0e20b049-9b82-465e-b0af-62443edb5a61", "comment": "Malware payload", "value": "ee30cd4964a0ac1576626419e3da0f7a9a390d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715973, "uuid": "1a4b0308-925c-4001-92ca-9ba7b4be1a3b", "comment": "Malware payload", "value": "3379b9c5148befe09a3c2eb046d0dd53380f6ef4a3dd37b896ae87709cc3af3c9cd4e3958f696ce8f153b9ab57a6ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715973, "uuid": "aa98ff6c-9e43-4c2b-b0c0-f2521812488c", "value": "T159358E47E29581FCC4AEC074D7679A33FA62B88E0534756B07E087602E6BF50AF1DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715973, "uuid": "1f503c06-6d63-4c23-ac15-0ee9ca813b86", "value": "dcbc238ca73a32ebe9e395395b45e7bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715973, "uuid": "c2bd9290-38c8-42f4-a9c1-e5c05720818b", "value": "24576:Bcg1G+bfN9U4pxqfv2xK5f5+KOVIH06iy9FMZq:BcPv4pxq32xmkJIU6isd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782715973, "uuid": "04dfebea-a502-44f5-8be7-6bbd60153b09", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782715973, "uuid": "8d9b71bc-0f10-46f9-b9a7-72fa0a801a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715973, "uuid": "55a9fe38-b371-4e3a-8ab9-728cd8cfe1a3", "value": "wabmail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9799a1d8-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765125, "uuid": "d67ac091-0dd4-48c3-8b2f-b469d80b4a83", "comment": "Malware payload (Mirai)", "value": "d5dfff23a6d0f0859ffd21aa1ddd1322", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765125, "uuid": "4d20362b-a166-44f6-9dca-a0232432633c", "comment": "Malware payload (Mirai)", "value": "0feeed10b06703064481b0b3a4fb034b0441456c43ef7f4b1a50395123fd77f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765125, "uuid": "90918b62-a7fb-4dc0-8915-e5384e8a610c", "comment": "Malware payload (Mirai)", "value": "a17431050e2f80cfd43771722511f584162ce7fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765125, "uuid": "fc53fab9-232f-4ccc-b749-d9137d3f7565", "comment": "Malware payload (Mirai)", "value": "6f86dc93edbe9fbfe7a6df3e7c81e59ce1689132e7420f1e9c8bf39b2a054050bbe952db693777eed42418a045b0eac5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765125, "uuid": "f5f19156-945f-47f8-b990-e988a3afb282", "value": "T10C343B87F900DF7EFC0BA2B244674915B130BF6A18620677F116BCE6EE290D5192BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765125, "uuid": "6bc327ca-48a5-41a8-97da-69c99e0aeb07", "value": "3072:jok67E0PBfRgTijXVeJXbLRJT8yXsRJSCP6CTNrOirgmAZAVdjbiLL3eAJlpOS1:jok4TPBX+5+yXYJSCRTlr5AZdLuuOS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765125, "uuid": "ff393759-128c-4bc5-80f9-cc74d3e2fca3", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765125, "uuid": "0636ee1e-97ad-4907-b363-b0ac789c7b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765125, "uuid": "0354406e-d16f-4661-b501-d86e643697cc", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ab39a1-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782758706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758706, "uuid": "cc7d4648-6a92-4de3-a75c-8812c4ddd20b", "comment": "Malware payload (njrat)", "value": "2f61cb4b14e0cf839a4a823eceea88e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758706, "uuid": "2ea65812-8794-4274-a678-f115e7550a82", "comment": "Malware payload (njrat)", "value": "1086e2ec8e9274e1639f14084f27d3b47e606c37ccc2a1e4976db6633ef797d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758706, "uuid": "317d8852-4b21-4f6a-ba0f-0a62e74e7a11", "comment": "Malware payload (njrat)", "value": "5bc1696dec9c0d82be4ff8910a7ae7c217e9e40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758706, "uuid": "1d32f0c9-8c69-4b8e-b345-a60a4487068a", "comment": "Malware payload (njrat)", "value": "aefeddd30ea3a529328804360e337c5a6545577365a0b82bd319f281b5929c1b09ea0790ae72bd7ac531aafd30bb5c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758706, "uuid": "5040fefd-b1ae-4b14-bf75-47221867eea7", "value": "T1CA032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758706, "uuid": "f76e3d94-6b84-438e-bce5-385c13ebc1c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758706, "uuid": "5f75fa58-ac68-4be8-9aea-c17f023c8176", "value": "384:VaDvkit2Zf5W9cTYXyc/lPM20zHFmnPuskrAF+rMRTyN/0L+EcoinblneHQM3ep4:kDqjjTYic/lkEPuprM+rMRa8NuSRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758706, "uuid": "55fd858e-c36b-4efa-a4d6-59adfcbfad2d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758706, "uuid": "8a9c5af7-686f-41ac-bbba-64e40a756904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758706, "uuid": "f59efb1a-e6ac-4189-a85d-91f39a294a44", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c76253c-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756811, "uuid": "6435b481-7428-4c66-aa04-3bf9958b8231", "comment": "Malware payload (Mirai)", "value": "2fa1a732d20502e1cf8f43dbe2ef5210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756811, "uuid": "a6635ff4-7b0e-4271-b901-db0c3dbcfd02", "comment": "Malware payload (Mirai)", "value": "1121a5e2224993b73254150d972bc6acef214758005cade5ba2b1cdeb2a757bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756811, "uuid": "3e62a0bb-8047-4c1b-bc6e-63b0d21c2e76", "comment": "Malware payload (Mirai)", "value": "f964290d564a44617b184def4c5548161bec0f85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756811, "uuid": "007d3811-9ce8-4162-8fbb-241f16b5edde", "comment": "Malware payload (Mirai)", "value": "6da910d36ffe86d40071d689e54ce3431de3634e150e9bd13c12fea5d28b7aa792d7c71e799d690ee09ecb67cb15949d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756811, "uuid": "c0dc0748-bed1-413f-b4a3-900d2cf0b25f", "value": "T182B35C22F4391A27C4E0A47B12F75762B2F657D911A8860E7D720E8EFF256D02607FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756811, "uuid": "ff628576-0617-4244-9f30-49d76af3ec4b", "value": "1536:kZ152buLv78bt/QxBU4slWE5ICPXboHnvtfMUtvDKSymq0nkKtNIYm530QmZXtj8:0oViUr5wtxKuqgTjIYOkRXl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756811, "uuid": "c5dec271-e53c-49e6-a6de-4827ca112936", "value": 116368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756811, "uuid": "4be6f91d-2b78-4a20-a9b3-3242c78a296f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756811, "uuid": "35b6f7ab-22fb-48a2-aab0-e397e430acaa", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033ac33d-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718061, "uuid": "6a8194c2-c3d1-473d-91b7-ff8c42046896", "comment": "Malware payload (Mirai)", "value": "a9ac1cf1082c945b14e18a9e20442716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718061, "uuid": "511475cd-928e-43eb-aa93-5c2d560aa461", "comment": "Malware payload (Mirai)", "value": "113adcdfc3cce4648aef6cabf2bb7631a7b5e53fbc505f887a0bf2b130b88aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718061, "uuid": "4b0baaea-746c-457e-95bd-9b8b6ac24bba", "comment": "Malware payload (Mirai)", "value": "752d5c158d15693f97165e22a4690748514a6a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718061, "uuid": "7b2f5731-6b85-40a9-8d47-31a16be37f66", "comment": "Malware payload (Mirai)", "value": "79873b9fbb9b9b937c76fd1aa6900eac629b745a5003d4313dccda0f672d47395308917ddbe5e2b74fe9fdfa9de108ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718061, "uuid": "8320d09c-82f6-4815-95de-1991fcd0cf94", "value": "T17C13E1EAB27BFAAECC7E45BA2F1D2A04E5F82C5FF0972A7BC4E4917504585D11E38041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718061, "uuid": "172e2d88-4d2f-4e6e-be6f-3d6d5af329d2", "value": "768:qhIfHyA8J99JgD00/1kx+T6RbexRe1xEct0y/Dh1JdJ8oLlZImAR4dlBx05A:qhIvyJ7gq+Tqbe+hyCrLImAR2jAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718061, "uuid": "49220d29-b645-4751-904f-80bfe2421390", "value": 42020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718061, "uuid": "071a9910-f465-4fce-af9e-6f4e0edcbb56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718061, "uuid": "160039ae-f4e6-4e7e-b845-884212b1555b", "value": "113adcdfc3cce4648aef6cabf2bb7631a7b5e53fbc505f887a0bf2b130b88aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5c873a-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737700, "uuid": "6c9782b8-d745-4057-b288-6c349d2b1a6b", "comment": "Malware payload (Mirai)", "value": "655aa9bafbb016dfa29c487c3c2d3e8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737700, "uuid": "d8361aed-92b5-4525-9aca-b22cb7d8e28a", "comment": "Malware payload (Mirai)", "value": "117e90254cfc0002c50ab57367db41da32579c5fd0992be5b02f70f29c4e94c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737700, "uuid": "330d95fc-6cdd-4f16-aac3-4d5c2a6c6ef3", "comment": "Malware payload (Mirai)", "value": "bf739b038e19ce835c939dd51e0ee21b6c84f3ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737700, "uuid": "d40ecf67-6ec3-4332-96fe-ada9c5aeb50d", "comment": "Malware payload (Mirai)", "value": "d55c0e6bf356fe5019e23d84826f4d1a7953cbb77b85400deb9e16b2b0b5262112b4f547aebc97c1014aa511a2a04615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737700, "uuid": "ca588404-db99-4ee8-8d6e-2f93a7e83cc0", "value": "T1999328C6B401DC7DF80FDABB4463290EB631E3611A935B26675BBD53AC321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737700, "uuid": "4b017bbd-7612-43b4-98a3-75474491b0dc", "value": "1536:8Q1JsIO7ywe3iyRBzPQRIIeNan6MiBQ9FW6O35Pb8bMThLbKrTsX5vH1M0zfTnVZ:8UBDQLeNan6Cw6O3BfuAvVMqYuaB/wt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737700, "uuid": "b5f07551-d437-4523-b8a0-51c31409c268", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737700, "uuid": "79d74a08-734c-4de8-be5f-65167cfea52e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737700, "uuid": "c3c72ad9-0115-4391-b4f4-6e28c0c3a0a1", "value": "117e90254cfc0002c50ab57367db41da32579c5fd0992be5b02f70f29c4e94c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0f3bd4-738a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782717379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717379, "uuid": "d58ab7e8-dec2-4a5b-852a-429490204313", "comment": "Malware payload", "value": "c61c692377422956f3419895cd264cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717379, "uuid": "f3c6fb8b-b062-402e-9bc7-a494cd68e091", "comment": "Malware payload", "value": "11b731432946b1a88f1bee309734c1a9c9df1ae62d5a070ca8355db46bdf93a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717379, "uuid": "c1495bc8-ff6d-4ab2-8fc0-fbbbb9c035f2", "comment": "Malware payload", "value": "6a9552698ee803d60c5be4f6bdae9a6185ad97c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717379, "uuid": "e8bf5ff9-6eea-42c2-9983-f8e07541930a", "comment": "Malware payload", "value": "9267d1072912b67a5c0d8878d448248d4b8a880918d8bb42571109b470aa3c9ca7754e1e3467748c584732d6c2d7091c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717379, "uuid": "2f23f70b-5e34-49dd-b710-a6ce38f419a8", "value": "T14337018F79F2A3E6EC51687C18F9222DFF1B2C40072446D3AA8958795E39DD78CB4316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717379, "uuid": "b8f2bee8-8810-4af7-b730-82753808ec04", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717379, "uuid": "68655be5-6eb3-4da2-958f-5aa82bd551eb", "value": "393216:BUDQDiRdoCqGskI9ujzoA3fQdg8YZfmOrm4u4uJoIuGv/uzieRmRc3iYsO8aoov:BUDQDQL1IGN3YdgVlTanXsieRJgO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717379, "uuid": "75f11bd6-14de-4586-a4ed-522e0bfc0ad3", "value": 22489600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717379, "uuid": "42199bfc-77ce-433e-bdf6-24594651de3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717379, "uuid": "8d3359dc-e2a2-4d7e-8f4b-432745dfe91c", "value": "Travel Leaders' European Travel Planning Advice.pptx.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15c0ec3-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698623, "uuid": "514ac38d-9fed-4ec1-86e3-2e8636813bc1", "comment": "Malware payload", "value": "c024347e31bca5d742ea962fcde5df03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698623, "uuid": "912ce40a-9d8e-41a6-8e6f-1f305bfa9b50", "comment": "Malware payload", "value": "124e12c0588583abe92f259c9012cbd7555305f9664be62820a1260b7b9afd8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698623, "uuid": "6198979e-cb8a-4caa-825e-a59d551f0a89", "comment": "Malware payload", "value": "a21b5ec45e65debe718a9271fea04b6ce05951c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698623, "uuid": "07978b54-a83a-4abd-b171-6c07e5bbc124", "comment": "Malware payload", "value": "1c059183a0478ec6fa50b3cb4d6de9008d142b56a6f9075b078ad2aad3c427a3699762f7eb9d5c00666687d64f15d186", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698623, "uuid": "971322ed-be80-4df0-838b-f40fb42f238f", "value": "T192E26C48F3966B9581FB55D010252CF4C6BD9DE896C869BC5BEC30681E5ECAFF0320B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698623, "uuid": "fee5f0af-71f9-4b55-967d-fe1a09067837", "value": "768:sC7xyYr+gtyAkahaDNXzoBVkILO/BU+4RumqKwsZbt0MNF0t8:ssxD+QaDBokMIKwsUMHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698623, "uuid": "b7aed8ef-4c74-4bbb-a65b-458d2a9241c4", "value": 33298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698623, "uuid": "3ab3b3c4-c43b-4bff-ab90-cc84fbb5e1d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698623, "uuid": "e6d12ebf-9065-4507-a621-7e2127fa0a2a", "value": "ufino(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82bd6dd-7392-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782720968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720968, "uuid": "18f8bc5e-cc2f-4bab-8e90-4717eb4e2e3a", "comment": "Malware payload (Mirai)", "value": "5d15e86e1849ddbac9db84a05307ef2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720968, "uuid": "5638bedc-9239-49c6-bb78-fcaf7bf27255", "comment": "Malware payload (Mirai)", "value": "1384db3bf2d4e17a814b198607c736ddcf0b0f1763fed72b232e0480643624d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720968, "uuid": "abc621c4-1b50-4ddd-a253-33aa151df04f", "comment": "Malware payload (Mirai)", "value": "6c252419ea66e765a11c0b4979f4e6f9b4bd7ed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720968, "uuid": "0d0d36d7-215f-4d05-858c-3a8a32b27eb6", "comment": "Malware payload (Mirai)", "value": "6639fa5c66d752d41a46f9c8beffac5c31ff62562ecf9681a2a232ec5785a6a808af39bfd1923822c2ca76c799f2eceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720968, "uuid": "6871a5de-06c5-4ca8-b574-f04ac3939509", "value": "T18B931952BA41CD73D40310F216E39F664632FA3F5867DA86E7A42CB1EE191C19721BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720968, "uuid": "4630c437-ce37-4422-944b-c714a0a5cf22", "value": "1536:wTM0+/4eIPQgYVgHHxkJI+lvRpmwAdHZqC46MJY4se6I5hIpOBhEgz:wTK/rIUgnW++l+JZgjJLh5hIp4hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782720968, "uuid": "332c29c9-03d2-4ab0-ae59-b98e34b6855c", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782720968, "uuid": "086c91d3-fa0e-4f15-986e-8782bb27f352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720968, "uuid": "79ce6875-6604-4c64-b12c-c627685dfbb4", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb75fcc8-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760487, "uuid": "4742e4b3-e78f-4d0f-b60a-7480f99cb78d", "comment": "Malware payload (Mirai)", "value": "00add22cd096e113fbab5f559df3e2a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760487, "uuid": "232feaa8-7adf-446e-beab-b4148f068cc6", "comment": "Malware payload (Mirai)", "value": "161c3e1ab9c293dc6a4ff24337706cc1c287a5f90eb9f2cbbdf5b3a61c1804b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760487, "uuid": "77fe869f-0530-4723-8d3d-4e4f4ce5bab7", "comment": "Malware payload (Mirai)", "value": "bf445f9a968036b9786f9edf8c376bdbad85f4d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760487, "uuid": "ec6ea746-adff-4180-b437-fe4782bbfc5b", "comment": "Malware payload (Mirai)", "value": "926179b5a49b480a0b641bef626c9c552c356433b52d99d41ac5452d42419eb7509da7a37bb6c1b801d2b3ff534ddfe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760487, "uuid": "3bd81810-c1e1-4d11-ba03-dbbb9e7b11eb", "value": "T1AF831882F8828B2AC6D017BAE6AF658E3361B3E5D2DF7117DD204B11378510F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760487, "uuid": "434ddee5-0aee-4c78-8904-9b9690cd18ab", "value": "1536:rTx20qyV2Y73aC80nExbngqXmI7pOYfAWKYd/ZE5iQEIQ4:rTY0qyV2i3atccGeZE9Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760487, "uuid": "f91e8b78-a2b3-44f2-b087-d681a568088c", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760487, "uuid": "a16347ff-e747-46bf-9e80-8d7938650f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760487, "uuid": "c4558598-1615-443f-964c-cdc973553b1a", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec6f64-739d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782725434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725434, "uuid": "01044465-ce41-4a5d-ac5f-7afc80ceafb9", "comment": "Malware payload (AgentTesla)", "value": "936aa8884eeddfe280f156b548cf3a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725434, "uuid": "7a89718e-a35a-4068-9934-6319ebc55431", "comment": "Malware payload (AgentTesla)", "value": "16240f7360bd3a4f85ad890be3ef3aac629f5391dde3be25a5354adc93616264", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725434, "uuid": "bb534aa3-25c5-4923-96c4-f6239c396a53", "comment": "Malware payload (AgentTesla)", "value": "44be54bca5b780e802288d920f6d1a8af9858575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725434, "uuid": "c46e5cfe-42a8-4d41-88ea-37aeb88ccae2", "comment": "Malware payload (AgentTesla)", "value": "904bedbe94a494a17a3b3b69e2afb611d0966a949a2de393be7fba87111cc6272ede6c09d974b9787c40d664630c76ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725434, "uuid": "ce6bde49-d685-433b-a49b-c0191dcfc908", "value": "T18BC4F151B749D122CC1729B49523E1D2CE27BC798EA0C973B1DABB0F26374E26D71329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725434, "uuid": "f359cf18-15e1-4da4-b6ad-079efae5c7d6", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725434, "uuid": "8fbdeb6b-c0cd-4184-bb0c-309259151551", "value": "6144:iT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Z8PVJ+4qEnaunyZLikbNsBSiQOMzDzO:iTsAXF28crKGbJZ8LLnykkGgiwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782725434, "uuid": "48050c66-a040-4e1e-87df-3f6f5aed041f", "value": 550304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782725434, "uuid": "081255e1-605b-4288-9b12-019b7694975e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725434, "uuid": "9a147b96-9cb0-43d2-a9f0-16134eb9b7f4", "value": "xeroxscanner29062026001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff785dc-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782758723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758723, "uuid": "1098f3fa-2de8-43e1-949c-230c9ec40c26", "comment": "Malware payload (RatonRAT)", "value": "4db7b73a3650b98b99aa282bf1e16cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758723, "uuid": "5840ae23-394c-4f71-be1f-a2be1e2b7186", "comment": "Malware payload (RatonRAT)", "value": "16aa5e9cd33302fb4bba5f5fe61b9dcef4e6e1a777098985eca17e5a6f075234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758723, "uuid": "21410896-5411-49e5-9158-936127436a5c", "comment": "Malware payload (RatonRAT)", "value": "3f762a0e0d991b182032fcf13cb94c75a61fe47b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758723, "uuid": "3db73fe8-7e96-44df-b25a-beeb415379e7", "comment": "Malware payload (RatonRAT)", "value": "202178e5af03230ed396294d3aaffbec2bc2cae0c54dc64e2b8637d007f93d6aa330d2e2317a10d6dea37305228564bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758723, "uuid": "9815d15c-1f5f-4996-ac38-ffa28cdd2210", "value": "T13D935B0473FC6929E3FF8FBE69B510500F72B9279E31D64D498A60980A71B86DE10F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758723, "uuid": "b275b6ca-b0e4-4665-a061-10bf148072e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758723, "uuid": "37f75fcd-c721-4725-89bd-5fcae5fad021", "value": "1536:LgW7MnDxVdabTsqa4tsi546K1lmnRySboKp+C0C82v1R:LgWYnFVWAX4tny6U0wSboKz0CvvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758723, "uuid": "28f0120e-1b1c-4c17-b663-33a241dcc1f2", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758723, "uuid": "71bc83a1-dde2-4182-bda0-54ba65b69db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758723, "uuid": "4e45bf8b-ea85-4bc0-a995-8b8be1c4b07d", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2feb91-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760358, "uuid": "9f3ee81e-8865-4b92-a18d-73d2bfbd78f3", "comment": "Malware payload (Mirai)", "value": "e826b9401ad6d258a22b2431ab744426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760358, "uuid": "36a11f9f-2cb7-4916-826e-e8d3c8c9173b", "comment": "Malware payload (Mirai)", "value": "16b70ea2d8e30680b097872fb5f04171baecd65414bf322135fae57036f8201c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760358, "uuid": "56433e83-5eed-46e7-8e62-b2bef08ffe9b", "comment": "Malware payload (Mirai)", "value": "916e3db733ee0f643054620d5ae96ce22e8fcb23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760358, "uuid": "68c3407e-9ecc-4c93-8113-4871d1735637", "comment": "Malware payload (Mirai)", "value": "24051894ee7b5d0f81b91114550c40492192c545c14cd290feda7654acade8982559396b1b5eba12a4e0c58dcd0011cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760358, "uuid": "c712e555-7236-4b35-bab4-bc552539a263", "value": "T15D23F14650F80665E58730388ABE2E535B08D34EBD99CEF3EF14447F994EB212A1865E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760358, "uuid": "b5f41d40-93da-45a1-9dd3-d0b9efd69cf1", "value": "768:FMxa+KqsLlPQ/XihSaUkhL/zbpZDEQK8od5E91hKBwssp+B5ErOut7nbcuyD7UHi:0a1qsS/XiBUkh7zbjDBY5E91hKqlIXyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760358, "uuid": "0af6394c-4773-4135-867b-e31a2fbd84d8", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760358, "uuid": "49f27e34-0c47-4fdd-b9fd-267287ccace5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760358, "uuid": "563e2eef-e978-413e-b40f-20faa523d2c0", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41d51b2-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742060, "uuid": "095d60e8-4bd5-42ee-b323-c9e015ac729f", "comment": "Malware payload (Mirai)", "value": "bda80a60d6606e1f9cb53af025a0f160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742060, "uuid": "d532d594-e52e-43c7-91d7-4d3a1859ce35", "comment": "Malware payload (Mirai)", "value": "17877a7e4c4e39df1f939953cec6fe18e55388cbd9cdc6549a31aa50d5dccb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742060, "uuid": "8c557a92-0c13-49a3-9533-48aec14e6169", "comment": "Malware payload (Mirai)", "value": "aafc9bac07b8208acc2daa62d4065d3a2205abef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742060, "uuid": "e93bc312-ca4a-4868-a6d8-2af2120cd59c", "comment": "Malware payload (Mirai)", "value": "035d112ed89dc1a22a20045172c63d3bfe12f39bf6dc398c84f35b31d67ab0e706896633a9a90a42c62096bec57837e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742060, "uuid": "ef0240c4-7cf2-4d51-82c8-0867ecd15158", "value": "T112047D8CB74DE706C19097FBDD6B0623633138427B4ADB627918622AFDD27EC5C16316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742060, "uuid": "79118d92-0dcd-451e-a03b-4715e78f1b0c", "value": "3072:sI6da80iXbUbkfojLaxKc7IAetqCQWMk/z/vTFfYpHsi:sI6E80iTEqKc7ytvQWMe77RY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742060, "uuid": "354a4429-28b0-489b-862b-12310b312614", "value": 179528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742060, "uuid": "8f30d8f9-31a7-4e5a-8b88-ca7541078d34", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742060, "uuid": "caf1feb5-1199-4343-a382-094327cda08b", "value": "aarch64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4035c8e0-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "29b62cbc-b48e-4638-aac1-1a47f18a5c8c", "comment": "Malware payload (Mirai)", "value": "7e5a305e8f35468767c95f2401f94cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "b50a8297-d5ca-40dc-8df2-4a68f32ee873", "comment": "Malware payload (Mirai)", "value": "17dc47b4c71ce24634749fd2c0d45ade5856b63c16b3c74f58163503a58653e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "7780fe0f-a5ac-4825-b745-a021b5b831b7", "comment": "Malware payload (Mirai)", "value": "0db39fac6493e0612de9600e43b54526120499e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "84484e32-cd35-4d40-9a2d-f3c62e508e25", "comment": "Malware payload (Mirai)", "value": "19f979cd7dfcb031fb880d803738932679643893416c6ab14b18423b5e5f81524873b69278ee49406652a0fe297add4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "c1b0cf83-ad29-4602-96e6-f586a2d182dd", "value": "T1F023F140ACEC8B54E17C213568EDBEC79435E696E0E9C7B755C12092CE1BFA23918FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "5fadcc62-6adc-4867-b8a4-bbf134208f4d", "value": "768:UH302H9PQXXBwA6BnEQUDNiH/X0Q5cu3HlaL3FJwpK00pdOLnbcuyD7UHQRjj:q302H9PQr6REQGdQXSFKeunouy8Hyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756818, "uuid": "9b438a7d-0505-4f8e-a97a-805ebb2ac426", "value": 47148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756818, "uuid": "37465daf-e2f4-4504-be3a-75745f456739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "347f772b-a14d-4b94-a96e-ce9ea8317a5f", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb809f89-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737697, "uuid": "ab748d33-463a-404e-8a03-516ad6725e57", "comment": "Malware payload (Mirai)", "value": "f386e7a2fab1ca2ef7ed5210976efc29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737697, "uuid": "8e5d0df3-ab7b-4b50-b30a-a6b11a221136", "comment": "Malware payload (Mirai)", "value": "1884e88c748a2cf8fe53bb7817c07dca47378ad21daebcb978479ea30401f0dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737697, "uuid": "97da15b3-b8c4-4c87-9636-38e806729690", "comment": "Malware payload (Mirai)", "value": "f2440c5fc496029872c81cc269818431a80ebadb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737697, "uuid": "7407c9c4-3dd9-4027-81bd-654cba60667b", "comment": "Malware payload (Mirai)", "value": "12be88e42f2953dafed51c27da294c105062b39cc88ff839165797fb6394147af8dbe9daa8c97fd71aeb3c8bba3410c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737697, "uuid": "26ae013a-559b-4ff6-9143-3f085e7862ea", "value": "T16303D050F5892A63F2BAE6234D43C6D47BB46B8BB3E1DD8876A2FF0521009361E45AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737697, "uuid": "32fa0036-33f4-443f-a003-b4054895139d", "value": "768:rbL+tO8KycVQAs5dRkPOkaZValHW8rEqgGXcve8/j9cdnnIMVHmS64uVcqgw09P:fL+eBZs5rkPOkMarDhIr9sn3HmS64u+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737697, "uuid": "d227a875-57f4-4f33-bee7-a57916f0a1a3", "value": 40172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737697, "uuid": "e418bd55-4b45-45e8-a49c-79e375b4fcfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737697, "uuid": "91fa0659-0ae1-4bb5-b75e-2b518b1708c8", "value": "1884e88c748a2cf8fe53bb7817c07dca47378ad21daebcb978479ea30401f0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968bdd73-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765123, "uuid": "d464c1ff-8466-49b3-b249-6113bda113c6", "comment": "Malware payload (Mirai)", "value": "51fb865a7fb8cb5ca301a01d1e441edc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765123, "uuid": "c4436b45-cd27-4b7f-8cf7-c98dcdae68ae", "comment": "Malware payload (Mirai)", "value": "189143c2dd0fd08631532adf134f24648f58b28f717383e44daf5281f21567c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765123, "uuid": "65e41241-f548-4a24-b576-fb170bf9b5c1", "comment": "Malware payload (Mirai)", "value": "4a381df0a4dcf5e36513c57bf0fb97911c2e3200", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765123, "uuid": "5904263e-4aa7-4b40-9fae-2179f782dc4d", "comment": "Malware payload (Mirai)", "value": "1e5858fd7e5d607518c0c71ead812b745348bbcf56e4c71998c6f5dc0c560647a9a838e16ebfa0d41af66c7fd399a244", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765123, "uuid": "1098834f-5e31-4d53-bbe2-5efcf060071e", "value": "T170141B45BA43CEF3E41304F111B3A63E0B31ED3A4836D595FB68AEB4D627AC1661536C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765123, "uuid": "868106f2-7fe4-4daf-9c17-2eea3e27de6b", "value": "3072:7UoWnAKKOqtxpPO2Zhs6LF56giO0a6iSU9WgelpQi:7XWz1GxpRhDaQbWgsQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765123, "uuid": "cf7b343b-fd63-4f7d-82f5-843b2c9d0836", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765123, "uuid": "ceebfae0-7b96-4878-9c59-185334602e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765123, "uuid": "f20df1ab-d7dd-41a8-9c88-4bbfb0aa5260", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcebaf22-7385-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782715473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715473, "uuid": "2d00de69-e787-485e-be4b-96015418aa4d", "comment": "Malware payload (Mirai)", "value": "7221ca00cd365f753f89ab10d7228f44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715473, "uuid": "27a47b1f-8e9a-4e16-b87d-7e6564201720", "comment": "Malware payload (Mirai)", "value": "1955ce730b08001a4f19ea8f38c4d20609dbccdba0bd7f8e0691f48a480c0ec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715473, "uuid": "6c47380c-219a-42f8-ae8c-21c739899757", "comment": "Malware payload (Mirai)", "value": "a8a401acde6d26a2409204e0be3ccd006671b8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715473, "uuid": "bd207542-4bd2-47a6-81fc-5cf1322306a2", "comment": "Malware payload (Mirai)", "value": "75e9fd4a77e6abc71d7e9e47526d31bad56f7550e51147063672f6fe91adb6615a02241f605f2a70a65bfc183b8e1bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715473, "uuid": "abea3289-dfae-4a83-a457-15f12681b41f", "value": "T1AD241B42B841CA16C5C522B6FA6E428D33173B78D2DE7212CD246F547BCADEB0DB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715473, "uuid": "3d6be9c9-0c5e-4267-ac3f-bacf2b7d3657", "value": "3072:0KFnj2ZGme3gLXvqKHrQ1S+UfxaIoJHZoTOuck9CuFi57iWWeaS:bF2YrAj2ufxaIAoTx9lS7iWWeaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782715473, "uuid": "96932dbf-0418-4f55-9a2c-f16f1c0cbf74", "value": 212820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782715473, "uuid": "968a1160-2040-447b-9270-768850807277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715473, "uuid": "abebebd0-2c93-4b8f-8138-fe942d03c115", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a9df9f-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712798, "uuid": "218bd7ac-044c-4b61-a097-8d0ee7949fff", "comment": "Malware payload (Mirai)", "value": "12a3ac97a544a7fe1d26ae8372a8653a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712798, "uuid": "7173f6b9-7c61-4482-9b5c-002b151e0418", "comment": "Malware payload (Mirai)", "value": "1957781d3d4f6f74007ed370b81c14f22254598b55a0e335afa07d677042449b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712798, "uuid": "b1ba1cca-3fff-48ae-94c2-5453bfc8869d", "comment": "Malware payload (Mirai)", "value": "bffa033c7694a3239587a00e680eba773d5635c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712798, "uuid": "2e4a9319-f745-47a2-8487-d23e5e85dd16", "comment": "Malware payload (Mirai)", "value": "6a0e9299ef5f35751935c97e33834bbf47da9e5b4087d8ec91537319008cb9898a881c5544b6cabe625cb75229d41246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712798, "uuid": "636be1be-8f22-4e7d-be57-583c51ec42bd", "value": "T113463A9CF81DE5A2DDD8BA747BA141867639BC45AF81C7232600B76D75F33D88F22260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712798, "uuid": "ef6fd66e-5a0b-467c-8bcc-eda3ef23f7ad", "value": "49152:qnuqtyQfieR6bqHSKQDKhFzfC5EgUey4unqi4H:Iuqt3fi+6bQSKQDKhFzf4EPqiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712798, "uuid": "5096cb6c-6017-4c39-80b7-2c9d80c911b3", "value": 5374273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712798, "uuid": "07f3252d-b5ce-44eb-aeaa-8246066aa4e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712798, "uuid": "61322def-f046-426d-98dd-5db3573cecd7", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed053825-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769563, "uuid": "67d22ee9-087e-4316-b837-7e1345f7a82f", "comment": "Malware payload (Mirai)", "value": "36ba54a625dc10e4249b562ed0424e76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769563, "uuid": "a5772b9c-d8a7-47c6-b8b1-c562ff01a5a0", "comment": "Malware payload (Mirai)", "value": "199d875dfc1a9c87784fd681d123ba4afc31360eec72d8ef10d4428cd4f17525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769563, "uuid": "7ac4ffc3-6e05-465f-bcf2-3ce8b41bc4d2", "comment": "Malware payload (Mirai)", "value": "5124bc0ea42a38c380afcd8415b6570223909201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769563, "uuid": "691fbda8-269c-439e-9aca-a2a24ab2dee8", "comment": "Malware payload (Mirai)", "value": "d269db9e7def7d089b96da28a365b4ce45bd700470a2e502a9691489caa510cd05cae8323d462bd213253643a09ac5ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769563, "uuid": "d5d7d9f5-df5c-483d-a53c-bd6b713cfb80", "value": "T1EFB3AE36E81968F4C07E8574E5A4BE790BA3F48052931EF716E6C6B65047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769563, "uuid": "2f8dd7cc-e0d3-4916-b396-a2333d37fb7c", "value": "1536:t/juy48gLDajwrmRZ2QproWQi1YKiC7p74Pe/9C/6otd1pHF:t7uy7eaMYZProWQi1fiQye/93efpHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769563, "uuid": "8f3f732c-ada3-46c4-a23e-2026340ed201", "value": 109776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769563, "uuid": "d8b2ab44-d85c-4d0f-a6b9-5fb1d2842bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769563, "uuid": "7b67b584-e6f1-4226-ae1f-839a5b233ac0", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcf66d3-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737510, "uuid": "44e1847a-3c48-4c02-ac2a-1fd9ec872251", "comment": "Malware payload (Mirai)", "value": "42199c9b7d08f1ff3eea25b55bbb9db2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737510, "uuid": "8d0fc206-89be-43e7-8e6b-ae42781758a0", "comment": "Malware payload (Mirai)", "value": "1a25aba4e3cac79fcd5fa1b964e338c0185fb5e10dc33417b5d465d85ec636de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737510, "uuid": "b4e614b9-7178-4944-b573-919ee0d7a543", "comment": "Malware payload (Mirai)", "value": "f1af34fc6c803485a26632efbd6eebce9725514e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737510, "uuid": "f508aa23-212a-495c-9d57-9384dd1fc48c", "comment": "Malware payload (Mirai)", "value": "8b4a590cc89d5b395ca344a4f4a29cbd2a77e9b9c856091b6dfb161d943ec21bd91ebcfeccc4b4236a9879cec54073d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737510, "uuid": "aea550d0-a7cc-4e8f-a4f7-477104babe47", "value": "T122B3E84E6F319F7DFBA8C23447B39A21975823D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737510, "uuid": "76cabc16-b2ff-484e-ac2c-4fa10c5d83c9", "value": "1536:GEkWi8LiZECcpHOWWJDmmn5Pd1Oe4qPrs9j4Zinyk7+TeVedVPneQBZN0x1km:U4i50poFfP49j4+7+Te0dVPZ0x1km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737510, "uuid": "cc3aa45b-b73e-4131-9865-4f2f8769eb10", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737510, "uuid": "1580b8b0-b35a-4b89-8c77-11dfe5685896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737510, "uuid": "9db9f140-13d4-4a6a-b1e6-3d1d40641ae8", "value": "328113d3f5eafd5b825a7866fbc40225763184a9121b64ba9bf3bf3a7ebb9666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0295a25f-73b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782733951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733951, "uuid": "1697b9b1-967d-4bf5-bfae-1874a548a48f", "comment": "Malware payload", "value": "61f0699fc4960a465665bb049b73c266", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733951, "uuid": "37982ebd-cf10-4c02-aded-78bf281a37a9", "comment": "Malware payload", "value": "1a80fe00158319a0fc5e5f36549cb3b00ec4024ef65085fd238a74870d562240", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733951, "uuid": "a0ca5fd9-59e0-4dc4-b873-f38ec1c97fd4", "comment": "Malware payload", "value": "553134b790fdd1a2395900d25f4daa156de56d1d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733951, "uuid": "41f7c4ab-4455-4bd7-81d2-865a4fdde11c", "comment": "Malware payload", "value": "6686d30244d20559e8a71eb6da84e6ee448aaf048ad1e01f943a7bf15a263860fde0ba9dce64613ec11e161980a7bf7c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733951, "uuid": "2834f281-1222-42ff-8cc8-3f1824e468db", "value": "T19CD7D007F09D8935C8DAE238FB2E4672B330784986E6A557760C92147F9F5F00BA67E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733951, "uuid": "084ed63a-af7a-440a-90e1-ca3afeba1d53", "value": "393216:LaocIxNNnugwOfeAwn5kn9lePwzrg/O3CEaDRp98IjyfFFYmFZq12+oS:LaoXPbwOfLlePwzrj36+IQFYmFZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782733951, "uuid": "581553a1-29cf-40e2-89b1-9e14db642855", "value": 60348228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782733951, "uuid": "85ce9bcd-3649-4d1c-952b-97af4c91a16e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733951, "uuid": "c8185eff-0ae4-4443-a7a7-bff8b797b343", "value": "telefon-sorgu-v1.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ba6cb9-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765142, "uuid": "2be3bfc8-763b-4f77-8478-d855016372e2", "comment": "Malware payload (Mirai)", "value": "265c0f67eceb529ef26c96f11002ef54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765142, "uuid": "2606c00a-a155-4211-a011-98dc15cb9542", "comment": "Malware payload (Mirai)", "value": "1a91f6c9109a1e3c0a7dee758c861869c08ee339283f8150dde01e85c1137128", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765142, "uuid": "d55ff4c3-0028-4bad-9eb9-b4a587b62c05", "comment": "Malware payload (Mirai)", "value": "403b606f40aa1af536ca1272ee71a8e467691b0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765142, "uuid": "f5ccfd5f-844c-46de-b66f-9082b1e5d0f0", "comment": "Malware payload (Mirai)", "value": "625f36f97ed9e87a1346145fdc0d9b8829c435b2442fb19202319c5b53f17e016e8644e087527269a1b13b836ce4ad7c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765142, "uuid": "59e73562-76b1-43e7-9701-c91dd0830ff7", "value": "T1DF241990BA59EC32C05E1D3667FBDB593B0369D14EA2D104C460EBCCFB875C0AB9857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765142, "uuid": "d2057ddb-32ae-4f86-9c93-4b2b31d7a513", "value": "3072:vwObuMZb0rZcN411Pqaam+PCeuqueHndIiVU43P8HSj37nGhM2q:Lt29cW7qa3+UquenVU4kyjCM2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765142, "uuid": "0ca9d9bd-a690-4dbf-a3a0-6dbc746c6b3b", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765142, "uuid": "375f2e51-11a4-409f-bc98-bbe62386dace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765142, "uuid": "dde1a9da-b00a-4e34-ae4a-505675dfbfaa", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4198dfad-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782736204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736204, "uuid": "d68a6f1a-54b7-4255-9141-ddfc289b5c52", "comment": "Malware payload (Mirai)", "value": "13c5176097a2289b119133301d347861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736204, "uuid": "8ec50ea9-db6d-4006-880a-f03d6e332782", "comment": "Malware payload (Mirai)", "value": "1aa751023aafa78ee800c9cbd797dfac488d8cfc12ce4e48b221d063babacc3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736204, "uuid": "c6fe2ae7-fccd-48a2-b5fa-60a826e65b3e", "comment": "Malware payload (Mirai)", "value": "8f48603ea295c0637ff4f823b0323be36a403cc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736204, "uuid": "e39ed5bb-4c59-480a-b2aa-dc74e0ad5742", "comment": "Malware payload (Mirai)", "value": "4e57829cbd8143b862e59725b50802cab57f2ebdbf15bd6fa0fbe927dbfb2467cfadb17a1b6b5f126c7d86701bd473f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736204, "uuid": "9aa5d093-ce17-437c-b72c-5955b9f2e9a2", "value": "T13CF38526BBA19EB7D80FCD3302A9490220CCA59A52E92B6FB6B0C55CF34BD4F45D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736204, "uuid": "07854927-afb2-4e92-b3d9-28ceb1f14b20", "value": "1536:h3X2ToQA7m8mLlUtS+8tYUEKKIayTiamUYHxZQ/uZlam81ZJrC1ZpkHPLi0oN5hv:h3nOK7IaNam1xUuZq1ZULeHgN5hMpPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736204, "uuid": "4a57f740-c4b8-4bb4-9bc4-fe065334e082", "value": 172700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736204, "uuid": "e625fd1c-8a6d-4193-9b35-8a8cfa54b152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736204, "uuid": "e2fd4a44-4457-40ac-9c87-2f0bc8761685", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3028c822-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737463, "uuid": "2624169c-4f5d-4174-b438-4313c16a6d79", "comment": "Malware payload", "value": "49e98082656cd8ea27dfc18516c22f7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737463, "uuid": "a987ce55-ffa7-4aeb-a341-698624630622", "comment": "Malware payload", "value": "1ba2320271fdd6712cab73cb4c374ba637a847aca80d9ba126fcbeeb46e8c020", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737463, "uuid": "e47aa81d-dacb-407d-8862-255f7fb0b6bc", "comment": "Malware payload", "value": "89885751697edc212135b39fe0cf5ab1557f082c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737463, "uuid": "78705b00-bfe9-4832-a66a-91949b5b281e", "comment": "Malware payload", "value": "4bf150a1ad089b6478879dfde4b3e49376a39f424ed663773ca0115eb374b881a111b86b7a7ee3813e3bfd4d5dbdf10c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737463, "uuid": "ec56bbf1-31ef-4b9a-9a5d-d4699cfb79c8", "value": "T1F3D02B9E6153B3874812156039C525D2264C22F6A47B41A82DC6D48B969853ECDDA9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737463, "uuid": "c8086210-5ffa-4ab8-bb66-937f8a6b69b4", "value": "6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRCw4yjEcXaoD:J0+oxBeRmR9etdzRxGezHt4yjEma+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737463, "uuid": "86761e0d-e39d-4cba-b5d4-8717ef7d6bf1", "value": 275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737463, "uuid": "227cdb17-e7c3-41df-aac6-c8e4e1d3fd01", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737463, "uuid": "4c8af0eb-e178-4081-9c5e-40455b7d2a15", "value": "1ba2320271fdd6712cab73cb4c374ba637a847aca80d9ba126fcbeeb46e8c020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce5770a-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701139, "uuid": "9206b752-28f5-42e9-9cf4-35d33bbbb74b", "comment": "Malware payload", "value": "a2c4f3a9b585703868d45f6baabc42bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701139, "uuid": "4d48cd50-f5f3-4f95-ad6c-a1625ddb635c", "comment": "Malware payload", "value": "1bb3430faf14bd1f26412987dd4e173eecef2b685bc1d086d1b79fa19e0efb50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701139, "uuid": "d36ca3db-8bda-47c5-a494-e176de745843", "comment": "Malware payload", "value": "fffed6d96eb5264307c61e440606629fe4eb17fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701139, "uuid": "3ef7ddeb-fc6e-4e44-93af-18545f66f9f4", "comment": "Malware payload", "value": "fae75f8eca2da886893d9a5f778116123c45425060434cb079c2aa7c40543e11e1f8804a6e61cb6da5dc89732a74623f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701139, "uuid": "356997d3-406c-4aa6-80b7-e7e5a9e2ec25", "value": "T10EA28DCCF38441A657C4AF67303649C9A848AABF64C8DB7F8F00791A3C658F489B6479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701139, "uuid": "411251e6-89e7-42f6-81e7-15c80d00dfdf", "value": "384:uIsCrhbPWqG8NAbQWFx0iKPt0s+JtFUAwynEzKQK33IyOB0R1h5otvfULU2NZFc4:uIsCrhbPWqG8gQ+0RPGVJvRFNIyOWRHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701139, "uuid": "d7091179-6856-4b5b-9bde-d7636900d8c2", "value": 23108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701139, "uuid": "037df602-3453-4f8c-aea6-7350edabd917", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701139, "uuid": "6d5c8bd0-d868-4583-907c-a4764aafdf1f", "value": "inotu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e5b415-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737693, "uuid": "295ecafb-f964-46ff-89d3-81ba16f1e786", "comment": "Malware payload (Mirai)", "value": "0b0d147e77f99489168e916bec34bad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737693, "uuid": "a1834dbb-379f-415d-abb2-20b80a7a860b", "comment": "Malware payload (Mirai)", "value": "1ca93bf656595a5a1b6c44f55f17d2c838d914009df64e4f66af406bd9eac33e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737693, "uuid": "c2f68f20-b9a0-4b79-9f28-934360501be2", "comment": "Malware payload (Mirai)", "value": "3bb99dccbf95f1a0276af5059e0f95f45dfae6c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737693, "uuid": "0c379e39-c5f4-4bbf-a408-4c4253dbe9e2", "comment": "Malware payload (Mirai)", "value": "b0af8f646e0b3e01c30418f7987f40157493b79b7c3410a1e8999489643e29219ce880446c2e7365eeabcad96e1bfca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737693, "uuid": "f7292f58-e7d8-4697-b1bc-5e065440ed14", "value": "T110B2E165604882B0C1753D78FA6DC3D3524709BCA1FF78173155882A69CBA1176FE2F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737693, "uuid": "829ddb4f-c236-49a7-8ca0-a06321a21697", "value": "768:SEb8BULtmnU4v7jQniePzuGZkm/BiQs3UozMb:SvBKtmDjQi8uO/QFzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737693, "uuid": "6463b869-c4bf-46db-a618-99840aad41e9", "value": 25136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737693, "uuid": "c9a09a97-4727-4736-b5a9-25e3f4c3b8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737693, "uuid": "f861a0df-9196-408c-b7dc-07c86d3584f4", "value": "1ca93bf656595a5a1b6c44f55f17d2c838d914009df64e4f66af406bd9eac33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1ca2c4-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769558, "uuid": "148c8f00-67c6-4392-a63d-10bfa359ee9c", "comment": "Malware payload (Mirai)", "value": "ce0ddd61fd5ac417fb893444fe210279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769558, "uuid": "08fac518-5934-479e-ace9-e4030d0266e2", "comment": "Malware payload (Mirai)", "value": "1d0fbc57518f0afb9596eca132e603a78fde0b49056c574fb76a8c7604e3129b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769558, "uuid": "ffcecbc8-eb66-4b52-84a3-de7bb6788a65", "comment": "Malware payload (Mirai)", "value": "b4ee69280f9374485b8c404960ebaf0e6cc8ae6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769558, "uuid": "4c5547ce-bee3-4a5c-8db7-a6d014fede66", "comment": "Malware payload (Mirai)", "value": "a480acbed8c9f792b075bacb301252f112fc4c095134a9ca56c6dd4b547bb73e7f280bf0e74d76bf9444c02750e39957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769558, "uuid": "8c70a047-0946-41e3-9e62-a8d8a9046a95", "value": "T1DEE2E1E320C02EF1C371D835EF74D6D679421A3C80E7525A66998FE467EE5880EFC58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769558, "uuid": "42ac8d87-5c16-4b0f-97de-f15bb10f29e0", "value": "768:TZ+6GyLuOzsD5AwQhe4ljYaDTTqu7++7g/Bes3UozLe:TKawDq3he4ljYaHTqu7+GCdzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769558, "uuid": "d9d80286-4b2f-4118-b1d3-a99ac114ad64", "value": 32892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769558, "uuid": "5927df6e-286e-441a-bb9a-9cae37983ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769558, "uuid": "460b7860-0787-457f-bfc4-9a4502820aad", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b8b985-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782763316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763316, "uuid": "7bea306f-a30f-4eef-a8b9-3c4fe0ab32d9", "comment": "Malware payload (ConnectWise)", "value": "03a274915f55acfbfdcb726b48928292", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763316, "uuid": "e4289a76-3cd5-4b53-9bb4-5d652c90b3f0", "comment": "Malware payload (ConnectWise)", "value": "1d1546d3e543bcefe52f175786f7d2391a6a2d0971fa70a2dacfb5cf3a34b474", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763316, "uuid": "f7aa3564-f804-43a9-ad0f-918b331febd0", "comment": "Malware payload (ConnectWise)", "value": "81878e7529da9b84d77592d986a687b135a24e38", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763316, "uuid": "013752ff-e71e-41df-9d26-4d9c41c9aa7a", "comment": "Malware payload (ConnectWise)", "value": "5b428f3e7172585b87136de0a21890d9f5813946a953516ab8ea0502c49c6b9a11baf0488448f9952369a5b26cafc7c1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763316, "uuid": "06bb5e2f-dbef-43ad-b7be-aa0c71a467b2", "value": "T1D3647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763316, "uuid": "b319728f-e36e-4258-8590-8d2fb30a7229", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763316, "uuid": "61b4bc9e-782f-40d5-82e1-58bdda5be55b", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763316, "uuid": "e0e6cfc3-d307-4de6-988a-b6010225ef30", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763316, "uuid": "424f8084-1b9f-4b4a-9235-44746817d96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763316, "uuid": "abbbbefb-5ec5-4b8f-8237-f2ad5bda34f2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5afed1-73aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782731181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731181, "uuid": "b60cbe30-4f00-4327-a248-ef1e88002825", "comment": "Malware payload", "value": "0476a642e4de1c6a023bae967c29a9b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731181, "uuid": "c9c358ca-3c94-46c8-ae0b-f23769bcdab9", "comment": "Malware payload", "value": "1d1fd212a97d237460794e03af175d054ea1c47121a9ebd8590f60a1552f875c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731181, "uuid": "0060c350-9ec5-4040-b3a8-b71244222daa", "comment": "Malware payload", "value": "81e136ef612583ae6bd4510656ed927e55cb01e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731181, "uuid": "49f685f1-7b7e-4f38-9d33-71d819183ca3", "comment": "Malware payload", "value": "831da059cbbf6800beb5e588e16bfac44b9f1159106ca7e70b4cf709455ab0290ab0456c213fee706360e5a5c463147d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731181, "uuid": "a7c74da7-6fce-44fd-aafa-5dc167064662", "value": "T1EA236D6516817C24AA99D4371D7F1F0CBDA983E6320492DDBFCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731181, "uuid": "df9d8b0f-9e57-4560-ae0a-c305e206846c", "value": "768:wXRWNGxVx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:klxEcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782731181, "uuid": "0d399c82-7a26-499a-8528-9513039f98dc", "value": 48352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782731181, "uuid": "882dd5fe-4a50-4f97-bdfe-d4693c9dcb59", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731181, "uuid": "39afe319-3278-4833-a02a-fa02f053117e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28dc1de-73c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782743319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743319, "uuid": "413562b7-b7e4-4a60-a237-658d2bba22e1", "comment": "Malware payload (Mirai)", "value": "573e2c0054c8a129d5117dbea9faec55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743319, "uuid": "5ccba251-bb76-47be-8d36-c8a419508ec9", "comment": "Malware payload (Mirai)", "value": "1d2db54cce7c1c66c532586487d7b0c8a4b6fac57e60a7c4d4cb89bee7a75bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743319, "uuid": "f24e9265-ab67-4aca-bcf6-409211607013", "comment": "Malware payload (Mirai)", "value": "7ea874a68f251868eab99fb2c76cfff8d64f08d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743319, "uuid": "d77ffa9a-a430-4ba3-b1e8-2b5047eba6f1", "comment": "Malware payload (Mirai)", "value": "c9854f9d48094867dcc46a83f2c8d9d168e4640efdeef630cacb9aa06316a34b13b194f36660a565be2eeb751026e994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743319, "uuid": "d362b7a3-6f63-4469-957b-898d97d6a296", "value": "T1B8C3F8C7FD01EFB7F80AA77604934805B230BB760D521AB6B21778ABAD360D51867F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743319, "uuid": "e9a40034-e5c3-4a36-ae6f-8f71066a60de", "value": "3072:LBo0DAWiVSr1Hv1wey6YDMQUF8nTBaMJtWJ3UZ2XtU:LBo0D8K9vry6iMQ+8TY/J3VXtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782743319, "uuid": "2f515cea-3d6d-4820-8100-6af0835f9203", "value": 119272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782743319, "uuid": "0a037cca-d7e3-40ea-ac1d-a69844023da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743319, "uuid": "9016a2dd-accf-459e-98bb-1e8adca178b0", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ead0062-73c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782744306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782744306, "uuid": "e05ffe67-f4f7-44d4-94f4-ac04b7b6212d", "comment": "Malware payload (NanoCore)", "value": "04f340ede96f607f310a9ca67370a5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782744306, "uuid": "3832d6d2-ebb0-4352-9c6a-46d34f8dee89", "comment": "Malware payload (NanoCore)", "value": "1d805377c6dc2c4321897789d82add4d2e83e947c5fe2a182061484db840d7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782744306, "uuid": "5b5861f7-65d0-410e-92dc-c6c948468344", "comment": "Malware payload (NanoCore)", "value": "e7feba95e7553a8d070623a279def1fabebe1ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782744306, "uuid": "e126a014-7d39-4915-ab0c-b8c7b215680c", "comment": "Malware payload (NanoCore)", "value": "0c26f34fd07b1854f2e4741e5eb0ada1675b9b20f40a6a5361b89697d5b7a3ab2e4655e71a5c6f709f335b4cff4458e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782744306, "uuid": "01c041b4-932f-485f-83a8-709e9d219142", "value": "T16714CF167BA98A2FE2DE8679601612129379C2E3D8C3F3DF28D854B65F177E10A470D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782744306, "uuid": "76fc35a4-0556-4968-a34a-46701a5c8beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782744306, "uuid": "76613ad1-15fc-4952-88c8-8ddf0fffde32", "value": "6144:sLV6Bta6dtJmakIM5eZmvN1onPN5rjfmQf:sLV6BtpmkEvN1MNR1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782744306, "uuid": "827bcc74-d47c-4fd2-9519-95212b48c31e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782744306, "uuid": "881e767c-8631-4902-9793-ce827db93611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782744306, "uuid": "f0181db0-2734-4b1e-9804-0c939e0293d6", "value": "04f340ede96f607f310a9ca67370a5e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61bdfe8-73ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (BlankGrabber)", "timestamp": 1782732991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732991, "uuid": "0ded0f47-8853-411e-bb4d-c503aedc236c", "comment": "Malware payload (BlankGrabber)", "value": "a5a282e514ae8051e7dd4a272a121859", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732991, "uuid": "db6df001-46ff-4236-a792-edb0bffd50ac", "comment": "Malware payload (BlankGrabber)", "value": "1e53c3dc450ba456b64884e9b00c440f2512567d611b1226e9ae262c007bdf32", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732991, "uuid": "6e99840a-bf34-4a0d-87f0-c224aadf7c3c", "comment": "Malware payload (BlankGrabber)", "value": "292fdc00d8b65feeb246f98c5fec035f404185c1", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732991, "uuid": "7d880dc2-1e3d-44e8-90c0-839bc0bef903", "comment": "Malware payload (BlankGrabber)", "value": "a8e32f0b8281e5213fe0da5e31be5ee350ff197437836ab05f66bddee62432299aa8cc62fd74a7bed20f9e465e0d7a8f", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732991, "uuid": "9cfaf8e6-ebfd-4939-bace-aa304722465c", "value": "T1B1563344735211F9E5F7223DC8A3C525E97278151740CADF83A887B52E27AE08E3BB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732991, "uuid": "f518aaec-ce47-4926-b218-b628e17493de", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732991, "uuid": "33c6eb0b-21de-4df9-b60c-b2afac22666b", "value": "98304:jBmoDUN43WLJY0jOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aiSg58:jBumWLfOjmFwDRxtYSHdK34kdai7bN3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782732991, "uuid": "f9eaef23-a515-49db-bb7b-f2ddd88fe635", "value": 6204895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782732991, "uuid": "7638d205-80ac-4aa1-a200-dca91949d855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732991, "uuid": "ac71ebda-6cf9-426e-aab8-c129d8f1f151", "value": "Madium-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae963618-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721355, "uuid": "e5c6c56c-09ce-4a17-8a69-10b8254033b2", "comment": "Malware payload", "value": "29a5686e0ed88e81fc2bcf28153badc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721355, "uuid": "d02cf9ca-a5a8-45ae-a20e-96d85e9cb0b2", "comment": "Malware payload", "value": "20768110ff9590c321ea4f781b1059ae9f5fe9b87e212b26c9e2ac8400872189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721355, "uuid": "30118ca4-f059-4298-90cd-01f36177e43c", "comment": "Malware payload", "value": "f61ad60f0ed5b5e1062fbab642e716094e538ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721355, "uuid": "8fa3d750-b2a6-40c7-8d78-ad374c8407a0", "comment": "Malware payload", "value": "c87e13ba95ead7f7ae84a81f3c7119f8833610c29b9dab5cd02fdca1989bc45b449253624bce99aea2c5854a1f148ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721355, "uuid": "70bfd301-6184-4903-8860-aa8aa8df979e", "value": "T191520ACAB695C1F4C0A8C377967B1C6799B5380802227ABF339990551E82330FD7EADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721355, "uuid": "bfa3c254-30d2-4b37-a727-b6e546a47a54", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721355, "uuid": "ef64b539-d192-4a63-880e-050cca403b9b", "value": "192:O+0vApAHlwYzm0gq8Jr9BB/6254sKolF2B1OMY3VaDHS4:O+0vAKwOg5XB16qn72B1GlaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721355, "uuid": "f7d5d42a-5787-4867-8727-afa764bb33ce", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721355, "uuid": "b0067fa5-0b0c-452b-8165-3315d70acfb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721355, "uuid": "ef8c1148-011c-4db6-9661-4a05c4ee9bdf", "value": "29a5686e0ed88e81fc2bcf28153badc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a176fcf-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718126, "uuid": "6fdec5cb-eb4d-40ac-995d-174cff6ae326", "comment": "Malware payload (Mirai)", "value": "95fa1274250c8637b5a4c686803fee0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718126, "uuid": "5c93e5fc-5f08-41fd-9db1-e4afd0faf7e1", "comment": "Malware payload (Mirai)", "value": "2115134fed587a84048767f4dd840b52d434fbd2d588a97d596e9c2655beed48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718126, "uuid": "c7b6ddbd-78de-4b7a-aa2d-959f6a4669b6", "comment": "Malware payload (Mirai)", "value": "dcc199d2d1d4062bd52cb97080e812829071302f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718126, "uuid": "bc981517-f13c-4939-822a-f51cec79989e", "comment": "Malware payload (Mirai)", "value": "1523e35ccd0424e7a3620507473cb7356a1f0ed6dcd087b52e2f96e49bb82e6f49783a0193912d5b12642f6470a46eab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718126, "uuid": "9b4be194-c03b-4fb5-af8c-c7592a76a738", "value": "T1598328C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718126, "uuid": "aecb48f2-2796-496a-b821-42c0b5bf8a2d", "value": "1536:iXDwDhVtcU4xiUWaqH3FgfKueEMWximKjfTsv4gz9F7vT:kDWKzQLH3FoFjwmKjfTc4gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718126, "uuid": "c4a91392-b4c1-4a63-aac8-05f4b534b6a0", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718126, "uuid": "d34ff181-32bb-44c7-baf3-c40d3d5906eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718126, "uuid": "9191c376-1800-4b7d-8cc8-86803e295ffa", "value": "9f0b37e9febf6a6623c12c18bd1ac934de0e30459b06bc6ecaedbca722ed9e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed21918-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698592, "uuid": "cbb6661f-6b76-441f-adf9-4083b37d7685", "comment": "Malware payload", "value": "9b605042e3a9db6017b255b3b5a391e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698592, "uuid": "7dcb472a-0f2b-4c9f-97ae-78e32b1e5843", "comment": "Malware payload", "value": "2129d8a2074b2573a3125894f6b8460ee716ef0e3b951836c5ffb7a21126559a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698592, "uuid": "36569444-bc08-4775-9cb9-bb60b997a540", "comment": "Malware payload", "value": "988e643e56176e8a314f1e62412188731de85024", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698592, "uuid": "f15ff58e-88b1-478d-b15a-1b26d31fe53d", "comment": "Malware payload", "value": "f8501b3562c2a4cf0b628ffaa66806bbda0dbfd82a7b3d977f4d99498c6f1e310f21ba594aec46be3f5fd69e4f2ca39a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698592, "uuid": "544a7c4d-4c11-4c0f-a9cd-7ffd007864a7", "value": "T114339DD93681EA7DE7C54914FC6928BCC9FA3CE70544239CBF03B4252E55883785A2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698592, "uuid": "7df176a9-0469-40c1-b0ca-80e52d463949", "value": "1536:ZDhzMejG5o/JnFYfF+Xjwn4Ry3qB/TMtf:jMebxFekX04c3i7MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698592, "uuid": "ded0ca7e-62c1-41e5-98d8-8a64ae300db9", "value": 52734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698592, "uuid": "837034fb-0fda-456a-bf76-c9aeb6ca1387", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698592, "uuid": "77819725-6638-4f05-944a-1718cb954440", "value": "ocafa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2cfa3c-73ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760785, "uuid": "c1d32273-9ce4-462e-9106-0d33e086c65f", "comment": "Malware payload (Mirai)", "value": "a16d9cc9a79fc6af107dc9f780d8963a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760785, "uuid": "a9ec67dc-d7ef-4391-9956-5aac3592b401", "comment": "Malware payload (Mirai)", "value": "219fb7eb12b9af933a2cd8da688b8fd39aa0d8ab096935dbcedc904ef0bec659", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760785, "uuid": "63b7ec32-dc8b-40e3-b556-a679ee2e2271", "comment": "Malware payload (Mirai)", "value": "36c293c1ac46bcf9771a57a777c43495aad4cef4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760785, "uuid": "5b3b106e-9858-41f8-b86b-d96bedbe30a1", "comment": "Malware payload (Mirai)", "value": "d7de533bf4f7f6f29a77ca163e02babc567b865d9eb40a2ce254da34ca77d68980ca6ee665fc7ece8308efcb5458afb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760785, "uuid": "26b813da-1175-42ba-bb0a-01b92a87e47c", "value": "T171D43A55F8809F62C6C129B6F65D86AC33174B79C3EB720689254B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760785, "uuid": "c0e1e2f2-7632-4d8e-b1d5-68df989765e2", "value": "12288:HbVePNowrXtxTm+TGg02BmX0lTRfDrPlWhFgp7Sbu5N5:HbVeqwrXtTjdllfDrlW3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760785, "uuid": "3c79dfdf-e84e-4df4-acc8-4b1802964ae2", "value": 623752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760785, "uuid": "8dfbe6ac-7a77-4f0e-b32c-3e63fe5bde5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760785, "uuid": "6d43fc62-dc6d-422c-8ffa-8053fd93eed9", "value": "bot_armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1726993a-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769634, "uuid": "347ecdee-0c5c-4b30-9ffb-5e7609f072ec", "comment": "Malware payload (Mirai)", "value": "a2abda4f1224bac61df174c7f30651c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769634, "uuid": "4123faac-a773-4813-8c27-839e989ad6fb", "comment": "Malware payload (Mirai)", "value": "21ac39150f6b46ff1443b619799ae01b79e34477517d80308fb9c9b8c915a10f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769634, "uuid": "e5fbf70d-06b8-49d2-918d-fb84391bc308", "comment": "Malware payload (Mirai)", "value": "86a702adfd43f05be4e08aaef51265f5eac20f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769634, "uuid": "c3c89385-10ab-42ac-a440-6fe8c6094b5d", "comment": "Malware payload (Mirai)", "value": "e886f6aa2b17ad449a4d06cb873a2e543c02f511a97c4b7c41c14b54c2b262e195e12043233c1c534ad98646424669cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769634, "uuid": "f5164213-362e-42bd-8afe-fa5656283c09", "value": "T1D2245C46EA814E23C4D7177AB6AF114A333297A4D3DB730689286FB43B8679F0D63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769634, "uuid": "94722eca-f109-4ddb-8833-c16f3e25735a", "value": "6144:GUiB0UfyLEaak87zNos2thrCGFTHeGLavM/912s:GUiyUqLEaak87zNos2DrnAlk/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769634, "uuid": "7dc209ac-1736-4840-b94d-a85570b949b7", "value": 210526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769634, "uuid": "6de359f6-91ec-435d-aaa5-d07cd749e23a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769634, "uuid": "3dae633f-33d9-4568-a655-9547ce704565", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea6f694-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773378, "uuid": "675bb624-092d-4dab-bbdf-c17114141d21", "comment": "Malware payload (Mirai)", "value": "f52da6a52371f62e7242a692aeea3126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773378, "uuid": "fc58b09c-8abd-4859-b6e2-da8890bcc2ca", "comment": "Malware payload (Mirai)", "value": "21d0c42ad9cd1258b7c353537940cf23f536630b246af1184549931be1722c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773378, "uuid": "cf7d08c3-ec87-400f-b6fb-efd7d97d1dd9", "comment": "Malware payload (Mirai)", "value": "8bad37d9a78ebd7c847210d900f15f8f9afb0e13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773378, "uuid": "a89c9187-d1d8-4a7d-89e3-f3e4d46966ca", "comment": "Malware payload (Mirai)", "value": "fb376f6abe2e6b96b3554e42518d4ff2e7afce1ac761980502fac283b5804f4f7a2eff37317f7cfac305fbec893caead", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773378, "uuid": "1d6dc6c5-86fe-4623-a2f9-b785be42068d", "value": "T18643023A92476FF8DB220971A0B625517B836BFE70FC66166B6EC728478EC160351783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773378, "uuid": "ae53669c-d931-4ff4-b1d9-10ba2cc79b88", "value": "1536:FbokSFoBueUWdIACx8AL8xlYykDkSR6Luy6tlV1nLJ:uk0ge98lokS4Ld6tlH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773378, "uuid": "5c635e13-c1c0-4d6c-b32a-d8c404e5a295", "value": 60136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773378, "uuid": "e34d363a-2547-4e35-a537-b10a89c64204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773378, "uuid": "3f84bb50-0b2e-4473-aea9-98aeec6ef95d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1decdb95-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712952, "uuid": "1de3c873-bfdf-43d9-9944-0f298bb809d3", "comment": "Malware payload (Mirai)", "value": "be95fd01824a0303bd133ac2ca8fb6e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712952, "uuid": "edc3b009-10a7-4d48-af6e-b9740dbe6ce5", "comment": "Malware payload (Mirai)", "value": "21db9f9bdc701b131cff80562864028144ef93ebb6f9e0675548cb5365f46bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712952, "uuid": "eb6dcf8c-84c8-4263-812b-ebd81a478918", "comment": "Malware payload (Mirai)", "value": "a6935138d24e447b33addd9f5ff5458fb79a89ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712952, "uuid": "bc2c2ac7-d12e-4650-8b8f-20cc966e5504", "comment": "Malware payload (Mirai)", "value": "f648840db7ae8bdb9755a7a0cc4c0379c95892196003272065b9430e01911d7c871ec26a0d7b4ac1e7648e39ae62f0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712952, "uuid": "2fcf7717-0ada-4e61-9fbf-b530a020159f", "value": "T1D2C3EA09FF501DBBD85BCC3705AC1A5234CC964362593BB53674DB2CB68698B8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712952, "uuid": "f2c8fa71-668e-4df6-9e29-4dd28a3d883f", "value": "1536:OaHyTPZEjxViOUXBt1p90SX9eSpClZCYy3gekH3TWkcRk0s0YqgpsnsLsvwxNs7b:/ydEvmFzVYy23Tcls0CkwxNs7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712952, "uuid": "a09799bb-5589-4706-bac7-4173e30cdbc6", "value": 129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712952, "uuid": "3511151d-77a8-4b3f-8efa-c605e9c68747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712952, "uuid": "3f6f06a8-cf17-4a60-813c-321e1150b291", "value": "IKp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364977a1-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775269, "uuid": "79582bcb-41fb-47e7-8052-b8434ddf9234", "comment": "Malware payload (Mirai)", "value": "c4b5dfa1ce72d2a1db6fdf9ef0b2acc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775269, "uuid": "0f9b8e55-a45d-4e67-b638-887e07c894d1", "comment": "Malware payload (Mirai)", "value": "237e4d5bba9ec28ea100c5f6fc2d8dda23392af28b333c4d8d2cebcbfa81d577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775269, "uuid": "be12a4ff-5993-40c1-b732-869bc29e3661", "comment": "Malware payload (Mirai)", "value": "d1b050dcd08583b41876e0c9f3605bbc09edf05c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775269, "uuid": "fd4a9df5-ae23-4219-aacf-85db4ce80b1b", "comment": "Malware payload (Mirai)", "value": "1b9da19d0f6b380b6d2f537e3424f84ea6ca7ad89f49b90ab333e30f1a13d537a9a94d651be8b9a406644d17f50b235a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775269, "uuid": "2d2b3e7c-4fd5-4aa5-a7a6-001838b4bb20", "value": "T159E2E17DDF90A999C2A42431EBACCDC7B5CB5258E3E8371B322801A1804961DD7BD28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775269, "uuid": "d09f3b12-485c-4522-b4af-c8f9816648bd", "value": "768:67xetyYfWrC/l/+w/3GY1ja4SXD3A2yBQAn4ts3Uoz9BJ:6t8yYurMtxOX02yBV/zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775269, "uuid": "bc4c4aad-ed9d-46e7-9a5b-fae92f8b5235", "value": 31672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775269, "uuid": "80ba3d0b-7934-46ab-8609-dd567a2254d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775269, "uuid": "0428f6e6-e63b-4cda-a51f-c062d39b2bba", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a71755-7412-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782776027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776027, "uuid": "e0468553-bb0e-4c59-acdc-230d6f0f990a", "comment": "Malware payload", "value": "fb492fc991e6829f39691c708e98b193", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776027, "uuid": "b7c16403-a9c7-4d52-a597-2ba5025d4306", "comment": "Malware payload", "value": "248319980ae1b866a7ea30da121f43923a6aeee0f2bbb6576fa6dd368e5ddf4a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776027, "uuid": "d898546f-b1ca-4e81-ae63-1b3d133f9caa", "comment": "Malware payload", "value": "8b19cf95487cadc52826d3d7959d2a5f6e9e7681", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776027, "uuid": "ccb62f38-c304-4e64-b9e3-d7202ca0b27c", "comment": "Malware payload", "value": "35035925979505bad8a454e0ade0bf0f584781bc5e2bcf585a28237ee8d782ac7f5a6fee155fd179db2541c1c6fcf2a7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776027, "uuid": "a22feb43-3f6d-4382-8418-75e9abaa32b3", "value": "T14693CF2BAC0335F7EC90D5BF42004224EFA2EA36235617F75A9711299E94FE0BD356E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776027, "uuid": "a06a286f-fbe6-4848-b5f6-61a4441b6a95", "value": "a7a48e6a1ac574443f1b812e09daef71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776027, "uuid": "a47c20cf-3422-45dc-a495-a241efca78ed", "value": "1536:L9j0hUF2ueHJYMi4XkiMtPkzbEmNH27sxJk+1tsfFC4ctQXtQV:Rjfwd27p9kz/asX1nk8JtktA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782776027, "uuid": "bd0f7b7b-e937-463a-930b-3322cca960b9", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782776027, "uuid": "3c44a904-5bbb-4684-8b0b-6f85c46ad33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776027, "uuid": "aa13d37f-8618-4d41-9536-32de9712f7ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c387987f-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1782763910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763910, "uuid": "c5ac7d2a-c90b-46dc-bbfd-4ba0829d8c5f", "comment": "Malware payload (Stealc)", "value": "6b57e128783abd160268c7031f08d194", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763910, "uuid": "cd9218d6-8bee-416d-a2fc-2fcdb0d3d557", "comment": "Malware payload (Stealc)", "value": "25572b53676f1041dfec6ddd3ac1b47c5db8c384c98aac6238c463ada08ad523", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763910, "uuid": "9f7383aa-af4c-4945-b942-ebd9c486dfc3", "comment": "Malware payload (Stealc)", "value": "e029a7434c24f8b0d759d440a6e276b3bee64d39", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763910, "uuid": "3f636e6b-b371-4610-9c20-ddeda83fb56c", "comment": "Malware payload (Stealc)", "value": "2ed1a6650ea3635bff4394e054662d84a505e382d75a6c4573b83308d38bf539ab06868429d69f4912a8a9b1b0bcdd53", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763910, "uuid": "a2683691-c221-4ffc-b855-80efda17bc89", "value": "T1BE95234593E2A569F4B5C33488F300066271FC561B381AAF27D0EDAE2E939D57936F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763910, "uuid": "3ab0f132-1a13-4a33-94ec-67c6c39ba16e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763910, "uuid": "45eb2591-b91a-4491-8d5a-3f435ed4d00b", "value": "49152:FjLa/DBeaZiKKk9zozHu5YDS0Hz3v/sbvWuCzpGA:w/VHZiKPWzO5MPHzcbuuCV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763910, "uuid": "f4a27454-417f-4c08-a59a-f8d59510c36a", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763910, "uuid": "ffb0013f-afaf-41cb-8ab5-400b4ee1278b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763910, "uuid": "4fbcdf21-de02-49d7-9271-28f7f6225e44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6073424-7391-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782720589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720589, "uuid": "e87ffda6-7b55-4128-b85c-e8574849465b", "comment": "Malware payload (Mirai)", "value": "ed434133e083deb7d48896c8fc003d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720589, "uuid": "eff72a9b-5947-42a1-b8de-42e0dfa97ff5", "comment": "Malware payload (Mirai)", "value": "267160946258e7cce833b6d632b5428c35d38081c744ab37ee0cc15dd8f0f2e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720589, "uuid": "307f3570-d95c-426e-beb6-2466a72d6de2", "comment": "Malware payload (Mirai)", "value": "cf1254146ab602448e765d553be485f3cb5db85c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720589, "uuid": "d591d2c6-65b0-4e2e-be43-769f2673744b", "comment": "Malware payload (Mirai)", "value": "c0563d1e6d3d39aafb9aab37f38543d55e55554745247b525fba56d5eea2b0de01f7a2e572643db35fb4c55397bcd782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720589, "uuid": "cc5ec8f6-6cf9-45b6-92b7-9ddca98f31a4", "value": "T129932C46E643C5B3C80305F212A7AA5F5931FE3A8C72DE86EB553D64FF124C1A212BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720589, "uuid": "cb0c9643-63bd-4892-80ef-f89084de2120", "value": "1536:uTnSsi97V46Cm7JjzW7fA/LokYvWPVe2j87ubNdKb9WxCJQe6BKSA/38e7GO/7m/:uSsu7W6Cm7JjzW7fA/LokYvWPVe2j87a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782720589, "uuid": "cddf55d5-f909-4fa9-be5c-35701682f182", "value": 91692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782720589, "uuid": "6e634314-565c-479e-a469-6536fc3df15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720589, "uuid": "262d8ca1-3ecd-4695-9b59-75aed7be0e3c", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ca9aa6-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698629, "uuid": "eba0af57-99eb-4901-9b90-f3c567ce01fc", "comment": "Malware payload", "value": "60ef2a6d156d1d515a314b9adf87dbf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698629, "uuid": "de4955f7-4b4a-4e63-9d1d-9eba5be43991", "comment": "Malware payload", "value": "2672aa397f823502af8f9ceb1a5e5b51e7f4d45083da1b31e10b21dc2062ac88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698629, "uuid": "888f1ecd-7618-425e-a818-ba3f5ec2ffa6", "comment": "Malware payload", "value": "2af08346c68f637572f1b9e916bdd4a4b742ef90", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698629, "uuid": "ababf994-e91b-424d-b240-9002d41ef3ba", "comment": "Malware payload", "value": "94cac7ac0a6f55a58e756e1694f64d1df3a75c287e771f3be96d4eedf911edafc93f6abe090435b04cc9116ce74516e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698629, "uuid": "79e1fff3-8dd8-46e9-8696-1abed3960469", "value": "T1E7E2AFC88FF2CE91194B1810CE3905A28EED8877D2635588F70C1D9DEA9DD1FE225A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698629, "uuid": "3aa6f905-b6c3-4274-88d8-3d71241e2147", "value": "768:vKTFNy/OgnNV2VKUMVLmA5jTVWNBY+Ql6OTfbtKMNK0tj:yTXmNV2LMVLmA5jT8Il6O0MMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698629, "uuid": "69537c5f-0539-42d9-a7e0-9ba7cc89a4a1", "value": 33066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698629, "uuid": "d54b40c7-e8b5-42b9-9c99-857c84f3a0ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698629, "uuid": "0aed0bdf-fc21-4636-bee0-384e6b149365", "value": "ufino(3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3816c1-739e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782725832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725832, "uuid": "ed59f7d8-ed4a-4cd7-b02b-8a811f9b91fc", "comment": "Malware payload", "value": "8543aea8e81178a8d91c2818b5284504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725832, "uuid": "03ad1d9e-d4ba-4516-ac3a-8477c9de661c", "comment": "Malware payload", "value": "2693b00d5f819207e0195c46a7d66bd750f22659d041f37d4bd0f5548a0dde75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725832, "uuid": "2fc399e6-85df-4440-8f96-7cfc6822993c", "comment": "Malware payload", "value": "e7b6773640502b3b070e5f688ee20b81b2446008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725832, "uuid": "52355233-d9e3-4708-99a3-948ba4e1353d", "comment": "Malware payload", "value": "1840d0e1cacd1723473d2fa52cfea4bd54f738577b6beeb9fe7b8c76bab7c69626da92e2a3cb7ca67bda70da3026978d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725832, "uuid": "44fc5b8f-a5a8-48a6-a7f5-f7c45610d44e", "value": "T1DC08335D1C69C843C5BF59FE795234B5D200DC2B2DF4E82E1F198AECB5A6D6200B893B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725832, "uuid": "509fb3d2-75d9-4dec-beb8-b390ad260f1a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725832, "uuid": "02337103-0a86-4804-b19c-8b285c42e41f", "value": "1572864:+t9IKPmT3RWYIJImKljUoEkB9dNDsMLXgiMZrIuEtyZSp7:+UKuzRWhImKljUvOhLXMxIuYp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782725832, "uuid": "23c473e3-e1f8-4d95-af5f-3117c9e52c5c", "value": 77361542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782725832, "uuid": "96476d12-da78-416d-9df4-8be41b8da747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725832, "uuid": "1d8b4a7e-917f-4bf8-bb55-4402472259f0", "value": "RelativeTwins_Game_WIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0417e02-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773380, "uuid": "4a00d465-7cac-49a2-8fb3-ba9d71838a7e", "comment": "Malware payload (Mirai)", "value": "4d2e761438c5a9d2c0d6d001ab02b636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773380, "uuid": "09ae6698-34a4-456b-998c-7722ecab4cb9", "comment": "Malware payload (Mirai)", "value": "26c13660580b570bc0d7e8ad91bd337047edfd7f0e1311d8b6be8364ad525b8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773380, "uuid": "d9fcdafd-d978-404e-b726-919cf78cdda0", "comment": "Malware payload (Mirai)", "value": "5c32a270ef271fbb446155b4a59bb1bc7ca09079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773380, "uuid": "54ff478d-4b18-42c7-a17b-05b6ac76e394", "comment": "Malware payload (Mirai)", "value": "9de1f36f356c9b15aa3e820480f7a34feb45a62ec6b7acd87d2bb2f24e08211f57b39a3e884df837e4592be0625c4366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773380, "uuid": "80d44269-1afc-40cd-96ed-66bd2e27db5e", "value": "T189539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9087DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773380, "uuid": "3ee80936-19ad-4e78-bd3e-bb76560ffe80", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYPmgpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYegQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773380, "uuid": "aa267239-1b21-4718-a5c2-37414872b73c", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773380, "uuid": "8b8ec6d3-e46d-45f2-8f17-d0ffff7ac483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773380, "uuid": "409c7bac-9ed0-4899-8712-34677ac96c34", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f14b5-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782769811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769811, "uuid": "22f7e516-c299-4638-91b2-0b315cb8d021", "comment": "Malware payload (RatonRAT)", "value": "9acee8f765d44e0406dd74c4a5f79d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769811, "uuid": "58831cab-fc5b-4d02-9166-33ba58309953", "comment": "Malware payload (RatonRAT)", "value": "27c46d58c8ba4920f24d2f09140d93473f9ec148dd7e44f3260951ae8b5b540a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769811, "uuid": "8025dacf-aafe-45a1-ab66-d925b9b05bc0", "comment": "Malware payload (RatonRAT)", "value": "a9480a9b3d2104a4e691d8bffd08887547acc96d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769811, "uuid": "097677b6-94d7-4299-9ce8-c62706bff675", "comment": "Malware payload (RatonRAT)", "value": "81665234d493edd5e3843a4350240c720a9d43ca55e8049755ca346b879163ae820b2bdf3ee5facc37f10859a64964aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769811, "uuid": "33389013-9221-4281-8f2d-7ec00ab72d1b", "value": "T1CDD31216331C80A9E8A677BB87711A419232B62E42D72FB42A55884DCB76B60C130FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769811, "uuid": "3dee826a-f7d4-4e3f-a97d-1d700f497ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769811, "uuid": "c15341e8-3295-4325-81d7-9be4ccbe1fc3", "value": "3072:eaqLcViyrX7JWLRjgn8707fcRVleIWYkR2j9sG4CUT3mywvCR2D:jqLco0XFWSn87MfcRVleIvkR2RsXhao2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769811, "uuid": "59b3f681-78ee-408b-bb3e-5610fec6904d", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769811, "uuid": "cd722b2a-c0e3-4fca-a712-dc23815c629d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769811, "uuid": "5a937ae9-7558-4d16-a8fe-1cfb7c72277f", "value": "xx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c512454c-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712802, "uuid": "7a242115-6428-435e-a37c-520e0bd433e1", "comment": "Malware payload (Mirai)", "value": "918d3beab498922b092f5f53462807d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712802, "uuid": "198cf97a-e484-4465-ba5c-916384566f87", "comment": "Malware payload (Mirai)", "value": "2823130bc798b87246e72a090502da737b1e44e9522a0b7fe72eb44924b4152c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712802, "uuid": "204fa8ab-2e72-4678-afaf-727ce66eedf3", "comment": "Malware payload (Mirai)", "value": "68b2240045a864e73709bec3fca7bdd4a3962be1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712802, "uuid": "da076feb-92c5-4174-b796-90a646035df9", "comment": "Malware payload (Mirai)", "value": "616216de917b3b70dd86db1f2ee92b8b55b863aceb1bc31ce1c1fd84fc3a4c8d422421016b37b73c1cddf268eb3b9916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712802, "uuid": "ea2119aa-aa0a-4a71-82c7-9c80d48c2e41", "value": "T137266CA8BC1CB552DEC87AB43B6541D5B235FC48AF41C7277614BBADA9F23548F22320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712802, "uuid": "d6290500-0753-449e-a3c3-996659425ed5", "value": "24576:pDNK6Fxw1aDV2IDWZrH2+6wM16tIoRbTCcAHbnSw2sOk5cvE7SCfTqXk59yjydzE:pDdwl27DoRbTCcS92sOds75E4EVPvVf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712802, "uuid": "5026695a-003e-4598-9532-8e93e94a6693", "value": 4849816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712802, "uuid": "e03ecfa1-dbab-4238-b28f-5890adc2f79f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712802, "uuid": "6155bb39-058c-4cb1-8c23-73c63d21c187", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d33cf5e-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718131, "uuid": "1540173c-67ff-4470-bc2c-af6ff4df478a", "comment": "Malware payload (Mirai)", "value": "fb34ba6c353beed51c3fdc7e6703a34b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718131, "uuid": "c3128be2-2cbf-43a5-b599-6cfd189ca321", "comment": "Malware payload (Mirai)", "value": "29f665d6a91fe320f244d15bd81da511d45333e2758f026efe8a3409b3360093", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718131, "uuid": "4eef60ca-033a-4da8-a9a5-17ed8caf9280", "comment": "Malware payload (Mirai)", "value": "23e8fd37ddc43f7094e2eaa246e78ffd2748ad93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718131, "uuid": "3b22bbf5-2d42-4a00-b579-0a78b4de63f8", "comment": "Malware payload (Mirai)", "value": "8ae72e4c8292c402d62339b74f7ceef7579503c0495003ed175149bad3e46dff539335d6ebba5240c39c1c6972530dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718131, "uuid": "40fc5d23-c46a-4571-a53e-92c3f50605ef", "value": "T1DBB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718131, "uuid": "e7af7adf-5a07-4187-adb7-42a094c4852e", "value": "3072:Ddub7djS5HEC7gBjmbhRhFczcmVRh865xm:Ddo7djS5ECBbozcmVRbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718131, "uuid": "7019ba9c-2fda-4d77-a170-7a9a3bc3af45", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718131, "uuid": "1b842bb1-d36c-4b19-8a09-882b924eb040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718131, "uuid": "5e12db44-281a-45b5-a9d3-a11295c8e48f", "value": "0a9e7aac7014a3ec0a78b3885fec5d2163193a66a864633e688a20881d290b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f41e30-734f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782692275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692275, "uuid": "cf07296f-ac6f-46e8-9486-0dc2ec4740a7", "comment": "Malware payload", "value": "917b814b6c0236829e54a17c55629350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692275, "uuid": "c26d70c1-ecb2-49f4-92a3-7eda65a81a87", "comment": "Malware payload", "value": "2a09a55911dcfea54ce275bc870ae1deec1a0c57a6cbffc85c8f5594c9f6e2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692275, "uuid": "6dedf89e-bacf-4eed-99d3-7550d991fb1b", "comment": "Malware payload", "value": "67d99241119658133ea0c3cc2be382459a308225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692275, "uuid": "e0c7c18f-ef9a-4fda-801a-18eb28cc068d", "comment": "Malware payload", "value": "4c2f04969de0a17bdee47f0799037ac9b4c18e9fca158fbd54cbbb0040f8abbf3b709a3c9b8f8afbafde1c083f4d87b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692275, "uuid": "343ba299-111e-430c-9e7f-12fd2c81393d", "value": "T1C183085AF9816B15E5D525BEFF4F424933634B6CE3EE7202AE205B2523CA91B0F3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692275, "uuid": "02e07a5c-e9c2-4bba-953c-1a2b4b4c4829", "value": "1536:ixnvo5OeykonPRiNUYtJOausca5o8iHM8om6ayl5UpimcN5iCKiZxIR+1:Mo0nPMe0Oausca5o8iHM8ThcN5iCKie+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782692275, "uuid": "a46a5522-d7de-4407-8702-afa55bcf3e02", "value": 87572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782692275, "uuid": "abd6ae91-8aa6-4cf5-8436-9d5ee55e2394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692275, "uuid": "4bea2d78-60f3-4ff8-9b25-56eda8103ab4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a99c7f1-737a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782710369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710369, "uuid": "35c4363d-2f39-4597-92c6-ca4ea6d1aa9f", "comment": "Malware payload (RemusStealer)", "value": "a034e6fcb5bba561da5b1261726cfc9d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710369, "uuid": "ec40a053-10e7-4eb0-ade5-9bb94a30e5f3", "comment": "Malware payload (RemusStealer)", "value": "2a169c4c4471f3c37d1e220155d710eb7a0cafead7552e48fdab8f9d4d9e5bb0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710369, "uuid": "aaa36869-57c6-4eb9-a98f-decef844cd06", "comment": "Malware payload (RemusStealer)", "value": "90cb29228c0709ea6bcd75659089a86e30b0987b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710369, "uuid": "c115c569-9e23-4813-8d29-4ba08efbc559", "comment": "Malware payload (RemusStealer)", "value": "2029a1704749e082bb61cf3e4e4cf2573499e7bbc1f582cd6152c4436040cd0deea96a42b8eeb9ad8c96a6617605bdcf", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710369, "uuid": "7b6265f7-7e01-46ca-be4b-3b3386c4f406", "value": "T181D55A07BC9588E9C09AA731C8B251A57B34BC484B3627D72E90BAB83F737D05D72B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710369, "uuid": "238587e3-22d1-4571-9fd7-440538379f09", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710369, "uuid": "33a95e09-ee32-4eba-a7d0-0a06a2e98619", "value": "49152:qqNXDWLRqJEMk4UMRG9eZJ7Zm4ncMYFIXtpi2pa:qYZ09MJkM42p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782710369, "uuid": "680d5043-d7d9-4a23-b2e1-ae4a4c957b07", "value": 2849792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782710369, "uuid": "fca1aec2-cdfd-44f8-90e6-9b39db7bc652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710369, "uuid": "1eebaa40-6912-4182-bccb-02b4aad623c8", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ff4c5e-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701134, "uuid": "69dff859-3ed8-4d2b-b58c-bdf149835b93", "comment": "Malware payload", "value": "9cc94d30fec568b19f60d1bb14a0142b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701134, "uuid": "a33aad6f-0083-4a22-a92b-a25d7a58273c", "comment": "Malware payload", "value": "2a6c5cfb8f1c5c6f88a3c1ef39700603c54d5b152817e90f76900854bbbab4f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701134, "uuid": "28e82c6e-f332-4fbc-b6f9-f6c724b64ae0", "comment": "Malware payload", "value": "f58ce4a3df50e4fa24e07d666f4dc789bc1bbfdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701134, "uuid": "73cce062-3d9e-4dab-91b5-a5119fbfcc54", "comment": "Malware payload", "value": "13ee6b068f3374bcf7b5d5ecb9bf1d824b94ba0830f2171c8d3d8fc7508d4165740eb4343fe9f179cadc4daec67c0780", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701134, "uuid": "3dd572ec-d8ec-4768-9152-6813b483c359", "value": "T15B138D6B9B3E5B7395A51A6AAC5D4FC8931D2B215C4CB0AFF3007C7C1C88C6EB1690B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701134, "uuid": "550287ec-8f75-4f33-b5f0-1826e2a45675", "value": "768:uIso95tUBRd/DjAQr+S2Jor8SMpLEettE6zEJyIpp0Ogq2Pmnpws9rkWPw2N+ylF:D95tSd/1r+SNlAtE6zSWq9kVByc50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701134, "uuid": "70f2037b-f97b-41be-a390-692124804abe", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701134, "uuid": "ea9ed543-467d-4547-b281-6c7a2f08b4e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701134, "uuid": "10f39c5b-8d38-471a-bc8c-64d07877a8c1", "value": "agime.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ce1d0c-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769601, "uuid": "02e903c1-cb46-4cc8-9fb7-c0d854b6cd41", "comment": "Malware payload (Mirai)", "value": "1b86a5ea7adfbc3aa787784c1f274870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769601, "uuid": "7db09800-b1df-4cdb-9de2-628179bb621d", "comment": "Malware payload (Mirai)", "value": "2c5128e8f3e5ca24df88f3b0786b7c0c866a849d0dfbdaa5c9935e1834f8793e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769601, "uuid": "0158dd5d-e007-477f-b8f9-42aff948a1f6", "comment": "Malware payload (Mirai)", "value": "a67efe9662b428147651e31798c61fbd14f00b98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769601, "uuid": "a9f07d5a-c0e2-42c9-b548-a29c3ce207e5", "comment": "Malware payload (Mirai)", "value": "02b1d472d7177794f107a4c766436323f19a6d333cd56954609652c8bcf7f6e9986ada11b99d6a6a1fef182b36de543e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769601, "uuid": "99167545-b232-4698-9b4b-cf3a1cdd3e6c", "value": "T1EAC32945B8829622C6D723BAFA6E21CD336163E5D3DF31038E219F1137C669B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769601, "uuid": "dede88de-1ff1-47bf-933e-ac0b00e0b381", "value": "1536:lKSmAASQ6ei2cdv/Lpl+9RKp1anmmA4zQy8R8PajUSi0CmOlc45PLv7Hit:8PAA/6eedYZAlwPajU3xX7Hit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769601, "uuid": "6c7e3c87-48e3-42f1-bc22-26859c02f302", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769601, "uuid": "fa3d7030-cca5-45c8-acdc-2cba11ac4db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769601, "uuid": "17f72954-d8a8-4247-a3d3-2a39f218a233", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52ede95-7356-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782695140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695140, "uuid": "31b66a61-c47a-4699-b52e-d2c06638e1ac", "comment": "Malware payload (Mirai)", "value": "df57d5ace6130f47712b516c6217683f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695140, "uuid": "75b85512-bd43-4cf0-b047-0bf705eda561", "comment": "Malware payload (Mirai)", "value": "2c7f26643a9d918d353c523c09a7b3947c00c0d79c1effc2f76659c4ef529fea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695140, "uuid": "664bc671-7cd2-4748-afed-758e1b3c9330", "comment": "Malware payload (Mirai)", "value": "7dfc6094f5e52bfdaf69112708378a690967f9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695140, "uuid": "f0448a2d-4d23-442a-bb9f-ab6e4a6407be", "comment": "Malware payload (Mirai)", "value": "f0711c75ed40aef327c41acb445cac7fabbeba1b52b27c4b3dea8e644c6f12c0a9072d614144a21a48916e724b546a2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695140, "uuid": "008d4f58-b61d-480d-accb-3eb0e79f7ce8", "value": "T1ADD08C029B11D0ABC1910172D8E91356E7F8E24C879623D380EA2E32AD0BAE10E46530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695140, "uuid": "6ceb7fb5-e94b-4694-8c03-ae713463281b", "value": "6:BnX//InsE/ptkEVtztibP7bQhd9ny5uww:BvwnskAEVFsQh65A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782695140, "uuid": "b9d14552-cbe8-4b43-adf9-47e435fcfa48", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782695140, "uuid": "b12ec2eb-86a8-41de-a44f-d89a9165d9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695140, "uuid": "5ae79d67-187b-4aa1-87cf-fdd9c3c5b197", "value": "2c7f26643a9d918d353c523c09a7b3947c00c0d79c1effc2f76659c4ef529fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43099146-7390-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782719886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719886, "uuid": "1931698a-89f4-40b2-a144-6c7be05d8806", "comment": "Malware payload (Mirai)", "value": "4e1d8438501b5581ff2e2065cba9244a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719886, "uuid": "62f864db-0ba0-4bf0-b354-f1819a7dd6bc", "comment": "Malware payload (Mirai)", "value": "2d01bd4d063774d2ba00bb04a752b86c5b80c5cbb36290eb42b7629dd220e4d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719886, "uuid": "d28f2b4f-1072-4ec1-ad79-4d756f4e5fdd", "comment": "Malware payload (Mirai)", "value": "0ad3999877c0560a999aa20251e371a4141e30c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719886, "uuid": "7e62dab3-1ab0-4d25-8ffe-4d04710128fa", "comment": "Malware payload (Mirai)", "value": "4dafd9d3075e45f1b084d51b8af752fcb12b15af9a4c447d2925ad932d281ca7f53dbff1876a0b21a0e3efe7052b03f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719886, "uuid": "8d26c333-1023-4be6-bc55-6f5ee927397e", "value": "T184F3A426BB619EB7DC0FCD3302A9450221CCA65A52E92B6FBAB0C55CF34B84F45E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719886, "uuid": "2687f6a8-3e59-480e-a923-56ac2cdfc67e", "value": "1536:m82TwjILGeScSVhex5k+8t8UEy6Xyjurs4z0ZQzu5+6m81ZJbO7B9FwLeDO2+JOG:mMJItXprh0Quf1ZsjeJY5hMpPE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719886, "uuid": "ec3c111a-2f5a-4483-9770-d10777506bd2", "value": 169712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719886, "uuid": "b18f6803-64b7-41e0-98f4-d56f1c3367ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719886, "uuid": "c75b75a0-2f00-4e40-8aae-839cdc4e6348", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ffb5f4-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760523, "uuid": "9b3fec1f-63a4-4159-a0c9-e1f17fbd5ea5", "comment": "Malware payload (Mirai)", "value": "c7cf72ba78b521f7259299b950f6e70d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760523, "uuid": "15759690-5c5a-46ba-afaf-e923cd398d43", "comment": "Malware payload (Mirai)", "value": "2d0553d5ec80a052c3d670eb42154835dd4e107d7f914b63299c05362d98a74e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760523, "uuid": "98fc23f3-589a-41b0-956b-85bedab5a4ce", "comment": "Malware payload (Mirai)", "value": "efcdde1e6da3d211d9b2746456761c2d7bfefe60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760523, "uuid": "d556adf9-07e3-4dec-83b8-2a8ad4a7b074", "comment": "Malware payload (Mirai)", "value": "2dc71b660d7bfd8fe3e3754c27df792fcdde6b2722b5ad689e0c22bdf5db1b93e088d50c740de26b250a8f2e297ee6ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760523, "uuid": "75f9ab54-2f3a-442b-935f-f3efe20fcf96", "value": "T1803195C623212D712DE6DF1E75A88424B282B1E2DDC36AC594D93DFD9CCEF087842A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760523, "uuid": "9ae00fa6-922e-465a-b47a-fe2aa700130d", "value": "24:v6PW/OSwc7IOSWi/woOS53OS6jOSwMOSsOSh8OS1/OSOVOl:v6PW/RkRWMR53R6jRrRsRaRxRWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760523, "uuid": "83f9f7d7-7181-4dc3-92bd-48d18183e93f", "value": 1774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760523, "uuid": "8f799a18-e219-4273-a068-15bf18f2f48f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760523, "uuid": "179d6603-fe1a-4f72-a26f-56a1f1f63277", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0673e18c-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769606, "uuid": "0cd44cd9-da65-47e1-8565-dfb6d652a4f9", "comment": "Malware payload (Mirai)", "value": "2ebb4188d6243ec5acebfc1ce7a72adc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769606, "uuid": "0a052416-48a6-48d5-b057-c773f6fe9653", "comment": "Malware payload (Mirai)", "value": "2d05ee4f122c444c348422014d02ce1d28dddc20b8655a61b8a657438811e986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769606, "uuid": "d4df7f82-915b-47cd-843c-daee088b2f0b", "comment": "Malware payload (Mirai)", "value": "49b60af4229fa6085f8cf43fe2bdca9b33f58f4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769606, "uuid": "2da530fa-c714-4404-bb20-a8b43e61ac63", "comment": "Malware payload (Mirai)", "value": "df5555e14d87e0241d6eb869c5ac5349e6fe3b3473ee1ef41fbc2a25d7b2a8812d10cea68aaf97346d548fe6ceccca41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769606, "uuid": "fc0c3baa-d824-4ca6-b015-425a997cdb9d", "value": "T16593F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B11779518F0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769606, "uuid": "a5c9ff8b-0d9a-4862-bdfd-4cca4aba7166", "value": "1536:9m0L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthSDH8kc8oeIH:9rBq1BtD6wq5UIkRIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769606, "uuid": "4571ad4b-cc87-491e-9837-556eaa1ffb6c", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769606, "uuid": "cd806857-0a23-4286-adb7-84c87ca0982b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769606, "uuid": "67ffc79a-9e7f-4619-b1db-9e9de8278af7", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9e6817-7415-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782777272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782777272, "uuid": "4793bd75-b716-411b-b955-21c3db4fa707", "comment": "Malware payload", "value": "0774ab75edc85b9b564e333b9789dddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782777272, "uuid": "7543bec2-4a27-4860-8f36-09a41230a35a", "comment": "Malware payload", "value": "2d113a07c025bfdf7f0ad82cdaa6ccfd217ffd5c224694bd1ee0fd69f34e04f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782777272, "uuid": "f53cc40d-dab0-4172-97ec-3f666e59cbff", "comment": "Malware payload", "value": "d9a19167abf0768895f5c761e231b20f097f80c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782777272, "uuid": "d1606ee1-1fc9-4f5d-a508-503def5220d9", "comment": "Malware payload", "value": "336db70d995d752f1e29cf34e82a1ef427bafb94d0ba5179944a1b87ac46253979ddd315ba35ab026376458aa0a54d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782777272, "uuid": "b49a74ee-7705-47d8-a5f9-3dc6cf78325a", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782777272, "uuid": "fae532fc-82cb-4bc0-8c7a-d0abf2440200", "value": "3:Bnks//xlEldlkl1llS/pllltml:BnX//InsE/ptk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782777272, "uuid": "5fc3c075-2fbc-42cc-b334-652a4649c45e", "value": 90, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782777272, "uuid": "3f30313f-3153-47e7-969e-43178ffbf674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782777272, "uuid": "59fb3245-ac2e-4e52-afc8-70f6da2745fe", "value": "2d113a07c025bfdf7f0ad82cdaa6ccfd217ffd5c224694bd1ee0fd69f34e04f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464ff391-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763700, "uuid": "00755154-bc4d-4e4f-942f-7dfb90bb5833", "comment": "Malware payload (Mirai)", "value": "bd908bd8b37529177a449f23e044ed1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763700, "uuid": "138aa044-6f31-4c24-a64e-4a4fd35d5a03", "comment": "Malware payload (Mirai)", "value": "2d1ec8a263610b7a565b961364a62b85526958c25ff23f7f3aacbd8be78bbc01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763700, "uuid": "6ccc6d42-d671-49a5-8a76-4242ade08465", "comment": "Malware payload (Mirai)", "value": "1038e92725fab34a3d77e7fded02fa698b1a96ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763700, "uuid": "d09f9677-8c50-44fc-a7b0-4c95f6bd943f", "comment": "Malware payload (Mirai)", "value": "b94a18ef38aa29b8986eff7f6da7e2d6ec2d3be51e1b113d3781f2109c061024fefd957c8082701a5a977b5e2e827a96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763700, "uuid": "d3010d72-655b-4988-9fb8-31c7fc992b52", "value": "T15B934B46BD81DB02C6E42376B95D82CC332603F8D2EA7106DD265F6137CB96A4E7B790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763700, "uuid": "ea5ae715-0d4e-4190-9d56-fc4573a826f1", "value": "1536:vxIsZACRRq7dCW3v4z1lK/S6+N56/JWLY5Z2O2JLE1Wm2Kdx13woJ:uuqpCwv4z1loS6+N56RW85Z2DEYKZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763700, "uuid": "da62c1fb-4ca5-4f0f-a9dc-a08eb6750c19", "value": 95548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763700, "uuid": "af0dcec2-8c99-4385-9ac5-1f72504a1c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763700, "uuid": "37e9d4a9-042e-4e24-941c-3bdedb36df2b", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bff596d-73c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782742261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742261, "uuid": "1b2f40c8-43e7-4e19-bd62-e15028a96cfd", "comment": "Malware payload", "value": "3d51ed3d5eb4a6fee126cee995c424c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742261, "uuid": "aa34fea0-3fe0-41a6-9de2-aecc54e26263", "comment": "Malware payload", "value": "2d3211d104d3491df44ffcff9276f442c724d7fa9f4397a41746b588bb37f0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742261, "uuid": "ca70d2f1-a360-4019-8d57-e6b94db358c6", "comment": "Malware payload", "value": "1fba4d9026dbb6d4d9bc1484a4d1e8e054a1bbb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742261, "uuid": "2d512757-41b8-4671-a09f-d74f5d2c61d4", "comment": "Malware payload", "value": "ad848e069f5d9691834bf88210a7444c0eac8e40c8d5a8b227f4346add223dfa511bacd28361a055ba95add82d2665b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742261, "uuid": "f1000515-38b2-4a7d-b64e-72d9a39103b1", "value": "T13B030847E253F43CE247C0744A96BA61BA7678B052302E7FAAC4EB3529F5DC02565F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742261, "uuid": "93ed742b-41f3-4ed0-b15c-caae21b3ff49", "value": "768:3Aq+0PlLaNzG4j9mgMa41xqfn6dTb3Er6:3tPlLaNzGqfnWbUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742261, "uuid": "0a6f2543-f29a-4376-aaa3-6105f842fce6", "value": 38048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742261, "uuid": "bb669687-2df3-44ea-a03f-a996328fd2cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742261, "uuid": "61041156-1d1b-4596-ab24-77cd8c94a5fb", "value": "2d3211d104d3491df44ffcff9276f442c724d7fa9f4397a41746b588bb37f0c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b18ab-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756806, "uuid": "830acd5f-36b8-410b-b2b9-4f1b1c1a54d3", "comment": "Malware payload (Mirai)", "value": "865e0e1d372e5172e2fd80ca3167b729", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756806, "uuid": "0331d132-43e8-4e56-89a4-313ec1e1fdbf", "comment": "Malware payload (Mirai)", "value": "2d41c6579db213ddd80880be0ed7d8e21bf266c77bb7a75eb6ef394b2fc05fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756806, "uuid": "117e3479-278c-40da-bd6f-928c04f26ca9", "comment": "Malware payload (Mirai)", "value": "950a96da5d27cc37242c239b9016a6093db81f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756806, "uuid": "b43b7f1f-0018-4e58-968a-aec2aa8a0799", "comment": "Malware payload (Mirai)", "value": "591f68cc12dae72532659074e7cb2bbd358cddec01feb6925dd4c4168bc3c62d1a0df8c0042d55d88fc65b92c62f107c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756806, "uuid": "13a07ff6-c407-477c-82bc-ccc973c19464", "value": "T17733E19DED14B1E9CE5CEC38419817B40996A9D0E38B9B882317CCAD6438A1FF49857B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756806, "uuid": "5fcf07f5-c83d-4542-9fa5-d88d3317e549", "value": "768:G2MuEQaatQ0M4r+nNngzcAQsV7kudDQna9ETDkdk9bEc2QOHsbaRuG2KWg:32alt6h6cAQM7kXlsS9XDOMboubo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756806, "uuid": "289eabd8-b37b-4fff-bad4-914e066ca057", "value": 50500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756806, "uuid": "7f050178-04e1-430a-87d2-17922e462d10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756806, "uuid": "c8b67e7d-70da-4b6e-84c8-eb2f95d39fb1", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9991d6-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782697840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697840, "uuid": "ba03c350-a84d-437d-8f5c-a9d355d5810c", "comment": "Malware payload", "value": "bf2ea2b666ca66037c5791d2cfd4fc1a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697840, "uuid": "24ec6fa4-e753-44d7-b376-b379150dc353", "comment": "Malware payload", "value": "2db83363b1c91e1f5744306766d25ad38ce80b955c90edd42631d98d27ef25a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697840, "uuid": "5a409040-b30c-46c6-a52c-032fcec0b459", "comment": "Malware payload", "value": "2e167798b3e58a84c6418efcebfbd63299f71647", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697840, "uuid": "956a7a07-a601-435f-a38c-0cfc7caf0509", "comment": "Malware payload", "value": "04e9c8e02b16a5693a598a847aabb5b862cc95d2c09cfb17e45c3923484664452c9dd10041f4859de6abc01729e50d60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697840, "uuid": "39a0fa97-2848-4e4b-a1a5-f880f6ec8d53", "value": "T158339E97C624CCEFA3F788CBD4960160695DA65315CDD5ACA3B812A30D4CE7BE02A1F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697840, "uuid": "07ad63cd-dd90-4a79-98b6-10c4106da8f6", "value": "1536:VbSUL8ZmpBxGsqfX+bND4Lr9pMDXVOIBst9EMoC:VblYAImD4LUROCsHEM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697840, "uuid": "59db05e3-c0ee-4647-8ba6-e13e3594fc45", "value": 52926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697840, "uuid": "c6c6f2b3-f4b8-4189-95fa-4f02d9fa1de7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697840, "uuid": "162ad4f4-7ea3-4cfc-af94-4a910475197b", "value": "usiju.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10457955-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699614, "uuid": "c1b38021-e002-4e40-b7df-20f09a16c60e", "comment": "Malware payload", "value": "bacdb452872a4e6e08baf088eeef19b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699614, "uuid": "563ab5d4-87d6-4447-8da3-7fbf6d20b0e4", "comment": "Malware payload", "value": "2dba680a61b135658e36e5caabde47690c6976eacb6806b9d3265ede80ba241f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699614, "uuid": "438002f0-36aa-4b4a-b6ba-5ad75c4a2b23", "comment": "Malware payload", "value": "7ff50d04cee7880c68758839b93cd80c87541311", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699614, "uuid": "4af0925b-96b8-4314-9f56-91a8622c2780", "comment": "Malware payload", "value": "a90ed02bbd5c25451b7e0050a95633c299a389d84d7a60d7944521297d826ffedafceda0a9bf5e029132ff7e00c41c31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699614, "uuid": "d598afa2-73be-4535-ad71-45b45acbff26", "value": "T118B27DE6A7930BB09E620BB3152FCAD4EC786A8F0DE117867173F6343981429B4F55B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699614, "uuid": "d36818d5-28ba-48a7-a47a-b40761726fe8", "value": "384:uIsFG3MCzCp7VhuMFfiULvElXG4swGvdt6NXPqUNPYYCPsLNq+DCrQyVTOFIVS/j:uIsFG3NwhtHvUtXPjpCEkQQT63jjyWEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699614, "uuid": "a4e669e4-e012-4b8e-abd7-0551eb5d1ebf", "value": 23532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699614, "uuid": "b5ec083d-0e19-495e-addb-5f247909709e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699614, "uuid": "2b876852-2ef6-4031-bd86-7badd04fb122", "value": "exiho.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e0fdb8-73f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782761174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761174, "uuid": "31a4e9d8-0984-414f-a2df-61adf7cbfc3f", "comment": "Malware payload", "value": "09e2035e6fb1999d012f98ac315aaf68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761174, "uuid": "0cd39762-768f-4bc8-97af-7a075354c04e", "comment": "Malware payload", "value": "2e41e1e4a45fdd39a18af69832092b848f3abe3cb94b085326ccbc450186c842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761174, "uuid": "c17282bc-7b66-43e0-9c50-2445f7e6aa61", "comment": "Malware payload", "value": "802b8e80142ddf7a4a0568644653e8ce1ae1ee42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761174, "uuid": "9c921e6d-0f1d-4d1a-a3cf-7a09faec7b9f", "comment": "Malware payload", "value": "ba8f97e5f4c0dab6360d12b5e2d6869022fdb5126c2b3625c383af0bbb0b61d0d61e29beb1d35d262cdffd1f6c6f90b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761174, "uuid": "5dea45fd-5dce-4b5a-a8db-a651596c7f6a", "value": "T1C4F58C07BDA048E9C0AEA3328AB65156BA74BC190F3127D72E50B7783F727D06D36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761174, "uuid": "0a565769-1520-4d8a-838c-4e0108729e0d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761174, "uuid": "3f844523-16c9-4c08-81ce-f7455ae1fda7", "value": "49152:lz4Ky/C7rYCwQ98x+JGMnYiZmbHrRpmYgbT0:lcXVGMjrzmjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782761174, "uuid": "78df620d-82f1-44b3-86e6-b04a701fca90", "value": 3492208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782761174, "uuid": "790c06bf-1df1-463e-9949-8088550cfbb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761174, "uuid": "6a198e6f-188b-4535-b0ed-f6309e4b4f01", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f746b0d6-73ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782733073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733073, "uuid": "7815a8a0-d265-42fa-a064-479d58227259", "comment": "Malware payload (AgentTesla)", "value": "7e4a82b07c382d1c2c4fe2b8d99770fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733073, "uuid": "713cf773-c299-47e2-8126-0ea705ca4844", "comment": "Malware payload (AgentTesla)", "value": "2e7fb0d1e3065be0f30ad2d336f01afd718592b2d2493d26107efb127d4fa4ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733073, "uuid": "38aea22e-89fc-466d-94a0-382b03a32e50", "comment": "Malware payload (AgentTesla)", "value": "a1494f9d240175f0cadab6bb1e0cc4b97a3b6106", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733073, "uuid": "9f09fb37-f6b5-4ad6-a1c7-ad388aa875e7", "comment": "Malware payload (AgentTesla)", "value": "bb4d783dff1896f52e0ff072297d4595311031fe880a97b3cf4b928641aaa30fc6b49604fd564c89cb7ceaf26963a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733073, "uuid": "097df4e2-cba6-4760-b304-a78dd9cd5f14", "value": "T10795192B9EE168BEE1F7C091A8B453C5783BB3B030BD047D98D703598A564891F9A74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733073, "uuid": "d3c1ecf7-62c0-4167-b7c4-14812c1e36b3", "value": "12288:c/kYXo62lIkakQiKPsEFTekVH1NLwcl+SUUBNzmzc4YeitCFr0Y0UNknr1jaletO:iLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782733073, "uuid": "04fff188-2d47-4fa9-a2e8-777ca26a9da7", "value": 1879310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782733073, "uuid": "f851b1fc-5372-422f-97a6-c3f6f906524a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733073, "uuid": "e33a4ccd-43e9-436d-b59d-1f293d40e365", "value": "Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea284ec7-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1782716730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716730, "uuid": "f445d05b-f89f-425d-828b-6d2f0f9f0287", "comment": "Malware payload (QuasarRAT)", "value": "917d599b4a954bb053d11233ad2aee86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716730, "uuid": "16ed4a02-0c4a-4f4e-b25e-74b06dc4c451", "comment": "Malware payload (QuasarRAT)", "value": "2eac96249e00012e874d427c378cafae63f8ad2aac861121818ccfb4ccb19e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716730, "uuid": "5c405bb6-0313-4f32-8f80-f3badfe63c66", "comment": "Malware payload (QuasarRAT)", "value": "00d33a28d1190be97e9ccbbb0632f122714791fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716730, "uuid": "9d828851-f6f3-425c-9152-152fa2eccca5", "comment": "Malware payload (QuasarRAT)", "value": "5e64d08063de913cfba4331e0d8053bc699a7deed96746d18625c1ef9c1cfe323c609cf57b437d185592791af7bf86a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716730, "uuid": "78a307b2-4145-429a-a774-e4c6c82e68e6", "value": "T1F5655C1EC6F669C0E0BECCF66D832D658C913F95113C368ED6B0F22245710E269DADA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716730, "uuid": "6bcbc179-ae90-4891-869f-556c4282096a", "value": "c5e134cc1c1e4c253962fc1102568c64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716730, "uuid": "beed6cc2-1e46-4809-98d9-fd49b99974cc", "value": "24576:2AQdDPUlQYV6q/fbF2wfv9msdQkPvAnkzH2YGyiepf+usx:2WlQAJBDgsei2yis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716730, "uuid": "42b0be7d-18e0-4015-ab30-f1cb7962e1fb", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716730, "uuid": "520cf704-df42-4232-9a6f-3cd397a83d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716730, "uuid": "6789c4cf-3439-43b1-8f81-3d7b054cca59", "value": "SecuriteInfo.com.Variant.Cerbu.279087.15880.6649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4dd2e0-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769562, "uuid": "11c44197-f093-42f8-a086-ab3309edfe25", "comment": "Malware payload (Mirai)", "value": "0d5f04d982a22da0bc16a06628f490b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769562, "uuid": "91bc1804-9e1c-4865-a10a-75b01f403f24", "comment": "Malware payload (Mirai)", "value": "2edae09d792c2429e7c1723872a80efc54d38716093882a01605ccb434306abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769562, "uuid": "7d1301a5-b027-457c-95a0-978c9153ba5e", "comment": "Malware payload (Mirai)", "value": "17cee8a3385d9406259edf508dc7ba7ff013a0bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769562, "uuid": "dcad0768-df3b-496d-b8b1-e43c14b99922", "comment": "Malware payload (Mirai)", "value": "280c48a36e3a30f14f6f6ee8e3ef4f1fd9e480b77411a8230fff6ea44439bdbd7fa43be3356db20c5718ad61a551fde8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769562, "uuid": "fe86cb0f-379b-4a0d-b827-f94626cd10a5", "value": "T157C36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769562, "uuid": "a009d428-4946-47a8-8b2b-d45984ef7131", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAGKC1D+tAlPYm5XLxgFxHi:n3IbE/HnQ/KC1ySNYOX1FXUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769562, "uuid": "06fc3338-beec-4b53-a418-0c973c53a4f1", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769562, "uuid": "c9453660-a758-4a06-8bc0-6feea5489777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769562, "uuid": "1975c2bd-98a8-4601-b63c-a0c10ba4a2ce", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4dd0bb-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "246a3963-fbb1-4113-a580-4401e24c7c69", "comment": "Malware payload (Mirai)", "value": "7bcb6224e25040767c83ac28cef9c0b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "0a466f5e-7f19-4571-8fd4-d1a297526193", "comment": "Malware payload (Mirai)", "value": "3004327dc9e3e4e0fee3572bd81097b10493d4b3f92ee6d680fbc582ee04054f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "dd800dc5-98ef-44f6-af10-6628b0629cce", "comment": "Malware payload (Mirai)", "value": "00755bb82da97c7b85a6fa5e2901cf8fbd99518d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "386710f5-428a-4f97-9dd8-51b90cd91b88", "comment": "Malware payload (Mirai)", "value": "d2e32a1df810c2e373aa197fdab86560596ae4e629e975df1e93776b562dcbb2cc98b74b8044fe59c9eaa4b4759ae6ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "e00a56ca-9eff-49e3-9c2c-3931a4aed9ca", "value": "T1A354891A3E22DF7FF66D867047B78930569876D62AE1D584F16CE60C1F2028E241F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "512de7a3-4dc9-48b5-8ea5-1f30ac813a48", "value": "6144:MILlMEl/ZzQy+MtLy58TrMJ/VSwwsfFqj6I:zZzQIJjrqoj6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765104, "uuid": "2daaa84c-732d-4a54-b616-0884d9b1dbab", "value": 304652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765104, "uuid": "6e3942f9-332d-4ae7-948d-e9ceddc40b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "e35e8bb6-b704-488b-b5e2-9c9e72feb0c5", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e0aca3-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698607, "uuid": "af0c11b5-0fa0-478b-8265-616226952829", "comment": "Malware payload", "value": "6124d4718cd7d5f87cb8d627fd7ac01e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698607, "uuid": "3a90d39d-9fa5-41ca-b3d1-6aaed2eac4af", "comment": "Malware payload", "value": "307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698607, "uuid": "7fb5ab97-df36-401c-91b5-ea66f6bafc22", "comment": "Malware payload", "value": "30f240c0d9155c489de60de9ca6db756ffb8f2e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698607, "uuid": "b49508bd-5df9-4bfd-8ef4-ecb0f8100a11", "comment": "Malware payload", "value": "27674db9125f0d05b8eb003341d5ab1285bbe365a24ffcf972ae50b519e19af52740b93963fc87e30018b04c8e5aa50b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698607, "uuid": "6dd9e120-bf8f-46bf-aabc-8d8578194cd2", "value": "T1F533AD34DB4065985AF01C69859107E5B57580AACEF82B7DA3ADD17F2E44B4EC23F0F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698607, "uuid": "9b986efe-8466-4d40-a0ea-a1e67c6b252a", "value": "1536:JkVu9PYS0Npyu8n5njBNLzKSqFPm0o6ebhdMfg:kUP18F85LxaebbM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698607, "uuid": "f8413e4b-2334-4eeb-9265-1ccdccbb593c", "value": 52678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698607, "uuid": "5c1fa966-527b-48ad-919e-edc1fb99f380", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698607, "uuid": "5201698c-9cb8-45e7-9559-6b75ef761adf", "value": "ocafa(3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632084be-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756876, "uuid": "629b3571-56d3-43ca-aa0f-04ed8a9e60cf", "comment": "Malware payload (Mirai)", "value": "e431d9eb88e2ef4d3c0474dfff10daed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756876, "uuid": "549d6fe1-1980-45a0-a181-f9d9e190ad5c", "comment": "Malware payload (Mirai)", "value": "30cf1c38c123713c2ac03c007d42b833db0c0c101cc56387eb8f99f2faef845a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756876, "uuid": "2a19bd48-4b27-4d90-bf06-741976600f7d", "comment": "Malware payload (Mirai)", "value": "4b9d1670c504e2a8e50b731a11dfa80a0bf394e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756876, "uuid": "892cf233-0722-45c7-8d69-ff7503bdd080", "comment": "Malware payload (Mirai)", "value": "f225f6694d9d790128b4dde21334bcdbe72b0f1a23b8a7514980f075d9f3e4da16d20d07dacfcec54909885d87d9e898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756876, "uuid": "cb0c7b3a-636d-4fdf-8c02-9e0dd7886512", "value": "T160B33A13B9C18CFDC085C034877F7936D827F0DE1239B29B67D4AE262D4EEE05A19A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756876, "uuid": "e4d62fd5-4985-4dce-8ca4-02cb31a47ec3", "value": "3072:hUrJxvo/E/IochRHZb8Az5CqRI09Nq45SbXo3Pe:hUrjvo/E/RchRH6p0fq7Xo3Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756876, "uuid": "44a47ab7-c3d6-496c-b98d-d92094de4d14", "value": 110640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756876, "uuid": "e13c036e-24a4-4663-9dd5-aac58be76ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756876, "uuid": "a8280085-57d8-43fa-8b0e-b907f09faffc", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98519c3-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760484, "uuid": "16a24555-6f14-4166-ba7c-5394bbd9b4f1", "comment": "Malware payload (Mirai)", "value": "1641d75afb33062f4b488b51bf508c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760484, "uuid": "8808251d-8909-46c5-8b57-356ef45fcbeb", "comment": "Malware payload (Mirai)", "value": "318a7bf65be9191c139d106439b1707915b895eb3bae233db91b3ef003e42d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760484, "uuid": "67862db7-d8c1-40c3-8d8a-42360653f4d3", "comment": "Malware payload (Mirai)", "value": "8ee1e9be7ce3f6ca3012fd475a541096cd23f3de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760484, "uuid": "25eae088-e50b-4c01-b9e3-7cb2537cd27d", "comment": "Malware payload (Mirai)", "value": "940fa2fb7251f091ab753c01efaef9238434dc62cbaf79185bbeb35e311d6e8d22d3c208efb93b8bec5e7a66f5d3e76a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760484, "uuid": "0f8a8f3d-7fa5-4f14-a89d-bdc19e31514c", "value": "T1A9E3F709BF610FF7E89FCC3705E91B0528CD556732A93B3AB534D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760484, "uuid": "fdc1e76e-64f5-4620-b6a1-b19dcd8fa78e", "value": "3072:y/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSne0oyJi6ts1uYav:y/IWWosd4Bi3u7KGzJtcMae10lJie0bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760484, "uuid": "9d25a869-a7ef-4732-9940-63bee6282e7e", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760484, "uuid": "c68e6080-4b78-4ba4-aff5-8ead6dd2627e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760484, "uuid": "faf2f0e3-414e-4333-bb05-752728b30694", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a777634e-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782758709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758709, "uuid": "aa81f024-4edb-4160-bc3e-cd915ea0301c", "comment": "Malware payload (njrat)", "value": "744e1221f6467d0b7e73a10f52e6cd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758709, "uuid": "b19d2a0c-6572-4dd6-9be7-54fb89616c71", "comment": "Malware payload (njrat)", "value": "31c37ff61aa322192236c9672f09e3d97b6e6e09c5019077df7d0567d4c0b48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758709, "uuid": "3d96558c-6e65-4775-84a0-7edd3ad21306", "comment": "Malware payload (njrat)", "value": "33e85ae9412fa870e5d6de31502e7d48c64ce224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758709, "uuid": "7f729880-ac2d-4945-8f8d-ed909cbe2b0e", "comment": "Malware payload (njrat)", "value": "7eba0fd4928af9f65cbb359bb841a9c7321b2605d38b147d743e35ea973bcb18d5a023b061a09e3068b3c8dba548c122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758709, "uuid": "cdff9c92-c32f-4a3f-8076-b971c4b57e72", "value": "T10F03294D7FE18168C5FD057B05B2D41207BBE04B6E23D90E8EF564AA37636C18B94AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758709, "uuid": "214747fc-572b-406a-b9db-3e781c4fd5ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758709, "uuid": "24fc29de-6678-425c-af6b-19ddaa43c2ae", "value": "384:6yTMUiDHblmJEpRGyEfBffXuKCYyEAnrAF+rMRTyN/0L+EcoinblneHQM3epzXGd:fTqHpR9EfBfWKClEOrM+rMRa8NuoXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758709, "uuid": "b8ecdb6b-3e21-491c-9515-02bc72fdbcde", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758709, "uuid": "51c5ab83-b751-4175-979a-8cf71f582c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758709, "uuid": "a08270d8-1d2a-472f-814b-963bf6bdab17", "value": "DCrat-mainCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa8b588-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782770668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770668, "uuid": "6c30450e-42c1-4e2b-babb-869044682f8e", "comment": "Malware payload (Gafgyt)", "value": "c7bb5b3a770497ae1389f9c0ba02ddd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770668, "uuid": "7c54ca23-2109-434f-b63e-3666c556d3f1", "comment": "Malware payload (Gafgyt)", "value": "31c737dc339d77f66a8eb33f5e514c7294b77978d084d60b0f6730c46ac6cf1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770668, "uuid": "90418bed-6b35-4ecf-a393-699ae1efdeff", "comment": "Malware payload (Gafgyt)", "value": "6609fbc18d14bb8afb97b5c85f6ac93c92f76e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770668, "uuid": "ca8e84a4-9a09-480b-a149-3caec20ce2ec", "comment": "Malware payload (Gafgyt)", "value": "ab64104ccc70eddc76f0ccec703f3d4db126002581f7d230846c1eb4a0f8dd223918a435b0b5b576ff265ac5eadaba1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770668, "uuid": "c2430626-2f15-4641-a2bb-aae280fb49c8", "value": "T1A7D32A46AD425A12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770668, "uuid": "65ebfd1f-c3ce-4a24-a205-c60a21dabace", "value": "3072:UY+3OS15mqV5O4nnPfGxKCEk7bUBbaVYScU0UlElEfMKV0KebzoC:TS1tLnPexKCEOb+baVYScUrElEr0XvoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770668, "uuid": "54956c14-560e-4275-a9d3-a92283766dbc", "value": 135524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770668, "uuid": "73ef503c-8de3-4e4e-8fc4-7cb3c532b361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770668, "uuid": "ff039ee0-910b-4c35-af9f-8fa2ceb16708", "value": "nerv.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4f8f05-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737462, "uuid": "55b4eb0b-7911-4cd9-a404-3193f3d5b996", "comment": "Malware payload (Mirai)", "value": "fff9cc1c67e7fe400b312139157c3bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737462, "uuid": "af8e3e25-da9d-495f-bbd4-73b98cf1c475", "comment": "Malware payload (Mirai)", "value": "32769d28deb08fc499dbef10a0b97fb55b2068a95140a7d6c7c42e7219c25e85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737462, "uuid": "1b0cfe6c-98fb-4f29-95dd-5db4fb09afc1", "comment": "Malware payload (Mirai)", "value": "dd668015a2e9a310ff6e84dc6750309fb9f76890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737462, "uuid": "35e2f188-a86c-4c89-a9f1-21bbcda34262", "comment": "Malware payload (Mirai)", "value": "40b621ffbf4b0102ea61cea93ac1fa245045f94588d95dc0143cfeb93d33bc94b533a77e070b6ad61f091bf60c57871d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737462, "uuid": "d021771e-c4f7-4fca-b0ac-e81d0ef4ab34", "value": "T1D6C3BE97F68B24A1CC6146F007C77B8D2E6362119E6BA9E76C0F763B097A1DF18163C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737462, "uuid": "f2735983-c00e-439d-b53d-cc84ca298c60", "value": "1536:dCfNRkaAYxcvAbWmtxtHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgYn/LWg:dkN2kxiAF+BGL+tJ2sd6tChhgYnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737462, "uuid": "cf381c9d-10e8-40d1-8613-a5db4ea929ce", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737462, "uuid": "50db28bc-d349-482f-a901-28a1413ba2c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737462, "uuid": "aa14852c-0b1c-4494-a6b0-5dd995c7fcb9", "value": "32769d28deb08fc499dbef10a0b97fb55b2068a95140a7d6c7c42e7219c25e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e5965-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737460, "uuid": "5c7459a9-f760-44d6-950c-1ca8359db33c", "comment": "Malware payload (Mirai)", "value": "9ca3b03fabb6d0fe766ee3af45e1c29a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737460, "uuid": "a4bd5a68-eb88-40e3-8506-21a24111c5f2", "comment": "Malware payload (Mirai)", "value": "328113d3f5eafd5b825a7866fbc40225763184a9121b64ba9bf3bf3a7ebb9666", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737460, "uuid": "a4139e79-2029-4fdb-b3e1-3e241ab8171c", "comment": "Malware payload (Mirai)", "value": "a146b737eaa15b088c2ef04b2d6cbce2a1794098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737460, "uuid": "cb557e4f-7184-46a8-80a8-5f2b73d67125", "comment": "Malware payload (Mirai)", "value": "6389e66b79811845429046751efde57ff72815a344347df80b4c99701ef024f803059fc9d8bce16aaf68427d3ebae6cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737460, "uuid": "542961aa-4a1c-4f58-ac7d-34a2191c6e1b", "value": "T14B13F1585A0A4EEDD67CC8B13AB127602D5C8F94FF5FA8428DE6CE610C819B910F5FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737460, "uuid": "5307b83f-f47a-43b2-8d40-4840ba77d185", "value": "768:P6/jZfcIpzKgxirQHTDnEjVOWASDmfay7f3GxOf4oVluU+lxKtrgYJgGlzDpbuR+:2jZ3OxGRWASiyy7OxOfvVMU+lxOrgYV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737460, "uuid": "e02bfaad-b6ee-4431-a512-f617d3d4c205", "value": 43296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737460, "uuid": "5e5c7e80-e5e0-4e9f-b267-dee846422c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737460, "uuid": "00e0e860-c842-49c0-8ad5-522fb8d42bcd", "value": "328113d3f5eafd5b825a7866fbc40225763184a9121b64ba9bf3bf3a7ebb9666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dcbb80-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763701, "uuid": "29edf26d-00f2-48f8-86b3-054f2a6118a3", "comment": "Malware payload (Mirai)", "value": "b14f94b415d0df273b2381fbad6ee224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763701, "uuid": "194021a7-9923-442f-9be7-854cdf312893", "comment": "Malware payload (Mirai)", "value": "32bd603ba84e760872a70162ce899c250826c450a878760dfe22fa11ee61ef92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763701, "uuid": "09740c17-99f8-4108-ba56-49ca6d87e820", "comment": "Malware payload (Mirai)", "value": "4f0834985a0a747df67f9d9296be8084bc951cb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763701, "uuid": "3ea7ddfd-01cb-439d-8b10-92057c37eb33", "comment": "Malware payload (Mirai)", "value": "7076627234c67441d12007ce89c06ebd3ec544219916567ca9a0da073be2427a844fbf631425f17fac79c5a70db6e775", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763701, "uuid": "95769847-e32f-4b08-886d-5216c2a37f07", "value": "T1EF934A46BD81DB02C6E42776B95D82CC332603F8D2DA7106DD265F6237CB82A4E7B790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763701, "uuid": "d7d1358c-c1c4-493e-8564-8056599388ff", "value": "1536:C5tgwRACXFGuK/O+i9ZjHH5z8jBWa9wBBU8WH/1+1Wm26dBl3IR:CMGF90OL91HH5z8FWayBBUH1+Y65e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763701, "uuid": "31751153-d6bf-452a-83bd-4e7167ab9d72", "value": 95548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763701, "uuid": "27394298-5b1e-43ee-bd4b-3f170f472b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763701, "uuid": "2574d539-6ccd-4e8e-823e-559e293e7770", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770a7a03-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775378, "uuid": "c937fa6e-4e19-45cf-84af-8bc770590855", "comment": "Malware payload (Mirai)", "value": "6d08811df5ba288d0694d34251696179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775378, "uuid": "d71f5e86-92d8-481a-92f2-1fd5f914cf3c", "comment": "Malware payload (Mirai)", "value": "32f9896f5207858ae63d718e89562e9dea9780513873da26aebe6666d3d495fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775378, "uuid": "76d4318c-13a9-4644-817c-9091c3c412e6", "comment": "Malware payload (Mirai)", "value": "2b0df069022548d13ca01636a0b9ed2f60515a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775378, "uuid": "58eb344d-e9b0-4bfa-bedd-10ac2f717038", "comment": "Malware payload (Mirai)", "value": "c268c8ad17dd3806524b9ee2afe2806ec47ac22b04800e2c13c9f1f3bfb37783e20271b952ec2b849e3ec1971634f34d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775378, "uuid": "8605118e-92a8-4d6b-bbd8-4c89ec7ae348", "value": "T170144C46EA414E13C4D717BABAAF414A333297A4E3DB730699286FB43F8275F0D63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775378, "uuid": "419c388f-e58a-4947-9f9b-5d210b6081d8", "value": "6144:gvJu2A6YwfxZqgva7XBKBK6/bzQgCKPHNQLHAM/9NEC:gRu2AhwfPqgva7XBKBK6zzHn1i5/LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775378, "uuid": "fc882281-70ae-473c-b01b-1cc6e40cdfad", "value": 204812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775378, "uuid": "3f221cc4-82e1-4d41-8fd1-76371dc05848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775378, "uuid": "da381337-1b28-4ac5-8efb-69dcdbfe2351", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5809d88d-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713049, "uuid": "0862fb4e-eba5-4490-a3f0-15e2d330b72f", "comment": "Malware payload (Mirai)", "value": "c22c51ee8c45087fa0e570ca00474282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713049, "uuid": "d3f671a9-ebb9-417b-bf83-7d3931d017f7", "comment": "Malware payload (Mirai)", "value": "331633e511552d0e2bdb744f929bf678f3870cc21740380c104a4044b132a735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713049, "uuid": "0f2b6d7b-9c69-4efb-bbe2-03ddff898547", "comment": "Malware payload (Mirai)", "value": "0d14b974af761d80af99fd0633277b10efc666dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713049, "uuid": "484f0005-b2a2-4da4-8039-529e2dd91372", "comment": "Malware payload (Mirai)", "value": "2b6fce41cd72fe6d40ae36cbc202f498153cdd51fb799b279da985d3bdb952d1cd044998a41a49a28e9ce9bfd0fd82ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713049, "uuid": "6e994086-56c0-463e-95d1-0dccbd31b2a7", "value": "T16E539C73C8296E54D19582B4B871CB781B63B48082471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713049, "uuid": "7b2ca7d3-1027-48a8-8def-210be7ae8a9b", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP6gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYygQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713049, "uuid": "5a4ef58f-1efb-4dae-a2b2-f0c1b3de8565", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713049, "uuid": "ed05935f-30e1-4239-bf8b-7acee9aeedd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713049, "uuid": "799cd6f1-8634-45e8-892e-fc26e79566ce", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4024348b-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775286, "uuid": "0768e861-0e3c-4755-be94-c6e0df1d46fa", "comment": "Malware payload (Mirai)", "value": "6af4be64ec1e0246ecca535ce1cbcc73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775286, "uuid": "91caea51-1322-4f86-b6bd-16bd8a56d925", "comment": "Malware payload (Mirai)", "value": "350549faf559177c364f192f013dfa537fb33a5ff1e6ca3674abba5daf2cce4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775286, "uuid": "532260e9-8bcf-4b97-8933-9e6d0ee24e46", "comment": "Malware payload (Mirai)", "value": "a921813b7adf7398465f33b1f6d33d15f31142d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775286, "uuid": "51622afb-c9f4-4e0d-932a-cf5e0d296a67", "comment": "Malware payload (Mirai)", "value": "f66843d71556be31cca1a95240720067cb1511d99386f5074d927e467b5e532698d04213a0ad6cd32c735640b75024d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775286, "uuid": "1128ff0f-2fb1-4d83-8209-37fe7e6fcfb9", "value": "T10073F1A2273D2BFE61300AB6395DC9853E91CFFCC96E5923420D8724B925A442BFC54E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775286, "uuid": "c1152f94-c15d-4396-87a0-bf91642683ab", "value": "1536:hWUcXivqfnuon+Mm8vC1+zb5+LVuidny6vWPkrP:kU6ivom8vC6+LTdnNOPGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775286, "uuid": "76a73dbf-07c4-4cab-8e4e-4721c286c0fa", "value": 73676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775286, "uuid": "ecc8a3e8-df75-4bf5-acfd-f7e49d086de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775286, "uuid": "2ea4649d-3025-4dd4-a513-c350197d4c76", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387ab814-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775273, "uuid": "132e82b9-211b-4eff-a546-8447d29217f5", "comment": "Malware payload (Mirai)", "value": "c9d58c732ddb190df6003cf67b6b458a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775273, "uuid": "643a2f94-f7c6-4a21-a835-9405444bf085", "comment": "Malware payload (Mirai)", "value": "355643ac8395f5a0778ab43b9e02a2271693bc1397ea0d6aa6b2d56ba3be8406", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775273, "uuid": "b9374514-ebf7-4bc0-8118-2c7a5e06189b", "comment": "Malware payload (Mirai)", "value": "7aa1937a9ac2fbb6c16e58c700b1aa0f2755400a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775273, "uuid": "7d7b08c6-8de7-4c24-8ae8-1bc922ca6969", "comment": "Malware payload (Mirai)", "value": "1d6b9d2f766bdb1c59d20c9162f75e447b05c670b71332236a7661678a3b5e50b5c1ad291306cb993bcb3737569b2638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775273, "uuid": "26da8d39-f5e5-42cc-8473-35a490e14f4c", "value": "T17923F18381EADBDBC0A814311EEFBA491914E91DB92742F378B0E4F89045EF921694C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775273, "uuid": "306faa10-7843-4113-ac84-e3ca91e3edb0", "value": "768:XMVFZ8PdT3TzXvlULWd4OTkMJdK8Z+FGJZeoCtn1Hp47QAu0ALZTCh9nbcuyD7Ux:YunXvlU84OTkxAypMQAush9nouy8HyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775273, "uuid": "674c40df-856c-449a-b45a-952d47374a5e", "value": 47872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775273, "uuid": "09028303-f735-43c7-9a6b-669e259fd4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775273, "uuid": "468522c1-8c15-469f-bde0-bea661e4c233", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1832c7c0-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718096, "uuid": "23aa8a10-2cee-4339-94d6-1f31dffe8fb9", "comment": "Malware payload (Mirai)", "value": "651626c1c2f2a079d72bf02c475b4b7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718096, "uuid": "c1d8ea1b-bdf8-408a-bb62-80a5efc24fa0", "comment": "Malware payload (Mirai)", "value": "35c7530cd117f5f65ffb019bdae016d9f3bf187d1a74430eca9d73d89d041d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718096, "uuid": "b3fbbf1c-659c-47d1-84f9-33e2c793dd60", "comment": "Malware payload (Mirai)", "value": "7cfd2d3d8f62a589b046753b71ce70b0b5f575d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718096, "uuid": "803c5860-2b42-48ea-8233-dc1781fdf57f", "comment": "Malware payload (Mirai)", "value": "5b278a734292f439f3da0bed56bf54ad84cad96e6ff06cac986a7192a8bd38dca3e113fe4afb69c6f238dcc1e237faa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718096, "uuid": "9381aa37-0b29-44c3-9724-6498df0f2f3a", "value": "T18FD3F809E9506B29C6E271FBFB9D52CE33271FBDE3EB3021D9304B9123C5A964A36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718096, "uuid": "9a8ffd9e-2bb8-46e0-9bf1-6b9f4b3f8d4b", "value": "3072:0qfnVTLfkVUTPa0g8xdoBqAA0gTLKQ4EiQv5h8p/7JO:VPVTASTPa0jxeBqAlgToEiQv5hAJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718096, "uuid": "495fc90c-01d7-45ff-b573-6cf39492e5d8", "value": 142344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718096, "uuid": "ec32cf4a-8809-42ca-94d7-4f413183f57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718096, "uuid": "13dadd91-569a-4a99-a906-ff476acd099b", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2b9bc8-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717166, "uuid": "18ab65e1-d71e-46af-8efc-e2caa6ee7951", "comment": "Malware payload (Mirai)", "value": "6cf5d75f8b2c581186509b21e4585641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717166, "uuid": "7c2d7de0-8056-4a5b-81b6-8dd0d9f2401f", "comment": "Malware payload (Mirai)", "value": "35da582c4e1d6ce099cd0376b4cc707c90a3014addedc213797f1fbc80fe3998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717166, "uuid": "623061ce-2c78-4871-9255-0f705222b8a0", "comment": "Malware payload (Mirai)", "value": "8894f233c0973855ca27763d6a46a57f6b999762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717166, "uuid": "22623175-fc86-4f85-8a93-fc2eea45ef61", "comment": "Malware payload (Mirai)", "value": "917cd4435d33e1b479fb098d063e1906b40002dfbf95caaf453066c94463892ee3adf7922b3805cc21330d8475e1d7a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717166, "uuid": "38387400-6535-4d08-a5cc-e996c1a6a9ce", "value": "T1F2B3E84E6F319F7DFBA8C23447B39A21975823D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717166, "uuid": "ebabcb63-82ee-4ee7-860a-b057212a0f9e", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4qPrs9j4Zinyk7+TeVedVPneQBZN011aD:gni50poFfP49j4+7+Te0dVPZ011aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717166, "uuid": "f03c01ea-8c00-4606-bbc2-c4c530444c16", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717166, "uuid": "a8d07159-d2e3-462c-b90a-5e89955220cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717166, "uuid": "4df1f8fb-4a3c-4f1f-b631-692b9d658af8", "value": "ba1416203b44e54b743127aa13e638095866129b9dd38cfaaa4ca8638b63b14b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44bacb3-7358-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782695997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695997, "uuid": "e915d89c-720c-4b50-b957-c66e5b2832f1", "comment": "Malware payload (Mirai)", "value": "7c0e6cbd00bc97207eaf33d4f2bd8448", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695997, "uuid": "6b785b51-33ee-46cd-a5f3-de9ba7e7e9d3", "comment": "Malware payload (Mirai)", "value": "35db02ed203cd01fa002d8f8416f32236338cf3c8352adc4856bcca60ebba2a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695997, "uuid": "132d9ad4-9d4a-4189-bca6-927e2d78a007", "comment": "Malware payload (Mirai)", "value": "70edc8d0bcb2747e9868387725180669b200f84a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695997, "uuid": "5b89fc5e-b884-4c84-b46a-b210c166c07e", "comment": "Malware payload (Mirai)", "value": "efad1bea310b5b502b09517582e4648740672c56a79f23d7065de1fe5bd4f8c8530f59be172acf9b8eeab4f8ed9b5c70", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695997, "uuid": "597e1eef-915f-4271-aa9c-7dd743d8e294", "value": "T1B701CECA4520BD80A01ECA1E62D751D0B422D3CF05560FA87FAC5D2DFB9C610F02AFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695997, "uuid": "57cb683f-6b0e-4521-ae6d-be8ac1861078", "value": "24:kXCKysE2hi0ziQvZohax868c7aaStWbdd7:e9Qp+MsSzc7vStWT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782695997, "uuid": "14785834-bcd0-4d2b-9e8b-7a4a0b447c5d", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782695997, "uuid": "bb5523f6-2349-467f-9b15-72ed45b3e323", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695997, "uuid": "0c57e7a1-94c1-4990-be82-7835ff9f6af2", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015c4c4a-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737814, "uuid": "f28ed214-d25b-44de-b57d-bf61e5ae7a44", "comment": "Malware payload (Mirai)", "value": "62351183c633fac5ff64adaf937b3333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737814, "uuid": "7b271159-a8c7-4199-9b32-b059fcb51319", "comment": "Malware payload (Mirai)", "value": "376875ed27e235fa7619eb29af5573920bd92c33419473e888b0289a58018e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737814, "uuid": "e0774f9d-c4ed-4b76-8762-9437ba7724c6", "comment": "Malware payload (Mirai)", "value": "3b6c974d5549638bafb071c5a047dac86936c833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737814, "uuid": "4d7edc9a-0a9e-4013-ba5d-fd016bd731fd", "comment": "Malware payload (Mirai)", "value": "049122feab5d80a03be0cff884417ba5b4c60ebcc4ced41b95fc676989db014b8f3df65200a1f717170d3f81c338bd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737814, "uuid": "72d90097-cbeb-4950-a430-8fa6b865021d", "value": "T1BB833A47B981D0FEC499D03887BF7537C923B47E1239B29A67D4AE262D09ED01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737814, "uuid": "9dcd51c2-f78a-4af8-b337-c50111548a79", "value": "1536:0THF5amJjfczdAyI+W1KYAEVkCkj6Rv3U8GbdGrAyvTEol:0THJFczdAyc1KyVkCdRvAbdGrXTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737814, "uuid": "2abe2200-ce62-47a9-8dbe-66868c3d147b", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737814, "uuid": "4451dab3-2161-415d-9144-14eeb3469aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737814, "uuid": "8535aa42-aaa3-4785-b473-811766396b4b", "value": "429fb76f3fbe3184da2f3997ae1dee40c1b8890e474b4d3c67aa2302e6307349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841a6c72-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760368, "uuid": "18064052-356f-4d2d-8076-601510f1bde3", "comment": "Malware payload (Mirai)", "value": "12c4a00e829c87ab5ba5fba88971d880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760368, "uuid": "4943548f-f9ce-4eaa-a647-af0bc7e31315", "comment": "Malware payload (Mirai)", "value": "37c3bce4bc35fc0215acd0cdc4be0b93ce1a5fb11b78f94d7e29bdf4dcc19057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760368, "uuid": "fbc3d660-43f2-470e-acca-3a100bdfc9b5", "comment": "Malware payload (Mirai)", "value": "ca64ee34bf16def2b5f6b0642ae688db1aa50902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760368, "uuid": "6596eb08-2b17-4f3a-bb4f-602f06e31dc4", "comment": "Malware payload (Mirai)", "value": "e2d82a4092f9e34aa51884838a1fb1c0c3b8d7b5fa254d4888182501d67abc60fffe73ab289681923c34ebf06443d209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760368, "uuid": "a15fd264-60f2-4138-abea-e5f1dc919b8b", "value": "T111630227501BF9C1E2604CF7A7045909CC600E7B66CE21932AE6C519AEE24AE6DAF54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760368, "uuid": "35e32fc1-fe9c-49c6-8164-946d47ee8d26", "value": "1536:iExWIQZDwwfBpKEsdObgqrHUyFDx0LNyJRZKCgO/oF/Ra:etZDPfP1sdog4x0LNsot/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760368, "uuid": "b12dfe79-179a-425c-82af-6eb812f85e32", "value": 72996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760368, "uuid": "f0bc5e16-678d-4010-8092-1aab8d11d7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760368, "uuid": "9a2429cb-64fe-4567-80dd-2d3233d62acc", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4ee029-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782736331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736331, "uuid": "10392b29-01d3-4949-8fa4-34b1a870a0c6", "comment": "Malware payload (Mirai)", "value": "00ed636b8c9224e0dd93804a7c1ab6da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736331, "uuid": "a2d71d5f-b4e5-432e-b9ec-ffbebf8bd71a", "comment": "Malware payload (Mirai)", "value": "387ad806f870f7680054bfc09a8869f614839e57e694886184075094cc83bb7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736331, "uuid": "3aa0be89-04c0-4e8a-b728-ad44c5f74750", "comment": "Malware payload (Mirai)", "value": "dec707416834c7553d9b0c6c92e73ccbde2ee21b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736331, "uuid": "b76704e6-32c0-4c1f-861a-375d18235a17", "comment": "Malware payload (Mirai)", "value": "5a6ed4dd71cc66b3d8161e5410c4be42669faaa8f7c6a11d1770f465c5788d1e999da62289b80610bdaf513afe9b33bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736331, "uuid": "985fdfb2-355a-46ac-9e28-2baa78290984", "value": "T1D3C3E649FE45A72EC3D272FBFB6D02CD322E1BADA7EB31129A305E9133C56915536110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736331, "uuid": "9bd9b103-be24-40c6-9085-8e30041b8e29", "value": "1536:3dN+JWy5GQNcUkoJtWrZ5x7vvJW8dPy4ItQi2SaJDO1tgbXax/9tEYEWe6W15h8D:vS3u5QdtDaZKxVtErS65h8p/7v26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736331, "uuid": "3cdb5a51-0645-4d96-988a-0aa51a7ce345", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736331, "uuid": "93874c17-abdd-40d7-8c39-160883a53ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736331, "uuid": "92b603dc-5c6c-4d99-b730-a5ef1d697acd", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1f7023-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721352, "uuid": "480dbada-993c-4eaa-9c2e-d6287cc0b795", "comment": "Malware payload", "value": "266065da4bdd0c9865ffb9c8203bbe80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721352, "uuid": "8c6e8174-4bc0-4e28-8ca0-874f78172acd", "comment": "Malware payload", "value": "388573d00f5ea1f1d0a7a60affe6e40da5924f30eb777072651fefb6c7f6e229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721352, "uuid": "ca9a5af1-b1f7-4e9e-a1ea-d8ec21062b4a", "comment": "Malware payload", "value": "9c3196e9e53112f560f3258a9fffecaf58638798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721352, "uuid": "0ee5dd2d-ce6e-4108-a2ae-8970d6940e96", "comment": "Malware payload", "value": "4bb94dad4a1a6f4226f82dd5d13bb672f1a3d55324208e314fd4a511f7003c73a4fec5851347fff70e000171881c2b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721352, "uuid": "fd5b5a61-bbfd-4628-ac5c-c7ba1fa84dbb", "value": "T1EAE733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721352, "uuid": "b4f66771-171f-4b71-91a7-e12c6195428f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721352, "uuid": "f7ecb758-415f-49ca-b475-8073ca59b10d", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNy:jdPJKrtOsHtAsg7lxrmeVlQFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721352, "uuid": "89365d57-94e3-4f0b-8446-ffc180ad8e7b", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721352, "uuid": "e4ceefe1-8c69-42e3-81bd-c04e23d21a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721352, "uuid": "415f297d-b5d1-44ba-b443-c8b5a0e6870a", "value": "266065da4bdd0c9865ffb9c8203bbe80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472ee96-73b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (751Stealer)", "timestamp": 1782734733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734733, "uuid": "23330854-a532-45f1-9732-4e0d5716cdd6", "comment": "Malware payload (751Stealer)", "value": "58395c49c6c6f66cf13ee86fc4567898", "object_relation": "md5", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734733, "uuid": "ea49bd3d-d03e-4f37-ae78-e50edd90899e", "comment": "Malware payload (751Stealer)", "value": "38f24a3c159f733c8f29820edd2a4f77a6218018d916d3c91db14da70848039f", "object_relation": "sha256", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734733, "uuid": "66ede445-0faa-44d2-824f-cc932ab35293", "comment": "Malware payload (751Stealer)", "value": "553d3d6598aacfb2c43e8f1450025807ff3eb330", "object_relation": "sha1", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734733, "uuid": "65e51cef-9275-4a0c-b8e5-71a75542b325", "comment": "Malware payload (751Stealer)", "value": "373535c0886283448403e759a3ea4a052cde75dd8f77ce8fce8562e3bb934f466c8773d20705df5d2e225ca8d6574c59", "object_relation": "sha3-384", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734733, "uuid": "6a6676e2-5787-43cb-8148-b04d9bcfd509", "value": "T1AF85F106A7E114FDC1AFE134CD625502E976FC9747649DBF43E899A12E333808E7AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734733, "uuid": "d8917274-75a4-4445-a23b-8031d701c71f", "value": "8d8029e87dbf652ff8d7bb1768ceef69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734733, "uuid": "e142ae21-e7bd-44f0-b470-ad070295d54e", "value": "49152:9xmWKdEuKOulAvMaHVv/1kBtjMHrF8GB:9xLyKOusMapKB9IF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782734733, "uuid": "9cd70eb9-64a3-47e1-abff-4eaa34e31bf9", "value": 1719296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782734733, "uuid": "83a62f78-fbe2-4c29-9bb5-67d9d3e5e869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734733, "uuid": "3b7bc14d-f0b6-4ed3-b45c-17f3e4f2bb47", "value": "spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8004420-73f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762602, "uuid": "657b8693-3386-4997-b3dc-c73762b68780", "comment": "Malware payload", "value": "764a37017cca12ec2aca9048333a7061", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762602, "uuid": "437faeef-a999-4907-b7a7-e0e8cb153122", "comment": "Malware payload", "value": "3954113141162e4351f448b06f9823323e3f7d78ea8f4d3ab41b2d0724dfcc7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762602, "uuid": "4022eb23-f556-40c7-a3b2-ba0e96e723dc", "comment": "Malware payload", "value": "1c06290fc004f0aa4462894d150d7ce018946f0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762602, "uuid": "e542e007-6595-424f-b352-694df8d88254", "comment": "Malware payload", "value": "cece4164c911ea25ed1ccdf9f296b2a9d1c6105f689739b70121550bbfe1744b8d6d29e5bc4eef9b8ec64fd70afb5d25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762602, "uuid": "91e7e39f-4b52-456c-bf88-12c7a7c859ff", "value": "T17725028FF2CB1D6454A252F0CC179E8B70BAD8DA478D0A924F55D1A57A3077CC8FE829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762602, "uuid": "c90ca8cd-8151-47b9-9354-a1b8ce51a029", "value": "24576:3+wOM3nA1FwPzr8m13Q7yUpkifyC/DDzO76ZRH0W+4gCus:tO/6QmBuRy4D3Oo0WWCus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762602, "uuid": "c5f3597e-513d-4158-a805-0b0243265b6e", "value": 1001422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762602, "uuid": "ee8b304a-ddc9-48bd-af28-2accf2fd3459", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762602, "uuid": "2e4fc07b-75de-48a6-8465-aa54609dd1ca", "value": "AULOZKRSSHZPIEMM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b97e6c-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760374, "uuid": "e9bd349a-7ed0-4cdd-a070-0e9cabb0e2fe", "comment": "Malware payload (Mirai)", "value": "5bb41fdbbfc8783b324d5055aead9317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760374, "uuid": "2611f92a-aec5-419c-9300-a81e3bc8677e", "comment": "Malware payload (Mirai)", "value": "39c0aa8e83774e185751a6b9633a97042b54341a4d2b19dfefec48f0df70201a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760374, "uuid": "c695797f-cc32-4e25-9019-5a62ea63e1db", "comment": "Malware payload (Mirai)", "value": "ffe3fd8fefb0590f29107a9e817c474d06b89d11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760374, "uuid": "ea880704-dbce-4834-b149-858f25e69b76", "comment": "Malware payload (Mirai)", "value": "c34702366a6f4dcf292ea457695f78e3298f9ee2ec21cf6180778f07bb5bb6a0fb9047bbf4ace89a710c618b801a0505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760374, "uuid": "3c9ab281-ddb0-420a-97a0-55f0eb2a1d43", "value": "T1F933F17BEA5C2549C9CD3CFF91A9C6DEEAF0F2D4A38F074512904CC43A60992A5A413F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760374, "uuid": "5ff15afc-413a-4292-8693-940f949b1c16", "value": "768:Zb4Ul/F2QUDqPofUxtpXG9xZHzBYscsOCul9eU9BrbtHJfdvgEwaGM4CxruXho7F:lBKAof8at5RVulpJfhx2CFuXho7Gd8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760374, "uuid": "a83de3c0-8277-465d-a713-4b05f139a95a", "value": 50460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760374, "uuid": "50dba1aa-35c8-4b79-87e8-61ca84bdd687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760374, "uuid": "a7a8dead-019c-4378-b8c6-da6434b5eb71", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b904bf5-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718128, "uuid": "12368881-2245-435f-ad61-53536d1802b4", "comment": "Malware payload (Mirai)", "value": "6ba3987d46e1f69c3126bb5c889d026f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718128, "uuid": "89f31988-a346-4db3-8a78-f8809679dfcb", "comment": "Malware payload (Mirai)", "value": "39c8e8b5c4e7b83547efee1358907129006cbe0ca7cdafa4feb14e2574b64130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718128, "uuid": "6f7f4525-87ba-4677-93c6-2c87442c702c", "comment": "Malware payload (Mirai)", "value": "9a316ea765ba5d87c28b878e4a214af8cfc1610a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718128, "uuid": "25d0c57c-e54e-4e83-bd50-bd42bce2d292", "comment": "Malware payload (Mirai)", "value": "5aa7582add3af0c2b7bae5e4ee1b63020a6cd5496028352fee43add25c952e2dbd6b0c163f98886a7a4b490c5438b6d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718128, "uuid": "68ed0257-b771-40ce-aaf0-efd35e941a86", "value": "T1D4833A47B98190FEC499D03847BF7137D923B4BE1239B29B63D8AE262D09ED01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718128, "uuid": "ee236f05-bb4c-42a0-af43-896a9546886e", "value": "1536:MqbF7IdAcsgpY+W1KYAEVkCkj6Rv3U8GbdGrAyvQEol:TF74AcsgpM1KyVkCdRvAbdGrXQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718128, "uuid": "1d9f6310-912b-488c-9632-92dd8bdd23ec", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718128, "uuid": "3fb57054-c48b-4f82-9dbd-0dabf44a445e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718128, "uuid": "c0e26e54-123e-4195-973a-7a15f28471c6", "value": "113adcdfc3cce4648aef6cabf2bb7631a7b5e53fbc505f887a0bf2b130b88aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3406736-73bc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782738972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738972, "uuid": "f6eb942b-717f-4aac-ab50-41f8d6a1e21b", "comment": "Malware payload (Mirai)", "value": "504456874f06f96bae1f6c0a4224a7a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738972, "uuid": "7ab453ed-f60f-4744-ac78-87663083d2e9", "comment": "Malware payload (Mirai)", "value": "3a9fcdc37cbb6242edc8be711af6439d2b3cea2cff6c0bc225fd01901e5050f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738972, "uuid": "737f0916-9846-42e5-80bd-e30dd4e5542e", "comment": "Malware payload (Mirai)", "value": "d6600cecfc37345444a571b65e6d4cc0a7ea76bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738972, "uuid": "79839161-8209-4be8-b1fb-cdef9a4ca487", "comment": "Malware payload (Mirai)", "value": "8a2f777a09a868474f7a9ba89ba37072e7f8419d98a447d0cf485a29ac7bdc7be59e830114595c713985c59e1095e458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738972, "uuid": "a9692995-595d-44ca-844e-a33c43af1b19", "value": "T132F3317A7E21AF7FE678823107F76FB0C75521E326E18281E16CDA085E7428D185F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738972, "uuid": "fdc31b34-7d2a-41cd-b0f3-af3305a43d50", "value": "3072:0eKOi5IyNN+dP8gaNghQ+4V5GV2tYFFZlgEM5iojhs4Y5Yuul/3S6Pa9hZxo5hMV:PD8KoIa5h0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782738972, "uuid": "b4d7559c-df01-46b4-a30c-83121c2ed658", "value": 172652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782738972, "uuid": "f15d12a1-5f4e-4b75-b379-105a692e9cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738972, "uuid": "c52fb92a-417f-4ef1-b055-7fdbf5db762c", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1d30d4-73f8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782764547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764547, "uuid": "4bdb3f84-6d49-4b40-9045-bf6891fddc30", "comment": "Malware payload (ConnectWise)", "value": "3e8f10a1a3f6d6bf023b25aece54de5f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764547, "uuid": "8dc45441-8083-409e-9485-bf2c48e5ca79", "comment": "Malware payload (ConnectWise)", "value": "3bda67cf2556354a1f93f0fd2079b5fc23357a663163e9d6c3726d204371c1d0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764547, "uuid": "4f5fc99c-59ad-4dfd-9f32-8c8a92f43b97", "comment": "Malware payload (ConnectWise)", "value": "30a99f09a639209e14b041e7e79a7031d78217e6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764547, "uuid": "4e5eed7d-c753-4df9-83eb-3082b1c189e3", "comment": "Malware payload (ConnectWise)", "value": "3339ce1874c713fbcc921a9c1871c5eb6c8cd9b78918b936499a0289392ef8e0ca7dc9ad343e097ab7fdd086b5502fc2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764547, "uuid": "f3f34835-bf89-4539-b3cf-3b7317ea3cad", "value": "T148646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764547, "uuid": "06344506-3af5-48ca-b91e-1a83bbd2faae", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764547, "uuid": "6283f3f7-a8da-4ca2-84e3-1619498b0f1f", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji97:p1iw7gryNkSV1hy1Z1u2JLu97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782764547, "uuid": "abb09cea-4bbe-4354-bcf0-5e1badbbd952", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782764547, "uuid": "2b6c93f0-631b-4bb9-839b-5560ec3b331f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764547, "uuid": "9495d903-3104-4a6e-a2f2-97b67225e09b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6efc26f-73f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782762574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762574, "uuid": "798e3e59-b9ab-4b46-beac-e4d4fe607006", "comment": "Malware payload (ConnectWise)", "value": "0b9961d509de73944ee47855f8cade87", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762574, "uuid": "fbeec2e3-804b-41da-a465-97fc2070bd34", "comment": "Malware payload (ConnectWise)", "value": "3bf99e77f24c2b7e4702388f4db9e98a6ffcce7581d496200bc088c8454e7447", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762574, "uuid": "6fccd9e1-4996-4bb8-82b3-aa14ccd09d7a", "comment": "Malware payload (ConnectWise)", "value": "14ae8591c13eca427f7d7065b44a229281cfc066", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762574, "uuid": "46c5efb5-883a-4a44-9517-190717a428d2", "comment": "Malware payload (ConnectWise)", "value": "9f2538275522f903f42b5acae76be87a84036a0f5314859f67cb63082fd9c4961979735fe9a53b06dce7ab4efbb2947e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762574, "uuid": "155562ce-17d5-4391-8ce7-8f840381819a", "value": "T11546E101B3D695B6D1BF1638D87A52656734BC049712CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762574, "uuid": "d42412ce-e044-4fdc-8235-306c7389e59a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762574, "uuid": "8663d5f6-8f03-4fb5-802f-ec1705dedcff", "value": "98304:rz3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zlZw:rCfefPlHxcp9ym3WltDUJVPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762574, "uuid": "0dd9e891-ad61-48cb-8266-c4180dcb0d33", "value": 5674848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762574, "uuid": "187b9817-6118-4838-a044-22664f313473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762574, "uuid": "5319aa51-61fa-4399-af67-011cb9337cc2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa420da4-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721347, "uuid": "bf78aa11-7fd5-45dc-bdb5-8f15f29ae8d6", "comment": "Malware payload", "value": "20cf7a48335f469bd4602911f82c2889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721347, "uuid": "a8c0d325-9a35-4eb2-b33b-9095f2249016", "comment": "Malware payload", "value": "3c259ee65974af10a2469938221c5c99774c7fed01362ac4283b9a296aba2981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721347, "uuid": "2acbb55c-357f-4224-81bb-43e438b5b5b6", "comment": "Malware payload", "value": "c89a6e3bb28b118a0e05a8cd0eb350bd332558cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721347, "uuid": "29ce73a8-d684-47bb-b625-8ac085c82878", "comment": "Malware payload", "value": "6512e7dc93077352473940e44c9819f2abf39052bb4240259d2f12276c4144c148fe7360f7a8a4df63d6b9c0da0a95e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721347, "uuid": "3f62e576-a605-4310-ae7c-613948c5e4b6", "value": "T121C71256E2BD00E8D47BC0B8C6574A17EBB1345513306BEB66A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721347, "uuid": "b8a678cf-9a8d-48b5-9986-dec977a71677", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721347, "uuid": "2548badc-d1e4-4ccd-a737-91bd8e065b4f", "value": "1572864:hIVoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLi2:hIVogVJnhVTMVEDjQKoFeLi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721347, "uuid": "4f43b58b-9c3a-4a26-a98b-96e2853a2962", "value": 52787538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721347, "uuid": "5aa45383-c581-4096-8455-3ce2ebe9f362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721347, "uuid": "fda87062-5228-48e2-bb5c-10ff699cc12d", "value": "20cf7a48335f469bd4602911f82c2889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11154711-73f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762322, "uuid": "f6be8b49-c2d5-4b10-8ba7-43ee52123972", "comment": "Malware payload", "value": "44775c5bffae3d05b732b3b36b83276a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762322, "uuid": "d8cc2fe4-0f04-446c-911f-49b1c5fa2d32", "comment": "Malware payload", "value": "3c7a52bfcdd2de7c1b9b8b291c6a9897633d66da189dbd325c495f8a76ed3a9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762322, "uuid": "3e08a5f0-a67f-468b-a517-fd56245288b1", "comment": "Malware payload", "value": "3b97e08ad97d5e30f219f31f6e48e02f36a5db6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762322, "uuid": "1e288ec1-b323-48e3-81eb-c002130d35b2", "comment": "Malware payload", "value": "14022414452b302c7450ed630cfaefd6092d2bb08ee774f38d3fe285d2b235e09144000c5d85277b553a56a240607349", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762322, "uuid": "f890d7cb-1eb1-43d6-b697-1072970c5686", "value": "T199169D0BBDD18979C4AA933589B706427B7CBC1D4B3627D32E50B23A2E367D05D7AB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762322, "uuid": "ce8705c5-6d92-4471-86a5-75edc62dbee5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762322, "uuid": "e2821b81-705a-4e11-858b-ad6aa165b9ab", "value": "49152:pO4LmYWM1g0Rwb12vhY+EcRMcWpIQnvwFwYJ3p0dVr/1YVty526:pLxo+m+VMppISvwFwY5p0dVrX26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762322, "uuid": "a6cd91c2-4990-4316-8c95-0ed999468bd9", "value": 4073648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762322, "uuid": "7974dd78-6a78-4981-9b89-03abc23a9aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762322, "uuid": "3bbc5624-fc2d-4c70-9aab-c8e650ed0b06", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1b3b6c-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770665, "uuid": "4b287e6b-efea-4290-9da7-61205e869a0c", "comment": "Malware payload (Mirai)", "value": "0428bdbdfb83870c2dc8504aa98cbfe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770665, "uuid": "3a528825-bba1-4fd6-8e94-a03e5ada0d0b", "comment": "Malware payload (Mirai)", "value": "3c90550ad4e64b9395add010732315f4fcb3dcd6bbea98d79432dbf5327401b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770665, "uuid": "9baaaef4-02ce-4548-a297-8b0ea2f86a90", "comment": "Malware payload (Mirai)", "value": "43b26dd9e5a7b8436bc7801e36e5c607fae291fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770665, "uuid": "d1a37aba-7dc9-4abf-9851-9b781e171812", "comment": "Malware payload (Mirai)", "value": "fb3d167858a3ffbb7955041e969505f51ca4d95cb32e61a33fb8efb21cae7c5bb00e0bf94bf0cf56a2a8d1f0eab4e992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770665, "uuid": "d7656802-7ef7-4201-b4f3-aeaf11faf714", "value": "T18DB34C02B31C0F47C5675AB02D3F57E1A3FF999021F4BA89251EAB5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770665, "uuid": "a9ee1741-1c1c-49d6-8f1f-e1aca5610f79", "value": "1536:bL4aGHx7PtazxJWsvNW/yHoslGEMzdbCLLOpHqDXzSbJ6ecKwgmkyRwPIe+hZ:buiNvHogMQe/b9BjsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770665, "uuid": "442537d9-65dc-4740-9d7e-2c3cf3e7320e", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770665, "uuid": "c768d960-084e-4c16-9255-efb8293a1315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770665, "uuid": "ee52c680-fb39-44e9-b149-8b5f24b92a96", "value": "nerv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ac42f7-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769556, "uuid": "5187a5a8-4424-4004-9151-73b7ac976fae", "comment": "Malware payload (Mirai)", "value": "34b4963a95e88e2ef6d35db7ab874546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769556, "uuid": "27067a45-9bf6-4785-b11a-3d437e85a5ee", "comment": "Malware payload (Mirai)", "value": "3cdd082de74b996e163163dbb7f6ee55911f7226ef5750e05b5fc14f7a26d48c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769556, "uuid": "d7fd7e28-1a11-45e7-a347-cab80a0dc2bb", "comment": "Malware payload (Mirai)", "value": "956763f0f577f8fcbe0624698db7d86bcd5253f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769556, "uuid": "749b5105-8f5c-42d1-9226-6f77331e5397", "comment": "Malware payload (Mirai)", "value": "1484912f9b4f7c3deafadaf77bfeeef544db7137c37b8d6c810874d9d659646a3c5d836ec5dcd39f8c244acec9f6baaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769556, "uuid": "915b78c9-8b98-4f6c-94aa-773d78816bb2", "value": "T16423F180969DADF2B6744438B1ADBA89770945FCC3C2732B457E33ADB38C24925E7944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769556, "uuid": "db165852-3349-4e1d-b6a0-572ec7799c0b", "value": "768:Ba4qwsMicR0iSKWLgP7ndLMnjq+fvg0gyDevicvH0QmQxJ4OURs3Uoz8:BqGR0/E++k4MDevicvFNU8z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769556, "uuid": "70dce81d-f55b-469b-a796-4fb50acbea14", "value": 49280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769556, "uuid": "e85065c1-aa1d-48bf-8549-36eefa92136b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769556, "uuid": "a6427bc8-125e-47f6-a9c9-f775274e3f13", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4271471-73c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782740718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740718, "uuid": "e02c75fc-8064-4e1e-9c1a-494e1973ff38", "comment": "Malware payload", "value": "ae095e417dd60f8515bbbfc561f39ffb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740718, "uuid": "2fee3fd7-4def-41ae-b3e9-6809ede0086f", "comment": "Malware payload", "value": "3d266ba060261b8e843926e426300d39277d2ee54497e0a6543428ba7ec6085b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740718, "uuid": "082805cf-f7d6-4bf5-99ef-de835f374553", "comment": "Malware payload", "value": "5fe7eabbd656245a2801c57e95dbbb269fe18a48", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740718, "uuid": "a4f1c543-4424-4aa6-ba28-74dc880c1362", "comment": "Malware payload", "value": "82c2c04e8dc90c4b88af6c9836847ee533d60ff9c9e4f374ec52ad7ddc023f78c7557c5779ab35e6fd74760f065676d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740718, "uuid": "7dca3bea-2fd9-44eb-8837-c21e0399535a", "value": "T1B0419F8723A0CD717C9A9967B15E45C079C7A48204BE6EE678CDFDE0188FC7CB500EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740718, "uuid": "39cfcfa3-8f53-4645-aa19-9d7f5f1a30f5", "value": "48:OpJYpTtpki/pPSk3p10pl9p/BupX1Joglp17pNn:OMH5BBM1KnjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740718, "uuid": "ba94bcd5-e0d8-4b5e-ab35-cf3ca92cafff", "value": 1897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740718, "uuid": "6c915322-7eed-4bd0-a5e3-aa8ab9bc6c4b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740718, "uuid": "12a0f389-c44a-402e-a1e6-583a96d77027", "value": "ghost.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c78a33-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721394, "uuid": "eabe63b3-220d-43a7-9e47-21198e949d01", "comment": "Malware payload", "value": "9531366d4d76afcdc1097a54d4662f81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721394, "uuid": "54fddf30-4ea5-49d4-abfc-6fcb0d5cccde", "comment": "Malware payload", "value": "3d4f625ac5524c8f84ed8aa60a0fbc772c982d6a10ef70f8077150a718cd1b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721394, "uuid": "b59c0cc1-7e3a-4474-9a73-2d29ff52054b", "comment": "Malware payload", "value": "63bcb30f816723c5259cefd1fba4f255086cb035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721394, "uuid": "737c52e2-5a89-405d-9ad5-a1c6bc1c1d23", "comment": "Malware payload", "value": "754b5e470881089b2c7eed48b4179f406aa0e0e64a85d240c7c9b17e9be90feea3d4df260d1a5b3ed7d3a92fbb9ad5fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721394, "uuid": "dbfdb399-934e-4dd8-b7cc-39a096a12558", "value": "T1C8C71256E2BD00E8D57BC0B8C6574A17EBB1345513306BEB62A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721394, "uuid": "59b345d3-0b39-4c50-ac96-2bed1d9cb8e9", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721394, "uuid": "41c7c654-31eb-4aea-bc71-9731b490fbf6", "value": "1572864:BFMoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLiM:BFMogVJnhVTMVEDjQKoFeLiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721394, "uuid": "bce877a7-6271-47a9-a868-607c6d9b5f30", "value": 52791569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721394, "uuid": "c77a2b29-911f-42f8-88a3-b5672b86878b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721394, "uuid": "243bf9c8-dc9f-44ed-a3de-b0f87881a3f9", "value": "9531366d4d76afcdc1097a54d4662f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b28c2cb-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713027, "uuid": "5fb5a5e5-812b-4b62-af2d-59177612039d", "comment": "Malware payload (Mirai)", "value": "8955f206f70d36700858acb4f170dba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713027, "uuid": "4352a81b-494d-4bd5-930c-a34bdc041103", "comment": "Malware payload (Mirai)", "value": "3dc74884aa66e1fff5ae707af5c05a3305f3e9979b679b4f5ceb3b66f3e201b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713027, "uuid": "a9b7adb1-4445-4166-afed-0b334f0341de", "comment": "Malware payload (Mirai)", "value": "689dab08e1ad74b02b16d6d8feabd8de96d21d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713027, "uuid": "15396349-7b75-4bf4-aa7b-fb6d33452d73", "comment": "Malware payload (Mirai)", "value": "f689fd8ed4f2cfa028106aae0ecc9028a072ec824d20b73649273376ec9a8b778b0bf7ac6dd668b83331a9f91c4e6fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713027, "uuid": "80d7d5cf-4ec6-40db-8f97-a22f3c09338e", "value": "T188A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713027, "uuid": "981017ea-ef16-4b30-9406-c98431ae11ac", "value": "1536:yk8NZJjWAanPccve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBan0zhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713027, "uuid": "0af22eac-1e20-4f44-a1cb-a93db38cc692", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713027, "uuid": "f861c143-65e3-4164-aaf7-6061634718c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713027, "uuid": "cc48333b-c213-415d-9921-607eb18a4b54", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8717dc-73ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760786, "uuid": "be1bb6b3-55b5-4b32-a99b-d89309c64da7", "comment": "Malware payload (Mirai)", "value": "5536e325412246526e4ee43f027661a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760786, "uuid": "6ec6f0d9-de11-40c3-81e3-5cb15639a8c4", "comment": "Malware payload (Mirai)", "value": "3edfb3a35b7ef0bfd3cf596355c553e470f3cb5c0050aabc6259731b30e6ac87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760786, "uuid": "7251c9a8-56b3-4f8f-aaa3-b4f4f85c8f31", "comment": "Malware payload (Mirai)", "value": "2180db5a60c856bb414e2a9077ab6049f2a13eac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760786, "uuid": "78b9b693-134c-4103-9a62-12de1a179e6c", "comment": "Malware payload (Mirai)", "value": "6e60786531b158de0fe5af7d2c2b55ed77b97f9407da6c65b29155018a311a45a1a04a43b4d3df36405c8af6475ee9b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760786, "uuid": "ba6ca751-d8c8-4ca6-a9dc-c9962d62dec7", "value": "T16DD43A55F8809F62C6C129B6F65D86AC33174B79C3EB720689254B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760786, "uuid": "50fc6bdd-22be-4965-9208-3aa7599b1089", "value": "12288:HbVePNowrXtxTm+TGg02BmX0lTRfDrPlWhegp7Sbu5N5:HbVeqwrXtTjdllfDrlWUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760786, "uuid": "047aaf83-2ab1-456d-a598-ec30bc2ca78f", "value": 623752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760786, "uuid": "b14ca087-c283-4b99-9ee4-e033257587c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760786, "uuid": "31d028f9-67ea-42b4-ad10-61061e8ca056", "value": "bot_armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9310d1ba-73c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782742354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742354, "uuid": "a068c546-582e-4907-a8c0-9f7d90c623c5", "comment": "Malware payload (CoinMiner)", "value": "1ccf41cfd9d85a0e6c49854e25d76ab5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742354, "uuid": "3f694ec6-6696-4d45-bd63-4d247dbe8873", "comment": "Malware payload (CoinMiner)", "value": "3f076a3e4a0733c630d58f790dc8b6422c5ee6344695f88987b14a060d721d4f", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742354, "uuid": "06382277-21e6-493b-96dc-30b48e55ff33", "comment": "Malware payload (CoinMiner)", "value": "f2a03400898271b8fb6310151c56edf1120b736c", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742354, "uuid": "cad920b0-6fd3-44ef-a089-f3eeddfaa398", "comment": "Malware payload (CoinMiner)", "value": "e5d321cb3d41307d3456268583c53b85ff357b0ca0e9091a5d58c03573d08bd6461228f6a72bd2da56fa11ec38408896", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742354, "uuid": "76da47a6-82e5-46e6-afb6-9bebbf630e04", "value": "T1E9F633A6A19545F8C2BDC738124B8562E4E7FBD357D13ABE36EC41342B17B180A38F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742354, "uuid": "5dbc4db4-fdff-4162-b170-b78fa18f6305", "value": "2bb2b30a5e1aae5f23150cc9cc094832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742354, "uuid": "015c13bf-674c-48c1-a173-6951ab008a37", "value": "196608:wUNOfkdxq3nuDmB8zzptR8HAf92Dwn/hENzt+WTGl3LLLyIOTD:eMLinQzptRmAf2wn/hAoH+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742354, "uuid": "4e316785-70e0-4dcb-b371-e77d1c057071", "value": 15369216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742354, "uuid": "f5624393-b576-4988-a8bd-1183edd0f639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742354, "uuid": "f3ffbb5a-09b7-41a8-bd28-6346fc49cdf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f292c6-73b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737022, "uuid": "43fb820e-c094-4e29-ab78-56813d442e4e", "comment": "Malware payload", "value": "43aa0d4c383ea3400d712c6dbca0f6a4", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737022, "uuid": "4694f830-7640-42fd-8a8b-9371cc53f895", "comment": "Malware payload", "value": "3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737022, "uuid": "26095060-9e68-45f0-b7f8-dbb7ff3e96c8", "comment": "Malware payload", "value": "eff8429985f73ac1dd8826ea60d9db85a6ee148c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737022, "uuid": "63b96bd6-60db-4638-b8c2-543064ff8504", "comment": "Malware payload", "value": "98b099b362c67d72247246f27e31989b9fedaa07e037d3a15b6fc0a515c471d80fcd59bdbba3f2296e46019f31b3511c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737022, "uuid": "b87d0c4a-a861-4f59-b666-ad25ed8e6e3f", "value": "T17101860F55517122EA4EF7772411AF9840B9F11395D06C999D14CC8A9E4346C076178A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737022, "uuid": "bb7e8f95-2277-4878-9fa8-cbdd6a2223d1", "value": "24:99B6YXRXMcuw1fRYorO1+gD4iWcKqovr4IK3a9OQqwe9:9BMcnq5Or473a4Qk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737022, "uuid": "91ab4d13-e236-4f09-9781-efc462f3aaa6", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737022, "uuid": "d9e8cf7c-1486-4d7f-804f-d949aee19aee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737022, "uuid": "1b6da93e-5995-4955-9bae-dc27b425f550", "value": "photo295825092412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b673e1-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701153, "uuid": "384eb643-06f1-4df3-9a0c-7d9a3e44a6c2", "comment": "Malware payload", "value": "617602ded18651d71f0089da4773bebc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701153, "uuid": "5d6843e2-67fd-41e7-bcc1-f05b2c18d1bc", "comment": "Malware payload", "value": "40ec689602bccb8bb281937ae0d687d0b9277a3378d2135e2c82427c4f8ba233", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701153, "uuid": "94fc5479-a229-40a7-ab1c-e9c4fce704f2", "comment": "Malware payload", "value": "47d8e3c377e70eef5c16e314fe60a0c73542741e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701153, "uuid": "2ce0f72e-903f-446a-a461-94cbf61988fc", "comment": "Malware payload", "value": "bb0ecb48573e97bc069cbecf9684b583e19462fa8f7d0f5a34467b94ae54bfbfa34bd49827cd16fab7857460cda9be72", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701153, "uuid": "97cbbb09-faba-4cda-9e36-188547cf988b", "value": "T174A2AE21B4044F6D7D65819334BE0240DE91969B43D0ECF37F92D6A39CADC2AAC2E4F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701153, "uuid": "d1507963-cf05-435a-8479-78153a3aabea", "value": "384:3EvAzJTEB9ETObdvINwe113ip0xFEhKTMVTNQ+vZyZd8qbKqGCsfqIUSB:3E4zVO9ETObtV8jmKT6TNQ2ZykqbBMfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701153, "uuid": "1cfec11c-4323-4356-9439-efe54757d358", "value": 21607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701153, "uuid": "9446eabb-b966-4f59-8946-29869b150e2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701153, "uuid": "137e766d-d2b9-4e40-a171-03a22cc60605", "value": "ubeqa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad817a9a-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760437, "uuid": "ec5793e0-128f-4756-9fe5-9f553bc561d8", "comment": "Malware payload (Mirai)", "value": "07019e16ff9af0e28ecada863404faeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760437, "uuid": "90db8cc6-6fc2-4fc5-91a3-305e0e28b0e1", "comment": "Malware payload (Mirai)", "value": "419ce5ebe81b76ec72a21e495df2b6f6c58209ed9e0614b096ebc2d2a07fa093", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760437, "uuid": "d1106df3-f845-4edc-a110-92beb7acdfe0", "comment": "Malware payload (Mirai)", "value": "64c046bc2da2220a74644fc7b392611a0bbe4ddc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760437, "uuid": "63e36bd8-307c-4974-950b-9c2bf47d9a13", "comment": "Malware payload (Mirai)", "value": "9fe5e0520028d996b8443c7c9d196b8cf964ce4c4b4de4679c32a27fe889f2511af9842e65244a6a6bd1c86e19b8c552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760437, "uuid": "12830e8c-5760-4009-b7fe-04b2ca835989", "value": "T199E3E71E7E618F3DFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760437, "uuid": "8e001b36-8a4a-4cbc-be66-f92e50189a80", "value": "3072:RkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB15AnfxbAefe:GF+6uk9hckUGXZy9q/uleW0AJsPQDJHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760437, "uuid": "a4635773-2686-4a50-ad50-9c81e4c413f1", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760437, "uuid": "2f38d1e0-daec-4652-ac55-5fd6b4e4cbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760437, "uuid": "221c3c1c-92b2-4bc4-816f-77041cd8dc00", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64d9795-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737688, "uuid": "75a1e330-a67e-4faa-be6b-b1bd749d4317", "comment": "Malware payload (Mirai)", "value": "295542a9f2c52f219d003d54b6daf4de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737688, "uuid": "b994c624-9188-43ea-80b0-e4fb0d485654", "comment": "Malware payload (Mirai)", "value": "429fb76f3fbe3184da2f3997ae1dee40c1b8890e474b4d3c67aa2302e6307349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737688, "uuid": "7b46aaee-c875-44e8-a4b0-8abe8a8142d5", "comment": "Malware payload (Mirai)", "value": "65ab9e489983865263ae211d8f2c6b894b6adc01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737688, "uuid": "967147cb-2e15-4a19-b6ed-723369a3620f", "comment": "Malware payload (Mirai)", "value": "925667b05dd1455c08d6db09d399cef9f410041d293e0f4531b630661ad290ad33738b8bf6ab782da3f3d016d8e4de30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737688, "uuid": "da4d4ecf-627d-4bd0-aa8b-245076f5619d", "value": "T1B013F175A723D7B8C1F7A6F5168A8AD1ECB49827E80A1FDE0C50B4AC68BB1DC4D409D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737688, "uuid": "df29b903-c990-4adc-a4cb-35f1b2a30893", "value": "768:H201GjDlPCGZnkrgJT2Y3i+AgZpfh6L35IG+HN3dBx05o:H20wjDlaanG4QgZbY3GHNrAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737688, "uuid": "7696ee3c-9601-4a1d-977c-45a75aaed562", "value": 41996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737688, "uuid": "2d66108c-42c0-4a4f-b9a5-0361b5fd32c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737688, "uuid": "a54fd599-c4a4-4ba0-afca-1df57f063ae4", "value": "429fb76f3fbe3184da2f3997ae1dee40c1b8890e474b4d3c67aa2302e6307349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da253ae-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699610, "uuid": "eb341f0b-6470-49c8-9e06-8ec79e0f583c", "comment": "Malware payload", "value": "ea07c9c94021f34cb999b26eb4d3adb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699610, "uuid": "c64f22da-83e1-4c87-b245-53e29ed90cdd", "comment": "Malware payload", "value": "438188975ca63bf62e1bec7d77b2c687a2c70e1229f2aa898025b23af8cb9f01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699610, "uuid": "5fb98e67-3f6b-4ba6-8f30-34728c227ab1", "comment": "Malware payload", "value": "cd6c60326c8c31b39e3c9451b8d56e39d0d3b8b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699610, "uuid": "939ba21c-c06b-4656-9764-ff7fb038e572", "comment": "Malware payload", "value": "e00927c47e8c650d8986571c937745f5037796998252aa9414aecbfa1ac6b470b417cfb021087b4f055bf2a47cf96400", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699610, "uuid": "fc12d448-e4f5-498c-8424-c6116b7ec411", "value": "T10F538E7AF353152E2EC45EF99070A5B6E636BA13D0D1BA4AB1DD63CE1D000846B7B07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699610, "uuid": "caef822f-26b6-4852-b6a2-dafeecd91d0c", "value": "1536:cuRzCgl5sbSv9zw8haD0lW+oCX5pHDJsmyO85XRmklw/4EImPS+usoByc5p/W:TuNb6zJhaD0l6S5UL1Xl1EIm6tss/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699610, "uuid": "d359cc3d-9d80-4ccb-8e8f-ca595395684e", "value": 64132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699610, "uuid": "ac08e406-09e0-49db-86d8-b4e9cd7e5e2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699610, "uuid": "78dd5736-7b35-4444-9ef8-bffce63beb16", "value": "exawa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e9dbc1-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700078, "uuid": "ea8fda20-8b99-4d2a-b230-2417acb96049", "comment": "Malware payload", "value": "84e4492b1e8ca0e2f9ab5b0b21adc1b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700078, "uuid": "f7de8fa7-6c70-4abe-be89-9163f7ec9054", "comment": "Malware payload", "value": "44aaad8944f052efdfd67a3c3f53526d728c2ee6278ec9a79e6edc753d81e9c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700078, "uuid": "6cabf807-65e8-439a-b245-2667158f9c2f", "comment": "Malware payload", "value": "64d9411746d027330fc7f968e16f9d87faa06d5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700078, "uuid": "9cf86d18-3f50-49bd-affe-a50b22904d4d", "comment": "Malware payload", "value": "8346a9fdd4a0fad787c22a919da67ba4281cbd9a946bc4d3ae680d28b1558ea8c2d00af02a70b433bee6d000d9b9ccbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700078, "uuid": "08954c92-ef33-4556-8ab5-aba932216662", "value": "T19EA27D6EB3128B557DE7CF6B123629F49F706F3764D50FCA8261A8633A6D802DD210B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700078, "uuid": "14acac81-014d-45d7-ab17-41608bcf001c", "value": "384:uIswoWSUM/WXkxRLTVXbYuRf5zjpT+iEw3+LEomD3HIjWiUQRDg5kQlB/alrFb2R:uIswnMeSLRkSd1CQOLEj346kQlB/alre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700078, "uuid": "5f17769e-6954-4902-8a6f-f67814fae5bf", "value": 23232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700078, "uuid": "dd0f2245-1c99-412c-b775-8a766c3b28cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700078, "uuid": "56b42b1e-8bb7-4956-9cc0-8c9ee837d38b", "value": "exiho.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd2e380-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782713084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713084, "uuid": "e51d905f-428a-4576-9032-4646f582a6ca", "comment": "Malware payload (PhantomStealer)", "value": "251f99bf1a149172034c892dd2a59518", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713084, "uuid": "36e9dba2-0ed3-4cbc-af8a-08ea37c38c85", "comment": "Malware payload (PhantomStealer)", "value": "44f697e4a8b91f4188017d4f44df7766a9ed61e98ad0f5606f25e5effdc641a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713084, "uuid": "9a7304c0-9ffe-4f51-8267-149bdfd050f1", "comment": "Malware payload (PhantomStealer)", "value": "1f832b30677ae0af1c70ed5bf95f1ae2b9b5de9d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713084, "uuid": "2edd381b-a6d3-4d58-8473-272e59663b5c", "comment": "Malware payload (PhantomStealer)", "value": "7a4ef04be58d5665d76482152be3bb21e7c85aa65712259631d028f854a1cfbcfdf2a2dfbdac2e46e2222d5a31efcc00", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713084, "uuid": "c78bf031-d5ac-4b2b-8bc3-3aa22cc41de9", "value": "T1726639218328A572A62DD72CD137FE78454E704B24E9EF1D34BD4214BA56F47A38CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713084, "uuid": "bad02b2b-d2fd-4ebc-b134-c1d1ad653e95", "value": "196608:6QmFSiYEfSo90AkbJ2sCynPNxcJ1DCoHOqNl0LeSrWQmFSiYEfSo9S:CSiYEfRyPzKwoH7gXmSiYEfRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713084, "uuid": "e6891a5f-dac2-43dd-be4d-1caa5a8b9830", "value": 6736812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713084, "uuid": "8a2f42d5-6241-45e6-b741-2cdb5f496f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713084, "uuid": "b9b8f496-dab8-4982-8a66-ed91200aa1f1", "value": "New Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be263dd4-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760465, "uuid": "b9fbf4aa-96c4-4abf-8a5e-baa2753b799f", "comment": "Malware payload (Mirai)", "value": "2edfa7fc3c3d6148892aae48c9d642a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760465, "uuid": "6b4d9d48-6558-4d9d-8e91-b8a6d0e33ed2", "comment": "Malware payload (Mirai)", "value": "451bc393482da43903976b57ebbdb535887505a663b56c5120daecffda0a4f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760465, "uuid": "c2547186-0d62-4fbf-ab7a-7de626476c17", "comment": "Malware payload (Mirai)", "value": "c2e3d7a6841923acc1c3557b8810de19554c0826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760465, "uuid": "840828c1-7890-49d0-b33b-1a3af0b85786", "comment": "Malware payload (Mirai)", "value": "4d062e8da7eba8b398ba62d1b517cf114a8faa8d4ee8d0599a38b5b3d228fe23ccdda2b94da69f94fa55734bc7dabd3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760465, "uuid": "bb727768-6586-42ce-9bc1-2a312eaa3a5a", "value": "T17EB34A03B9C28DFDC049C038437EB536D925F0EE1739B29B67E5EE266D0EEA00B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760465, "uuid": "3584a7bc-d803-45af-84f0-3db146cba8ec", "value": "3072:5Ku4lbmjzXIei+vgQe59o05ELlCvTjiu+9QWGBWGRy:5Ku4FmvXIei+vgQe5bbjOt5Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760465, "uuid": "1f5d40fc-2bdf-445d-9acb-fdbcee59fe09", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760465, "uuid": "fc51580c-dc3d-4749-a0a9-9b6ca06734eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760465, "uuid": "ecd3f8db-f68d-4aac-a25c-e67c94dd9c54", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c177bcf-7379-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782709969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782709969, "uuid": "ca50f6b0-0515-4c51-97af-5810899b3383", "comment": "Malware payload", "value": "c6e10a4777757459a7dcbed56ffeacd4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782709969, "uuid": "6b8a962d-3b30-408e-ae9b-87cfbc142e96", "comment": "Malware payload", "value": "453d5fbf9f72a97fbca6cf799a61a0ebc916b72226c4c3926112ba1183b205a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782709969, "uuid": "0d6dee68-60b2-4df4-8dbe-ebea5de69760", "comment": "Malware payload", "value": "4921a0d5c9c93159c5ca3889308388e3aeddc93f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782709969, "uuid": "4f4aa559-b5a4-4201-9a06-6f1e3d19896f", "comment": "Malware payload", "value": "64e410d79225187303cb5912e16648ddf46797937b8dcb0e6f11a8644ab7000900427145cea339f1567d2157d14f5c1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782709969, "uuid": "51d7d9ea-e8df-44fa-91f2-9e804604610e", "value": "T1E1237D6516817C24AA99D4371D7F2F0CBDA983E6320492DD7FCA3CF28C59A9CD21872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782709969, "uuid": "d2c15b3c-da95-4f13-b975-a6422b0aedcc", "value": "768:HXRWNGxVAs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:BlxUcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782709969, "uuid": "b87e745f-609f-4971-b5d2-f3a53c70bf96", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782709969, "uuid": "4bc972e0-d226-4b1e-92a7-2e111af555bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782709969, "uuid": "51ff4888-bb44-4059-97f4-0854d1a1d3f9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42160449-7366-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701845, "uuid": "27d3cf77-eb4c-4c44-ad9a-f7b13021fe26", "comment": "Malware payload", "value": "4d8158ef2d23a1f71f59506ad3f00ab7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701845, "uuid": "f3b9386f-3c2f-48de-a104-83fcb475501c", "comment": "Malware payload", "value": "45584544686425ccf53e6d099c6a588adbd1dd6c64d84a4068ed861e5af87ef8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701845, "uuid": "9a6c02cb-5b2f-4a56-bd3e-f227a09c4277", "comment": "Malware payload", "value": "d62f3e6667f0f82ac01efa822cbc87b04249d1d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701845, "uuid": "06774653-c552-4db5-a42a-5f6128736fdb", "comment": "Malware payload", "value": "9a38193114fc1a38059a894caceaec115e0033c39cdd08fb3bc8a73b4410a4c08dc9fcb35641cf4ffb69d4291c951dfa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701845, "uuid": "fe7a7ab7-d975-4758-ac35-8ac1367f8d0e", "value": "T1AF03AE8871492CF4C3EF32C364DD115237DE04A2D3E87AACD358A62C579CA9D65B09F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701845, "uuid": "4705b810-fa31-43aa-bd6f-5aba44e8618c", "value": "768:2THh/2i6eqYl892dd0qA5eYCYBWsPog82enFKfjLNcOZ:2wiEYmAcFJAdnFKfjLNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701845, "uuid": "dbeeeb1d-e507-4079-9c0c-3ba5d7f9bfdf", "value": 40235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701845, "uuid": "fa2d2f34-5477-424e-8abb-c2d495db6220", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701845, "uuid": "07355ebd-b555-4bbc-ade4-a43d5cc5b0dd", "value": "ireza.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bfda3a-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721397, "uuid": "84af31e9-a877-4650-b34f-b7f9caa428d6", "comment": "Malware payload", "value": "a2efb1f2f8116be87b97c5956e46ea37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721397, "uuid": "3314ad2b-a03d-4cc7-8004-4da9a0c8b2c1", "comment": "Malware payload", "value": "462cb84f8cac8fa5fe9a70a09c883cdcce807ccfe9ae63d8dead06bb23de7b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721397, "uuid": "acf90a4e-d5f1-4c4b-bb5b-1169e9bb154f", "comment": "Malware payload", "value": "cfdf2583c44aceb0a140f123d69938dd7cd685da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721397, "uuid": "42c98e9c-18c7-45b0-929d-d878e84b60bf", "comment": "Malware payload", "value": "24d1d72fb1c90f6fe6403da92822cc564c46405fb639c12c174c2117a5854acae0ec69ee0d67d4dbc87d93eb37db3249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721397, "uuid": "d4eba2d7-875b-4a7c-abe9-9d92dd3d6616", "value": "T1D7C71256E2BD00E8D47BC0B8C6574A17EBB1345513306BEB66A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721397, "uuid": "e023f2c8-0f0c-4ed7-85d0-3d7d2d6ab180", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721397, "uuid": "e1e1a887-95d6-4b04-bffa-c3b64130a428", "value": "1572864:hIVoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLiF:hIVogVJnhVTMVEDjQKoFeLiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721397, "uuid": "3795802f-ca66-46b4-838b-2ddaad164346", "value": 52787538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721397, "uuid": "e62483d7-5b8a-4cc1-b751-b97e8b057958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721397, "uuid": "a79acaf6-ade6-4608-9a8d-32eaae13f7db", "value": "a2efb1f2f8116be87b97c5956e46ea37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cfc05e-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "2a721a6e-3320-4242-b411-24759b28b12f", "comment": "Malware payload (Mirai)", "value": "6c796337de99d73c22100826d0dda147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "df6a6c4d-3fcb-424b-ae0c-a68faa95f5bd", "comment": "Malware payload (Mirai)", "value": "4761538b84739ab042de484749e359402a9115faf3a4ffbf564d969095edd4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "a49337e1-2bb2-4ee5-8973-8b339e841f92", "comment": "Malware payload (Mirai)", "value": "48d4d49be00e7dfcea5612d3206802c0cff0b256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "e6fa787d-9ba7-4a9b-a476-1c9dc09ec007", "comment": "Malware payload (Mirai)", "value": "b24db04ae6553e9cdfaf14c50ab89041ab9631efb81f14d55785b895d972387e7caad947d7f2c72868df37eb4b164771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "dc70154b-255b-4999-abee-716e0acee99b", "value": "T1DFF2E126CAC85F66FF7F7EF075A5E2997F948F7D6399EA4260C42B050B01C46020CAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "0aca1f56-823e-4301-8173-37302cc54b4d", "value": "768:sk9hrdmlHU75149rLg4CbdALXgAANXSl9yy4uVcqgw093:sk9Nd6HaE9A8wAbgy4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713050, "uuid": "6319b1ac-a139-4f5a-b85c-f8a3dbcbc310", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713050, "uuid": "871206fb-6b6f-4c3d-a9c0-f716f0fdb5a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "4e0ac3c3-d7ba-4de2-b8e9-68a29b32fe64", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e288a883-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742058, "uuid": "840ae7dd-cbbd-469f-822e-6e001a161ed6", "comment": "Malware payload (Mirai)", "value": "f43d73c583727bd37a2bc5eee9434541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742058, "uuid": "6c3ca6f8-cbb7-4e6f-aef8-c31d8eb963d1", "comment": "Malware payload (Mirai)", "value": "47ac17be7522428a45ce0917a80bf7d9937d1ff88151458a7c9bfc95b6a77f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742058, "uuid": "d2a18f43-0f00-4e77-900f-e76474819453", "comment": "Malware payload (Mirai)", "value": "8aafc29ae09f7cb3f7f9dfe1f868fdd342bc0403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742058, "uuid": "27935ed1-c6ad-4756-94e0-32536887cf40", "comment": "Malware payload (Mirai)", "value": "655b2f7fb47a607f953b0091bb60d821f7db63bded0cebf927a735e68d9f92bec5cda675c645c9551761aafa368aad64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742058, "uuid": "a20f62b3-f59c-4ae3-87c0-53b5523440e7", "value": "T17D047D22FB1D1463C0934E715D3B03A7A375949146BAE60961087F2A1B33AF54E87BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742058, "uuid": "f6349d55-2cf4-4447-8524-502739a67a41", "value": "3072:vUZUboyYyYMAkBnG0kzqJcJK3zGHFpURho4noFK:vgio3/MhnGLGJcJK3zGHFq0HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742058, "uuid": "6be00e68-2cf2-434b-96df-c0110a120d4a", "value": 173400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742058, "uuid": "e5590af0-a2de-48ff-a39e-f84d7946754c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742058, "uuid": "7c3302b8-754d-456c-a68d-eab5f0b684da", "value": "powerpc.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0433ff-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769615, "uuid": "19d69733-8a21-4f80-9155-bd6f4d0ce4f5", "comment": "Malware payload (Mirai)", "value": "73ba1da9153523ca4d87af624166ced6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769615, "uuid": "ed412e10-acd7-4e14-b187-55cb8afdc603", "comment": "Malware payload (Mirai)", "value": "47b5c3a0a7cc16724f4d93f35492c3c21e311d1521d0d9a5e0c24f3676b13ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769615, "uuid": "8ee76c07-2609-479d-b45f-b550a909d53c", "comment": "Malware payload (Mirai)", "value": "1fc491131b566d39eb69e0d72461d15737094892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769615, "uuid": "87515e91-4273-4cf6-bdde-05bbb48269be", "comment": "Malware payload (Mirai)", "value": "efc91906b110d0a2f800863a066dca918e831bc74dc143779ae1b52dfa125fcf75aaa0142474e67ba1748ff25942924b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769615, "uuid": "517aaeef-7e94-42d3-a401-827569bb888a", "value": "T12FD32946FC824A22C5D722BEF92D218E331317B8E3DE32129E245F6137C659B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769615, "uuid": "010c32d0-5ec1-4b97-ad49-11ed8e2044d2", "value": "3072:whnw1dzzJI8Wse9Ygd7IafuDKxyCqiR/oHvc:+nAJI8FhgdMaEtCqUoHvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769615, "uuid": "7a1b0427-1839-43c1-8795-86e41facc54e", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769615, "uuid": "df93e2b0-6ed6-4ba2-993f-d263655ceece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769615, "uuid": "463d2155-fe1d-400e-84fb-635dfe89d314", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b1484-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782713050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "4be49743-c0a8-4d67-b3f3-abdb3a11099e", "comment": "Malware payload (RemcosRAT)", "value": "fb2619b8abf6715fcfab94d5b77715bb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "0907e777-094a-43cb-b98c-083424308813", "comment": "Malware payload (RemcosRAT)", "value": "47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "680ddc49-ed60-4fc9-8b29-0c4f38dbcd71", "comment": "Malware payload (RemcosRAT)", "value": "ff8592a6f254a3b95d0318e1edb1d058fc12e9d9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713050, "uuid": "24e67834-3196-426f-8de6-540009990980", "comment": "Malware payload (RemcosRAT)", "value": "4b6ee4ea20ffcfea021708d0db3283ddbbabb49ceb1915d06a045f92c380d6ae4d9f5d5db3c0bde42ebcb162e9a61a39", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "795f6190-3d2d-43c3-afe3-5358166ddc43", "value": "T103434C51DDE80B7A1E43076CFE91A951C6F8892C453690ECF3D9270E601E4ACDB7B2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "9c70c5b7-7b50-4ad0-af0f-b23f42cef522", "value": "768:COkTajXiRqPQ2hhiA4ppWlxPzsCdjzlQYz9pUt1WOOgUsmfnNAAsDTWQ6:jQGysP6BjWlBz3lz9pULx6nNAAZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713050, "uuid": "de9afb8d-35f7-433f-88d3-05fa3f158699", "value": 56063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713050, "uuid": "e4704785-1ffa-48bb-962d-9c45cee0b419", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713050, "uuid": "d9d12a14-bf8b-4e1e-b3da-aa2e5a25f3c7", "value": "HR Leave Schedule 2026 (Updated).vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789ca34e-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773233, "uuid": "a4b60680-4b99-4cdb-b779-db12fda806d5", "comment": "Malware payload (Mirai)", "value": "b3c3a2bc354092052327ef14aab5b4f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773233, "uuid": "5d967a1b-111d-4f03-8373-df64b7996911", "comment": "Malware payload (Mirai)", "value": "47f4697de6e24f50bc84f1325aae1436d0e19788f350bdcc90a3f3943a9728a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773233, "uuid": "9b6969ba-339a-44c2-81f8-b7c8640803b3", "comment": "Malware payload (Mirai)", "value": "29688c18726d8c190bb2d0a8f2ee8604ab354cec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773233, "uuid": "01692b69-2472-4a32-94dd-74da5b50e4c5", "comment": "Malware payload (Mirai)", "value": "df6d010c8a5f777aa542b705e8bc6cf7a1af64de22774ab0e6824d5beeb902097d5d63b60bc166e1ba50ad7f0a65c62e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773233, "uuid": "f767d440-6970-4ef2-b7be-3bfacd94d18c", "value": "T1AAF2E1315E1A3DE0E6B0AC7C517641C5E4A35BB1E17296FD674C8398B38C82612BE62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773233, "uuid": "bd9483c1-983d-4b37-9b38-1b6a70c4f263", "value": "768:+ZAb2jdTWDPtuRl//9ysfu/Gig+7pBWLX5F1ms3UozX:+ZAKjBWDPtuT/9ysfZpcWLX53zX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773233, "uuid": "60f91088-75ce-4ca1-b2da-bf12eb41c5c0", "value": 35548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773233, "uuid": "301a3932-a766-4595-aa31-718ee0b74353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773233, "uuid": "4e9139e4-4e09-46ed-904e-656b89df72dc", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89165db3-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "1b0fb7f6-9609-40b1-bc83-e62db6357e0d", "comment": "Malware payload (Mirai)", "value": "e362b3c962c7aace64f50decd1fdd1a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "b17ad631-70af-4b6e-af4f-b6bd7ccf929f", "comment": "Malware payload (Mirai)", "value": "48100a445c431aaa9f5bf37ae32c8868cc400e1e9c88191358f54c4e6a80652e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "73b81a2f-5e51-4648-b586-40c89fdd006d", "comment": "Malware payload (Mirai)", "value": "1c158a5fa08d2300e95ca475d833228f0b84539f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "0d2b01e2-4b20-42cc-b9f9-369a0ac3fb4b", "comment": "Malware payload (Mirai)", "value": "4c0774879e0190fff6fa62ef84030419b4d32616dfe6ede9cd7fb1a17bc2665626400eca2c5b36623de965296fbc4e43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "8626b922-e44e-4b1d-bb14-beadf41a0082", "value": "T137045B22DD25AF8AC516A1F0B1F18E785F12BD2548470FF9A5B6EAF44143EC8F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "9ad61cd3-e7df-45c5-b44a-00320f9561d6", "value": "3072:lHihiSY1K7VHjcML7+KAWzZQNLJWw70M0ij57nGx:lHihiN1KJHjcML77mww7Uij8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765100, "uuid": "34a2698d-ce41-464a-97e2-49480bcae368", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765100, "uuid": "1495b367-fd8f-4ada-95d7-b80a0fbb86cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "0d3a1356-468e-4501-9a11-d2e73382c98a", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8500b44f-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770677, "uuid": "1281d25b-6860-45f1-8636-b488a8e08953", "comment": "Malware payload (Mirai)", "value": "c272174b3d0141a6c45969125324e27a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770677, "uuid": "ff0b70e0-ed7f-434e-8ab7-54ea405bce53", "comment": "Malware payload (Mirai)", "value": "482698293d879600cb9b1b93c45075f77750102661fe8dd8cd97680e25ec8681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770677, "uuid": "c3d2ef72-9a17-4c55-b880-6d50958a0e89", "comment": "Malware payload (Mirai)", "value": "88a76684a2de53f261a54cfd3baefe447b22b0f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770677, "uuid": "7a69b428-57ce-40c3-982e-758d43977ea6", "comment": "Malware payload (Mirai)", "value": "283be81630145c5b99b3b91189f3ab23b3108fa08a1f12dc1b24bb3cb11312f8b70919c4bd5ed5467e7c4797d02db97a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770677, "uuid": "4dfd7d3c-6764-4304-a266-df6b8e9cd41e", "value": "T173B31851BC825612C6D612BBFA6E418E375623A8D3EF3213CD255F203BC791B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770677, "uuid": "f4baeed7-eb0b-4454-92a2-4ea0e8218f2a", "value": "1536:bjcun8lzTm/RWSimQAf3GVNUsdnS3qF4Z7Fo5YWRavLKjA/t5tt61rO4nl6DoRa4:bjcmam0SwNUsdnS3qWJjW+LEA/t5zD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770677, "uuid": "1b34efe6-dac0-4594-9e99-09099cc2aeca", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770677, "uuid": "a8036018-4396-40a1-9c92-aa7b4184dbbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770677, "uuid": "1b932971-5d01-49d5-9127-51ec5f364ccc", "value": "nerv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bcad20-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770678, "uuid": "95df9603-1fb0-4ed0-a0d8-6ff96bc32bbc", "comment": "Malware payload (Mirai)", "value": "39a8d266f551599ad3550dc7edd24347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770678, "uuid": "4c9681c8-db1f-4156-83d2-cdf40288f79b", "comment": "Malware payload (Mirai)", "value": "483ddab777936fca2b3fe7896c84987deb519e236ae41796eb35767f46bb38f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770678, "uuid": "85e46ae7-eca4-4e48-b40c-a618ed357ae0", "comment": "Malware payload (Mirai)", "value": "e8e604bfaad7ec3e27a1938398f223a36570df61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770678, "uuid": "95ccb1bd-e132-485a-a8ad-b731251b68ac", "comment": "Malware payload (Mirai)", "value": "90c6b7b05222c44e1d85a591c35cc232faf2020b2f6194ed1da32756930966e44dc6d121f160f6dcd65a2d2d2ad5afc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770678, "uuid": "51ad124d-0caa-4474-b5d4-771d2555d8c5", "value": "T10893AD33C52A6DD4E6519674E0F48AF81B63E10082671FBB59D8C5E95087EBCF20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770678, "uuid": "ebfccfc5-0f46-46c3-8918-e5e23d352136", "value": "1536:CGKSorFc8wtA6zh8qjeCckbJcNcnMakQ7mTFiFfJGKGUFeo7UzEmUvCxuJo99C8j:CG7orFc8969xjeCcEeWnbq0J5GOmEmUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770678, "uuid": "cbd4fd09-978a-4cf9-8419-00e3cbce31be", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770678, "uuid": "f081ec57-16f9-4773-a986-e6eeb3ffb863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770678, "uuid": "86d737b2-f066-4f7f-87fd-b59c133f5b77", "value": "nerv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1756464-73e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782756578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756578, "uuid": "ac1246a5-5bea-4648-ba93-bce500db817c", "comment": "Malware payload", "value": "4ea90275325918f571d9fd304f3c59a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756578, "uuid": "93037043-9a73-455b-884d-120361c4a8bc", "comment": "Malware payload", "value": "4840f5ba0c2b726fbc48f8d975e74d265b5ce495b50a1f90356650b3966b6661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756578, "uuid": "78f53a7f-a161-4ade-8c62-c6e78e98a087", "comment": "Malware payload", "value": "f51308579aa2636500e1ea59adf545185b37bfe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756578, "uuid": "5ed10824-d650-46c1-bfef-b42f402a2ad6", "comment": "Malware payload", "value": "f8f3296f23fffa1a3ef520bf848ffeaa5e49384fcf5b5b36f86320fa667717f513eb7f5cbe404dfcefc8febd4d4fe64d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756578, "uuid": "b1f0e331-99cb-43f5-9b0f-55c0cf61e2cb", "value": "T1BC969E2EF571626CD04BC070679FC2A21530B4742A753C7F3B86DA782EB5D9913ADE22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756578, "uuid": "4618f142-17de-4d77-be7e-7b05a791f2b8", "value": "196608:kYQxsLwAADIGvuwEzWytdfRFVKiXbaQ4qfNw1tVuV:kYQyLTADIxzWIdfAiXbaQ4qfNw1tQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756578, "uuid": "3f48b343-8e03-4d7c-8283-d5c15a70ec2b", "value": 8777760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756578, "uuid": "9b6a38ee-920f-4c60-9e7a-5731bc14f2e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756578, "uuid": "789f25c4-5409-4184-8e97-11204b0f5633", "value": "gg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5c46e4-7354-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782694137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782694137, "uuid": "d776eeba-a92c-4d3a-9d28-27605a51c087", "comment": "Malware payload", "value": "faf8b16f6d0403ea99a7784960330929", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782694137, "uuid": "432c1d1f-b976-4944-8daa-17f4a77fa859", "comment": "Malware payload", "value": "48eef0724990d401f589c314349a0033cb37f731ffffab54a57154e7b444fe42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782694137, "uuid": "aaacb607-1f3c-4a5e-acdc-1c14996a7c30", "comment": "Malware payload", "value": "7584569449cc6bbaee43633e9edb62718224537d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782694137, "uuid": "5f0fd56d-f36b-421e-abc6-7993a698c35e", "comment": "Malware payload", "value": "9c7ea84a212e1f029a665085b01ef609869945d21d6099caed02d19fa2aed84a15f9f0d2aff5c9e954f9dfe817661dba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782694137, "uuid": "2409c426-f834-40ff-845c-88f44307e66b", "value": "T1B3236D6516817C24AA99D4371D7F2F0CBDA983E6320492DDBFCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782694137, "uuid": "6c6d7b33-0d50-474a-ad31-75f5cac3b0e8", "value": "768:8XRWNGxVV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:wlxscB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782694137, "uuid": "75ddcd33-7150-4444-b60f-30d03afa2047", "value": 48384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782694137, "uuid": "071ea377-a2bb-4624-8bb4-1ef6dafc7ec4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782694137, "uuid": "4a22ccb9-a9d1-43d5-9890-72cddd8f1d09", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78ac96e-73b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (751Stealer)", "timestamp": 1782734738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734738, "uuid": "32e6139f-ae97-455f-899d-71eecf90a760", "comment": "Malware payload (751Stealer)", "value": "85bee7b4a41440ee97085961de9d8aac", "object_relation": "md5", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734738, "uuid": "8a832946-823c-4748-a355-f3e1cb5b8641", "comment": "Malware payload (751Stealer)", "value": "4a7ee630df4b7af2da5f8c5e511492735f558d2b234e07d3cf09db999a8ac5ef", "object_relation": "sha256", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734738, "uuid": "087592e3-a208-4159-bf73-26ff8739a725", "comment": "Malware payload (751Stealer)", "value": "17826cb947af5da7c43f5196e25d16ffc915863b", "object_relation": "sha1", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782734738, "uuid": "d042ad03-253d-4107-8dfb-c41aff012248", "comment": "Malware payload (751Stealer)", "value": "e5a8b4914ea2fad8104cb3a7e0e5ab11fcfdc8434965d533620f0a7b1789c011f9672060a5d29776f06cbba18be1c157", "object_relation": "sha3-384", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734738, "uuid": "058c3456-4c1b-4020-990f-94cc717f01b6", "value": "T11885F106A7E114FDC1AFE134CD625502E976FC9747649DBF43E899A12E333808E7AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734738, "uuid": "6d3a72fb-d641-42ce-88a9-84a4d470bd33", "value": "8d8029e87dbf652ff8d7bb1768ceef69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734738, "uuid": "a35c73f6-1a19-4fc0-abb0-bf7a464c2df8", "value": "49152:AxmWKdEuKOulAvMaHVv/1kBtjrHrF8GB:AxLyKOusMapKB9vF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782734738, "uuid": "202adc3b-69b5-41c9-9bb9-93f2434f83ed", "value": 1719296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782734738, "uuid": "48d45e5f-a6aa-4233-9689-a119ebe8dcd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782734738, "uuid": "8c1904df-12f0-451e-a00f-7ce8bcad5173", "value": "injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423470c0-73fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782765411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765411, "uuid": "247eaa75-37af-4ced-9b35-8319f3d4f121", "comment": "Malware payload (ConnectWise)", "value": "e77e3eb429cf501264a656f5ff0df40b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765411, "uuid": "da71dfcc-581c-4360-92f8-f21e8f272b8e", "comment": "Malware payload (ConnectWise)", "value": "4a840e8c86a4b3f9949b29203dfa833ef4f07cfc6f95aa9a22125a9ee23e4ea5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765411, "uuid": "f1d79008-20b3-434f-a278-5010171d3db8", "comment": "Malware payload (ConnectWise)", "value": "53f2275680d83e62beb2f8b83684fd8da24586f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765411, "uuid": "0e1b074a-7ff0-4294-bc15-6a2131a981cd", "comment": "Malware payload (ConnectWise)", "value": "cd4ebe0042e62669633d54b151e67ca663277b79bdc17afa79d69bda57c8caca852cd75b6019a1fce96c4be8f2955e0e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765411, "uuid": "b241c206-376f-44a5-b5a9-9c2c7849cea9", "value": "T13556F101B3D695B6D1BF0638D87A52696774BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765411, "uuid": "c23f60e4-eaba-4800-bc2c-0cc4dab2e4e7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765411, "uuid": "a90bf51c-fc06-4a6b-aabb-ab1d358a563c", "value": "98304:fzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlOJAP:fhfefPtHxcp9ym3nltDUJV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765411, "uuid": "287f393d-8605-4e25-b071-68a3d5b49101", "value": 6082024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765411, "uuid": "0980c2aa-0714-45b7-9c91-736f214d8ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765411, "uuid": "4eb4f6bc-70ab-49fc-8eab-59bec8f35e57", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b1cb56-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760431, "uuid": "01f5fb80-78a6-4aee-b542-e830fcb4534c", "comment": "Malware payload (Mirai)", "value": "a3c9f6a2ecfd6512526f8c9c19a02621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760431, "uuid": "d3d19ea0-a4f1-4766-9d82-b494beb961d9", "comment": "Malware payload (Mirai)", "value": "4ba6efdc71efd7d2f933ec6fd241078d74b1c5797823ca0199d1817f04284d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760431, "uuid": "8c4bfb63-e918-492f-98c4-8eca8f74834c", "comment": "Malware payload (Mirai)", "value": "21d2990681d89117b2755f0d17729a40247ebf3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760431, "uuid": "e9b0e83b-3bbd-4494-9435-37e317b8280d", "comment": "Malware payload (Mirai)", "value": "50dbf4c8c5ff9cd0bc8ba3800c296bd6c64170df413676aaa6ed544fbde5119db2933e8afd2146b47621469df4a882f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760431, "uuid": "37393649-cf37-4774-b149-a8fc8d970333", "value": "T1CAB34A4273180F57C1970AB02E3F27F687BFE5D021E0BA89650E9B5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760431, "uuid": "de3f3b2b-468e-4363-a7c0-324237663ca9", "value": "1536:+xirbGVEL0pFXbtiMCMBOgKdIKjg9JKDl9j+Juc1uoaXd99t:+x8q+Qibjgid92uUU9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760431, "uuid": "ec58b10a-c937-4be8-be27-64d785344fbf", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760431, "uuid": "b142f810-b5f5-44a4-8d63-77d0c5373a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760431, "uuid": "30fa7c52-2edf-41e1-855a-f6959d5665a9", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ec747b-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "fb580f3c-1658-4364-b4fa-2c9e491dc9db", "comment": "Malware payload (Mirai)", "value": "834906b0448634a219026df2cfdc018d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "3207f7ec-c64f-4a63-adf4-39d36d29929d", "comment": "Malware payload (Mirai)", "value": "4c1964edd06cfbf937fd7fd55f155cf00f57feb9c77af83f1702e2c7545d8205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "ec253517-5c9d-4b69-8df3-a72e33ec7cb7", "comment": "Malware payload (Mirai)", "value": "6d8da8c85cfd644b9053f7e79d34e6bfc86e75a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "c07f1814-c969-495b-9806-419b739bb231", "comment": "Malware payload (Mirai)", "value": "e4b878d282081486bdbc34c360d6b60a262b3f6a6ac99f8eebccf6a6e4c2fb8e7ac9b818cbad221015d6b379d6a2c0c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "b81c51b3-54bf-4449-acbd-8f0fb9462486", "value": "T10C243B93FC01DEBBF80FE3B288574C19B230FB6118521A3671A3BE9B59350D56963E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "9420c649-e1a7-408d-9469-6c10d37104eb", "value": "3072:KwNhPq/cmiVWfRe2l1hitH4NonvWZVydAD0fEg1TqhTTto+J7lVIjbi4L33ne3F:KUxWRe8nDlnydY0fNTyK+J2L3wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717686, "uuid": "3165c214-a777-4ff1-a372-8a2de4647e51", "value": 220884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717686, "uuid": "00898be5-1a73-4a63-b26f-5b56917a55de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "20e55626-1f5c-48bc-b32b-d120d9b6be76", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2426c48-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782736823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736823, "uuid": "a0e3ce81-9261-473e-ae8a-16ba78d05e95", "comment": "Malware payload (PureLogsStealer)", "value": "dc3f3c19287e7f2e508238abb8727dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736823, "uuid": "4a95f491-7d78-4ff0-b5d1-9034d67de2b8", "comment": "Malware payload (PureLogsStealer)", "value": "4c584c37ccafab4dd5afe80d8146aa2cbe3eb8e10983512fb5074c75375c8462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736823, "uuid": "f39d6c50-25ce-4393-9c56-26d295290175", "comment": "Malware payload (PureLogsStealer)", "value": "dfd2d0ff548fe7646c4e6dc7797fd737c7ff9bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736823, "uuid": "293c4759-b47c-4298-acbe-a55a2705d450", "comment": "Malware payload (PureLogsStealer)", "value": "cf272bb2ed09c6c0c00e3398ad301891c853f0021042f71ecb0c36ea83b234f4b02102cad9a2c0ea5970626f9ed2e213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736823, "uuid": "50ed9b93-6673-4f04-bf70-a4916ebe1417", "value": "T105A51C14BF770027D56681D3D8A18C4AA15EF5FA63EF28CA4375ADCF035300A69B7B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736823, "uuid": "f64f12e6-f876-4d0c-916a-c7067f36b94d", "value": "12288:zBRTOnAoYLb4PI0vg35EAXfChH84B6CDZo/E8maXhDWMijAvFdPQUv8vcISObpTP:Zd23S6ALUq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736823, "uuid": "2af8f776-cabf-4224-9982-ee3afbabea84", "value": 2181300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736823, "uuid": "02e61e30-1546-42dc-afef-af3803e49cc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736823, "uuid": "6f0a461a-5ea0-4f1e-8a71-2cceca1352d2", "value": "Quote 85129400.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c4ee25-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775275, "uuid": "68bc9c73-bf69-48ce-8f23-736870973058", "comment": "Malware payload (Mirai)", "value": "88cba93506d25e93bbaae0035ad48d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775275, "uuid": "6ffaf370-f295-45cd-bf70-6ce6c01bd8e2", "comment": "Malware payload (Mirai)", "value": "4c9ba8e26c1f993fc5f6b8e4ba46cb4ca956d21ca0beba6b5326c3e8bd389751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775275, "uuid": "c2200387-1ce8-40f1-a734-16f9bf72f227", "comment": "Malware payload (Mirai)", "value": "515569b4512e680c3c9164ae3b76e71cb0fd9d7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775275, "uuid": "cc4b3af7-0b03-4d31-b3de-ca7d83442d5f", "comment": "Malware payload (Mirai)", "value": "bbb53586d278702b954ef9203d73478068f1d1aec8a85d594fcdc48fde2f3aad87322ec35ba0793c7edb9c2985bd1ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775275, "uuid": "68dd7a65-5a4a-4a56-b2c6-50b31627a860", "value": "T140C38E22B4391A27C4E0947B12F74721F5F653CA11A8D60F7E720E8FFF216502A17AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775275, "uuid": "6c360b64-203e-4e4c-b412-1b1f8e0ea0ae", "value": "1536:hagP+QJILwim69EFieLp2s9M2enEbHgaRlbPZMSPa1C3jeF3YuA63mtN1qd09vMM:hb2oBa31YwVfKpRETEL1KFrY2FYOBF6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775275, "uuid": "904e94dd-e202-4492-8e2a-c2fb72d81353", "value": 118336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775275, "uuid": "5113665b-1848-47ba-96af-f18b01141cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775275, "uuid": "4d296206-4729-416f-a74a-9f91f8f4260a", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e51b261-737d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782711771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782711771, "uuid": "8a961a25-9cfb-4862-a281-d7eac03be8da", "comment": "Malware payload", "value": "888f5222bdf475d97af60922ad70b23a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782711771, "uuid": "a5e4e3f5-8443-4edf-b8cd-29224ea8b035", "comment": "Malware payload", "value": "4cb2cdc23b7bd56e94e09f9db82522a990707ebce19cb08678fd58f679ad5edf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782711771, "uuid": "373468fd-ee55-4bc9-af19-3f627c8b7561", "comment": "Malware payload", "value": "326203a1eeceef9564c8cc812a6d21652851854e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782711771, "uuid": "8a547e9c-1891-42c3-8015-ee0e5ad148d3", "comment": "Malware payload", "value": "7415d544087a2560718f7d12569dcce184058994627e35b051c5e118d2dafaf58192d21abd5c240d1f2d6674041c1d47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782711771, "uuid": "cd69f90c-0ae5-4e5d-97e4-489480d72022", "value": "T1BCD02E6B0363027840A108A8F6C6A801F1041BBE8CA0D66B728715201F81309F0A12B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782711771, "uuid": "428c06d7-96cf-4083-92da-69791bb386a0", "value": "6:hT3oH0ogG14nyk2wfQSNQAulNXYq4HvXDG+NjVsNXYrkJ:VYHvgiidlfxQPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782711771, "uuid": "9ebbfee0-5d2c-428f-ab22-ab542008f9e6", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782711771, "uuid": "e1b99b74-2921-4435-9788-047456880185", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782711771, "uuid": "443b7438-ed96-4a7c-92a6-422d060aae15", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240b3bf7-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "9097d959-6e4c-4113-b957-b8eb08e0c98a", "comment": "Malware payload (Mirai)", "value": "1786068f66a478484595d1ad11ce3232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "f6843fc1-1c05-484d-90af-bc8c76d2f0b6", "comment": "Malware payload (Mirai)", "value": "4cc8862c89c56deb6abbcdef19abbf97c11c99be2526716998a3efb53eb3553f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "4879d4bd-884e-4ae2-a79b-38abddd92dbe", "comment": "Malware payload (Mirai)", "value": "48d6948e26f31f4689c136b2a525067a5dcc82cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717686, "uuid": "f31b283c-eae0-438a-8ebb-0c77e529c5a2", "comment": "Malware payload (Mirai)", "value": "66c9adffcdcf8d047b9fd6353067a19466c63652d3e97dafdab8b363fa95b7c9c93b153abb3876e4ae88c754db73c03b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "1242ec18-e62d-40b8-a3ba-4a6c769e3fb7", "value": "T114142902771C0F43D1A36EF0263B27E083ABE96118F4A684751EBFC99371DB25545EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "e09c2517-223a-497c-a6b6-9ef4031660b6", "value": "1536:kJjjZB7TF5LoNLCCafexpVWRqI5+86uqL/MlqM68UE/UvA4DaplkDFizTcdCGBQ7:8ZZFGkCaWx3Wk8plR6ip45Q7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717686, "uuid": "762d191f-c6f9-4927-ba8b-9045b6071cec", "value": 192640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717686, "uuid": "aa14f5fb-0a7d-4672-899c-79c739bcd8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717686, "uuid": "49dea1a7-6c69-42ab-886b-9aa62a649c06", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46b1d30-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737685, "uuid": "c232bace-40fa-400c-89e9-98e541bd0057", "comment": "Malware payload", "value": "1b558f58d8d791e02cde68aed9feea3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737685, "uuid": "4a1a035f-35ab-4c03-a3c8-eca574db4b55", "comment": "Malware payload", "value": "4d31a3ab6c6d06a6b8952b638a2ed3c170c28fbc42bd1c7d273912a1e4ff8857", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737685, "uuid": "e4d22cd4-9cd8-4761-b646-bd4727e60e13", "comment": "Malware payload", "value": "63b98cccbddf77fc525d38c116c139101f12e6c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737685, "uuid": "3a06f0ba-e6b0-4cdd-a98b-7e105bef2faf", "comment": "Malware payload", "value": "c2aab1b869b4d174a23e4a082daae8cc61d795b188b3675343139dab5afbbc59339a524c206a682da1bb9247467c1caa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737685, "uuid": "57b179ca-2719-4e15-8f3a-9c27b998788a", "value": "T11B512FD135713A313CB758A7336D5838328160A96C97DE8964E8FDF88DCEE0579841EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737685, "uuid": "43e62297-986a-492d-b38d-199108e59d5c", "value": "24:IjsP0swhIhOMsoxsAAs7CP0s3s7GF7HsoGAstdsrNINk0sgi9sW8Vs6fFsUycs6B:GIHGFgpNiQ3xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737685, "uuid": "e5b51e67-dc9e-44ff-aa4e-0258ad25b432", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737685, "uuid": "38982cb0-0c24-4222-9e00-cb08f1f86fb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737685, "uuid": "b9484e1b-22c9-4205-907b-469159a4e93c", "value": "4d31a3ab6c6d06a6b8952b638a2ed3c170c28fbc42bd1c7d273912a1e4ff8857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a4b25e-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756805, "uuid": "ab3e12e1-0b95-4fe0-a294-87ceaf07a0cb", "comment": "Malware payload (Mirai)", "value": "0664c4353dda4206c35df7134b8441e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756805, "uuid": "2810fdf7-1752-401f-9d3f-589247ccb196", "comment": "Malware payload (Mirai)", "value": "4d4d6523fb7e1565b971639f136be051cbef263e272c2e57108cd46f262444fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756805, "uuid": "252f33d4-ab0b-4d05-97fa-dc90c95216cc", "comment": "Malware payload (Mirai)", "value": "bbdc230b94d52fdd77107d714da4a705863deb9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756805, "uuid": "3aec134b-a675-4dd3-8c97-a7262ef33230", "comment": "Malware payload (Mirai)", "value": "50481cec8a4d4df814192d6d51bf81324d5dbe2a7a7e401d25cfd65fd6c8bb32b6dbc05ea16aaa78da4920affd0a00c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756805, "uuid": "34929e13-5281-476c-b43a-c1815bfbc268", "value": "T15D23F104A91E2905D1A06CBBE33D4282B3D657FDE1FA36720C18C73576498B536F9357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756805, "uuid": "d91d80ec-5d32-4851-8cbb-c906ac3c6678", "value": "768:ErJ6+f2ZwP2OL4dXlQycbMWh5mBPOrfdPRQq8WqtUQ8K+agm7QqU78XHwOAV2peo:II+cLd3cRI+fdPRWt98HaDXUI3w+gvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756805, "uuid": "4c3ac5f8-b89e-41ed-af6b-dec68b483158", "value": 47416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756805, "uuid": "8f80655a-7587-43a8-a1ee-d6addadda36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756805, "uuid": "431ac78c-c162-463f-9c35-5431d7dfb5b2", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47bb35c-738d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718895, "uuid": "d16c54c5-d3fa-464b-8370-dc9ac2a9ee52", "comment": "Malware payload (Mirai)", "value": "d7a1f27629f2589d0bff7aa2bbdfc341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718895, "uuid": "84c1ca53-3a85-40a5-a87f-e313d824fea9", "comment": "Malware payload (Mirai)", "value": "4dd17f76964d0fc97b88a937663f13781da10912937762c27e530e79b780f9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718895, "uuid": "d106d613-2ae0-4141-9226-57712fb66612", "comment": "Malware payload (Mirai)", "value": "07bbd8e1c217770639e45b65533f5fa067514a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718895, "uuid": "52def076-371b-43df-909d-e0f3c4aa80dc", "comment": "Malware payload (Mirai)", "value": "cc7d70b77c64740b8e90c266fc2fdc8188a5158c017d9d8ec3da2fb023bf01b9b074449588496eacb16ccd67971da67d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718895, "uuid": "b00e44a4-7ab8-4b5d-9205-95afbde1f85e", "value": "T1E45302C0EADB9593F6F06C72D83B4356D06387FB96AB7011EBB211EA6875C8D15F9010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718895, "uuid": "d6c57618-676d-41a8-a05c-85b06320d314", "value": "1536:CVRtiry4oBUQyqCM24z4RBMZKPmmOLgXlFk:CVRtF4YcDM2489Zn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718895, "uuid": "e288ee75-ad22-4c6a-89e9-4d50be62f4ef", "value": 63252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718895, "uuid": "a3b1c719-3d16-4688-a684-5876c0976d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718895, "uuid": "4dda9f59-76f9-416a-8777-87478ac0b5ae", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3ff6e1-7366-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701841, "uuid": "febc4ca3-cb6c-46f4-84e6-3891f434528c", "comment": "Malware payload", "value": "f6e03e35add72b11d6e1d3e452aed7ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701841, "uuid": "f15c9c22-971a-49af-a61c-f836b25e04e7", "comment": "Malware payload", "value": "4dec1f10104b6389f0cf94b650d37bca3baf56765ada3144266b6f2e07b29245", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701841, "uuid": "7651f063-907e-45fd-831c-beeb770d855f", "comment": "Malware payload", "value": "8a456eed5d6f8b75db1d4aa99ac6a621acd67b70", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701841, "uuid": "9a2324ae-31eb-4fc8-89ad-cc8e21bfff46", "comment": "Malware payload", "value": "9058744ba0a92234cf5d0968b46cf9840feb10b7304d37868c84f9e5f6e7bb3d928d7fdea1324bfdaa4ede5f3c1b8845", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701841, "uuid": "0a469574-2d24-4f7b-b9d7-a2fb45eb093e", "value": "T1CDE2AE059A91CEA98CFD023674A687448DEC5B2486CE71F98219E1C23E5DE4C342FBF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701841, "uuid": "9f13facb-6d4d-4803-940e-37561abb36a6", "value": "768:hKKjiwcXWTHp7HAsP/YleTWU/PqRJXCMxU49gBb7N1+:piw6W7KiwleTW4qa7N1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701841, "uuid": "cc869832-dd7e-4dc9-ba05-848178d84806", "value": 34151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701841, "uuid": "a5d63b80-6833-4953-8221-97a55f807d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701841, "uuid": "20c25019-e10f-41b8-93d4-5af6c322a201", "value": "udayo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e09d158-73ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782760787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760787, "uuid": "17479959-9cb1-4c6f-8c0c-482eafcb05fd", "comment": "Malware payload", "value": "6eba9f522ccfbac1e09d8674f076ca04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760787, "uuid": "18ff297b-8f1e-4521-b74b-cc6243b3c023", "comment": "Malware payload", "value": "4dff8e4481b9ccff3d3a740a34dd4d5f31144373d958ad649ad9dd3857c021c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760787, "uuid": "35bb85b0-b86a-405f-8c4f-fe67d9d78ee2", "comment": "Malware payload", "value": "b63b23e49c9a06d002aa311983d386033d5c9427", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760787, "uuid": "01c8eb1a-e980-47e7-b57b-4f2d373f368b", "comment": "Malware payload", "value": "b167998ac6c10ef94967e521ac1e635463091d77581b2c5a44b4d76affa814d163da6237a1380c5f400e364b27ad7d96", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760787, "uuid": "eb395e71-0455-4459-9a5f-6f99570c95e2", "value": "T16AE0688170700DB2BDAD8D21B31E8085A442B75555F9EAB4C0CABEE1014FC0871C2B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760787, "uuid": "67f3b2e0-0ae4-475d-9403-460232fa10eb", "value": "6:h6iOnFflR1hqq3FqKehKfzKR6XTOUocEYd7+4fsQDF9FH+hQDVhQDjDDFOK:q1hqd+K6jl7+4PFHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760787, "uuid": "25255045-b242-44a3-8150-719150e75be3", "value": 381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760787, "uuid": "f878cd5f-d0a0-4792-a31f-8381e60d2afe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760787, "uuid": "18750573-b7fa-4a3b-83d1-337d49070b13", "value": "i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bdbf5d-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769569, "uuid": "2d12c691-c821-4e49-a86a-b68e0764cf1a", "comment": "Malware payload (Mirai)", "value": "16a4f0bccad567560023aa0a3d146684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769569, "uuid": "e7e13594-ca0e-4728-bd43-8da021ac9572", "comment": "Malware payload (Mirai)", "value": "4e2532c5ba90c45d1693dea76d31070edd5e3472ece0d723be303531e6f7c768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769569, "uuid": "20c9662c-3e85-4832-aedf-dec9f53b41ea", "comment": "Malware payload (Mirai)", "value": "eeee699900cf5ddbd028262ad73005125bc3c806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769569, "uuid": "e2e0f227-8a88-42d5-9541-e07db46eaa36", "comment": "Malware payload (Mirai)", "value": "8c5f6a8d3d77809cd280d8a052af1a81b4e7ddc034f9e910f9dd26de04611cd4c9e3b213ff2018ecfb0dc6ecc9d6974b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769569, "uuid": "f6b3b97e-40a4-49ef-bc87-b56cf05d70ff", "value": "T1477302A3431378065540F9F7E4174E40229776AD20F175BB068849A8CD6D9EAEFFFA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769569, "uuid": "990451b0-8f9d-4e63-aaad-1a855159e476", "value": "1536:0f63v+lqi/A3n9OHtOuu1m/L8z1Vwbz/zN5TgcPVUuRCLcrAf4YfCOYCi9:00vW/cQFB/L8z1VAz/zEcNUuRCLc84p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769569, "uuid": "739ff8b8-35b3-463a-8e5c-c3b44b923489", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769569, "uuid": "3f70396e-4efb-42ce-8d23-31223257442b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769569, "uuid": "a441639c-32d3-4f1f-9f7b-14b2a52dce12", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290f206c-739c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782724996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724996, "uuid": "f6ca2585-19a8-4308-a66d-3111b3369a56", "comment": "Malware payload (CoinMiner)", "value": "11e003f7a8219ead455d6df8ac6fe584", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724996, "uuid": "5da09fb0-5d07-4f22-b529-f44422b35452", "comment": "Malware payload (CoinMiner)", "value": "4e5206392c8b4a362c99f54e28416ba7ca089c057740a1dc7b288a065a04b6fb", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724996, "uuid": "513dbeb2-0ee6-428e-a3f9-6fb0d34babe1", "comment": "Malware payload (CoinMiner)", "value": "4e4b10b417b8c453b3616d0750a73d2c1290a0cc", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724996, "uuid": "ee5548fd-35ac-4a26-b68d-137fc0596dc9", "comment": "Malware payload (CoinMiner)", "value": "2efee76fb45c1055f450c70b8d75d0e375d696a61edd516ffc63483c5582cc1ab77b5ffb5119764aa42014a2c2d3cc89", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724996, "uuid": "b9f7a20c-aa61-4455-80ee-51f08b411881", "value": "T1392533850CEA8537AEF4D039F22E96225CE12BB201BF0BE1B7F6DDE1F8185D91248475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724996, "uuid": "106e4529-c133-4cb1-96c9-207fa5b6f578", "value": "24576:ypo/CeHSUqO9KByVJRNj6+bjE+B+IHT5ikmOlW4jx:yqCeyU99K8VJRNj6ujE+oGGOlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782724996, "uuid": "643c40f7-bb46-4d51-ab27-64d10e478b64", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782724996, "uuid": "5abdeb04-1891-48ef-bbdd-047982b1ce6d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724996, "uuid": "40106748-f5c5-4ab8-9110-33b163a2b276", "value": "4e5206392c8b4a362c99f54e28416ba7ca089c057740a1dc7b288a065a04b6fb.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a728de-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782761984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761984, "uuid": "ecc1647b-ee88-4651-94df-1cdab6c917cd", "comment": "Malware payload", "value": "994e8501074ccbde9a483c8b88d8dabe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761984, "uuid": "0f6fa617-3f80-4c01-be87-22afae565d4a", "comment": "Malware payload", "value": "4f341e62522a2ed6f9256891d9631f1748d93930eb6b520e29ce7567e870e97f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761984, "uuid": "a21b8e29-3fcf-4dec-97d0-3528b8e7defb", "comment": "Malware payload", "value": "2b8f762e66b611b31c6dff31dddc87f8e9df2d50", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761984, "uuid": "7a6f10b3-5642-46a5-b4f9-0c43cfc91dfc", "comment": "Malware payload", "value": "d188cdf84cdfbc756d1713660411de7a55c12fd9907a253c8dfa384ad566c47d6adda6048f0f8442a024c787261e3db0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761984, "uuid": "cce83751-c041-4920-b774-88b4aa9f2cd3", "value": "T17293CF43FC293ADEFC16C8BE468922144BDA962907651BD70B5714125F68FE53C386E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761984, "uuid": "7e665446-3cbe-4702-bd74-3f95c01127c6", "value": "8aea82e1c1ceb9472b5cd29a2f4e0f06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761984, "uuid": "c3856c9c-e2b8-463a-9289-0b53bb9a345e", "value": "1536:1GF7oaCZlywQD9ob21DOu4TE1zu8Iop9I1Je2CYQBUTWKms1gTz:EFgtQD96252E1coHHhB7PTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782761984, "uuid": "8fda656f-a586-4fde-9ea6-6526b7995bf5", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782761984, "uuid": "3aa72309-0fb9-4358-99c8-d02751dabfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761984, "uuid": "44b0efb9-e00e-4ca5-b17f-13e085cf901f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4332d12a-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756823, "uuid": "c173645a-191d-4479-95b1-2446e9f3a353", "comment": "Malware payload (Mirai)", "value": "bb1e06386cdee38d5af82dffdfdc0fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756823, "uuid": "82183387-4ef6-4268-8518-b4400bfabf1e", "comment": "Malware payload (Mirai)", "value": "4f70073d86149980db1331483b354b0a2d065eea40fdfce4401005dd7ea41a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756823, "uuid": "63089471-490f-4d93-98b4-d65ace6cf4b6", "comment": "Malware payload (Mirai)", "value": "546a7af1885e7b9bff13431cc20e04251d25917f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756823, "uuid": "fea8b7d6-ee94-4acc-ab17-a4255caf9b95", "comment": "Malware payload (Mirai)", "value": "8a991488ea1585aaaca3db07c9bf9aa2fc0953ce02f302ae533874b5c2daaa47c54d1880140c267fd5fd39a9b3cc5d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756823, "uuid": "489b59a5-d8b9-4ed1-8b75-bac81964a773", "value": "T122A3AF23D4265D94D1590578A8A8FE351B23E4C052536EF71AEAC677A04BEE8F807FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756823, "uuid": "e2838ffc-eef4-4bec-8ed0-fc3482579d39", "value": "1536:Q/a16u0fKn/yBkmw5MTJLSiaKy/mf7Z+BeOmadCH11dQZuTHN:QSIu88yu5uwi9yY0BeOmad01iETHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756823, "uuid": "c07c6b44-08e8-4221-9069-9ba40eaa4847", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756823, "uuid": "10ee4fec-4891-40e1-b000-bc487190a9da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756823, "uuid": "725052b8-17d9-4e47-8d85-af05b3120e18", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fbdabb-73d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782748690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748690, "uuid": "ead0e987-b08a-4451-810e-e03ee0722ab0", "comment": "Malware payload", "value": "936a8158efc9eeb358eb7ef24ac70d61", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748690, "uuid": "ae071e07-413d-4c16-b2eb-61da039e4380", "comment": "Malware payload", "value": "4f89e201ef9174fd4043b7279a3f4eb9f3435b71fa479d5c0c87b9f30b2e11a7", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748690, "uuid": "cb57e4c3-d9f5-41b8-b9d6-064a318d83ff", "comment": "Malware payload", "value": "c3b34e9924386c3f8a14f7dd53f6e81fa927404d", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748690, "uuid": "6fde7deb-7f34-4cf6-a243-3c40437807b5", "comment": "Malware payload", "value": "109393d2218e5560c38aa23793a6bc51746208b2222d0803fc3ad257165932f48b120657b7dd501bd164f03b3c40a70b", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748690, "uuid": "b6cc15e2-04a6-4277-9252-e4281b6151e8", "value": "T15292D62A8908BEF4082D3392298B6C6799010741A775350EF9DED69D3F7B360DFF58A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748690, "uuid": "1d52b9e2-01a9-439d-90ad-f53b9ad7e683", "value": "384:KGybte30WNaujKv7bhBd91kpEbhlUJWjX96mhU5DR7Ad:KGWt6rSnL1kaNkA684DCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782748690, "uuid": "ce5e3c99-013b-4722-8969-d27d72b206c3", "value": 19473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782748690, "uuid": "e4b11bf7-a305-42bb-bf29-913298bc08ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748690, "uuid": "2e5eb6ff-2de4-4b27-998f-4cd160c83a3a", "value": "B C document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21d9d90-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717119, "uuid": "161fc783-39fb-4fb4-8e12-ecf5d5dd77a6", "comment": "Malware payload (Mirai)", "value": "bb4909738ce82b9146bbae81fc073fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717119, "uuid": "07fbb4eb-0e7f-4510-b9be-64370495f936", "comment": "Malware payload (Mirai)", "value": "503ce8c59b24f576b99fa519226582750f8f0240b88fb5a3b531d3e66a096277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717119, "uuid": "0eef8da8-be38-4122-92e0-54d003af3209", "comment": "Malware payload (Mirai)", "value": "c3d8dfcdc154fed923b8b3fcce677e38d2e62d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717119, "uuid": "459a18d3-bea2-441a-aa37-8777628be510", "comment": "Malware payload (Mirai)", "value": "277b93ac2c82b1a8efd1efc06008667d9dadd8caccf6a275bcb80f1780ed8228843f09c81cb7266e033df9e696450394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717119, "uuid": "9ff584a2-c311-43d5-b0ac-45fec7479bfe", "value": "T1D803E11AE44A9241E63A1034017BF00722D0BB179A48D7B693C072F7EDAEB72287D7DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717119, "uuid": "196ce194-44a8-442b-8c5f-11ed1c4ba723", "value": "768:meAW+GkX7xgBSxKLgTcSw7SYn9+0u69Xco46FCmjyaUd3eivTRmvnbcuyD7UHQRF:me9sGBSxKcTc3eq9+0NxkLevnouy8HyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717119, "uuid": "6f7493d6-cb76-457c-b3c4-bda773a908dd", "value": 39676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717119, "uuid": "36150071-1c18-4e4c-820e-7986d6229b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717119, "uuid": "1a7753ce-a146-4b00-bd19-08c8a976e674", "value": "503ce8c59b24f576b99fa519226582750f8f0240b88fb5a3b531d3e66a096277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a29d6c5-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769639, "uuid": "24d1f169-ba53-4992-b384-e6dbd99af8b9", "comment": "Malware payload (Mirai)", "value": "d4c34dc59f24fb408594c3fcd5170b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769639, "uuid": "dfc57b6a-c8be-4001-a4a4-40f024204b30", "comment": "Malware payload (Mirai)", "value": "509002e1b1c3d3e64a6e70bda4e63163f07794d6719d346df5c75c566cb09999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769639, "uuid": "d5696d1d-4953-4ec1-bcc6-833e064a631e", "comment": "Malware payload (Mirai)", "value": "6a73f2e4850b8b2a985f10e1750c1cc49b0c8e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769639, "uuid": "a31d2e7b-e6f9-46da-9fd5-b448858d6001", "comment": "Malware payload (Mirai)", "value": "f8bfddc51cef6c1e40212468983f1423921150d80aac86fc65712f2d5b61a68d68c0ccb777fc133cf61fe1dd836db5c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769639, "uuid": "e8304042-3d26-4c69-bcb1-054985181271", "value": "T15BF3F805BB610EF7E85FCC3706E9270128CDA51622B97B36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769639, "uuid": "cd160e13-9daa-41d1-bab6-5a8b91ca1b5c", "value": "3072:ldrx+vzsw8TONAdQLty5l6Gm7UxbiuyZ6RlxP4FQQm8DrfIHy:lJx+vzXUONAdQLtKlTm7UxbiuyZ6RlxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769639, "uuid": "f4fe7f8e-a94a-470c-80f9-88c42ecf2061", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769639, "uuid": "2d812ebd-aaa4-4ccf-b705-1042b7241b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769639, "uuid": "fff52448-80ec-46db-8676-9bd58e88fea8", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25febbd4-73c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782743459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743459, "uuid": "bf0bd11d-639c-4e5a-a033-599c9679e773", "comment": "Malware payload (Mirai)", "value": "92091a84d0833a371fdc2113c4751a88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743459, "uuid": "e26a44e6-f293-417d-aee1-a85c25986d62", "comment": "Malware payload (Mirai)", "value": "513184be598b4408182dd7eaad182938cb1e4cc70c8bcad700a34fdef998bab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743459, "uuid": "e7eda40d-bd7e-4a69-8578-15faba095786", "comment": "Malware payload (Mirai)", "value": "bebf90637cd83ea09f036092d493532229898856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743459, "uuid": "3b9544bf-0f0a-4128-8da9-426787cddcad", "comment": "Malware payload (Mirai)", "value": "5186fddded583fabef2f6853e9ea7c7a665cea4ff3ddbc42cb6fa9038ee18772a13b0a981321882f3a700663ee82d270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743459, "uuid": "3667443d-95c8-41d4-9d60-b2a843fdf028", "value": "T1C414F752BD51AF23C1E232BBFB9E418937156B69C1EF72069C317F503B868DA0E76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743459, "uuid": "25a5990c-5b01-4cc1-96a7-40ac61acfb38", "value": "3072:4lA0AFAHJDJEgcwyLPpnrcbiTCp9yPF5aJn3rNAb75l6fuTHhrGr8ki3:4lOVc+T6yNIV3rNAn5l6fMHh48ki3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782743459, "uuid": "6ace960e-46e4-4150-8f00-6a64630f5005", "value": 202212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782743459, "uuid": "a1879824-d406-40de-a8af-89712ab379ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743459, "uuid": "cf37fd8b-7651-42b1-86a4-120a908dbfcf", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9af55-73d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782748135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748135, "uuid": "45cbb6e6-c0b7-427d-b3a6-9334d236eaa4", "comment": "Malware payload", "value": "0085b39ca6ea319a1eb727a45722b240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748135, "uuid": "3a16c7a9-4764-48ca-8fd5-0481ca94b18d", "comment": "Malware payload", "value": "520297b8e5bc7bf9c34556334674cab2ab22d3c1fba0522f920e9b3037b00638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748135, "uuid": "52db197f-7127-4877-b3a4-54f8ec93fe60", "comment": "Malware payload", "value": "2152eb7d9e0e322788b09bc9bda8eb381601d4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748135, "uuid": "19f498dc-1acb-40ab-a718-3fe19ee32280", "comment": "Malware payload", "value": "9a095bc77b99a3016f2e11a47e7dd32d3fe9a4fca7647e502e09c594945b90944f6192989aa97f002f98c991d2d12835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748135, "uuid": "94b1a583-6ea0-45af-8d61-7a669b8cb356", "value": "T132A65AD71A8A68ACC786EAFB8534703FDA03B46553AA71EF563A72EDF613D147024340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748135, "uuid": "abd030d8-5e27-4e45-abd2-ee6afb89bc20", "value": "511a9f08ad049024ceadb3547f453c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748135, "uuid": "33ec6735-76d8-4018-904f-3e24ae2374a4", "value": "196608:NHid9vyObfMHl8mq7/yKm9b5G8JADSIsUzxoVU7lvIcBI:MDpU+FKn9b5/yNoqZvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782748135, "uuid": "738fc7f7-3ee8-4a02-8c9a-b87df20b0076", "value": 10113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782748135, "uuid": "a4cbfadd-121a-4469-88a2-9da0ecd88fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748135, "uuid": "ba328336-618a-4dfd-a22e-fc225ec0dedd", "value": "SecuriteInfo.com.Win64.AURAStealer-B.61931277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2931948-73c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782741172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782741172, "uuid": "a5100654-d8d4-45df-858e-15444cf7fd6e", "comment": "Malware payload", "value": "3fca3244cfbe80c0709a7c8b8eff74d2", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782741172, "uuid": "1d25d4f7-8536-4296-b3c5-1a7c461be907", "comment": "Malware payload", "value": "535887f6b1c2a6634df5a53d4bcb8660a94bd5597f9548e0fc7314356eb2fb65", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782741172, "uuid": "de705d84-d987-4226-a00f-e7346c605fe0", "comment": "Malware payload", "value": "65d9aa41ca1abcab0210070c1f5769354cdf1551", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782741172, "uuid": "5ea54333-e58d-4778-a9c2-eff66e326874", "comment": "Malware payload", "value": "874e8daf5b2390bddcc79f620f18ebc22fbd903b8eb29905b63243f7bff1b189041b0bb60371612c598deb3e26c35c10", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782741172, "uuid": "82bcfda2-9994-4e7e-b88b-b413792e0fc7", "value": "T13F072333B29A253EE06A57361972A150553B6E51AC128D0BCEF4795CCF3E2703A3F64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782741172, "uuid": "cd805b08-9c03-489e-a976-237e75f732d3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782741172, "uuid": "75a40e70-734a-40ff-9bf3-f25e55f47e91", "value": "393216:pcwJhMXYOgyFslbfv5G+36h+9JH6qlRm:9hMXY5l7vUDwJ6q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782741172, "uuid": "f9a493fd-dbfe-4b07-903e-eea082420ad0", "value": 18013738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782741172, "uuid": "9eb83533-acfa-4acd-abad-552d3ca323e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782741172, "uuid": "4b26d826-598d-40a5-b6cd-b4258320c937", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3defd6-7366-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701835, "uuid": "6156c635-9f3d-4f20-90fc-cda76ddf5311", "comment": "Malware payload", "value": "70307667162781b17223b24aa4acf5f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701835, "uuid": "d0991ed6-3858-4296-9f7f-22dcf5defb94", "comment": "Malware payload", "value": "539a2e320b986af4c89eb677744459582833f004e1bb86ce6baf69536d064974", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701835, "uuid": "99d96634-7c88-4d41-a8c9-6701ed0967b1", "comment": "Malware payload", "value": "ef494024f9c8695e6675ff6fa6aba891ecc3d0c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701835, "uuid": "eeec3739-fdfd-4e1d-9de1-77a114bca90c", "comment": "Malware payload", "value": "ecea5d08a33719271f544f41d3ad7ea5915f5d3a365e71935f994bfa6183c5fd9f4956a6ffc8656290db85b843c3b197", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701835, "uuid": "aa5a581a-5bda-4e26-af05-af3c896ecb7a", "value": "T1B9A2AE3973608DD457538367C9FAAEE1D28DC59066CEEE24C308B6FA1241B18F68E1F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701835, "uuid": "4863ebe6-310f-45a9-ac63-aa93ad4fd43c", "value": "384:3C3jhL9WwST69wJFioiYWlaZ/AdCB4HYuCYLOAFXwxTLpBUq3vSNWHhK:3Czhm69EF9iYWlaSdCBRIxipBUQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701835, "uuid": "1c7a1785-a468-46b1-b14a-1cb7580b0555", "value": 21599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701835, "uuid": "8387edff-33ea-48d8-a1b2-10b4266203ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701835, "uuid": "56cbce6b-7064-463a-b3c3-78de41127bd7", "value": "ahimo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e76e33-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782755423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755423, "uuid": "b1911cac-716b-4699-b050-61e5c1537958", "comment": "Malware payload", "value": "9cd7cb039e360a8b8f58f313a0dd7cea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755423, "uuid": "df1bd72a-8df6-4c09-803e-f07c9dfbcc7e", "comment": "Malware payload", "value": "53cb5ca23f87d31f53f2632ee092def8157285bde34b7b3f50900f5134c50123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755423, "uuid": "f786e7dc-473e-4815-b91f-d1bd2ffc1033", "comment": "Malware payload", "value": "26f7f2f73e3ec8a6a994c930e89988ec215ef6a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755423, "uuid": "d97cad1a-183c-48ad-a6d1-4934b54cf194", "comment": "Malware payload", "value": "284e2b94bd2836e3191441311640cfbfcc5852e3a86d2ec3ed2ea980ae877a7b5c99b5caad9fef5a18b7dbe04b921369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755423, "uuid": "c3418c17-33e3-4bec-8019-202e08e1299d", "value": "T13CF37D12FB1C1463C4C35E701D3B03A6A37599D186B9E60951087B2A2B33AF55E87BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755423, "uuid": "2a2a8fd5-8127-49fb-baa2-3f4cb0f91e46", "value": "3072:feOnvy+yhZ/Jndmmt0AzJz9PCwPjuR9o6dTIj5:feQvhm7ndjKAzJz9PCwPSUs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755423, "uuid": "16a6cfd4-61d3-4416-a026-7eb992c95a0b", "value": 172976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755423, "uuid": "cec3d274-3f84-45ec-9d77-67bc7514f5c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755423, "uuid": "f37bd21a-a455-43e1-822e-1bb44498c80e", "value": "SecuriteInfo.com.ELF.Gafgyt-MV.46627357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb87fb4-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "1a735df0-21f2-4436-bb4b-16549f4b3e5e", "comment": "Malware payload (Mirai)", "value": "c8476819efd7643ceb8b378725dfecfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "c2157759-7951-4814-8c6d-6b258701ed17", "comment": "Malware payload (Mirai)", "value": "5459622ae504dc35f2d900e0d01da72623119f67cf65f16fe0301b8c869f35a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "1fad1224-864f-41a8-af60-23273f9aee13", "comment": "Malware payload (Mirai)", "value": "cd07c45d679b2ec821f4f1aa2344e82a9780bf8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "2f7d8c8c-3506-4211-9bde-2cf1a9ba7e97", "comment": "Malware payload (Mirai)", "value": "81bca776f2b0bce5c98aa8ccab4fdf34abe6183b09cf6eeed79f5d10f378576072456869cc5dc53da2d313d424b83843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "35de7db6-1c8f-4dfb-a77a-2423087af92a", "value": "T12DB32919BC416F05D9C625BAFF1E538A33536BACE3EE7112F9105B2C33CA95B0E2A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "17c9a743-1d37-4c77-a437-9771f72a7998", "value": "3072:ry99+yjCz1nrFfaOhLV8R0dEcchVMnanJgsTajls0CkwxNs7U:ry9rmz1nrkOhZ8R0dEcIVMnadSFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712953, "uuid": "399fbfca-461b-4aa1-8db3-80727aac9c3e", "value": 112368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712953, "uuid": "dccf3b41-bbe2-41ce-9b77-5309561dc2ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "405d2cc4-4332-407c-880e-b9927a807425", "value": "e2I0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314bd095-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737465, "uuid": "0a57071a-7825-47aa-93d6-96d751a60c99", "comment": "Malware payload (Mirai)", "value": "b45b1de78276e1590213012ca8322d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737465, "uuid": "476625ec-50f0-4664-b57d-78a557f7d1c4", "comment": "Malware payload (Mirai)", "value": "549a251ebe180d6fe7aa3cfbdd2c46b15f5283fbbed2bfe20f65d6921d4419ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737465, "uuid": "c9f8458b-c1b1-418d-b980-410e1acf0f83", "comment": "Malware payload (Mirai)", "value": "a82abdba8509493c4568c44ae161e45eda23943f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737465, "uuid": "fb988879-626a-4c81-9113-3968c5bbb75f", "comment": "Malware payload (Mirai)", "value": "9e08c8b70c020500abc3d6b676eea76a28ec1427a639fa9558c9d502924edc68352eee310355fcb19fbd5ecaa3257077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737465, "uuid": "c82a4f94-bd3c-4e1e-be4e-a6e15206d204", "value": "T1F244F806AF610FF7D8ABCD7346E61B0128CC691B26A52F36B634D958F50B68B09C3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737465, "uuid": "70c564a6-bb59-491c-9ac9-b6dcc0f3c38f", "value": "3072:5DBZ7HFm1C2LQkAb3v0BMmxRA6qpFTvDBKhhr8BZEU:5D/7HFGlQ/3JmxZqnryZ8BZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737465, "uuid": "3831ac5a-d9e1-4a3e-b95a-e0d5d47205b2", "value": 266824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737465, "uuid": "ca2e05b6-7176-436d-92c0-e4df079183a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737465, "uuid": "c8c8e002-0acf-4d8a-a2f3-74d4e1a0e981", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dbb9b6-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782718219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718219, "uuid": "e51c5469-c6ff-43f7-aa65-f1564c14954b", "comment": "Malware payload (ValleyRAT)", "value": "c41d56b14d42ecf2c0e374006ad82fca", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718219, "uuid": "88039f1e-2979-4b14-9ddf-35efe11ebd72", "comment": "Malware payload (ValleyRAT)", "value": "54ad3d4d8342ddea5cc6adea83d26a574a11d7e5133a04af6999a87adbbc2336", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718219, "uuid": "e047934c-44c8-41a0-9363-bc4c55250ff4", "comment": "Malware payload (ValleyRAT)", "value": "3dc91f0d8d9842dcb2c27aa77dde949386624bd4", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718219, "uuid": "4cde74ba-4122-4ff8-95ab-69abf938417a", "comment": "Malware payload (ValleyRAT)", "value": "eb6755062014cf4f67cd994f6e50fc824a057ba7bf720f9b64a23b5061bda645cf5399ee0be69cf14e92fd8eabd84cc4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718219, "uuid": "fd2e8442-743f-4bb5-b5fb-9c316f01064c", "value": "T1D53833A8547C82FD166B4B1DD0CA224915F0752B79AFA0BCE70834F932AF149E8FF465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718219, "uuid": "ffe591a6-8c57-4efd-9ff7-4aae2dc9d5ce", "value": "3145728:YW1YX6U76gQbbZVmehEwhQABBshDylbaHg/X4XdX:Y8YXJzQbbZVm1whQMjeH8oNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718219, "uuid": "52fd0a50-b6a5-4d86-97fd-daeda40877d1", "value": 104584836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718219, "uuid": "11289492-213d-4288-aebd-0fcaa681a9d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718219, "uuid": "caca7c49-5228-41fd-b59d-e1ea1abe26ba", "value": "LetsVPN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4d9072-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782757078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757078, "uuid": "f9941945-010e-48f2-88b0-b6d89574ba51", "comment": "Malware payload", "value": "1b314c54dd53eb0fc07fffdf10efca34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757078, "uuid": "146d276d-1332-42c7-ba6b-c6b339361387", "comment": "Malware payload", "value": "557631a98fb3a3625ca15e9f53a29daa200aa70da82a27c9d8c35f3ed10b2c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757078, "uuid": "e0fa68ad-6948-4050-9359-a24f4a9f520b", "comment": "Malware payload", "value": "19e58350499f0e0ac63bc27f9c9f26f4ef5a922d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757078, "uuid": "e06602cf-eed1-4693-b579-67316dfb0cfb", "comment": "Malware payload", "value": "a560f3f570bdddc34c4431f44e2a0f8677ca0683be21cdfee35d31198cfbd2f685d3491ded3dbfb56e32f3e7f13b88aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757078, "uuid": "aef635d8-7c53-42f0-8fb9-a50ba7cd73a5", "value": "T1BA058D2AB2B3F17CD01BC03447DBCAB24636F47526212D7B26C4DA353E66CE12369B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757078, "uuid": "0b4ea056-e757-4e9f-bff0-5c9636907f66", "value": "12288:U0+hhllTFcUNgdGnPPdoH7dZwqXRZ6hJemJuGsW2oMaySUFHX:yzl5FrNgd0b6Z6TjID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782757078, "uuid": "4a317d19-984e-4bca-872a-d8c2b40ecb11", "value": 834328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782757078, "uuid": "6d0d9533-683a-4af9-9ee1-8550f1a99caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757078, "uuid": "41e074f1-9b8e-4a1d-8980-8bf0c6470d10", "value": "e9f25a0269d15dda7a1d9a676f3b33bf8635570dc921d4f1b8322a1543d1894e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701a50ad-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756898, "uuid": "72c1e12b-7864-40fc-bf20-6f64498c9513", "comment": "Malware payload (Mirai)", "value": "8e0f86a3561a4b02f28b6f3806854321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756898, "uuid": "27534927-e41b-44dd-aae9-ce848f244a3e", "comment": "Malware payload (Mirai)", "value": "56356ad2174e92db91aec52d77fff20113226c7771090a7b7ccb0f1ad99cf83f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756898, "uuid": "a707dd07-157f-4794-914a-9f943b69f684", "comment": "Malware payload (Mirai)", "value": "d5d2a782f094498de05fa32989ee31f4268a5b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756898, "uuid": "4db5cb6d-0b24-4d65-848f-506c861399f4", "comment": "Malware payload (Mirai)", "value": "dbe324e9f513a9b60e4e85017ed4e4b3cb17e42552a4bbfb02fb05eafcea4a94c488e6df3a80eea1efa45a33e8648ba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756898, "uuid": "02901d4b-b78f-4717-804c-ae1e1d8e5d3b", "value": "T190144B46EA414E13C0D71779BA9F524A333397A4D3DB730699286FB43BC679E0E63A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756898, "uuid": "ba4510cf-6e6c-41b3-a62d-1948bf609325", "value": "6144:FDyK4XETtlfIazUzj94W1NpCxvOH2c3NAM/9scJA:FDyxXilfIazUzj94W1PQ1E5/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756898, "uuid": "751df45d-4927-4286-adba-eb77d72079be", "value": 202071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756898, "uuid": "69d81e9a-6d36-45c7-a12c-23d9095e47a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756898, "uuid": "e067a965-27c5-4aa7-af10-402d02076042", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785d6965-7353-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782693776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693776, "uuid": "0fd8850e-75b7-44bd-b1cb-0400c3baa4b9", "comment": "Malware payload", "value": "fe604f80dbdb7960142d71365ec49ace", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693776, "uuid": "a5e0dc6f-f312-4a4c-97c4-a2e881a981a3", "comment": "Malware payload", "value": "56696f8f91b5ff3a268c8e597416b35ac9a4e51d1fc6b65d7616853fc7ccd1ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693776, "uuid": "17d0fa09-fc9b-46eb-8176-06161a1f592e", "comment": "Malware payload", "value": "2f4f02e1abe7f3228030db8a2716c21f7aa15e33", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693776, "uuid": "10452f8b-ca7c-4fd5-989f-56a1f42521b6", "comment": "Malware payload", "value": "adb06e7105e9ad6920ecf3aab99e0beca702da7ab5cf638a89374e4a3e17694d444534c7202bac6437ef9920a1c9800b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693776, "uuid": "eb1ac499-1b8b-4344-805d-523a625e6712", "value": "T150C2F0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693776, "uuid": "01a42230-4989-4610-aa30-fc9c08379842", "value": "384:NVVud3s1yu7isjsKG6qkSgjkjV/A4UAcGM3JNRhQuW57:VQsylUMkSgjkjVdUAcR3JN34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782693776, "uuid": "7cb8306b-7eb6-4d75-a742-e37244a037c5", "value": 26059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782693776, "uuid": "59c166aa-7e4c-43ea-8554-2aaa9a9dcef9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693776, "uuid": "9b15eba8-4671-44c7-bc0d-0028503fc03a", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcfa762-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782716847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716847, "uuid": "c65cb202-4730-49bb-9214-32e3f396a7ad", "comment": "Malware payload (Mirai)", "value": "df24ac7bf2ef43612a21c28cbd2c7221", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716847, "uuid": "467e518d-8f65-4b54-bd84-7e630fa440b7", "comment": "Malware payload (Mirai)", "value": "579f3428febfdd5cccb0eda56a00384d424d69a457e2544e754b5ad1c0563743", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716847, "uuid": "3f3457ed-0074-46b0-9452-b589c7b84d85", "comment": "Malware payload (Mirai)", "value": "7d200e51c1cce941cf6ca8c3132e3585607f473c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716847, "uuid": "0f52672e-e782-4627-a590-72a5bc7e6ab1", "comment": "Malware payload (Mirai)", "value": "c6668934e3c5c13d6ea98fd5ef79b40490e40106da99dd9cea17948a1556f1182243f498bf2ae5eca64d1833e43a5ef8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716847, "uuid": "c96d65cf-d979-40f2-bfa6-8c15b9a70fcc", "value": "T1B7014CCA8540AD005069AA5D76DB5AD0F421D3CF15570B78BF9C5A2DEB88904B0AAF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716847, "uuid": "46cadd06-9ecb-4e72-b5f9-5f05011c9a37", "value": "24:kXCKysE2hi0ziQvZohaT01YV1nBcEzPFnXKi7:e9Qp+MsT016nBcEdKi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716847, "uuid": "a6dad4d3-a42d-4c4a-9459-7c1d95f8041e", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716847, "uuid": "f8fbc5c6-544a-4e10-876e-1fd678418689", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716847, "uuid": "c00d5189-dfc4-4fce-ad3e-5808dea62b03", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8065af62-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760361, "uuid": "20c46b3d-9d66-42bb-bee3-9d9be41f72a4", "comment": "Malware payload (Mirai)", "value": "1ffdb94a19a20443b3dcfa0cbf23d0c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760361, "uuid": "e09b83af-12e7-435c-9d2a-c6c1b8c650e6", "comment": "Malware payload (Mirai)", "value": "57d3e8130b61807b4f92abb4a39272443e8670dd189501af0b6c6fe0c38df5a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760361, "uuid": "ac2c53fd-191f-42a0-9b2e-b4bee4be6985", "comment": "Malware payload (Mirai)", "value": "4fabaae6ffd21a1c7825afe9728c731e945ed0d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760361, "uuid": "fe780890-fe45-4d9d-861d-c878659755c0", "comment": "Malware payload (Mirai)", "value": "a8a12317d83b61d65524072e43938d6229ff7ea9d4976224702c7a706e357d4fd55be0b45b1e3e0f49590d56d5586ad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760361, "uuid": "5afc0abd-6259-4131-9891-3005f94af945", "value": "T19723F176308844B7B9B40772DD8FB552BC485AB1E1BE504437198B2C38D432BFA79BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760361, "uuid": "c5da8399-d345-454b-a229-3e681e7dd528", "value": "1536:x5FypnpCGRa1+LK/YTXLxYS27ugAuCtbL0:xCpCaa1+LVTX1YfxMbL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760361, "uuid": "138c37cf-009e-4135-93aa-6c6cf0c8294b", "value": 50096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760361, "uuid": "41bdb597-24cd-4cd5-9e05-053b699a4796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760361, "uuid": "db143109-e7b5-41e0-9190-8d2c66ac8067", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831d6160-73ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782746622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782746622, "uuid": "48120a03-6f4e-4bd9-8b42-12910564a48d", "comment": "Malware payload", "value": "d074703783405f7bd72384fb15e39c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782746622, "uuid": "35306079-3fdd-4efc-831c-cdc3dd411928", "comment": "Malware payload", "value": "57dac1b0fa9e682d746a942301e285c8cf030e42a00ec79aac16400eb65bce64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782746622, "uuid": "d68d6beb-c949-4751-9ba7-020c5c761c55", "comment": "Malware payload", "value": "75a0afd8a5199de7bb87b7e3407206042321e0f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782746622, "uuid": "ae882a77-5db6-4903-8449-ddf6a7405b4f", "comment": "Malware payload", "value": "1d05fe08e801d4070d10272ef2a1bb618cee4874cc566a8fc126da93d15232c27a5ecf383c8d08448029ece59d1cf79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782746622, "uuid": "2641e7ff-d0f3-41a6-a069-0b8ef307e6b2", "value": "T112E73337F149523BE0AA2B355EB3A024983B96504D928D1BC7EC759CCB356303E7B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782746622, "uuid": "fe4a19c2-2d0f-4982-acd1-05f1f0f62c48", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782746622, "uuid": "84958f97-2539-4006-b034-63c4a2fd4f1d", "value": "1572864:zAb5tU/EvsBLTW4qIIbDNCRJ062JC3JuuODB7SUOTa1R5J:zAb5tUesoaI/NS2KJ0DUUaa1RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782746622, "uuid": "90a8b985-b142-4503-b8fd-5b4d0c53cb72", "value": 65923968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782746622, "uuid": "46170e94-0977-405a-b9ad-58d76d8cb632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782746622, "uuid": "58d7c424-bf9b-4ab1-9820-fb3929c421fd", "value": "OficioPCPE.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee18d92-73f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782762560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762560, "uuid": "d5503881-f37f-4989-8330-c53b3e632cb1", "comment": "Malware payload (ConnectWise)", "value": "8d00f3e003be4dd52ec46c359e1ad325", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762560, "uuid": "d38298b4-e6ae-4e3d-96a2-621ddb3c2c61", "comment": "Malware payload (ConnectWise)", "value": "586092e1603132f41856f9e6768e443a218503ffbb51676c64ed12e3242a1efa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762560, "uuid": "7cb0caef-75f7-4194-9195-008f90418980", "comment": "Malware payload (ConnectWise)", "value": "cb3c59406500114f50b29097fc6acf9225fd6a03", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762560, "uuid": "59e8a3a6-5d57-4e43-a5ff-ffc9f59c43c3", "comment": "Malware payload (ConnectWise)", "value": "ca86ed5d1f921f13ef500a247d083f593a531a1bfcb7967c1499d5f28299a5ff7beabba3a3ac529ba0d09128a94507a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762560, "uuid": "3683f162-c5c0-48ea-a2df-e2c2ee00af03", "value": "T11A646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762560, "uuid": "0b8b0e94-e77e-48c0-9a39-d8ffb8546f15", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762560, "uuid": "88727ab1-8ce3-45b5-ab43-46dca0540c67", "value": "6144:mmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji95:t1iw7gryNkSV1hy1Z1u2JLu95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762560, "uuid": "4f5449fc-6bf4-40a3-bb83-34a231b3a694", "value": 313928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762560, "uuid": "74266707-c0b8-454c-93c1-04e90eb9634c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762560, "uuid": "a3555477-a15e-466a-9172-fb935b91ce9a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135c7768-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699619, "uuid": "e1ccbdc5-df8e-48a8-a3c3-ce3bc1013b4f", "comment": "Malware payload", "value": "0f5f2ee05aba8019051089413cf7c2cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699619, "uuid": "ea059cea-f4f4-43b7-a9b9-73c6a3edbb21", "comment": "Malware payload", "value": "5863e8d2de01c5ef06479d5d563b6be6a84d49286d55376b093376939c97b328", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699619, "uuid": "0836c225-993e-49a5-b039-419e239665e2", "comment": "Malware payload", "value": "6c4a57643e70ed9a2c5757e6acf187a134ae7d04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699619, "uuid": "33b3eb6e-b7d9-46de-aa07-e1014c41cba5", "comment": "Malware payload", "value": "57215aed9cdfcad2c2c46a08df504f4019e9b4490c9f11a493dd14f035625b0226fef10aba78a78e8366b48f7200c0cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699619, "uuid": "70762984-6a14-4b43-bfad-7d205bb0a9a4", "value": "T167A26C80F781557043D66BD2687950DC8FFEFDA04EC47E8EB35264A3264DD13B8A21B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699619, "uuid": "73a83563-39ce-4f4c-900e-1373acad2232", "value": "384:uIsAeIlq8clmzK7Nr+t2FrQKExvKUPNqdBZyLyWWG1DG4ENtC1n5t2N5FclWM1cB:uIsApo8JYNrQaExvKtdBZyWWlZELknzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699619, "uuid": "a0da81c9-869f-4c36-befc-696ade82ac4a", "value": 23372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699619, "uuid": "31beebc6-bd83-458f-94d8-0e08e8ca8f7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699619, "uuid": "dfeab692-5d1c-404a-92ff-a6e0540a93c6", "value": "uvuqe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dd495d-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782756804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756804, "uuid": "5a86994d-1f33-46ba-bc1a-5dd3547bb48d", "comment": "Malware payload", "value": "94d04830e3a75ae3c7e09de65de0d6c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756804, "uuid": "7485de6e-ec8f-44e4-8aea-e545f1b013bf", "comment": "Malware payload", "value": "5973ac8ab6933166c04b3776e462330a6aeed95b6a1587b45ad8d6a57fdb9672", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756804, "uuid": "77fedbcf-7d95-4cce-9945-118b42831653", "comment": "Malware payload", "value": "b882916c8f1907a5513ffa0a556c696ef48503ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756804, "uuid": "f34fe4b1-77f3-4f52-ad6f-b741c4310d50", "comment": "Malware payload", "value": "9ef39c2504cc712cbb336f778aaafdaf3b17b1fe73e98ec2e5f59da6dd155725d48607ffe140b6cc645a67945883c93f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756804, "uuid": "09e73385-1dd0-4298-b9d7-a4b5eaf6c6ce", "value": "T1DB5189C562013F312ED59E26BABA482D7283D0DBA4CB9FD594D8BDA94CCCE047C41683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756804, "uuid": "37728d1c-effe-4370-a8c5-b373aaeedd33", "value": "24:Itisl5IhOEN31A/Pss7T2TGF7J6YGA6LB0NINksorejlTXyUvD7J:izVEN3iMs7T2TGFlH6LJJorClTXVLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756804, "uuid": "ba922a5b-3203-46bb-ae53-ac33f01e72eb", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756804, "uuid": "a840383b-9886-4b9a-a4dd-28f41b540f2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756804, "uuid": "4ec93ee1-3981-4db1-ab94-1f2da8972d16", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca0f7cb-738d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718828, "uuid": "c9d8ef8f-abfb-4ea1-97fb-3bd563211479", "comment": "Malware payload (Mirai)", "value": "4ab99f30dea424f829914e33fb4881aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718828, "uuid": "43e0794b-42b4-45d1-a1e6-d06253ecaedd", "comment": "Malware payload (Mirai)", "value": "59e05d55eeccbb41380e1fc456fb84489c7d32d081c65c4bb8aece162e80ca23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718828, "uuid": "13c18375-761b-44e8-b5b8-ace97d89edcb", "comment": "Malware payload (Mirai)", "value": "2fa2a90874c54c115f19ff6807c5e60a39fb7d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718828, "uuid": "cb35139a-3977-4dd6-9b97-a8634f04e926", "comment": "Malware payload (Mirai)", "value": "271eb3584c070b86ab03cbeb9cf3ac6c2de0ea6a96a2d9cd7e1910c850deb29e35e689460178d938d4a5428416fcadf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718828, "uuid": "cc39c216-caa7-4241-b615-8f01044acc02", "value": "T1D3D3F84DE910A729C2E272FBFB5D12CE33271FBDA3DB3126C9304B9123C56A61939521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718828, "uuid": "0dd8bdc8-4873-4163-84d4-f1f9d2b4618f", "value": "3072:WajZ5+tzsswaF0Z1R3ZQu3sWwnf5h8p/Sd/:NN41aaF0bR3MWwf5hBd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718828, "uuid": "7b2291b5-db25-43e3-b562-5e2217ebd3e6", "value": 132744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718828, "uuid": "2f8712c0-31bd-4c1b-9d80-fd1619977cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718828, "uuid": "e2fc0cba-b772-414d-95ca-e24980748b7f", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35325565-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760235, "uuid": "de139396-ec2f-4ae1-af39-0c74293f8e06", "comment": "Malware payload (Mirai)", "value": "97422ce882dc1144e13fa279dc141b0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760235, "uuid": "c3d01aa4-94bc-4099-a3e4-903f96d07a22", "comment": "Malware payload (Mirai)", "value": "59fc56d62ed4addf42bf46b4a251e9bf5a736fe2e53c7e13f65ab887b241022b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760235, "uuid": "6ac9258e-d040-4e6f-bd95-d607d933d776", "comment": "Malware payload (Mirai)", "value": "971a31279eed227b3fba17d76b4b410a5e7c672f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760235, "uuid": "63a2c9ca-cd41-40e1-81b9-72b206834a1b", "comment": "Malware payload (Mirai)", "value": "2cb9dd12df984b82486d4dac3a10fad6c1c0ca26b444ccce97448515f1d15a60d4ddc4624084de3158368b08617d8e93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760235, "uuid": "5a2bdb89-e716-45f3-852f-8a5c22656082", "value": "T14C6161FA23610F336CEA8AD772A84418714240DB94CF1FF59BEC68A95D8CFC9BC41681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760235, "uuid": "a0627271-f6d4-45cb-a35e-c8d49e6ff692", "value": "24:ItgpYZsg61bhgPSkgKllfgczmsg4PTgvDvGgJgt86gofnLgBDBNIpKksgSdMEgGc:iyJQN/38L1qTLKJlPIkHBgJsbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760235, "uuid": "65c1c9ae-713c-420e-9524-880a8c06b7c2", "value": 3314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760235, "uuid": "44babb9a-8926-4ebd-8a8c-bab41dc47731", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760235, "uuid": "d3482e8d-c301-4bde-aaa9-e1df67c17959", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d570e31-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770664, "uuid": "50dc188d-56cd-48c2-b38b-dd53a73bcd85", "comment": "Malware payload (Mirai)", "value": "fd8588cd932547329088b8fc456652b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770664, "uuid": "63ace8ca-caf1-4995-bcd2-df1c2931e228", "comment": "Malware payload (Mirai)", "value": "5a021367a916abe1d8b054fff01ca0b7fde072eb96452dee4cf1a7b644c03ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770664, "uuid": "f93cae37-4e72-4caa-8ce2-e7d99979baa6", "comment": "Malware payload (Mirai)", "value": "7ed220ae4bd70c0d5ad8012c3327a4b7bae3bbf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770664, "uuid": "acddbc5a-3fcd-442d-bce4-82ec20890dfd", "comment": "Malware payload (Mirai)", "value": "135793349c1df55c9473e7a65ded5750de4d931fc2ba4535ff28511a20f0ec8bca1b4c8c2d6772b714298ebd6b77ed0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770664, "uuid": "d0fecc4b-01c0-4aa4-a9c4-84ae49fbebcb", "value": "T120B32A86AC814A11C5D613BFFA2E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770664, "uuid": "5c64387d-0b66-42eb-b68d-d09193b6f820", "value": "3072:Vfx2IfERqVXKO4bnOfGZKuawHQonVLao6qXmfeaMFM6xut:uIfjlQDOeZKuaWQonpaPYmgMmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770664, "uuid": "150244e8-44c0-4ad1-a563-2570139f1eae", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770664, "uuid": "c276d23f-0f2b-405c-ad0c-3d3c3bd63c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770664, "uuid": "7e5ebe9f-1e86-499e-b19e-145ee4c864bf", "value": "nerv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8675a2b3-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782763378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763378, "uuid": "5839d7e5-36f1-4aa2-b28c-061873f2992c", "comment": "Malware payload", "value": "76fc400558a27278b459ce477ff9f162", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763378, "uuid": "534672b5-4db7-4d07-8edc-ef2a8896db8f", "comment": "Malware payload", "value": "5a16f5533f8486c2c75b8f1d087d95f741f88868882b1099539f4a9d7d7e7da5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763378, "uuid": "e505260d-2389-495d-8edb-e4e59c46f55f", "comment": "Malware payload", "value": "83267e9d6e149a1e3b736cb6c5687074d94f2a4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763378, "uuid": "2d02ff67-44e7-471f-a085-ff0a7db4d7db", "comment": "Malware payload", "value": "3234a195f1abfa512b39cf1be7a8101f0feec23e2f6c8adcdd20ebc8f6a8cd59cdea5d2b169367b045763bbd3dc71301", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763378, "uuid": "99fefaed-1236-405a-95e3-60baae20f99f", "value": "T1B501AFC68600BD50405D9A5E7A975690B411D3CE495E0BA8BF9C5E2DFB98804B126F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763378, "uuid": "c5772b23-420d-43ed-b7df-cd4556f68a3e", "value": "24:kXCKysE2hi0ziQvZoha5nFSfR8F3iZXIJr7:e9Qp+Ms5EfO3SIJr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763378, "uuid": "651122f5-63e2-41a3-b896-4895e9790680", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763378, "uuid": "1f4e9216-5dd0-461f-bc28-0b47ea29911e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763378, "uuid": "30ad90a5-75f7-4858-b66d-a01ff5e5df20", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aa67f0-7366-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782702093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702093, "uuid": "e0b591a1-c8a4-4c52-846d-6da060c669ac", "comment": "Malware payload (CoinMiner)", "value": "cbc88849ffeab52cbd7ee94d3f562c3c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702093, "uuid": "29769303-148a-4fd6-8ecc-9484291f38d9", "comment": "Malware payload (CoinMiner)", "value": "5a69d7e544366d516dca0903468a8c7de23f7ad21bdf7cfa7fa72d5e18bbc048", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702093, "uuid": "12b88505-f313-4b16-9db9-babc84a62788", "comment": "Malware payload (CoinMiner)", "value": "4f7f5966f8bf444e924a46ea146d8a097d3dd319", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702093, "uuid": "d82a7551-2f4b-4541-87f5-23c4d072946b", "comment": "Malware payload (CoinMiner)", "value": "fa2141e9184f52859405d13298ec148a6e23f313ad1c6232d7372fc09d847169710dc2372ee1cea3e51e1912ca713126", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702093, "uuid": "d43ae079-5ee2-4686-94da-27a9e26cd69b", "value": "T17B66F103D5E78EF4D12BD67D46629373A924B08C5E33B12C29A5F36A1FE0934A15EB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702093, "uuid": "98c82c2a-5c22-4172-baf6-3c5995d9ec32", "value": "2c35b4f5cf81f37fdc9ad2a3c51dfcf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702093, "uuid": "4ae4cacc-bd1d-4a5a-b2ab-18099000c444", "value": "98304:gzZXLWgkFtsDV2FHNxZemyphjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInS:gxnRWdemyujpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782702093, "uuid": "a12eccb7-3487-4250-96fc-2d175fb6ea15", "value": 6548992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782702093, "uuid": "5a133174-2c89-4a85-8971-332b289ea8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702093, "uuid": "edc8b32f-830f-4dbc-a791-ec457ad1cece", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07de5ac5-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769608, "uuid": "c7c7916a-3e09-4399-8d80-1d1c8ce88375", "comment": "Malware payload (Mirai)", "value": "dd4090bd3bb3a477eace0080993e5bda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769608, "uuid": "bc79c934-fdb2-43e1-a56d-fc309c3366d9", "comment": "Malware payload (Mirai)", "value": "5b099adb9b5f3e95b9f44777437cd87daa06e160192c7a017d799293e8f99e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769608, "uuid": "f617a39f-8336-4b7e-b6e2-75b6fbcce396", "comment": "Malware payload (Mirai)", "value": "d2ad6288389406ec728212c281875f4e5fcc060d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769608, "uuid": "84095274-acd8-4fc5-9e99-346460e824dc", "comment": "Malware payload (Mirai)", "value": "6ec6e8238c56bd5dd763913edf1dcaf54c9d29ce911dec61cc5c74e46c900109feef81ad82c78f719f0ad4b8466f1e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769608, "uuid": "1accd8f5-476a-4a87-a156-24b20bd83bdf", "value": "T1A2B31807BDC18DFDC089C038477F753ED822F0ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769608, "uuid": "2d3f6a30-085d-440b-9d18-32d328bc70a3", "value": "3072:gHoE9uzAHZeQ9eAT9kkzy+SJGCvR0MeITI8IunXYq7be:gIE4zAHZeQ9XT9kKhbMeKIIXYq7be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769608, "uuid": "45f8fd09-3401-443b-909a-632d8f3c7385", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769608, "uuid": "cd6d9d55-1b7c-4ee7-a591-2724ab3b6203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769608, "uuid": "acbfa931-7b1e-4b53-89e3-2f8d8c8f9e29", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49ebd5c-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782718358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718358, "uuid": "38212c32-64b3-40d1-956e-87f012822fe7", "comment": "Malware payload (RemcosRAT)", "value": "5295eac3b0a897ea9fa0e4de8f435a75", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718358, "uuid": "f006c411-1fc9-4588-b4a2-1f43f3b40ce6", "comment": "Malware payload (RemcosRAT)", "value": "5b88eb2c33e9389324abd2f14064a0c1861bdccd5ee12c49e6620112c2c8dfaf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718358, "uuid": "fb5d4df8-9133-4148-854c-1f9f50f2b26b", "comment": "Malware payload (RemcosRAT)", "value": "52cd0441ef9172e79955d42a54a628a366a05ab0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718358, "uuid": "a365d48f-d85f-44c8-b1b5-577053a07675", "comment": "Malware payload (RemcosRAT)", "value": "312e8e024d559937a6102979a780570a8165bcf2b291369347c3e566111aff2167aaabd4ad6e5b1c1c8ff447e64bcace", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718358, "uuid": "fa4eee33-816b-40d4-ad98-4af554c8dd84", "value": "T1D5A42E38ACEA502A71B3EF698AD67497F9AFB677372E541D109203460713A41EDC133E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718358, "uuid": "1e98c4a3-7b11-4077-8880-2eccf69a83b6", "value": "12288:AY7Yn4q5Usks9y7KFL4O1GZEXX6Q0KzcQmnyHq:b25C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718358, "uuid": "8d2180a7-2ed2-43a6-98f4-40ff82c31046", "value": 467724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718358, "uuid": "674da8ed-f16e-40e4-bc78-a5430e47681b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718358, "uuid": "64c34d1f-2ae5-4b3f-b443-66a6bd764cc8", "value": "New Order-2900-26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c65a9c-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782742056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742056, "uuid": "3a00d8b0-9ccb-49a7-ba8a-411df8f353c3", "comment": "Malware payload", "value": "24287621482baf51b945d72200cda99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742056, "uuid": "4ae637b7-2d73-4797-ab7f-856669cc5724", "comment": "Malware payload", "value": "5b9562222836095e6f17078b52ca4e29263e1c974ed6c23d30bcc85a946bc1cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742056, "uuid": "4d811891-3f9c-43a1-93b1-516795d92556", "comment": "Malware payload", "value": "b4ade14453460bd92ab0a4a562a4990643560f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742056, "uuid": "251601b8-dd3d-438e-b15b-8ee339a6d451", "comment": "Malware payload", "value": "1f333e1d57e1d01f655f0ab28c6148f29566bb23bf470515df747cf3c43a447050298cc2afb8b7c26edfb71ec6419840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742056, "uuid": "372b1ad5-8da1-4d85-b49d-e69976cde9a2", "value": "T167B37B917B5D7E6FD1B25D3A8447C301BB39EE40EE061603916C77272AB32D10F6A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742056, "uuid": "8e8b5baa-4ed1-42dd-81de-8f00537d4b6d", "value": "1536:x2UcBjruNtOpmBE0bHlSLYVgRJTP7ityNEojVvYSbZ2uoajKQE6QrYTpswBVwXcN:x2UcGEpmBFJiRJzMJaVvYQk6oY917N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742056, "uuid": "3ff7f598-7c30-4abc-a213-52a6ed5e8004", "value": 107440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742056, "uuid": "61078b93-a348-4d9d-939c-2958a7c03a5f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742056, "uuid": "6614a9ad-87c5-495c-8839-c81bf5158409", "value": "m68k.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9ffbe7-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760360, "uuid": "5925c5f4-fd3f-4ed7-973b-d522b265de3c", "comment": "Malware payload (Mirai)", "value": "e4cdcab848d09ddb9a836969dd76adfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760360, "uuid": "ddedb7f5-97a7-4ef5-85fd-feac739de7f8", "comment": "Malware payload (Mirai)", "value": "5c9fa24b3cdd8e0ef033fdd5437587283911faeed1dee09304453cbf16876696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760360, "uuid": "8c67d31c-2643-4041-832c-08036000983b", "comment": "Malware payload (Mirai)", "value": "e1601c6ef00b269ca1d50f2ec32e02b5377fa314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760360, "uuid": "6ed34750-6bdd-46eb-9ee1-85880bc51f3c", "comment": "Malware payload (Mirai)", "value": "4b58beba50a823e6d4f75695f1732960e60fda390f8b4bad35b0416e979b4977b7142fa354697e51e70fde1fb240039f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760360, "uuid": "32521b9e-8794-4c42-8385-766dfade368d", "value": "T13C13F1AAD4D538D2EAFAACB458D7E9F3B7B48E88233C4D42298CFF115062D115906DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760360, "uuid": "00fb959f-73da-46dd-88c2-3c42b5d18ef0", "value": "768:rC10oUpO5g8iHUONwH+nI7ZcsM6UrAVo1gchm3zEiBmjgbeIlwhh9o4uVcqgw09T:u1nqUOKeAM6Ut1gchm3/wS4u+qgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760360, "uuid": "b4756d25-c429-400d-a22e-23549b49faa2", "value": 45228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760360, "uuid": "62e8d6b2-580a-46a6-beab-dd3ee555dcf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760360, "uuid": "9cc335da-460b-4589-b9ed-570b49e1e8f6", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a2833e-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712797, "uuid": "aec80df3-ea8e-4511-b395-a24767fb0064", "comment": "Malware payload (Mirai)", "value": "aab2601eef126b88f7c588b6e3aa0f13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712797, "uuid": "af59b1dc-1e06-4dbc-9521-c7f2ef55b593", "comment": "Malware payload (Mirai)", "value": "5cc907b43309ce9700d132e32fa9a66f82dd50800f653c023c23ae1c6f8e1df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712797, "uuid": "df1b3ef8-1cbc-4072-a46a-d7d894e74734", "comment": "Malware payload (Mirai)", "value": "5885e0d06b22ef800adf1462114618ea35e1ce52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712797, "uuid": "66ed34a9-0ce7-48f4-87be-5f764912349b", "comment": "Malware payload (Mirai)", "value": "d03b197bd5e618a21562634f5cd07dad82142583ebae2ed020d5a36f4f10e19709b85a578081b04f4a60987c17f80601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712797, "uuid": "d41fef0a-a5d6-4cff-a3a9-1f1308aa2491", "value": "T1DD363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712797, "uuid": "0f60d5e3-bc2f-411a-9547-eec7c64c7623", "value": "49152:Pbx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPxzU/eq51T9xQH+F:VEauhfY9n6vCSotowEPGTD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712797, "uuid": "85e0e2f9-b638-4cfa-9dfd-b4f75901582b", "value": 5030040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712797, "uuid": "ea7bb182-77df-4289-a7f8-d2d1cb0edb97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712797, "uuid": "c6a619a0-c8e3-491e-a17b-5f33b08a55c1", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb522e-73c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782743016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743016, "uuid": "a8311891-c9b2-4ce2-b69a-739ac7acbae6", "comment": "Malware payload (Mirai)", "value": "fd1e440926a89616a23394b894bacef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743016, "uuid": "4952da7a-cb53-45ba-8d43-cfa3d02af636", "comment": "Malware payload (Mirai)", "value": "5cd0114cc98dc7bddee012eaa34550d596bb5a6e22b687c535fb4ad3a8fce47d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743016, "uuid": "5f605539-b11d-4cb4-b383-0a224f146e4e", "comment": "Malware payload (Mirai)", "value": "ca51e77b9feb10d3920d49aa66867f36071a0c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743016, "uuid": "1a7e1ada-dd89-494d-a4b7-6ab09b86b2d2", "comment": "Malware payload (Mirai)", "value": "ce8fb0446a18dd42a170e605afaa3d089103e7c4abb827c004e38be8829dbe7af04c4d07f9af94675366e2759fd4ee1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743016, "uuid": "d301d49b-e45d-4a90-bcc7-a41cfa011fec", "value": "T14DC3D73B2B230F63C0D5207112E30271F9BADB9934BC47D7B8E06C9E6F599943156AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743016, "uuid": "f695468e-d924-4555-ae48-aed80b6e72b9", "value": "1536:ETE6CfgIK1oCOQDnp7+whN95vvDetsOOmtBK8YphaXJZvq4:EI6Cfg55OQLp7RhNPvi4MHYphaXJZvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782743016, "uuid": "2f4b243d-fa7a-46c9-8be9-16e6210c829a", "value": 129840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782743016, "uuid": "f2e49e68-c5ec-4533-b645-aba92a4c03b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743016, "uuid": "45ef4779-e312-4e02-945c-5fc288ce4f7d", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7961cddd-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773235, "uuid": "2664b90f-1508-4908-810e-3568ed6c75b1", "comment": "Malware payload (Mirai)", "value": "874286e093d600b4c79d4638b9721153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773235, "uuid": "fe366de9-5330-43e2-8f26-0874c0a02f82", "comment": "Malware payload (Mirai)", "value": "5cf36b618810a9991e792956ccccb82fea10a6713793adb9a0c80bee8a945b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773235, "uuid": "d678f875-2114-4c73-af54-b1c99c7f89fd", "comment": "Malware payload (Mirai)", "value": "64a9f6516952ed0e298eef52ec161a1a99aebf86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773235, "uuid": "d4c59b83-f2d8-4641-9b7c-a33b9c887bf0", "comment": "Malware payload (Mirai)", "value": "28020d665b2f36a5485f4f7005b6e1dded59384bef7fc34fe5b1a67cbceb44cd5766249bb65c55066096ea475a90a1fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773235, "uuid": "e07e7587-60b0-4579-bbea-0acf9a385b0c", "value": "T1B0E2E1912927AC30E320647B1E6CD34719BAB6B0C2AE31DA3D3506BD37878DC5A79747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773235, "uuid": "f9ceb3eb-0eb1-4051-bc9b-c345f956d802", "value": "768:XeBsVPxhgNjq3NXJlX0y+CVidmYfhkXS8qwjKVhIs3UozJ:XeGVPxGpq9viCViTMqwjKVh9zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773235, "uuid": "0d0741f3-7b72-4ecc-84f7-b7e1a678cf6a", "value": 33824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773235, "uuid": "0a288913-b3a8-49ee-b21d-a8641c201efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773235, "uuid": "54f54771-5e7e-42b5-83ef-63bdf2be80d9", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e0c40d-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760364, "uuid": "16e9049f-19e3-4288-9b13-59acbd8ee4ca", "comment": "Malware payload (Mirai)", "value": "7f9d451f23b88f85458a193e362f4608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760364, "uuid": "838e4ebe-c00a-4b78-803c-06c7ae076282", "comment": "Malware payload (Mirai)", "value": "5d0ef6c936fdb360b9ee59fdbde8cbc9c0fbf987cb4abb6ba984182d453c7957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760364, "uuid": "a026865e-f56c-4b3b-aecf-d17cffbdb0e8", "comment": "Malware payload (Mirai)", "value": "4e43a6100575877733e38e1006977a9810a19ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760364, "uuid": "61dff33e-96e8-44d1-8a3d-6eb3b32079cc", "comment": "Malware payload (Mirai)", "value": "748e59abe193c89c1f68c5258faf521759e3c215e9afcbea12bbf726f508a4781b354bbb47502b46d1aa0aebfd1c90d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760364, "uuid": "4e568312-9d9a-4e24-ad39-9ec59396100f", "value": "T1DD13F1B48179E625CAD600714EEE6E5BD840F51CDCF94DF96AC038121AB2EA5BF787C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760364, "uuid": "4fa30e73-ffcd-4c1a-8078-a79df81be64e", "value": "768:DD5VGdppX6YYc+Pws+HNsQgN4FT/8gYuIXbL5cn6bpVlKWnbcuyD7UoQRjS:fjGLgYY1Pws8mbXS4nouy8oyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760364, "uuid": "cc6e5a30-d356-4fde-9e82-61194445a191", "value": 45104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760364, "uuid": "ee93ddf1-db43-463e-83a3-7820b005320d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760364, "uuid": "564268a1-cdb0-4ecf-8fb8-bdad989e55d1", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea607a5-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782736736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736736, "uuid": "5b62a6a9-9b24-40a8-af6f-f1b949e3cb61", "comment": "Malware payload (Formbook)", "value": "be6dbe6cbe0c2172ba32f5ec02abbf85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736736, "uuid": "27d42da7-4564-486d-9c5b-3d87edcb7896", "comment": "Malware payload (Formbook)", "value": "5d3336e73a6ae8c166510f10919b2014bd0a05ddb0ad622de9a27df4cc52e65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736736, "uuid": "d6db3a6c-b103-4d85-b9a4-ec7ee9de378b", "comment": "Malware payload (Formbook)", "value": "2ba9bfa121d7defcbcbe5a0cdd4c113596632af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736736, "uuid": "9d91e66c-f66b-4dd3-b916-fa45b7029563", "comment": "Malware payload (Formbook)", "value": "b6bf7a727c810bf1043bdee308da6bd2fbbaef48c605dba4e057054592e2e12bedfc2c2cdf7da5c4495311ef1e285af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736736, "uuid": "836a89a1-70d0-4d37-b018-3e7defa2216f", "value": "T14B9502148AC42FB4CF9D9B1D50FE260EE3B1098F9415698EEB33BD46BFA7A4051071B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736736, "uuid": "af4904c7-22f9-47a2-a9a6-bade884db554", "value": "24576:Ynt458vyPudsZDtNg91sZedgv9nzzT53JbBwQ2N4Pez8FOjDT3VV8WyvDGk5z28j:893w1VB110TFiK3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736736, "uuid": "abf00dea-ac69-4675-b440-a194ad4a513f", "value": 1981456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736736, "uuid": "9849ff79-d19f-43f8-9625-29933181f3ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736736, "uuid": "8d37c658-341f-4c4e-9732-1780d7305e5a", "value": "PO79765968483475574.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb1c0d7-73c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782740894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740894, "uuid": "9ef520da-0ce0-446c-b0e8-97ada428a531", "comment": "Malware payload", "value": "a2e6e6fb8548dcb41563d4bf7bdf46dd", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740894, "uuid": "999f02d8-b88b-4bdd-936f-8a1feae0fd63", "comment": "Malware payload", "value": "5df9a7e01d3a9c166bc92d1ef61f34422f7f0b4da394327eade218367bcc92f6", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740894, "uuid": "f7f2846e-2baf-424c-aa41-750d7fc3fd98", "comment": "Malware payload", "value": "4490456d3c73f0d2735fec2d7f540a7a8d9b45e8", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740894, "uuid": "b55de57f-bd2a-4d56-bdca-c22dec34fcb3", "comment": "Malware payload", "value": "1f9e6f015b6c070f8e5fcc81db727f69bc6733d1d160c341062850c213f87b2c4506eaa61e79abc6f57269d05b3c429c", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740894, "uuid": "b40b8d47-361a-4d99-8e2e-018306f85a8a", "value": "T1730178BCF6BCCEE2259CC985B5F055095881A0CBA1F55BC5F34D29247F08D49399260D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740894, "uuid": "c6252e78-3c56-48e3-b0c4-1ce353f5ca24", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkkjkaIZSlaIZ9AeEnn:FzY8k1/sWi2jkwkvSlv9de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740894, "uuid": "6671ac82-f531-44e4-a567-f844482343b7", "value": 696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740894, "uuid": "24dd4db5-6ff0-4b48-9d7d-3ade7426b7ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740894, "uuid": "11488f50-25ad-4c9c-a9fa-28f7139171f0", "value": "ipmiv2.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d51f5-7387-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782716046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716046, "uuid": "f20036e9-7bc8-4be1-87d8-42434ea0d4d4", "comment": "Malware payload", "value": "3420eff7041750b0c772a63ce32179ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716046, "uuid": "74898dab-1f48-45a0-95ab-5a93812a26dd", "comment": "Malware payload", "value": "5e83283481ef1ed7877d832ae3ad53d836a3309b96d8ade1e56dd1726cd6fbe0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716046, "uuid": "184c5471-db9e-40d1-80d5-8262c95121b7", "comment": "Malware payload", "value": "cfb593fa5275696aacc0cf9b1baba005674300fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716046, "uuid": "486434d3-e2b2-45b8-877d-566df069dda2", "comment": "Malware payload", "value": "3de78fd60f4a1c4100559a13caa8d7b99c11ec0c2fad0698023202a9a58e6351d8a159cd94392e2d9ddd126ac7944b68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716046, "uuid": "4c3a0519-7664-4f8f-8a73-e9a77500b96d", "value": "T1E7D097A29033003110B29C50F0D66800B0808B3F8C25CA1EBB2320B01F0238EF0D1789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716046, "uuid": "b0c1ca07-5e31-4305-812c-5881856156c9", "value": "6:hTSBX/1BP5A5hAulNXYq9DG+NjVsNXYrkJ:VkPfkhPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716046, "uuid": "ab9d2b88-6ccb-4796-ac14-87dfd8fdf620", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716046, "uuid": "e49f1130-3ed5-4957-a02c-7ffb46009639", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716046, "uuid": "b9c43425-1456-44ea-a7b1-d00f07dfe162", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bcd4fa-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701148, "uuid": "de886324-223f-44a5-a9e1-0198ccb20af0", "comment": "Malware payload", "value": "b4caac339328e54ca03229680af0092b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701148, "uuid": "a8c057d9-1bef-4343-baf1-eb1457af1fe4", "comment": "Malware payload", "value": "5efae610f13b8da52c3ff912843b6bfa32052bf4b79ce3a460d98141a47fd175", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701148, "uuid": "e9c274ca-7bce-44b7-9749-7e97b45b181d", "comment": "Malware payload", "value": "c81ec6567bb71204ee99347f3cffd44b83edc17a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701148, "uuid": "407acec0-58fd-4b95-9f4b-6757b3f5816a", "comment": "Malware payload", "value": "eb982b22e200dfdeacdc369f0a70cf6d120250257554e2e684a2aac0d068973d54c2fe43ecf734af04f02647a67d15c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701148, "uuid": "ec736a1b-612e-4a75-8aa8-46862fae819e", "value": "T1B1039D15EB219EBC12FE5A3C18A40AC689F5026990D0365FFB3DDDAD2DD1D44D33E8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701148, "uuid": "765b21b3-3338-47b5-92e5-748f2f1536cc", "value": "768:UHWnpr2H1TViIeHIniuU5g7JVi1b67k+6f83OE9mdlyvZ8Z/08:UH8AVTEICffAAh67Y8b4Mh8Z//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701148, "uuid": "f30868df-6c4f-4cb9-a98a-a313548875e2", "value": 40723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701148, "uuid": "d8d37608-23fb-4cb5-92f3-337fbe16ac9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701148, "uuid": "88b24a85-41ed-4a0d-8ed5-ab514a927c74", "value": "ivawu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e3e39-73d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782747309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747309, "uuid": "bd827d46-d539-49ca-b63b-0ec4b2770d82", "comment": "Malware payload (NanoCore)", "value": "1615ac4b69265a70f17a0eb37df82065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747309, "uuid": "8a78bb22-c1b1-4f2e-a938-3f6b0f73b345", "comment": "Malware payload (NanoCore)", "value": "604a502f34aa28773356a131d2ce537866cdd973e464a7144b0d626fd65f5937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747309, "uuid": "0bf841dc-cac9-4caa-8ccd-380cef2806f7", "comment": "Malware payload (NanoCore)", "value": "1a46239db708d9eb82152b45392433be8f182b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747309, "uuid": "e3dcf89a-eace-4f69-bdaf-3ec965563cf5", "comment": "Malware payload (NanoCore)", "value": "30f4e3ed3ccef39e7f0f0867c40507933b83e906bb9bc4b4b0f9a5c3a4808ea3d103e4020027374d570abb4c616da009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747309, "uuid": "42011893-0e44-4549-b1d7-336628114e78", "value": "T1FF14D0563BA88A2FE2CE81BD712201139378C2E399C3F3DE68E454B75B667E106471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747309, "uuid": "b3750db1-479a-48e6-acbf-8e893203f09a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747309, "uuid": "d5f1f24b-5509-42aa-96dc-413c20c9000c", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HITa5zohUAeoM4YQUHxAOeb62S4:gLV6Bta6dtJmakIM5YTM4YPSBRbOdCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782747309, "uuid": "a934a54b-d101-4b80-bb38-83186d16ef61", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782747309, "uuid": "79a848ad-f950-4a5b-a818-5c503d1bff5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747309, "uuid": "0ee65909-9c0c-4bd1-b674-6b9e533ae456", "value": "SCTOOLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebb3c74-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773243, "uuid": "06305544-1850-4892-b326-c69cdafffbaf", "comment": "Malware payload (Mirai)", "value": "965179c60aaa14f4c81abde3f2bdfa0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773243, "uuid": "dd5f7c3a-f0b2-4207-8e79-5fcdba8cf921", "comment": "Malware payload (Mirai)", "value": "60a68bdb7838f8f9c1bcceae008a115606c9d4c268882635e5d9d4b6fa595e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773243, "uuid": "e4faab0f-70bc-4a5a-b849-4033b127d6dc", "comment": "Malware payload (Mirai)", "value": "2a7aecdb6bdbc074e5ccbf562f1900bf035399d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773243, "uuid": "b998151c-a55c-4137-a607-d12ab94777b6", "comment": "Malware payload (Mirai)", "value": "e3c8818ad412327a25235d463c4e3f3ec101b502fbb626fc172c9c6d40db065291e270e0b3c10949b3f3cd09a416c067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773243, "uuid": "6474913e-bfd3-4292-a3b5-6afe9731d923", "value": "T1C7E2F26A51ECB12CE44E903BC32FA98E31E65D11FE17C69424C4B6DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773243, "uuid": "952673cd-98bd-4e16-b67e-0fb5558f50a7", "value": "768:g32bRAqg2NQzSPMjFY8AFOEPB6ZSq7xnwNQBUW:DbRAp2N4ECF+FvB6ZSonwN2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773243, "uuid": "6f4a6023-c6e3-4400-8931-386efc3539e9", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773243, "uuid": "7118aa10-0f16-49ad-bd38-2129fdacaa6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773243, "uuid": "979c8258-d323-4b47-be2f-fa6ec32e5ac7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6284c299-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763747, "uuid": "0b835282-5392-48ea-9988-71081ff5c2c7", "comment": "Malware payload (Mirai)", "value": "f7805bc74d22c909ad87ba943d01a466", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763747, "uuid": "2bcc5922-eabd-4d80-b12b-b16bc73db361", "comment": "Malware payload (Mirai)", "value": "60c4a4620b83676a6f0d1cccd83d6f5e771e199752a9428e5d7c324bc3589382", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763747, "uuid": "5651eb9c-d4c7-4c2b-871f-8673165013d3", "comment": "Malware payload (Mirai)", "value": "9f4be687d70d03f503f83a0c780c8b4319263c37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763747, "uuid": "5bc9135c-e774-4b7b-938c-d9e888e5f6a7", "comment": "Malware payload (Mirai)", "value": "47b81d0f715b0ca996c4ad9c448d4ea65f1f76aa1806fef7bf22e67246a1ce473a0c7171fa58dd42e16364092327157f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763747, "uuid": "dbe4c0fb-e6f2-4bd8-90eb-d99dda976d84", "value": "T1C1F32859BC819F01C5D626BAFE1D528E33231BF8E3EE70129D245B2537CAD5E0E7A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763747, "uuid": "fe267dee-cfd8-4f2b-9312-a9e735c7480e", "value": "3072:5Uwiyp5zuSoYP302HREZBMBAFbPr8kbp3JgrhGantm3yN1k0mPVm+x3RoQhEK8:5UOsk1BAFbPr8MqtGatm3yN1sPVxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763747, "uuid": "fa85e37a-9b53-48ca-9b55-67ae0ccecdca", "value": 160156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763747, "uuid": "678a31c2-4586-4131-bdcf-91099a69ec19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763747, "uuid": "c6ce514a-8993-4c13-b877-1086dc7f0d49", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1310ef-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763471, "uuid": "b5959817-d042-476c-8465-80acc029157a", "comment": "Malware payload (Mirai)", "value": "c8371618c051687a0072e7f807528660", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763471, "uuid": "a5ba196d-e0ab-4858-8961-0d4ae88ec0ce", "comment": "Malware payload (Mirai)", "value": "616cd18e35620b82d680158d498e00c5e601190c9c28c452915f73465ad6b354", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763471, "uuid": "986183b8-2e98-4c96-8105-fc7bdaf4cd6f", "comment": "Malware payload (Mirai)", "value": "e0cace782ba1fd3b252b04a1c98172332501564d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763471, "uuid": "cf587666-1fe4-4840-baf8-e97af638b86a", "comment": "Malware payload (Mirai)", "value": "214fcdde8745324c98076d65fdc2af79f92664b3f322bdfb176c6bb86e412d3fe69b64aaace516bba047d3e1244d985e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763471, "uuid": "620c2a49-a249-47b2-aea8-368f726cd59f", "value": "T12C5104E7115287312D62DD23FABA481A7280D0EEA9C7FF69EDDCBCA5528CD083C45647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763471, "uuid": "76de5d51-78e7-4ed2-b7d5-82a602d3617c", "value": "24:ItGsmKIhOE93pAbPss8T/TGF7JlHGAyLOtNINksEr0jJTZyUYI7J:iXlE93GAs8T/TGFlPyLLJErsJTZVVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763471, "uuid": "935d5f7e-7f76-4ec3-be85-0acecb9dfc1d", "value": 2699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763471, "uuid": "dfdddba1-1525-4689-8625-5b344a16ed88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763471, "uuid": "ce6b01dc-a7d8-4535-8521-d12ad8868b60", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09655ab1-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769611, "uuid": "f4bb2132-7637-49bc-98f0-87bc4fe33fcc", "comment": "Malware payload (Mirai)", "value": "c9386a000d89ee6a735cb9c85ae0cf56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769611, "uuid": "b45b81f4-ea42-4730-91ab-3a8df1913679", "comment": "Malware payload (Mirai)", "value": "6172ef4802bd98715c4b06c51273f6d98749aa656d99fab2401bec802f1b205c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769611, "uuid": "4d01e846-08b9-4049-bf1f-9bf5dabff219", "comment": "Malware payload (Mirai)", "value": "03e44858ebd4e16be2b5dc3f399c7854e9accb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769611, "uuid": "3a85efa8-5ec6-434c-8639-c1e58f991376", "comment": "Malware payload (Mirai)", "value": "405e5100a188cdd0b3121affd1b33e097e88c3a5a14b34096b05c6e7c8bc5b8cfaaf3bf92ff7e654f7ce56a68307be59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769611, "uuid": "8b5dfd81-b44f-46e3-bde2-c58c4f070d77", "value": "T11DB33BC4E243D0F9EC560534213AFB379A72E5BF212DDA43D3A49AB26C96AC1D40679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769611, "uuid": "d3abf2c4-8289-4b8a-8e3a-a06bc2a03b85", "value": "3072:hd5qGekwumbRajd24WgaM28xxfebx/S3H8QY:75qGek6bRaj4zM3GJS3H8QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769611, "uuid": "520beac5-6ff0-4fce-b626-4f20753cda50", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769611, "uuid": "a8fc806d-4506-4859-8678-9ce62427b574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769611, "uuid": "917f5b2e-eac3-4ad3-9a6c-1191d50c9685", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d118db-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737817, "uuid": "902fe75e-be0a-4e5e-92e5-cb8fcb77ae2c", "comment": "Malware payload (Mirai)", "value": "8b0b204ee7bbe6fa59db10c4b861b920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737817, "uuid": "985095af-ebe0-40d0-ac23-95176685720a", "comment": "Malware payload (Mirai)", "value": "61edca8bd9d2fbeea3d7b87a31975dc4e330e50176a65bd76655420e703f7187", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737817, "uuid": "293c60c8-f1fc-464c-9fde-a0d94051a3b3", "comment": "Malware payload (Mirai)", "value": "0ad99bb939d8b222af45be8b7fffa95aa432e23d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737817, "uuid": "3b0349e3-8ce2-4b9b-bac4-8094ce7c48a0", "comment": "Malware payload (Mirai)", "value": "1122212235f68a37c5c6467568baf5d1c3a6a545d87201eb58f9053e5090d316520802630319be7eeccdf4f7fe705a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737817, "uuid": "b001b707-c40f-4a55-8b52-c1f0fff8607f", "value": "T10BB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737817, "uuid": "6eeb0e42-c608-4468-b9bd-aa796bffa625", "value": "3072:qd5b7djS5HEC7gBjmbhRhFczcmVRh865Um:qdh7djS5ECBbozcmVROm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737817, "uuid": "32a2b6c6-f64f-4ac4-b157-dff76624f615", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737817, "uuid": "8d6e8d0a-ed4f-41a3-a5a0-17a273b248a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737817, "uuid": "0c414675-f9d8-4f4a-9a10-6366e5414a6f", "value": "79ddac30f0cb86fe37f81d954778572e758426d8a1832f244a1d338823363bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33eac9b-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721362, "uuid": "55783665-7a18-4d50-bda9-aaa9535084bf", "comment": "Malware payload", "value": "44519f0d3e97f3af87a0c3e6bd578035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721362, "uuid": "c9dd775c-ff05-4b59-ab03-ef3f5f22d9bc", "comment": "Malware payload", "value": "629c1298e768c2c529326acbae7359cf4bec9c1e6621b108a321e271d31e276d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721362, "uuid": "17614d08-4334-41d3-87b4-ac4fa82bc6f6", "comment": "Malware payload", "value": "c4680b60ee53a2194a243291dac373b2b6a3ab70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721362, "uuid": "a99ea210-22ae-4035-82cb-6ea4b6fa577d", "comment": "Malware payload", "value": "0e31e53e3e86949eb2b6534500d6e0a8e93794c2a53c50f2afff12074e021b4c4abb088bde80348a570ff7127567d20e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721362, "uuid": "a09fdd72-5b28-4799-8d66-f33a135a0563", "value": "T135C71256E2BD00E8D57BC0B8C6574A17EBB1345513306BEB62A48A692F33FE16E7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721362, "uuid": "4e11fadd-6bdb-48dc-8615-663c68253ba6", "value": "759a3c183e9207f0571ae8ae7b2a52e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721362, "uuid": "45d97621-29d0-46ac-91d8-e598e4005a2c", "value": "1572864:BFMoA1VSGYEhVGHjewsH2FVu0ADjQKoFeLiT:BFMogVJnhVTMVEDjQKoFeLiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721362, "uuid": "a72c5f0d-0154-4e7d-bb7f-6fcbd7a2253e", "value": 52791569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721362, "uuid": "20115f20-b854-4a62-abe6-03235b69be8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721362, "uuid": "3b29dfec-0354-4a4b-a715-73eb49dd4fda", "value": "44519f0d3e97f3af87a0c3e6bd578035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75fb73c-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782736858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736858, "uuid": "aaf06336-b4f5-439c-84cc-9f8fd72bea34", "comment": "Malware payload (AgentTesla)", "value": "30311b353d0d58b34e7c1d855479a16e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736858, "uuid": "a3904387-f670-404a-80c5-6f05c2bb6a0f", "comment": "Malware payload (AgentTesla)", "value": "62b5b78f80d371eb50e98ce67a45df37192936498e88f2184366631c95eb81db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736858, "uuid": "36cc1c47-75c2-4e0d-a8f8-94e7b775bf24", "comment": "Malware payload (AgentTesla)", "value": "0d01413b0b092183bb637314bdf9198bccc159fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736858, "uuid": "b740c88a-90d8-43d8-b573-38a28c025d89", "comment": "Malware payload (AgentTesla)", "value": "1908386b75cd14fde1e7bb2e381f53e1aca5f092b800a7971f9e5a073801241d3bebb52b9691da8525532a4636f42d2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736858, "uuid": "843995e6-45b0-4a4d-9130-9cc68d53bad3", "value": "T1AE85D728DBA24A599761E72A4DFA0446AE4F77933BCBDD0834BF0FCD43125E1A67052C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736858, "uuid": "c4fe8969-50d1-4233-bb0b-9ed21c0720f6", "value": "6144:HPf0UMLCCb8jP37ZmkmdTnRkUIteM2wKWYfk8Alqu:4/vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736858, "uuid": "9bf1f54c-5dfc-4e3a-84e5-ebbfbde227ab", "value": 1845748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736858, "uuid": "68cbaed6-3823-421e-898b-ce9e30569d48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736858, "uuid": "8355aad5-79c2-466d-9dde-a0e963eb546d", "value": "PO_#3334.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f02ee-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737457, "uuid": "ee401ea3-649d-43b7-9f83-b454dbfca9b1", "comment": "Malware payload (Mirai)", "value": "15e214085b7801233da0de799b981c62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737457, "uuid": "84ca57d2-12be-4300-b1d3-6e2bbd537ab0", "comment": "Malware payload (Mirai)", "value": "62cca9ae3c547f1119bb500cc809362240215f11eb1851fc60974e1d5de4b847", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737457, "uuid": "1a3992dd-a243-4bf5-973f-2c333f1ceb59", "comment": "Malware payload (Mirai)", "value": "7ae01e9c40f9a29e02fcc9d0c2e76bf8af1ace65", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737457, "uuid": "400b93be-ea06-4a72-80cd-0497d05930e8", "comment": "Malware payload (Mirai)", "value": "181c6f4e8336dbfcb2f225db839aaec703a33b898a0fa25709dff2d105df65dd98732c4b991a4b71ceab3a2ca0609784", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737457, "uuid": "f1f96e76-c593-43a9-ab6c-6521808a955e", "value": "T10C51BBC621221F312D5A9E27BABE887D7181A0DEA8CB9F955CD8FCE544CCF047C41643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737457, "uuid": "a1bd8b96-7c5a-48c3-b7ad-260cdc19ce48", "value": "24:ItasDnIhOE53VATPs0NT0TGF7JYWGA6LnWNINks8ryjxTPyUpV7J:ibdE53Co0NT0TGFln6LhJ8ruxTPVfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737457, "uuid": "d593b1ba-84e4-4d18-b4e1-eee64a8d08a1", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737457, "uuid": "cb2008f8-fada-40b0-b8a1-5f438ec4b0a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737457, "uuid": "cc1c27b0-73aa-48b3-87c4-fb1ecf9af006", "value": "62cca9ae3c547f1119bb500cc809362240215f11eb1851fc60974e1d5de4b847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee5ab80-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760359, "uuid": "6c40e052-1c28-490c-b42e-0edaae9bf9cc", "comment": "Malware payload (Mirai)", "value": "97be326b5fdbefdc224eed92a29bddda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760359, "uuid": "cd769a98-d79e-4aa2-a615-e994199b130c", "comment": "Malware payload (Mirai)", "value": "6361f5497881328549d7432fd77bc16f671aeacc051830fa789a5a591c3e7380", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760359, "uuid": "bd8ba2ae-f0ca-46c1-8242-f032a41fde04", "comment": "Malware payload (Mirai)", "value": "d5f697c53094ffa1c094ab5eed6ea0e3ca7036e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760359, "uuid": "36d6715d-e97a-4505-8527-3bed907432a9", "comment": "Malware payload (Mirai)", "value": "50c4fb06ff0c390509c803bfd2c2462ad222240ece11d2373e40dc3aba004c3964f9a442323e0273e740b470ffc4cac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760359, "uuid": "154df9f0-371c-4a85-a90c-6bfbb1020fb9", "value": "T11523F1304289C0622B30623152BB97CF16761EB9E2FE7527346886D0EF9EBD653B4984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760359, "uuid": "f7b5054f-18bf-41c1-9cb4-694eca08ea70", "value": "768:WlVAshpNH2Kflo4uzwS7USsm9v4cWtHOpAXtZ/sp8gvtqPrtCWRnYipt9es3UozF:nspVu4awwQm9vngHsmjEpwrthR3/zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760359, "uuid": "177c3d21-261c-48f4-8b66-10714f046d3c", "value": 47364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760359, "uuid": "3ecfa66f-4095-4128-92ed-fa5c0513b3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760359, "uuid": "3e2362cb-c607-4651-89fd-387785d5a8f3", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812b1b14-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770671, "uuid": "b7d354d9-0e52-4e87-8953-8d20a01a3d78", "comment": "Malware payload (Mirai)", "value": "771dfb7d8a43c5c757f9bb762199dccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770671, "uuid": "dbf0a50f-cf2a-408e-8f5b-c9a58c406212", "comment": "Malware payload (Mirai)", "value": "63c2176ac941063c3c0dfaf8d3f6d798bed2cb976e0a622dff1ea5caa4d9d3ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770671, "uuid": "f89b17cd-dad9-4bff-baa1-971ee244f634", "comment": "Malware payload (Mirai)", "value": "b2799b723b324f2fb63f4e6a5f214e89be956cb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770671, "uuid": "b3b86fb1-8fda-4608-8c6a-96c73f1a1397", "comment": "Malware payload (Mirai)", "value": "dd7c715d8728a9e883b9845fb3c50bac17bf2b6ea657c298e53c0720f04c35d3a5723c701d9df96ccaa3875e0f8d734c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770671, "uuid": "781b6799-7412-4ada-bf20-66cb9f3a07ce", "value": "T107D3F806FB210EFBEC9BCD374AE91705258C651A22AE7F367934D928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770671, "uuid": "fe8dfb55-6d30-41b8-ad54-8dd884afbbb0", "value": "3072:NnjFbpospIvGVSy/QrajBcNiD0qwwgr7P:Nn1bJfUYSS0qKfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770671, "uuid": "d311f9ee-8cd3-4f1c-984d-7f2c5eb85555", "value": 141588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770671, "uuid": "dbf32903-9666-42ed-9223-9e13c3428b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770671, "uuid": "e3afdda2-e849-4da3-96c5-b1092edff5d2", "value": "nerv.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c108d1bd-7353-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782693898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693898, "uuid": "b7146b8f-bbbd-4864-b8d4-ae4aace8a2c6", "comment": "Malware payload", "value": "da69ea04f14a52d24a9cfc7a748a4c05", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693898, "uuid": "fc9a6e0b-e1f9-474c-b840-7d9707448554", "comment": "Malware payload", "value": "63e0ead45ab257e0dd1cc8d5dc6d83f5e0313272a4840938e578628ee092a8ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693898, "uuid": "bc629c40-2b8f-43cc-b1e9-29e0b1be39e3", "comment": "Malware payload", "value": "2dc4eed7e70e09b2e80732098e82f310a6fa503c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693898, "uuid": "15bc2d52-552c-48f5-8bda-32b37dd4d304", "comment": "Malware payload", "value": "90d692ab903996c02021bc05c9d701d3ff311a806f5de8748838a1564a1b8cb94bb7cdb9f7a8ca01976df326de72344a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693898, "uuid": "5c5b9e4d-eb8e-4812-b1b5-c97544e9ecce", "value": "T14FD097A2512345B060A34C60F0C7BE21B2090B3F6D56C20CB83728302E0430CF0C2371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693898, "uuid": "317f1cf9-a894-484b-9f1d-1c87d66595f0", "value": "6:hT//8Fk/GzJYiX0HDBAulNXYq4HvXDG+NjVsNXYrkJ:VRyWp9Piq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782693898, "uuid": "91cf2ad0-bc26-45bc-9cd0-7fb74f8100f6", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782693898, "uuid": "22b90469-be22-478a-ac85-ea5006a677bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693898, "uuid": "0d32c20a-f278-4ecd-b775-539ef371cc59", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7755313-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782721423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721423, "uuid": "82faf87f-94d3-4566-a499-fb56d95d9735", "comment": "Malware payload (MassLogger)", "value": "75071e56c67a11e605584e2dd88328b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721423, "uuid": "a35e5860-9a83-4c59-a528-55d781f175ff", "comment": "Malware payload (MassLogger)", "value": "640c7c6ea97dbecc0438cd6d77d4a599e459929f626e2f0b2b4a66dfe1f99b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721423, "uuid": "bf691116-a219-4b52-ba52-aae0b224ecc5", "comment": "Malware payload (MassLogger)", "value": "d7ce809c5ec1ede0489a3be06beb792d38f89f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721423, "uuid": "956fff7a-009e-4db3-ba19-4879dcb7fa26", "comment": "Malware payload (MassLogger)", "value": "c30ce6c6ad30c24035903713e845023a4938bb42ec7b301f45439f7c8d5de65db4da2d6ecccf29b9579cf3932633072e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721423, "uuid": "dc30e90e-1b43-40b0-a6b2-574128538d4b", "value": "T1BF259D9C3111FA8EC8878D72C968DDF4A6102CA6D707D24391E77DABB93D7869F041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721423, "uuid": "25f7e57b-07e2-4313-a7e1-3b6f4b09dcb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721423, "uuid": "46f2c66b-89ef-4c4d-8e05-03ee10889255", "value": "24576:qUvJO/blPE3bMN5E7BC5pwqZemfx/HjiTVt1wt4:Ry5P9NeWXem5vjiTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721423, "uuid": "ab55643b-af95-4e02-bb2c-80f4ea02fc02", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721423, "uuid": "b882b801-416d-4820-b718-0fcb74029d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721423, "uuid": "e9057ef5-e7fd-434e-b4c3-5ddc16f148a2", "value": "eJpi6ZTmpkYoC3r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac817283-7391-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782720492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720492, "uuid": "dfdeedf4-f273-4071-89b3-b86078b8fd46", "comment": "Malware payload (Mirai)", "value": "e47c9e66ea787abab1e9dc5068cfd9a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720492, "uuid": "a16399a9-8782-4ae9-b380-fd9468a43254", "comment": "Malware payload (Mirai)", "value": "64b0dc4f8e133441917153b4323e01e04a289cfc10e8878baa1974f2f138ace9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720492, "uuid": "56ed9f58-9412-4494-b26d-c4ee3ff391ed", "comment": "Malware payload (Mirai)", "value": "b246bd4fe70123063e3c7a9f6c10d5c3304e34be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720492, "uuid": "76eaec1a-d976-4935-877a-e94e7209cac1", "comment": "Malware payload (Mirai)", "value": "f1d2576c78484ec018c3a1e805f575c697435fd668bc587f91476214181ea1c26f96b216adecfa6fcb33404c2c7c78a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720492, "uuid": "dab45cee-322b-4741-b209-73d5ec884c5e", "value": "T1A3B3E6C7FC00EFA7F80AE77645934915B230BB660D5215B6B22B38ABED360D51427F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720492, "uuid": "5be20700-9eae-499e-8e3e-2310995a0582", "value": "3072:qvM5dAMdLordn1ryyITCJQfpd0ZBM6XKJJ3UZ2Xt3:KMv5U5nYyI2JQxdmefJ3VXt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782720492, "uuid": "78e2c91a-f8c2-4b24-a0c2-b5f512fd70c3", "value": 117828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782720492, "uuid": "495bcf38-53f0-4457-af30-204225e46f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720492, "uuid": "c67ad393-a25a-4c9e-9336-d3acdf8518ed", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cadc0d-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762134, "uuid": "3157e2b8-608c-402b-9ceb-fae72ac5bf50", "comment": "Malware payload", "value": "633a9cc5c7effe682724f75cda571485", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762134, "uuid": "78b20c42-0074-418e-aefd-27ba575f87f6", "comment": "Malware payload", "value": "64f5d668ffdd18dc9dac0da41d409727b2521d920266f79b914483c9d3a76972", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762134, "uuid": "bacc6bf0-af86-4301-bf86-180969906b62", "comment": "Malware payload", "value": "3e5f9b381d21b70ac9f4bdfe5eaeab40d736d257", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762134, "uuid": "2340c7d2-0ee3-45ea-a6f6-111ca2fdad9a", "comment": "Malware payload", "value": "cec2f396015c55e7f0e867b86041c1978c6d185a4eb59bd6e2b64bfb58c2992908c441832d0598b75511bd339d62d783", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762134, "uuid": "6902e9af-fa76-459a-a765-7d6d555d9aa5", "value": "T113E54A07BDD168B9C49A933189B642567B7CBC080B3677D72ED0A33A2E327D16D76B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762134, "uuid": "ae096aea-40d4-4995-ae62-23b308da01a8", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762134, "uuid": "80b7970e-480f-44da-a036-126d90c1b30d", "value": "49152:itlsw9Y+W1obB0LdRmbNOQFZbnyt/OPVNR+6P:iwJnWNhmtz6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762134, "uuid": "32366bd3-6c82-4203-bae5-4824a3465504", "value": 3216480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762134, "uuid": "b41adc46-4452-4aee-9963-9e16c8d718ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762134, "uuid": "328c85e9-0f25-4dbe-b5a4-b3024831a275", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94402a6f-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765119, "uuid": "571b1c22-c48b-4680-a37b-dc9fd77d4323", "comment": "Malware payload (Mirai)", "value": "41cbe99e24d6dc66ce0ee0a86e3ec870", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765119, "uuid": "a6671392-f5f1-4ff3-8534-5a522ddfd49c", "comment": "Malware payload (Mirai)", "value": "657fdfb15c2256423d41754d93eec028e1bc1a4f9dc65fb01b8b19c3f687515d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765119, "uuid": "882e7c92-a4bf-4b15-8388-9509faaea296", "comment": "Malware payload (Mirai)", "value": "f554d034f7c63fd2f9dc5802ebe37ff8ebb6d2a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765119, "uuid": "f48ae54c-896d-45d3-8e79-a0691ab73fb3", "comment": "Malware payload (Mirai)", "value": "1a27c81a27372c61cf53072fcc832f55f0ff4a5556e62364b82fdd11697c8463af4701b79694c8fc6bc6c552bded0648", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765119, "uuid": "1a335078-b8ec-41d0-895b-4b2bb452e460", "value": "T1A3043802D603CAB2C01301B212B7CB761E31F9B7AE25D452D3FCFEA5AD656D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765119, "uuid": "5e347cab-61d7-4325-a051-323a831581a1", "value": "3072:6pvxSRDke9jrwcV58ctaiJE7/CRDh7qU83Flpm8X:yvwpk1ctaomi7V8tm8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765119, "uuid": "52f8978f-6cc7-4460-a8cf-77ce396b78e3", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765119, "uuid": "1060c537-ed0e-493c-ac29-d68b73f9f0b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765119, "uuid": "8fc44a25-ca24-48fc-818a-7ece920d4dbf", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e7ea2c-73e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782756524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756524, "uuid": "4d399867-ac86-459f-a21d-d809f03c744d", "comment": "Malware payload", "value": "00b1870adb8fde03fd9dc5128756a955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756524, "uuid": "3623c5c8-a5f9-4c1b-9639-d00aad42e79a", "comment": "Malware payload", "value": "6595029e3a3f6918222d3260d19f46fa21f93e9b923cd55be41ffc292c33b81e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756524, "uuid": "bbc23083-3e9f-44bf-a96b-0769657736c5", "comment": "Malware payload", "value": "000e7121c7456af45db5332ea8bff5a07a72f6a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756524, "uuid": "56177003-6089-4e61-b9c3-d262e38e1588", "comment": "Malware payload", "value": "aa7bb6adca3253f8ee14f3ece33e5ab5d5aea118b0c4838d92a63b30dd0d1418984e4d10d10e13b6de824535839717b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756524, "uuid": "eeb2cb02-9fa4-4196-b560-35403cca73e0", "value": "T136E533CC250250FBC8829B7D187662D6AD05E17B1DFF9C130D99B2C7AEBB7A24E0D056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756524, "uuid": "25f22944-17ba-429a-9be7-a5eaf87e1d33", "value": "98304:n+ZdTJZm3Yheh28r8iP5D13z1uH7ODREl6:n+ZZch24J13zUbONk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756524, "uuid": "f43cd68d-e307-4750-b8bb-2a620705dedc", "value": 3209140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756524, "uuid": "c3d9ac80-5e5d-446b-a3d2-f1a7290f6667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756524, "uuid": "bee99843-48ee-4599-ab86-f3b003273a5f", "value": "gg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134b3a39-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769627, "uuid": "432781ee-5c94-439e-b3ed-3b42796c0edc", "comment": "Malware payload (Mirai)", "value": "6ac0c578de912daaeec17f74f83fceb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769627, "uuid": "8f30a20b-246c-4cd5-9efb-b6f396dfb99f", "comment": "Malware payload (Mirai)", "value": "672fc836e76667d9622110791dfba8f3cc3ac2d576facf8f7f778171a0f214f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769627, "uuid": "3ce07e4c-edff-4871-9302-9b6111c6c717", "comment": "Malware payload (Mirai)", "value": "2e974b153a0d1a4634bb72c6cc4ce1b86dd7cae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769627, "uuid": "b50a12ee-7721-45cf-a344-ad6d9482e91a", "comment": "Malware payload (Mirai)", "value": "6aba34010bb778cec469c6abd9ad93653608539a0b47a33cee7a0facfd2c47cfcf4241528a48d99b084bd62b64551088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769627, "uuid": "9156a666-8bae-4a7f-a171-e9facc5ead46", "value": "T1DFB35BC5E247D0F9D81609302276FB375E76E1BB1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769627, "uuid": "9ff01f3a-f4f2-45ff-8e44-2161653de5c4", "value": "3072:zpe9zJgGmi+dkEF5nSMDKuJ7jkuSUBNIHYCbBH:zpe9zRx+dkE5nfeFwIHYCbBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769627, "uuid": "468be219-5ed8-46d1-9053-d946e387c4a6", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769627, "uuid": "949e3825-4ee2-4c39-837b-13c2472c20ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769627, "uuid": "823a0c19-4cf6-43d8-862a-40f6b924e5b0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fbf1d0-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782736510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736510, "uuid": "d7a04642-5523-49e9-af4d-8450a2123ab0", "comment": "Malware payload (AgentTesla)", "value": "144175e6d925911952d00c93dad50d83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736510, "uuid": "af2e1aa7-940c-4189-869a-91c2d3395a0c", "comment": "Malware payload (AgentTesla)", "value": "68342135a1fc950275e20600e8ebbf62258744f26adae735a73fff741d75aca8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736510, "uuid": "f866ef43-4f08-40d5-86a7-575548908c08", "comment": "Malware payload (AgentTesla)", "value": "1a559dc4687ef44ae46c9669eb598189b0c11883", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736510, "uuid": "ae3f421f-cffb-4314-ba0f-dce3a2a8aab6", "comment": "Malware payload (AgentTesla)", "value": "273b0a637932eaab99d3da7271fcb4ef35401db514174c37019f4115cecb6a1f49fdd7cfc49f5251005408394951b35d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736510, "uuid": "2e20eebe-4f5e-44f9-b2d6-4026e9cbbb9e", "value": "T1F636F6415B94E173B324E79C923AEE38540E601324EADF1438AED728791CE47A758FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736510, "uuid": "89bf68fb-a239-462c-9c3b-0ecbe4b83107", "value": "98304:Hkom3KDk6Y4O3RbAfysNqSJ22g5h6NIK7pomi0NngixJ42iN9iuphrZgmkom3KDj:W3KDk2+lyNqSJ2nsH9oT0Nng4J5ibTac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736510, "uuid": "06e94b3f-f222-4a55-8f69-1959298ae0e9", "value": 4941844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736510, "uuid": "2ebebc1b-e1eb-44d1-9ab3-e02cb88acc64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736510, "uuid": "be445e6d-9efb-48e8-b908-3d7f8621db0f", "value": "PO for samples.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d30b041-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756813, "uuid": "22430a53-68db-4275-ae16-c94638fb75a2", "comment": "Malware payload (Mirai)", "value": "c97224ed298fce00a6258371a6d39708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756813, "uuid": "9fd19503-535d-4042-bbf9-30ceb25403da", "comment": "Malware payload (Mirai)", "value": "6860f0745b14d706c4344d98b17569b47522cb73dd8a0abda3ca9c70c71f94b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756813, "uuid": "503b20b9-3c7c-406a-a65a-b574c188af8f", "comment": "Malware payload (Mirai)", "value": "75571e30504ff2d942387c0bf10db68e7d98273d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756813, "uuid": "365a0f54-b990-46bc-a64f-285bcaeff22d", "comment": "Malware payload (Mirai)", "value": "3a7d4fa1df7b88a316c055bf3178dd39eafb46c730ba101986f0c64ad1a41dfc23f418022ce4c8247569bd373d13f9ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756813, "uuid": "43ab505a-bfb5-459a-bfb1-4a9ca2c83c4e", "value": "T19C13F1126186087DFA2F7676BF44C3C03BD41ECCB754CFC1E682A93A6E924562E904AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756813, "uuid": "e3db3459-54db-4dc2-8ee7-b9d90edc044a", "value": "768:V8afHXXN0x+eWdwgMG5HKLPM+zwv9XQnFKxp0BEvtm2ycHlKcFR3UiR4uVcqgw0M:VvvXXKx+Ft5HKDvzCXyFKxp0BMm2hnPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756813, "uuid": "cc2ba480-4c37-4dae-9a6e-4631517ebeaf", "value": 45284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756813, "uuid": "13f46369-8d3b-4c8e-905f-3b1c7137cd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756813, "uuid": "44433134-d25c-4dbf-8dc3-d407ccb196c9", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bac8f49-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773238, "uuid": "a53727f3-8a57-4144-b1bc-def5c3d59c08", "comment": "Malware payload (Mirai)", "value": "ec294f33271a4ca914ece4e2fd5400b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773238, "uuid": "66b0c469-5efc-438d-909f-c276a03a01cb", "comment": "Malware payload (Mirai)", "value": "68857051c25bbf96357594e0d70c0678eba91b3ee67ff189ba20859dbfa359a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773238, "uuid": "dec6889b-a754-46a3-ba95-f109605dda61", "comment": "Malware payload (Mirai)", "value": "0ec8208b11115911b8a5331025e3dcec8b718f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773238, "uuid": "14ef9686-dbdc-46cf-9a44-bb0476e870a5", "comment": "Malware payload (Mirai)", "value": "6e5602ddc57729f8c70b746001df9a2bcf67e725d67ce42ebb1ddf72b5d36151b5f3d5bb4cad740b9034708caf776abc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773238, "uuid": "990eddf3-3b81-43b3-ac17-11244086f5d7", "value": "T12A03E02510105EF0DEBA1872E8F844C629034BFC55FB7B9139F448AC45CA5AE2EEE5D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773238, "uuid": "32301ed9-1e48-499c-9614-afb64e815197", "value": "768:YhbUpgfK/AwDBKK3fgYg17cLkilEBwWEG+gXFubkavou8Lv9q3UEL+u:YxUpgy4iBHfgY+7UlEBvZdGkhkLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773238, "uuid": "7cdfc6db-f006-4475-9e95-67e49b97eb3d", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773238, "uuid": "fa31927f-3096-4e91-a906-3bdac7d02146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773238, "uuid": "bc29fa04-4d98-403d-b671-39db30a704a1", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe3113-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769568, "uuid": "0c88baab-ce61-4bf5-91f4-61e426d91e08", "comment": "Malware payload (Mirai)", "value": "6581d2e1dc7acd78adcd196b03c4825c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769568, "uuid": "2264aeee-3042-4538-a883-55a0e2649aaf", "comment": "Malware payload (Mirai)", "value": "695646d788062d36fb6925823c9bb59610cfc5b92fc16600527038d4e5f6a2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769568, "uuid": "fb082e06-6118-4d00-b837-c42dee2f90f9", "comment": "Malware payload (Mirai)", "value": "9afedf828471cdb69ea607891c5f89d56346e875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769568, "uuid": "cd845c7e-dc31-4478-9432-dba6c19a9b35", "comment": "Malware payload (Mirai)", "value": "659e5b31aaf68e4b9d6c516d7d0b424b7d9d837b360343b39c953f9f4ff52535bff78847a332f76c787bd03a9df5a698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769568, "uuid": "0002ef91-e077-48bc-b6e1-4759a9624dc9", "value": "T16E23E103977E5E58992A527880FAB81D8440F715CF9D99CE79C149B3A036FBD7878380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769568, "uuid": "b53aeeef-5d80-47b3-b707-fafb23a8247a", "value": "1536:hV9DxbcGzB9TSJcym2ZGU9Tkgwv85qyLfnouy8oyN:hV9lbc6B9Tkcym2cSTFwU5Voutz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769568, "uuid": "7746ae36-2bf9-49a7-8630-1204c318cb1b", "value": 49824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769568, "uuid": "22bd0fb2-0f63-47fa-9a29-679cf1721320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769568, "uuid": "9ef25082-e0c3-480b-b424-67975253d101", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0ff4c0-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763554, "uuid": "b396ddb2-e801-4b3c-ac43-1c169725b7e0", "comment": "Malware payload (Mirai)", "value": "142212a1d54ec38140c1625ec2083a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763554, "uuid": "da40a5e6-d201-4997-9cf0-a44faac97ae6", "comment": "Malware payload (Mirai)", "value": "697d5bfe5d4cae1a7a756c2857d5f354407af53fd033c86ec08a2e0ab70c3253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763554, "uuid": "48ef8062-36cf-41fe-8c23-a763a1abba1f", "comment": "Malware payload (Mirai)", "value": "59ad6a3817572cc8e16ca7c0ef258e0297e10c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763554, "uuid": "0f25786a-db2e-4c32-ada5-4b9f453a4298", "comment": "Malware payload (Mirai)", "value": "3a0a55aec3fb0d9835a4a4e1ebba3528f459f79b049159575850466c18a348d88c9920a9251f353ec53cf565cf98c136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763554, "uuid": "f52131b1-5705-4247-82a1-7e965248097b", "value": "T1D7836DC5EAC3C8F5ED2209301172BB675AB3D13E2268EA83C3A6D975EC125C0F51679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763554, "uuid": "ce6d157c-e63c-4d47-bd13-4289849c1dd6", "value": "1536:mZtH7MIlsW4aowG3eHO23tAjw19KHVd1YQRMBP:mvHzlsWxS3oOEti+9oYQGBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763554, "uuid": "3892b609-d522-4ca9-919a-3ee540385641", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763554, "uuid": "dc48c797-fb59-4364-a0f6-39969a14bd58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763554, "uuid": "2a0d0101-f5a0-4d55-86fc-864d4dd1450c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346eb819-73b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737041, "uuid": "7c81cbf0-77a8-46eb-bbc4-213761726c94", "comment": "Malware payload", "value": "2733c132ec6101da77a76fe6b0215514", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737041, "uuid": "eb04f136-cc63-4a00-9e2d-07f7f2d1a082", "comment": "Malware payload", "value": "6c4601ef63fa80419a4abc0ff20338200201b08beb44ab04f91f57ab73497eb5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737041, "uuid": "36f6be1f-2a33-4324-bdc6-7424979b2b7a", "comment": "Malware payload", "value": "a609bcd0f03b32e4b6e55715fb72d56cc07e54ba", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737041, "uuid": "29ea311b-4ee8-4dfa-b563-d4c919e258ce", "comment": "Malware payload", "value": "097e7a5bebebfe78579372681c59685bbccb20df8c8bfcd4793575c1234d41c4fb5f9410b5e5a70c61407ede7bf6c3be", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737041, "uuid": "fc946e75-bc83-4e75-8972-1edeb088e7d8", "value": "T165E5334685EED49FBEB7022563D47A51932B017BD5C3112B4AF28AE3F0D46C458AB8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737041, "uuid": "f03bc5bd-a71d-4953-a1b0-fa34815639f2", "value": "98304:szkXrg18sb7bEU8oDgVoTDPTSwN5/jvVLO8:szk72lb7bEttVQTSwNdvRO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737041, "uuid": "02606bf1-375e-4200-90c5-1cb7fa73d37d", "value": 3177355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737041, "uuid": "e6fcc122-8a21-4187-b36e-29780c11fc91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737041, "uuid": "c9983464-e606-4c81-953f-ca5a2644a3db", "value": "digital-magicians.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39f0b4a-7358-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782695996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695996, "uuid": "df9559a6-9db6-479b-8360-30370366c616", "comment": "Malware payload (Mirai)", "value": "608208c68d78cc9bc644f6e9e0d8935b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695996, "uuid": "ec2919e4-20b7-446d-a47c-c4e7c5a5dd6d", "comment": "Malware payload (Mirai)", "value": "6dbc819d3335dbe0a0992d05f358dcbbc35cd8bdc1c7cad19baf7c329f83c224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695996, "uuid": "4686289d-b194-45c9-a540-0fc15084ecad", "comment": "Malware payload (Mirai)", "value": "c72fe4be43439384e8e7f84657ce10790ae343a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695996, "uuid": "32efcd4b-0748-418f-bc36-c7b540629bfb", "comment": "Malware payload (Mirai)", "value": "894f5bd83e832c3e197cac4d2d547003a4bb75a8004cb42a6e2a27c1659debfa11a45fcfb952d0152ca25536e810f0ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695996, "uuid": "3ca33a9d-19e7-410e-bcab-a17f639cd2d4", "value": "T187C30845F9505B23C6C626BBFF4E428D7B261758D3EE720399256F20379B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695996, "uuid": "edac62d1-fcf2-462d-b927-7c98c01e4501", "value": "1536:lxz0XbCZ/O0Q2rRW4VqfZTY0flK69UOwLOCvrNkgqlcLwywHy4N314NxlfPcL1/9:MXbx0Qd4MZc0flParWVv/6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782695996, "uuid": "79c2bb29-896d-4162-a6dc-7d2a063b4024", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782695996, "uuid": "a38a87e7-64f1-4d53-af2a-dc3cd5ebe7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695996, "uuid": "dee3a338-7683-4f0e-8d96-6645b953f5a4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7ca1ec-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742053, "uuid": "3a643aeb-3135-4379-a2ae-d86e631c74a4", "comment": "Malware payload (Mirai)", "value": "248b9c06c3beb15bda4aec5dfbfccbf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742053, "uuid": "c45bad28-d89a-425e-96df-681816302909", "comment": "Malware payload (Mirai)", "value": "6e2d74bc041275b644c767329368d9fe7075ffc154cfdb37cc248438a5fa5853", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742053, "uuid": "411cd765-e9de-43b3-9fcb-1036f82c8690", "comment": "Malware payload (Mirai)", "value": "b3672c3aab045c01a5ac03c9bf6575f4d9b4f705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742053, "uuid": "0f8b732e-2738-4522-ac83-b09f3a785e6d", "comment": "Malware payload (Mirai)", "value": "f482585e478ccddb90990711030858c0d16ce78b4210fe167707bf1883c693f8df1ced65570d2ead35818307da8b4854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742053, "uuid": "22629218-2436-41be-8481-3bee4edda177", "value": "T11B934B03ADA0C0BEC095C274A7DFD262F732F85556213A0F3394AA263FA1F991B1D795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742053, "uuid": "cda98a3c-2dd8-4688-8ef5-73ab52ef552d", "value": "1536:3Iid18sq3HeNA1LmT+KrBeB0f68sbglAbCcLoSmormnKmJMoUbH:4id18h+8qtek68bAbRmnbUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742053, "uuid": "b5cb1328-c825-43ef-a474-9daf265695b3", "value": 92808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742053, "uuid": "00519afa-49a7-4798-b56b-d990abf2c17e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742053, "uuid": "148bf543-9c6a-4c40-8cfd-20fa80a0994c", "value": "x86_64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d63730-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "d6913925-d5dd-44d7-8e1d-7a1f3eb7673e", "comment": "Malware payload (Mirai)", "value": "2b7b45e3377e7fe6ebf461a9aba22832", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "421750c2-d38e-4a9e-a69a-30405dc8aa20", "comment": "Malware payload (Mirai)", "value": "6f191b8068b18b341bef972c6630ab91435ad84311a2877e8196d23c275b4bde", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "23f6143a-cb22-4135-8b1c-31e5d63b09c6", "comment": "Malware payload (Mirai)", "value": "790684b54d95bcdbd0f92fb79e3316bfde467f14", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765100, "uuid": "3765a942-bef0-4dd9-8513-a101b91d34e0", "comment": "Malware payload (Mirai)", "value": "fb7ff0f4e0bdb6d3b0a57c8698249ed4ec8d561a1b3a48a67d464ed7dcb05242c276b5c242674f59657e4e5d963b1549", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "479f55df-81ee-4f7f-9696-f4fb54019f77", "value": "T106242B037A81C9FEC496D1F04BEBA5319978F82D0635714B3794FFB12B49EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "61218fb3-da2c-4bf4-9935-c140a4ef037c", "value": "6144:KBbbTJgbFZpeT6elrPG2er/+PlNzY/4X9:KgcT6el62er/x/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765100, "uuid": "30b93c6c-f695-494f-bcc2-df21cb8f6b94", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765100, "uuid": "0f6a04e3-4113-44fa-b000-5d8b924f07bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765100, "uuid": "f9aa2693-4efe-416a-866b-4f232d7d19ac", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be496062-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737702, "uuid": "8599ca68-d540-4c36-8d03-7d4d332912ce", "comment": "Malware payload (Mirai)", "value": "ba5225881c22014de40d68ce4fb0a998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737702, "uuid": "f0cc7ed8-dfc6-4b22-a30e-543c02918f41", "comment": "Malware payload (Mirai)", "value": "6f3c8dc222cbaa24ae828b9e74f737ba9d73381be65ac5d46a10da99a098f969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737702, "uuid": "89abd1fd-c7b5-4543-acfa-ec54472fa734", "comment": "Malware payload (Mirai)", "value": "00722913da5fb8225255ddcdc2cbef210b23b837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737702, "uuid": "2e433573-cb1f-4f96-8cca-77bd6f31a900", "comment": "Malware payload (Mirai)", "value": "d8098bc822e82fe0fbc1c663c56825e973ca61ceff4ec1a53e40a8bc6aef1df8aed9208551505aecda42e7da1212dce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737702, "uuid": "886ed1f0-08ff-4294-bcad-ddf15a6293e1", "value": "T11F739E23C87658ACD25842B8B0B0FE3653B3E51056572FFA069ACA7A9047EDCF9453B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737702, "uuid": "69bfac25-765d-41f5-80d6-2faaede2fa5c", "value": "1536:+/0d1XEcTN3eJ9E++KrpgE7YgJMiCYKkN3skp:+8d10M3lIrbhJMiS68kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737702, "uuid": "aafad8c4-5564-498a-9473-3f0e7ebcea56", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737702, "uuid": "babccb17-3719-4477-8028-7f3017d1a9d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737702, "uuid": "62f7e639-9b6f-4da2-92cd-36f4d5596041", "value": "6f3c8dc222cbaa24ae828b9e74f737ba9d73381be65ac5d46a10da99a098f969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e090502-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775282, "uuid": "d38a6a75-f826-456b-adbf-d6971721685a", "comment": "Malware payload (Mirai)", "value": "6e6fcac04b9df059679acfa9e2304689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775282, "uuid": "84be4cd1-4228-4808-bd1f-a2d39d0ae686", "comment": "Malware payload (Mirai)", "value": "6f639155215ecc4b9590e0f768cdf3201df52dbd581275d58ec1723bbafe3afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775282, "uuid": "1cc64b54-19be-4848-a0a1-f86c1e3c9df7", "comment": "Malware payload (Mirai)", "value": "2b5051ee90d4ffdc8ea364fcb7ad90780d0c662d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775282, "uuid": "4d2fa2a1-2492-4d58-a4e7-63ce88de3f07", "comment": "Malware payload (Mirai)", "value": "19acc3ba778b89d606cc38a1eb7449f043700a1e2a00c0df137c7931f33e6a69d7ac0161539d79d914b758af30c4ea3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775282, "uuid": "a4a8b923-3702-47d2-8691-3cbcce095690", "value": "T128A3AE36D4199CE8C5550238A4F89E361F63B1805357AEF726E9C3B7609BE58F809FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775282, "uuid": "13ff1b54-ef84-4e9b-b2b6-7439eed12b75", "value": "1536:6/CpYUyOokMYq50m175HKZxOAdKERLD7HxBzxCEOQ1g107wm:6KmU/Rxm1EZxOAEEJ9Bzx/+q7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775282, "uuid": "3163df25-6f5c-4cc2-b175-7084c3f028b6", "value": 104508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775282, "uuid": "18402067-df06-4e97-9643-ae5465565eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775282, "uuid": "6a6a3db8-5501-44dd-bc55-25acf68788db", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a139d6e9-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765141, "uuid": "da8ea52e-3719-4c82-87ee-4067f34e04b7", "comment": "Malware payload (Mirai)", "value": "4fa207e2bbd0008f095c328fab4cfafb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765141, "uuid": "26646b7d-b51e-4ae8-9bb0-c5b065bb9385", "comment": "Malware payload (Mirai)", "value": "6f87e28bf658c79133f37b3f9eea93746ebd6df8beed4156eeaab78670b8a35d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765141, "uuid": "b8a6eb52-62c8-4efd-b356-91906a843f6d", "comment": "Malware payload (Mirai)", "value": "9633e2fea61fffcc35de2ff7b11b89f43bda65b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765141, "uuid": "1202401d-2419-46a9-8584-992f61e6ba6b", "comment": "Malware payload (Mirai)", "value": "83e440b50bd1c5412ab090aca47e1e8a81e7049657c7c0009ace1b56a85a67a504ed023fe42621992d88708636799475", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765141, "uuid": "3339debb-f83a-4529-b962-0218f8fcabf5", "value": "T1E824FA47B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765141, "uuid": "e5383c17-0157-4e94-adbb-84902c3ad3b1", "value": "6144:wD4YsqcDN5Twfl4ZeYalumqQ2gZ9YNJmh0jhP2:w/sN5TalVYalVTZ9gmujh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765141, "uuid": "b8b98b3e-89d2-4ff6-a5da-5c717560bc51", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765141, "uuid": "933db1f0-4435-4dc0-ae4e-c1ad15019ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765141, "uuid": "9315ab88-3b91-458c-b440-2bba88b44375", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af24458-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756809, "uuid": "b4996b23-474f-4daa-99eb-4b796ad07a7b", "comment": "Malware payload (Mirai)", "value": "e7f0387b8702467d605d4057521e92ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756809, "uuid": "3ada46b6-3e9f-4334-8f56-62b2a77eef13", "comment": "Malware payload (Mirai)", "value": "6fde2b43bac6faa6d2b607f3cd09a2aae5e276f589d1bae6208a4617001e8b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756809, "uuid": "365e752c-5c8a-418a-a0ca-88b532ddbf32", "comment": "Malware payload (Mirai)", "value": "60f9971ffef9460c1c391a1683c526cc480076ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756809, "uuid": "292bccbe-c2f5-4026-82e8-be96c7a33cc0", "comment": "Malware payload (Mirai)", "value": "e72e8c7f449dd9eede725b7bfb51e8b9cfd13919ea531e26446744a3d612e1d2879f72b9f47208e6f5cb81954e38eeae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756809, "uuid": "40e374b4-e423-4006-884b-99b661d7a114", "value": "T1E923F1E750726FBCC427713A185351B0B601B88BCB2791C6694938BDEDA78B097A7FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756809, "uuid": "ae6a9d52-abff-4219-a64c-aad7760c66ec", "value": "768:Cu5g+EAdnC+zdnBH3n8KqxUDx5f4erNRFFKXK6tTxX/xcLhq7SvCEGH1gIVEk422:C2hzT3MxUDxplPuZyL4ICEGH1g2HlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756809, "uuid": "dc22d2fc-58ce-4d94-9429-f6d936edc354", "value": 47656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756809, "uuid": "210da6c2-ee32-44d1-8d88-33b6c039ed4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756809, "uuid": "d0a2d8bd-ad10-4d18-8457-3d48aa9e32c9", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba31dd6-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782697835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697835, "uuid": "9f43b1b3-3dbb-473d-b87f-cef35d81c65c", "comment": "Malware payload", "value": "adfba4cba45caa5c3695d842b729eac0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697835, "uuid": "b0af6dd0-9002-4c31-8db9-061a20be762c", "comment": "Malware payload", "value": "706da49ead225c2f2f35924596d3f07939d714ad2e36bd1d8dbe52095800080d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697835, "uuid": "3ab8dc0d-e125-4ec0-9b51-4e037b9313d8", "comment": "Malware payload", "value": "105ddaf1ec0c02440ae261411253033f37c66d84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697835, "uuid": "6f00c4cf-8803-4d26-a9d2-fbd308c3bb68", "comment": "Malware payload", "value": "30d02b62d7db7595bf753efdbcd6d95bbf0c2567d0571354959280fc461df0041b589a7bc2a955af4e1980b3f6042fe5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697835, "uuid": "a84dd0f8-90d8-4ce8-b5dd-3370309e3546", "value": "T10CE26D15BBC08F6B63EE6FD1081102F9C6EE969F52F0A16973DD531C2E5AC19A0B2374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697835, "uuid": "9c00069c-5215-4b55-a7f5-2308f650d0ec", "value": "768:0UkRDjWWc+rz1z0ZbhaV4B4xgZpGMZPObtoMNB0tg:0UkRDjWM2s4B4x50MvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697835, "uuid": "db306c89-eae3-4c0f-b7c7-e32d84417328", "value": 33338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697835, "uuid": "7438ecd5-3d12-4916-84a2-a49097beea0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697835, "uuid": "66347cdd-c45c-4c06-9ccf-4fea43068283", "value": "ufino(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdff7f08-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721407, "uuid": "59671dde-6a82-4745-9f27-61c11c506cfb", "comment": "Malware payload", "value": "a6c4af54bba54b2d5eba1084c850c6cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721407, "uuid": "3cf86671-5604-4f6a-916a-9eece408ac80", "comment": "Malware payload", "value": "70a00eb807859f43ff3b4a27d478b51ba02d1cf9733234319b68b5f6c07d2fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721407, "uuid": "9306be18-01f1-4af6-a99c-152c564f5519", "comment": "Malware payload", "value": "ffe599ac210f7485ba615c1865aa6f7504ad6a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721407, "uuid": "f2bca9d9-dd59-48f1-9e08-7694f5612223", "comment": "Malware payload", "value": "11916c09aaef882d17a4d1a607abc14608c42893e36ca7005ae78094e0760ddb36245b674db2b4dc534350906e9cd85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721407, "uuid": "e0393f40-2d6f-44bc-9ca0-3efdd6791e00", "value": "T1B4E733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721407, "uuid": "8c60a741-a512-4e3f-a8cc-8ae58d7b3ec5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721407, "uuid": "15256231-d951-41de-b995-e987fd3e0f4a", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNW:jdPJKrtOsHtAsg7lxrmeVlQFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721407, "uuid": "827ceb68-8c00-48c2-bd8a-615ccf28ad9a", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721407, "uuid": "cb2462a8-76a5-49e5-9b3a-40983f4cf464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721407, "uuid": "73fdf24d-ed11-4e14-9e30-e6a6ac1b71b7", "value": "a6c4af54bba54b2d5eba1084c850c6cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20aa3303-738e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718969, "uuid": "562a9961-6ab5-4225-a04a-8091b9152dd0", "comment": "Malware payload (Mirai)", "value": "ae48dee45157533c8d9057929d07934b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718969, "uuid": "4150db63-0900-4a1f-a609-86e5cbdd409d", "comment": "Malware payload (Mirai)", "value": "713a0b62de7a94d63139cde8bfbe39c68ce89386900c66e62038d9cc38bc8e96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718969, "uuid": "943a7014-0496-49b6-80ea-c10cb930c9b1", "comment": "Malware payload (Mirai)", "value": "e9f71ac8327eed8a643e7c29b34790ba4c6929be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718969, "uuid": "241786d8-4de4-4e08-b136-eef257a454f6", "comment": "Malware payload (Mirai)", "value": "0bd132d730bc9a23cc6870a9ec55c8f6f0c2de8adb63522fc0cdd19291fabaac1c8360503830204c86e60b512dd631b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718969, "uuid": "b5577b7f-a11f-4865-a7bd-e30ffc46a144", "value": "T13C041845BC419E05D5CA33BAFA6E028933577B79D3EA7201CD205F5527CAE8B0EB3612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718969, "uuid": "9d33469d-c2bc-4741-9d6f-8fda6827284d", "value": "3072:dK6NeJgNHRILBqwNpJYHR7ddOpQTq8aG+7iFovt6bb67CTh5OGH/i:81Jyx3w7JY7dd2QW8aG+7iFovt4bdTza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718969, "uuid": "c5551c22-9b20-4299-846a-d5886d601641", "value": 178444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718969, "uuid": "ef81a062-d0ef-448e-9161-0bb8388fc920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718969, "uuid": "cd2aaed7-89f3-4df7-9d9f-176b26e1e04f", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9ebd5d-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763707, "uuid": "39e2df6c-9ede-4e43-9e0a-87595509b4da", "comment": "Malware payload (Mirai)", "value": "ca7535c2baecf6875cc9b8a5a806ec7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763707, "uuid": "97e35dcf-11d1-44f0-96cf-a1f645ac7a30", "comment": "Malware payload (Mirai)", "value": "717d3530bec0d97d1f82ee8fe503e4d01040441873cabc2a9437c747bd8387b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763707, "uuid": "8aab6563-1ecd-47d8-bbe0-8ed242017797", "comment": "Malware payload (Mirai)", "value": "e05cea7ba1ca11f15431646d3ab591c011700358", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763707, "uuid": "86dcdb3b-1cba-4075-b524-a1260f6522b2", "comment": "Malware payload (Mirai)", "value": "6e5444e1087f94c9c71dcc5de29065cfd2b1b25d44e276939ba64e6bd8a5af3735ed321f9c13672c790294cad28fc1b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763707, "uuid": "f22ce21e-64a9-4dad-b31f-b8bc01505155", "value": "T179C3D71FBE619F6DF368C2310BB34E35A68927C627D1C546D27CE1106E6028E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763707, "uuid": "9722ed70-a6ad-4b71-81e1-4013adabcb23", "value": "3072:a2z2g34N/69Ck97rIzcGg3gGq5ZKFpy7Mu:aVN5Z8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763707, "uuid": "2a04ad78-8985-4ad6-91d3-74409ea859a9", "value": 126128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763707, "uuid": "fbbda2d7-20e6-4712-b6ea-58ffe54ded1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763707, "uuid": "65bf0315-5122-4399-8f0c-03476a9b4f7d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f95cca-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700073, "uuid": "ad6eeaa3-8c2c-4be0-841c-05423a06cc39", "comment": "Malware payload", "value": "dde09a96cc53fd86bf0c722529b8a3ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700073, "uuid": "3d91eccb-e4de-4fc5-b68f-9c7506bddf35", "comment": "Malware payload", "value": "735017f0bd2a42a7067fcece1436c61d71e4a5b7ea717ba12a74d06dc5ff582f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700073, "uuid": "fbc4aabb-298e-4103-aca0-0a9c290f76fa", "comment": "Malware payload", "value": "37cf43e707043d0d02f3f240551206e96399ccca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700073, "uuid": "279396c4-f149-4ee6-bd0d-71e2bb853557", "comment": "Malware payload", "value": "6124d3f80593e17b7730e65c49ed5f9a80a0f68cf6de141f2caff8fff1be3ed2a5203aaad8becc04ad885d4d8cfcc801", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700073, "uuid": "4e7ada2c-cf7c-4ab3-87aa-3a4606717989", "value": "T199A29E60A39084DB52D25FA3E56780E47A385E0930DA3FADC720B7B02F94D14E9DE5F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700073, "uuid": "e2d62544-773f-4a56-a7dc-ce8f154952c0", "value": "384:uIsoQbXjlyE5byuPUFXqsKLCalRPXrfkEYqp/wID0fLFhnjhSfIT9/QGESiV9nBs:uIsoQbXjoqOuPUFYL3Bx/78Fptn9Ix7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700073, "uuid": "77ae2278-ad2b-425a-8101-eea9f6f97f45", "value": 23148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700073, "uuid": "805fab71-9a86-40ea-a913-f16754616e4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700073, "uuid": "f42e0f59-3158-4dd7-8fb0-55f3c8565cb4", "value": "enuse.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72064ba-738e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782719329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719329, "uuid": "8b1b0e33-2522-49d5-90b5-71eb88a52f35", "comment": "Malware payload (Gh0stRAT)", "value": "a4357f1cfcf9dff97a646db0175705aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719329, "uuid": "0f9af393-40b3-4abf-b39d-f9700d499eee", "comment": "Malware payload (Gh0stRAT)", "value": "7367ea4cb0851baf6e17d42347060d4c60fd40d18d3faa7af146992cdead2999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719329, "uuid": "24fa81b6-5b78-455b-b32a-1e9676cc055c", "comment": "Malware payload (Gh0stRAT)", "value": "14b560059ef768308f51d17a7c788aff68817528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719329, "uuid": "76aa4327-afd7-4172-9aeb-85f533297bf7", "comment": "Malware payload (Gh0stRAT)", "value": "dfc4d4e7342490030fd0921087b82a4c5e88ff7baf223fb4799b66b67d841671dff4f41347f5a14d0224db94f3cfdda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719329, "uuid": "5ea9f1d3-91d0-4274-a151-3a5d7950cf26", "value": "T116473323A28E233EE4BA497959719E50583F7E61952E4CE396E44E4CCE2E0601C7FF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719329, "uuid": "fc06f1cf-0873-49b9-aac9-da1b650d487d", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719329, "uuid": "239a1ad4-d82f-40af-8dab-83e210ffb8f5", "value": "393216:NDuwACMLNLHFMJ5kel1ctzWcovLFqOBZpaY6BT4z0q+/I0iE1FxD+WcTIbCqSnYj:gmMLNRMJGelGtzSvJROY8T4Qv1FxFcTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719329, "uuid": "de512cbf-4cb6-44b1-8955-275db66dc891", "value": 24582448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719329, "uuid": "e3029df2-2773-47b9-b528-92cde6eb6dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719329, "uuid": "124f1a94-c511-482e-903f-672981dc8fde", "value": "AccountStatemen-1.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87d297d-738a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717613, "uuid": "9b28350d-65e4-40a3-bc8d-49b8f7cdbde4", "comment": "Malware payload (Mirai)", "value": "75bb3dfc7e7ae44b98e03491764b1bf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717613, "uuid": "6d2e370c-4be4-434c-8acd-5bc0b726c16a", "comment": "Malware payload (Mirai)", "value": "73d001993a857c1e6d21fc05174e4287629be1e4d62522e3a515e8565ceecab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717613, "uuid": "f30a9ff0-aaf7-4fd0-9523-09cb356780e0", "comment": "Malware payload (Mirai)", "value": "475db39fbb514f21ac4af836cbf5f3ec20b06625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717613, "uuid": "fc41411b-7761-4f25-835a-7f513adca724", "comment": "Malware payload (Mirai)", "value": "c0b16ed0252c83d681f44ed561868da577b38ea16bc7b0300cb3ba9981ea0eaf5504eeff53d902f790591db479ee6a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717613, "uuid": "e6412e69-1878-4010-ab7c-85b3bddcaadc", "value": "T1CF530157F65C892BE45B08D5A3106FE3B7E7C1CE7A64E9035361A76385C3A131238C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717613, "uuid": "5199ab29-8600-42ca-821c-f8385ff98e91", "value": "1536:2ONWPkl79tfJwHMrPAx3osnKv9FmEW8rPLk9kBYpaNzUa8kkaoT/Terdxisn4u+u:ZNGklhtfJU0ox3osQFLTYpa5VRkawE42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717613, "uuid": "497ee6b7-352b-4075-9c2f-d1423fe061c9", "value": 64364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717613, "uuid": "582fdea9-df8c-4cd0-a8f9-b122fbd54f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717613, "uuid": "409b92d1-7e45-4f50-920f-72765a8c6da9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbf6549-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769594, "uuid": "ef3d7a68-d167-4b66-b18a-df7160b66f6e", "comment": "Malware payload (Mirai)", "value": "9d8d3dda6adb7c734f4f5617ec307865", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769594, "uuid": "a1adcc44-e97e-479d-91ae-a806fec3da75", "comment": "Malware payload (Mirai)", "value": "741f0679efda39d79303ddf28e93fd5dc9cf10b761d19c9d5e11165d965cb636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769594, "uuid": "da0840d8-cecd-4726-8dd7-a49b094f9003", "comment": "Malware payload (Mirai)", "value": "b6e15c5521f8f0b4938d5535753836887337388d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769594, "uuid": "51588177-ba48-4a31-960b-9529bf1bac6d", "comment": "Malware payload (Mirai)", "value": "ed3245f55fa0f4a5d28843c346f149a64e05376ef7ed6548b88c84c3e81ab5adac4c8d55b79620fbb5c0e3e0ac696440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769594, "uuid": "49cae38c-5972-4711-9d57-8ff0005b8fae", "value": "T139C34B0273180B47C5A319B02E3E3BE687FFE5E021E4BB89251E8B564575EB75449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769594, "uuid": "905515b7-6ae6-4804-9876-7f17d7c06cb0", "value": "1536:E6V1hv1xI7CTe5djscUAn2KFBzNGAN6PeFh+1mW1HKyEDgHUw:E6V1hvMrCcxlz3rFsmbKHUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769594, "uuid": "07f04a69-3ae0-46ab-959f-def0ca57d069", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769594, "uuid": "923e66ae-2828-45d5-9e6d-a72803124907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769594, "uuid": "4b76d968-9a5f-442d-b91c-4f492a1b2081", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49b12d9-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717123, "uuid": "8c18e3d1-0fa9-4542-abf4-d4b00a217c6a", "comment": "Malware payload (Mirai)", "value": "e3d6ae77a7f9aba99011428f2296d7a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717123, "uuid": "26d28ea5-1f46-430f-882a-c7dc47cec9dd", "comment": "Malware payload (Mirai)", "value": "74a20e8deb4f4dc6c83ad29a7f2f62dd49b76de7dca5aa3cb71b25cc54d330ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717123, "uuid": "10bbf549-487e-4b1a-9811-ed53d67e0057", "comment": "Malware payload (Mirai)", "value": "a7048739de12e23117bf6c34993587bb5a7a0b47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717123, "uuid": "5664ec02-7ec0-4937-9bc2-26d39f362040", "comment": "Malware payload (Mirai)", "value": "533e5d158e1e9cc44a33c2eee32c97ac0ae7936f3f01b9585a87bc9642e9f7c46d8e28cdc5571ed13f7af60b3af19678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717123, "uuid": "f054cb3b-f80b-479c-9a05-b5c7b1607484", "value": "T165C3BED7F78B24A1CC6146F007C76B9E2E6361019E6BE9E76C0E663B093A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717123, "uuid": "48f2bc8d-a44e-4a26-8d65-b72bdc166e5b", "value": "1536:BH6XXWAZxg6cgoWZKxtHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgxn/LWg:J6XXhxr4R+BGL+tJ2sd6tChhgxnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717123, "uuid": "5fbf526d-149b-455b-9605-8a7dbb7fd71a", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717123, "uuid": "6f02ef6e-1a7e-4cac-92f7-8031abe201ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717123, "uuid": "b510b49b-529f-480d-91a2-74d6a10eb820", "value": "74a20e8deb4f4dc6c83ad29a7f2f62dd49b76de7dca5aa3cb71b25cc54d330ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc60f023-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782713217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713217, "uuid": "4d628c01-4b29-4111-92bf-9551e3abf236", "comment": "Malware payload", "value": "e87d25fb62b2dfdd20fd413ad2a3a918", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713217, "uuid": "a7c36e34-8d0d-4d0b-a259-dea3e298e482", "comment": "Malware payload", "value": "74c3857e040d7e9150b5f2390cd681c1c150a34498c8cc139e04e7f0718434aa", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713217, "uuid": "8dfbdfba-2042-41a5-8338-325563d111dc", "comment": "Malware payload", "value": "b1d33f323ab61ac8890ecf1ce433ca7391118cd8", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713217, "uuid": "55b9f607-a522-4c36-ab5f-fc8c9c0ae34e", "comment": "Malware payload", "value": "40a3845cbb5f8ea211cbbd3b123ef30b3edbfb7ddd3145552a19365f19e4abb53853c9f2a9e45adf27fc466afd6dc721", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713217, "uuid": "e78d1e99-e478-4769-99c3-bde808ca45a3", "value": "T126472311AA1EABFFC85C063E54B7511B03FA2D902118AD7D9AA1EC09B6DDF03767F124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713217, "uuid": "3228ab66-67cf-4648-bacf-b99e73c32f16", "value": "49152:ceOoeOReOgeOoeO6eOneOWeOYeOreO/eOEeOpeOseO4eOBeOZeO6eO8eOxeOAeOQ:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713217, "uuid": "753a224f-ab21-4e65-b586-0cb20ea80ea3", "value": 25014369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713217, "uuid": "8f7a9b6e-fd5c-45c4-adfc-c9d3643b70b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713217, "uuid": "762e6d2e-4464-4550-92fa-8795978e97fe", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165693d3-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699624, "uuid": "4cb5f4fb-4bd4-4ee3-8ee5-e54e803295d6", "comment": "Malware payload", "value": "814f2f02614dcb39d290c5f64675b18b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699624, "uuid": "92da64d4-50d5-45b2-9f1e-262ee5697ab7", "comment": "Malware payload", "value": "75a73d044a81da0598715bd1a2ecc697dc080bd162586310fd2547270b84a0ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699624, "uuid": "552cf549-6e15-4040-af4b-f33dbea9b017", "comment": "Malware payload", "value": "9fd3424a854e8ed6a1c73f43978602b1dc34466b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699624, "uuid": "03b86eec-edce-41c4-b47d-e430c99daf1b", "comment": "Malware payload", "value": "3dc3a4a9ba2dd2a0403bb7073c0819e1fb35b4b7a692bcf6a0624cfa7f11cc5d2436003f8b48b3dd013fdeb578a6ce48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699624, "uuid": "6dfdeda4-d17e-4fb1-b58f-2a0b51436d0b", "value": "T194B29E67E3928EF056EE1FF390164BE8F5BC9D09C8E21BDA87D5B6343C82A4D24541B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699624, "uuid": "04d72790-5e38-4644-b333-e1b0647199fd", "value": "384:uIsm8MakWX1ninEFGBf7hBCoMiYuv51mIcbbKfXf9OizSxNjqeiT5T2NZJFclWMg:uIsm5axsnECf7+oMw56KfVOrj25T2N/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699624, "uuid": "6f2f2d7e-0d2b-40bd-a197-97384e82ec61", "value": 23440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699624, "uuid": "c01cae08-69b2-4cb1-a7d3-569587bf0ecc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699624, "uuid": "614fa4be-a6b8-4796-a327-ad542ff05d28", "value": "uvuqe(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d26551e-7407-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782770932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770932, "uuid": "9cf47989-1766-4eef-82e6-1a7f9c86e175", "comment": "Malware payload", "value": "e8d1f95ba964fc0ba510ecbc0473e22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770932, "uuid": "510f9ffa-31b6-4d65-a7cf-4ae56189db96", "comment": "Malware payload", "value": "76ef465db71f0b8b94b5a8a6b5ba1e6dbc7f11a72e3759bf2896aafe3b82fc83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770932, "uuid": "65b36948-9b5d-4040-8e3e-a3eddc21f876", "comment": "Malware payload", "value": "c8be6d97aff857de4551cc5711167e87631c29cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770932, "uuid": "d65cde9d-f1ad-46af-8937-0f66dab2b6f2", "comment": "Malware payload", "value": "625cbdb81bfd24151fd8a86f940b1614681b3d5e90e66505fce9a016c376e46d2380c99d9a5eded47321756ad20d5826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770932, "uuid": "3553316f-d9d0-465b-8aac-cc6a7b16e59d", "value": "T13957DF77814238E9E9B98DB4D01025416DAC788B5778A3C7BAC871E667EB7E08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770932, "uuid": "efce07b5-81ca-453f-847f-dedd9681ea77", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770932, "uuid": "d5e88821-0472-4327-bb34-6ba4af19f2d3", "value": 27295744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770932, "uuid": "6931a612-e5fd-4735-9a5c-96e2cee9e567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770932, "uuid": "945c1549-871f-4572-8390-14ef25ba6fc5", "value": "76ef465db71f0b8b94b5a8a6b5ba1e6dbc7f11a72e3759bf2896aafe3b82fc83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c500dd0-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756892, "uuid": "ace099f1-bd40-4bc8-9d43-54372986fc06", "comment": "Malware payload (Mirai)", "value": "4daabd838d737ca4d00b9a5389e818d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756892, "uuid": "92139f26-5e1b-4248-b539-df10684cf8e2", "comment": "Malware payload (Mirai)", "value": "770eb52b0f1c0b6bdffc4df6b046fe588459da39d92307399f0d3f6ae99834ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756892, "uuid": "39e22655-4def-46e1-b276-532f3d413fec", "comment": "Malware payload (Mirai)", "value": "d66e6f66222b1ec14d337a068e8b79738481ecbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756892, "uuid": "4179ff55-1510-4f93-a970-8fe4aa23abc6", "comment": "Malware payload (Mirai)", "value": "6b7b624a8cc4cc89f39f9958a2b368162756db7d704beb7a2cc0299ca865596204b5acf852b2c59096615819afcc69fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756892, "uuid": "1f675907-407d-41a6-932e-b9f3ad44e868", "value": "T191B317C1F98F81F6C90B8C306066F63FCA31D8AA51719A6DEFD59F36DA336819112349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756892, "uuid": "e36bafb4-0423-4f56-9915-ea07c0f42b30", "value": "3072:XV3HDlhAeArwsUm4j2seZ3wYeBgZXqBlBjcHivVvG:JjlhA1EsB4jjg305cHqhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756892, "uuid": "7f270264-6e43-438f-bb27-2bfce1174d04", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756892, "uuid": "1a9001db-1828-4206-802a-4d1d7ed2306a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756892, "uuid": "d3497133-a7b8-4d1d-a2d0-7534861446b5", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c78282-73b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737367, "uuid": "3aa7a9ce-5f10-4214-b804-1d6d614ddfce", "comment": "Malware payload (Mirai)", "value": "0c00a30dbad22b5573cef980d73e50fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737367, "uuid": "56a0e6da-a2b9-42bb-b7e9-3b82dc740754", "comment": "Malware payload (Mirai)", "value": "77ed8fae517c78b0c00b626e69c1cd69686570a32041c22447978dad2ea03859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737367, "uuid": "fc028701-fd9a-40c1-92ed-4c2872746f4d", "comment": "Malware payload (Mirai)", "value": "05543dd6c38afc6cbffba53c381c949774e93c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737367, "uuid": "001f7855-83d2-4312-8a25-3e912b925081", "comment": "Malware payload (Mirai)", "value": "4db79bb2d47b96a90a7ed7890b67243c601fdee32d7c64f628052c457b993d0c1be1cddc1923c48b2cbf04fc89627ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737367, "uuid": "ab19a4f9-73ac-46f6-87e8-094b7871bd26", "value": "T1F546FA15AC843BE7C02C9B7494EACE5623745D144AF24A362694FFACBC762387F4789C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737367, "uuid": "5b004702-ffd3-4f53-b85e-863fa22beae5", "value": "24576:9Zd8DI+mz9x9sx5Rxprkglm1R1Q0UDAnG6Xi2NWdK7lHsI2SbbSKD0HpiKiEfdiF:exxYUUbKYJL6nEaj2buvKDLrIje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737367, "uuid": "cc6f00a6-175f-4bd1-b935-dbf925f273e0", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737367, "uuid": "a5cdaa21-181e-4e19-a2a3-10500b413513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737367, "uuid": "7ff5a86e-0236-4aa1-9562-0a4128cdf1c6", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b97aa59-7387-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782715927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715927, "uuid": "0e32ff84-3d8f-4f6a-8512-cc5372c4f0bc", "comment": "Malware payload (AgentTesla)", "value": "492dbd37793c7a3718b34387f65fa874", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715927, "uuid": "327a341b-af9d-43a1-a681-2864055e34ed", "comment": "Malware payload (AgentTesla)", "value": "7858578dd980a870035373a9c70a2257a93e087393dc35a14e735f8fa4869564", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715927, "uuid": "b664ff22-db61-4831-ac76-1bbdd3f2f304", "comment": "Malware payload (AgentTesla)", "value": "9add49653f4fd81d568efb8d527dabb6cb05d369", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715927, "uuid": "fdca6b07-2a33-4047-a7c3-a6724635fb47", "comment": "Malware payload (AgentTesla)", "value": "4abcf1e1207968d5305251623b843ac28bae8f75108fd55640b21a82271672f8a5968327d28f476f10e429ee495d78f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715927, "uuid": "6284e881-fff5-43ae-aca8-23dd4edcbc16", "value": "T13AC4F1A1B745D123DC172A749123D6D28D27BC799A91C933B2DAFB1F23334E26C61329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715927, "uuid": "be2e3b9e-67e4-48e9-bf94-f73d52e1a1b7", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715927, "uuid": "1217a3a2-710f-496c-9ed1-ea81b6a2c5e2", "value": "12288:sTsAXF28crKGbJZdrm2opvDE36bWZpeVP:sTs6U8E3JZdrm2oZDfCZkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782715927, "uuid": "91b91a75-55ed-455b-a76b-80afe35b1926", "value": 570200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782715927, "uuid": "9565e488-8151-4c32-bdd1-ced43c77977b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715927, "uuid": "0eb77f8f-a4ee-423a-a462-25c70d868898", "value": "scanned0011290626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835f67a8-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760366, "uuid": "6c59101a-463a-4040-92c0-58614620c597", "comment": "Malware payload (Mirai)", "value": "b8cf86b56f64fcd4b86a0e4491c7b9bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760366, "uuid": "f0fa55e8-7cfc-4307-8bf9-b3a07c558d0f", "comment": "Malware payload (Mirai)", "value": "786634933c38897f46b03de08a6d54e6a20f790b7671a08bc8ad54339597779b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760366, "uuid": "614827d5-a3dc-4ced-9e5b-c040daf0547a", "comment": "Malware payload (Mirai)", "value": "fe3dcd5ca1d70cf7d123f755ec89562530bdad69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760366, "uuid": "d2e9955b-49cd-4d61-9819-76bc759a9c82", "comment": "Malware payload (Mirai)", "value": "19489eaa0bec5e832a52feec6a83d684920fd02aa2c19792a473cf8bc27c52ffd08e219808f139b899fa28a7f25fb526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760366, "uuid": "004b759d-3b80-492a-b733-8f055a7e68b5", "value": "T108C34CCAB401DD3DF94FDAB644630D0AB935A3A156930F26635BFD93AC331A4BC12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760366, "uuid": "68f5f1b9-57c6-44e1-abe7-1def95ae4c30", "value": "3072:XtHX+ns20yVick1U97Ia6c/dHxNAl47cpX5to:d+ns20uiWZ6cdRNjcpX5to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760366, "uuid": "3f50eb84-cbff-4adf-9853-83e8267cec42", "value": 118740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760366, "uuid": "8aceaa1d-d9be-44f8-9b27-3132092f535b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760366, "uuid": "b7a44c72-b7a6-42a8-9cb2-0761548de1bd", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def17854-73bd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782739475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739475, "uuid": "338276e0-e04c-46d8-86b8-25842bc3332e", "comment": "Malware payload (AgentTesla)", "value": "a8cd942e54b62570476cfef7e7904000", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739475, "uuid": "c7f896cd-9280-4633-9843-35857dce8e55", "comment": "Malware payload (AgentTesla)", "value": "7881aa8363eeaa52111abeb6a1178efad0e948626e00b2b825d0f128aeb047fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739475, "uuid": "9cb08215-c85f-45a5-a911-3d820a9ecfde", "comment": "Malware payload (AgentTesla)", "value": "bdc655fe32e9ceb8a4fb5aaf27b90cfd15584a9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739475, "uuid": "b52d6e38-4deb-4401-b047-7e5c633d5b08", "comment": "Malware payload (AgentTesla)", "value": "28f3600ed4fe40b1db9924f1cdd2c85c862fcde88cc360ca4f1a5d75bf0b2314e4413b8112520b684386646d309101b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739475, "uuid": "6c55ca9a-cfb7-478e-8fca-951395b19dd0", "value": "T1A3367D484524B786D0FC9B248D0E7FEC1A4ED447FE69ED473A2A8A758B08FC27644793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739475, "uuid": "1ed95419-b4b9-43d8-bc71-13e0641de444", "value": "98304:lVPJXlFT4n+6+eCBVCCJdLs+FR0SPPAUsHt7RzidtcDk1WRbvooioVPJXlFT4n+y:K3UhR0SPrsHt7qtcDk9N3UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782739475, "uuid": "0be4a2c7-4e8f-4b17-af64-0b6ff876305f", "value": 4941844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782739475, "uuid": "7e0b3ce5-1021-45dc-97a3-d5ab563ad27e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739475, "uuid": "f4de78a6-5b05-4269-bad1-b88882462723", "value": "Payee advice pdf 6.29.2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eaf0c6-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769554, "uuid": "416e1911-5a14-490b-af98-c67b0b644b56", "comment": "Malware payload (Mirai)", "value": "0b56416ac3fad453fb3d28d0e83fbd96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769554, "uuid": "fc627958-59d4-41de-bb3e-5fff939c4d13", "comment": "Malware payload (Mirai)", "value": "78b8ea25449147ec183b1c4092ce18f43345647e183977fc5571c637e7e7418b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769554, "uuid": "064af55c-6f5a-4059-b4b3-91075a8170e3", "comment": "Malware payload (Mirai)", "value": "a7f94e3a475c5b231736b6ff5b9d22d7d7be393c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769554, "uuid": "51df21ed-493c-414e-a709-b6577a168368", "comment": "Malware payload (Mirai)", "value": "21cb71e68eadbced8402c8156fbd2f16248f3d4f0831ee3ad71d5f86d08b58394157f651b31a9bf931d402d5661e1f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769554, "uuid": "3f1aad3a-e3a0-4628-b976-c34ad9e4a225", "value": "T19CC34B9AB4019D3DF94FD57B58632D1ABD21A3925183272A239BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769554, "uuid": "9767ede5-5bbe-4cf3-989a-f8620e0f6604", "value": "3072:1jXiHb1ZoCERu0rV75wjcn5JqQeX8+zFXKrU:lSHbPoCERLOonrqo+zFXKrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769554, "uuid": "64edd503-9960-45b2-9eb8-75407b77ee19", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769554, "uuid": "9da1e868-f0b6-4882-8bbb-86d59ef0e2ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769554, "uuid": "3af64602-0795-48d1-adb5-4f068061db04", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09fb290-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712795, "uuid": "be0ec6f6-148e-4c9c-ba9e-520df7a12899", "comment": "Malware payload (Mirai)", "value": "f02c70997b3f9295ad861ef26f436eaf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712795, "uuid": "ea14e030-ae48-40a9-8bc9-c72ec235cc80", "comment": "Malware payload (Mirai)", "value": "7902bb4f23146c836ce28c9c0e63a5b673680cb35d337890c72d81d8161e5c9f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712795, "uuid": "0cd0926f-6ab1-45c4-a5b6-d92491fd6562", "comment": "Malware payload (Mirai)", "value": "ed20f4ed0d73a87763f92a0d25da0201e00ddf19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712795, "uuid": "53b380d2-8d40-4269-a571-000626ea8e6e", "comment": "Malware payload (Mirai)", "value": "e09f51263360266ba849652d7646d5f062ac7a24d99d22d6668f2392b9ee2dd009ff1389b1a696145eb25efeaa58b27c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712795, "uuid": "5ac6867a-f155-4bee-aa87-9aae3ca2f76f", "value": "T10841C48B2264D4B38D0BDF75F35490C8D18997E3A163CEBCF46445A3009926CF596F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712795, "uuid": "c4c0ee6c-226c-4851-985a-b735effa7b71", "value": "24:UvOJ7kaUIG2Yk1QnFVgkYBk/bBNIXxNIuyKPkkKPbi2v4A2vX8m51ZHkRbqVWq0:voLUv6vKPFKPm2vx2vHHwI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712795, "uuid": "6e8c4e89-76f2-4989-924d-35c8394af623", "value": 1900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712795, "uuid": "75ba6f2c-90ae-40d3-9778-33002cb78e9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712795, "uuid": "9d8a638d-34b6-4a28-941f-c0a03afc6d03", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e29184-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782713118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713118, "uuid": "96e1dda5-ae39-4235-b341-6b218a0bc12d", "comment": "Malware payload", "value": "bae522159f475034b35f3ffe3be3471d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713118, "uuid": "2ee80700-7205-47a4-b39f-85a3eac32569", "comment": "Malware payload", "value": "79a0bec1e8c9b4db86e986d1be00e65bbae2468f32d0af20308ac0c6d5966afc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713118, "uuid": "e6c7d4d3-4c67-4c7f-9366-21061e9c6e17", "comment": "Malware payload", "value": "b7a0bc0c04e2d9badcfe1951d40ee880f8ad8bed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713118, "uuid": "aa88729f-d08a-4827-a0c0-0791065123c7", "comment": "Malware payload", "value": "3617925beb15a7b09d7e3a9a1a46d07344f77c0dae03b7e7e2a683bda863b10563b918dc591e51ed98674f85006dc079", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713118, "uuid": "57ad7406-588c-4c46-b903-c9a9613678e7", "value": "T14AA63C2BAB8C031C2655B26158A505C9B01FBAA77FEF0919D17F0FCE1F692E852F4718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713118, "uuid": "4114c5fa-0238-4ce9-92ec-12a9dd18fdfd", "value": "12288:Q2PtDk/bbdyABIHwfuzRgJgGU1XKxC2ALVxz8jTDOyr5ZcwQTjT94FziVT3ZnM5x:Q2S107BvqmDWeKL14x/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713118, "uuid": "5082eccf-d6ca-4346-9266-64ee03931b1d", "value": 10107022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713118, "uuid": "fdbacad0-646d-4914-8b65-3edc79cb539f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713118, "uuid": "946f31db-1808-49ff-b062-fd1bed009156", "value": "Orden de Compra0000655461.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b75ffd-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756820, "uuid": "3b947e39-b654-42fc-acd7-1ae82a48da0b", "comment": "Malware payload (Mirai)", "value": "7823554499e106e49dfecf385bef0eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756820, "uuid": "0822fb69-2b50-47f7-8ef1-fc5aa8fda057", "comment": "Malware payload (Mirai)", "value": "79d8ee464361361d11a2a31bee53eebd66b48df2b5be146398e1314f059e069f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756820, "uuid": "73b101dd-6ebc-444e-8ee5-5af5a8a57a30", "comment": "Malware payload (Mirai)", "value": "be2c1d3a8c052fb60cf185a1f0be0f09851609a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756820, "uuid": "9455e6a9-88a2-41c2-bb99-23be8d5b9e3f", "comment": "Malware payload (Mirai)", "value": "24344334c7d2de7cfbea36c8c206628513f23368f60a2d8569d375ea31fae7a5976c3d4f9cee44a118d57a513ca7b562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756820, "uuid": "ec8bbd82-7fc9-4b77-98c5-630b5b5e3892", "value": "T16C230161C6CE8C87DC68C1F92A53710DF881C54B7A96FAEB27D088050DEEBC2552CBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756820, "uuid": "4feda51b-cc0c-4dac-af5e-f4c26adde8ca", "value": "768:BH+Y/eFMBDmIr0qVkLzLQpTXhLvQXZqcsHYWZvVm5HQDRIp2lePuIXyinbcuyD7f:N+W1Dm1wkLzMdxsXvsHYWHa4lePuICiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756820, "uuid": "3f67b94b-bcb3-44b9-8305-b8c8d221d735", "value": 47860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756820, "uuid": "9b842401-08b4-4c8d-9d2a-2abf949961b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756820, "uuid": "0bb02a40-3f10-4ff1-9dc3-7d8399799493", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b729a7a4-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737690, "uuid": "231bf5cf-a307-4574-97e0-1b8dd7d760c3", "comment": "Malware payload (Mirai)", "value": "5cc2dd783f4af1e8e5b313269d9d75d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737690, "uuid": "a6dad2eb-a60d-4652-bded-3682a8d400d6", "comment": "Malware payload (Mirai)", "value": "79ddac30f0cb86fe37f81d954778572e758426d8a1832f244a1d338823363bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737690, "uuid": "3b7dd7c4-36bb-478e-adad-d415ddb3d38a", "comment": "Malware payload (Mirai)", "value": "7ecc428d2098412b12cd2d1063fdd43e8de13a2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737690, "uuid": "3c87cf54-5bd3-482f-9182-db051abf211a", "comment": "Malware payload (Mirai)", "value": "ae01c0b9a3919e642e079ca38b1a5c36b614a54e5aa0b313a6067cca0901171a6d71e3ff45d5d56b92d5f92bcebe46c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737690, "uuid": "1c9d7f96-ed4a-4be1-9fb9-789b05c725d7", "value": "T16B13F1EE609554E8C5DF687DACBE47720951324563DF0F06E2118E48BED628AF0CD5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737690, "uuid": "c981fcf1-d2c7-4b08-bf72-41d91641945a", "value": "768:NjdBuP37LSHyomZgMDE/U++v5DOzvW3kVNCyoKDvrs/3XBWuuyOFWHz:NjdBo2y/ZHcON0W6Zrbrs/3xv9vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737690, "uuid": "f7e5b125-5317-4767-96dc-3375b4623866", "value": 44540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737690, "uuid": "a6665181-1f48-4b8b-a087-dc8222d5b179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737690, "uuid": "3bb8b9cc-0932-42d7-a4ef-243655c96665", "value": "79ddac30f0cb86fe37f81d954778572e758426d8a1832f244a1d338823363bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72272d7d-7376-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782708798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782708798, "uuid": "f37a9d73-8a92-4c1e-9d27-40116ec5495b", "comment": "Malware payload", "value": "b7c54203d950e0ad89576183e30b8d8f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782708798, "uuid": "6a1cecca-394f-43be-8172-ec2ca211a511", "comment": "Malware payload", "value": "7a1d2297fd793a86a537ef8f220385216a3a2050ca53ce4ef6ad398407a90ff4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782708798, "uuid": "4a99ab52-c509-4d38-84b1-e1737c557646", "comment": "Malware payload", "value": "99fcb03d25a00d72a9fdddf895997f142e8173f9", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782708798, "uuid": "f6875060-b264-445f-9104-b575c72c6182", "comment": "Malware payload", "value": "fcdd2a0ffe7a2c72b75cc018be142d2216c26ee8c57c003dc1c53f713ba9644ceb0e1abaffdcef8c93918aa7f4b503ad", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782708798, "uuid": "a97478f7-6716-44fb-a46d-de360b371e2a", "value": "T14ED57C03E69184BDD25DC274834BD632BA32BC9E0620B26F57E47A313E76B915B1E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782708798, "uuid": "cc88c308-e270-4779-a4c8-bf22c70a2327", "value": "a7ca6476fde9821db67486cfdb93699e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782708798, "uuid": "f5c25712-0ac6-41be-9b01-5cab1244efc8", "value": "49152:JUw/fQqbGWi9/uznckKgh7+6zqqrqzPHs4pxk653CN2xBGfl9ERsKx1SIU6i1:JFXGHyPbqs4pxkeZuwRfN+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782708798, "uuid": "19d57a3d-ffb0-4f9b-854c-b4ec0161689c", "value": 2917728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782708798, "uuid": "a9586822-0b1d-47b1-9a99-4b738492d1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782708798, "uuid": "ea0e7917-2e12-4eac-8d1b-89615a4d0234", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7812d7b-73ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782760051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760051, "uuid": "787699ed-c7b8-4818-95cf-5cc95f39a76a", "comment": "Malware payload", "value": "cd91f12cf47767396194394964d2267c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760051, "uuid": "95f9832c-f398-4587-8547-8835b6a5e589", "comment": "Malware payload", "value": "7b5121a41008653cda152a3bf5f0d0c44254fa3cd98af607dbc32f6e65341242", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760051, "uuid": "829cb720-ca9f-4c9e-9792-7209b2a7c578", "comment": "Malware payload", "value": "6a13e1fa76ca966980d477c1c741d3d6b41d3395", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760051, "uuid": "b40a9fe4-5701-4e5b-b93d-94f09676964e", "comment": "Malware payload", "value": "ec7e41f70648741758c871ab555f9ea375efc8d50dfae0c8e7eb817e70edc5cb3fda7c3d49c8f264854df5fbbae52b34", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760051, "uuid": "5da71ca6-3155-459e-82bb-ef1729d06035", "value": "T10366334A10206DFBC9FCF5F8A18829A24291EE0F76501411BD7BF47E38467C89B97B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760051, "uuid": "41ba468b-0879-4a00-9068-65ca82f7307c", "value": "196608:lTnpm/SDlI16xwycQf+UxYaZyenxL0UE1prbZkARY:Vpm/SDWAiy5NHZyenxjE1lb2ARY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760051, "uuid": "6f0fc71e-b181-489a-a48e-e45e224aa82e", "value": 7000898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760051, "uuid": "fa373aae-d51b-49f7-9c35-287f71134a6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760051, "uuid": "8e54a319-3498-424f-af97-41370cf832fd", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea97f7c-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756896, "uuid": "73f67490-ada9-46d3-b5ae-3f4a65d93754", "comment": "Malware payload (Mirai)", "value": "8d0c33e727367b648116a390f9345e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756896, "uuid": "f49ef612-48f0-4dc4-937d-f4ecbf633bff", "comment": "Malware payload (Mirai)", "value": "7bd08689347f5416afa9bd5c8e0b516aa01290a1de004c9ae7f084c8536fc1c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756896, "uuid": "771d2091-bad0-48e0-b8ef-35f2c686379c", "comment": "Malware payload (Mirai)", "value": "3ff73e40d0a2c277c6c9c5956dcf894fd2a16fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756896, "uuid": "28b0ef4e-b7a5-445c-a145-b71a7dc57f4f", "comment": "Malware payload (Mirai)", "value": "9623536f78f42f799249a3f1dc40a5f1531f778b68c6f17992ac22e8cbe1eb6d44b3323247801bbbff27d967c67f92dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756896, "uuid": "53dca3f2-446d-4a75-9d16-0d9234e605c4", "value": "T1A0B34BC5F247D0F5EC92053021B6FB37AD72D0BA1328DE83D7A49A36A8656C1D44ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756896, "uuid": "6cfc9e01-0a50-4318-9e4e-8268a48ab135", "value": "3072:MTZbasGhpoDIxkZTUaktasOHfFlcH5veCTBP:MTYsGhp+IsH/fcH5veCTBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756896, "uuid": "4324223d-ac75-4c66-bcf1-c36d00b913c6", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756896, "uuid": "98a37899-a54e-4f8c-b538-6880ad95ea45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756896, "uuid": "ff7adae4-adf2-40a8-aa0b-305305f8a933", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba0a6e5-73a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782730745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730745, "uuid": "fd8ee920-14af-4aef-8632-20bcea8c2bdb", "comment": "Malware payload (Mirai)", "value": "f3b9fe8df214c972f693c13948f76b60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730745, "uuid": "d615e1bb-6cd6-4508-920c-bce0d69b7dac", "comment": "Malware payload (Mirai)", "value": "7dede952e67bc20819269e5f6428ee1adc4602d051e5aba790ec77b6b866f191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730745, "uuid": "45faf64f-a5cd-475c-a7c5-31e2f8969b70", "comment": "Malware payload (Mirai)", "value": "e1711546f03303f97974fc64ea5ec75be59cffa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730745, "uuid": "6d2092af-3cba-4a99-89f5-67fda99822dd", "comment": "Malware payload (Mirai)", "value": "4b095d27f32c4ab9b3363396725f03cc46b1b1a8c155e4864e713213ce6d72793bb46878319ccdeed78907bb9b3eee57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730745, "uuid": "01c1324f-4a87-4403-add8-1abb0229af35", "value": "T12EB32A59BC406F05D9C215BAFF1E534933536BACE3EE7112FE105B2D27CA96B0E2A106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730745, "uuid": "a7cafe8f-383b-41d0-ab26-21712bd4b1f7", "value": "3072:YDdrF0jCz1HjFfaORIV7VjWbfVTTl8aMEgsTajlwI2aBU:YhrF0mz1HjkORK7VjWbfVTl8aJxI2aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730745, "uuid": "8f1d64ba-1aa2-4c23-8abb-41b6d4c786cd", "value": 112552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730745, "uuid": "2630a169-1df9-4c11-abf4-9fa6319830de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730745, "uuid": "df57b51d-7ecd-4b5b-9e7a-ae86a12be078", "value": "9ER", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96196899-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765122, "uuid": "299e1705-b145-413e-9c16-f35914fc2b48", "comment": "Malware payload (Mirai)", "value": "0e36a3ed23b591fc5f5774d8e27d8088", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765122, "uuid": "8a4a23b2-a8bb-4941-9073-356b538b439c", "comment": "Malware payload (Mirai)", "value": "7e9d7dd37751686dc39a23a7f5f2012c3075e1a1f7fa61712887c7617439ecc0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765122, "uuid": "a51285cb-af13-4c06-8d7c-fc36b194669e", "comment": "Malware payload (Mirai)", "value": "4647940e8a3d8dc017ab87f20eefb71ef758b3f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765122, "uuid": "ac6b662d-501e-4b9b-a416-6c67364bc01c", "comment": "Malware payload (Mirai)", "value": "7d4249e6b864fc44f3e161d02373fded78052775d19c1cacf28d5e17dd1319e6776694bf9e223582dec8c0c68ce180fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765122, "uuid": "d46a8f49-a2d2-4696-8e88-8d493bf26d20", "value": "T15F14EA46BD518F23C6C311FAFB9F429C772667A8D6EB3102DD257FA437864DA093A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765122, "uuid": "20ecc069-f747-42a1-b7f1-f7452d3538aa", "value": "3072:RiOq/Prz0ZtLExAHiTib62OKTEAvIxGIj/YrRWZ8UgJJg3jz7nGPvL:XUPn0E6Cue27TdvIxGo/H8dzg3jAvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765122, "uuid": "98b5f4cb-3b38-48fd-9eb0-f430b8812001", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765122, "uuid": "c3b48829-82aa-456b-9c4f-ba6d0b560fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765122, "uuid": "9bb0d907-ce9c-4d6e-b3fa-1cf2cbb01d0a", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96348fe-7368-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782702931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702931, "uuid": "9bc2fd1c-4701-4795-9b0f-2b973928e444", "comment": "Malware payload (WannaCry)", "value": "3ff29efc50e11f9d466325cc148861f5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702931, "uuid": "f045ecba-0d1b-4992-b863-13ae8e678e51", "comment": "Malware payload (WannaCry)", "value": "7face3ccbf29cfc4294e3058cfb88713afd36d49cd12ad28e5b637e212d6b4a7", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702931, "uuid": "4c03fb40-18cb-4489-a134-c0e4e8e01465", "comment": "Malware payload (WannaCry)", "value": "590e6df1de0b676e5e228c0e159d0701a3d401b0", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782702931, "uuid": "e4128e8d-8615-4bab-a37c-f648608eaf9d", "comment": "Malware payload (WannaCry)", "value": "6ddf0a741c862af5202e6f92816f646c5388b9a4089cd8e1b1aa75c12702047294946bb0bc481e429e7a55d405b37da2", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702931, "uuid": "563a7ade-8e84-421b-969e-a7203c72e26a", "value": "T1D836231E31BC91BCD046177994B78E66E7F37C4A22B99B0F5B84877A1D13780AF68702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702931, "uuid": "f1a8cb1d-72aa-4492-b141-5bfa36253092", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702931, "uuid": "ee3d368d-59ac-4ccc-b786-831877f787dd", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626ZA0p+9XEk:jnXnAQqMSPbcBVQej/1INR2AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782702931, "uuid": "1213e373-649d-4a0f-ab9e-a6e7a2c31aa7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782702931, "uuid": "2c3010ff-396d-4a69-9a04-b4b74cea8205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782702931, "uuid": "946cb854-f878-4ace-84ff-26980feb8b0c", "value": "7face3ccbf29cfc4294e3058cfb88713afd36d49cd12ad28e5b637e212d6b4a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5fa312-73ff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782767710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767710, "uuid": "bc66ab43-0f39-4e50-b41f-db47d06185f2", "comment": "Malware payload (RatonRAT)", "value": "5042b3aa7196657eed48fcb84580be40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767710, "uuid": "b5c5aa10-20b4-4ef4-880d-a61009f70e89", "comment": "Malware payload (RatonRAT)", "value": "7ff17ae0309f554a8569e55e283e9e1a19437174df959bb9cc8d90b19ebf800a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767710, "uuid": "275ccb0f-9c69-4fba-8261-038eb115235a", "comment": "Malware payload (RatonRAT)", "value": "5f1b0e4875740cac9dcf024dfc14b80d45706f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767710, "uuid": "ed991003-6fb7-406d-96a7-45d1635cc378", "comment": "Malware payload (RatonRAT)", "value": "5766efc20720505ac03aba5bfaf4e489d2b022a54e9e94c373e4fdd00ad44f38d41f931acce4c8d25c3e88a2f517bd37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767710, "uuid": "7b8bc601-8c98-4490-b928-a53a7ef71b3a", "value": "T1A1B30231F3804712CE95A6752857D88483E7BF43A757EF6B3CCA12419ED23627DA87A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767710, "uuid": "5f643dd9-c96e-4714-aa8e-4e0f40693bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767710, "uuid": "f0093819-5d0b-4468-9c8c-81004006c6e9", "value": "3072:WGLrZtf6o4AsgmYKWiRMtnSaIY9N0d/RY+MWa8BY:XLrZN4AxmYK0tnSq9N0d5+P8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782767710, "uuid": "a75d8aac-b3d8-4cdf-bdfa-24794f4d7bb3", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782767710, "uuid": "f9c90906-1171-4c7a-b7ea-0582b170c2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767710, "uuid": "c07a65a9-73db-43f3-8bcc-7292bce51e3f", "value": "XwormCrackByAizen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37a9d9f-73b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782735509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735509, "uuid": "69e687ba-06cf-4080-89f9-aa33f8b6b232", "comment": "Malware payload", "value": "b90f1d0a77d56564e71ed080eefc53e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735509, "uuid": "23d3eb26-43ec-4247-aba7-060ea1c7a9dc", "comment": "Malware payload", "value": "81c183e4cd6595846cc3277be65cf0701641b5d0dbe095168105d7213cfd44ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735509, "uuid": "6ee654bb-6e1c-4d47-9cc4-ac34098ac57e", "comment": "Malware payload", "value": "bda9605e616277876643b07e59ad8184fd69a690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735509, "uuid": "674059b7-46e8-4c9b-9869-d318c7e58bbd", "comment": "Malware payload", "value": "b95f53db70a314d60e62e299ff0d3893b2eed31b1885a7e47f019dc917d56a83cf9f9958c6c8165eeb15b2d1596a1232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735509, "uuid": "4247b4a7-c2ce-443d-8a3c-d6e309a6355f", "value": "T153246B437B878FA3C2256A744AF382389ADA37170AA7C4D7C3B95F0167555A03C29FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735509, "uuid": "5fc60a0f-b1c5-4ed8-83cc-83f27c2c95a1", "value": "3072:RGquV6n0Tb3wauysFvApx1Ge0iNfhgGjM4YErRKH7lM+w1qgLd95F2MXYhj0l6I:7uVc0v7uysFvApHdHfSH7xwVhW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782735509, "uuid": "0fc240df-31d4-4c9b-853f-dd25da297ec8", "value": 218216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782735509, "uuid": "f7c00d78-51c6-4f58-b6cd-82634b87dcf1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735509, "uuid": "70727628-744c-45be-bab4-e73a2e4609d2", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3c997c-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769567, "uuid": "031ce657-ba7e-4c36-bd6c-d1bb4d1ec00c", "comment": "Malware payload (Mirai)", "value": "d01cb36f291f92f91a5e6be1c9bdc0f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769567, "uuid": "ef29e73a-dfdf-4033-821b-0ad6eafa3727", "comment": "Malware payload (Mirai)", "value": "8200735c40ff9727a5de977d9b01f51e4f3cc564304595de530f03f8d07b242c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769567, "uuid": "120f3c80-32e2-400e-b988-63e77f5b0b9e", "comment": "Malware payload (Mirai)", "value": "d2b49dc2b0ad2e49b31f0811a0b7c7f1b79601a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769567, "uuid": "d3e72ea6-546c-4349-bc66-287fb8f5db66", "comment": "Malware payload (Mirai)", "value": "fa49c604283f5933229312b962c1078d3e5a295e3b75b9df1518c9c685c27c971711e6af6c15875c003d6e266698579b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769567, "uuid": "a4fe261a-3407-40b6-8bec-36b33a824997", "value": "T1AA33F1E85F2100EEE996D2F3D2728F041B380BA4F447DC96254AF25E6E57BB139CA5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769567, "uuid": "86ac36e8-8daa-4a5b-a220-18e491a89f1d", "value": "1536:Uq5QM1ttR8TZuOUD3JIPaYB5iT9SBVJu6:jh1tb8cJ1T9UVQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769567, "uuid": "99f4e41b-3a61-4e9d-bc91-d5206113f5b6", "value": 50516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769567, "uuid": "ff5e0912-1d10-4b26-bbdd-8d700b5a65a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769567, "uuid": "43d52e6e-eaa5-4e82-b652-b9d032c414b0", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd0460f-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1782758718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758718, "uuid": "0baebfa4-f350-46a7-927c-08eb68c93dc2", "comment": "Malware payload (AveMariaRAT)", "value": "14b7d8e98b8cd97f8f302bab2b4dea27", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758718, "uuid": "2af83928-8b04-4cb9-9345-762d7b30be21", "comment": "Malware payload (AveMariaRAT)", "value": "83a2d5361b91b0ac26ff7c5f161dd3008de6922c5df7f8c0af80b1dea105480d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758718, "uuid": "fbec60f5-e73f-46c5-9870-2ce2da3c62b2", "comment": "Malware payload (AveMariaRAT)", "value": "af09bf91db9bb8dfaa56f1d2e3d4fab97e6fdf72", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758718, "uuid": "149e7c7e-bbf9-47a2-a7f0-e115ac7c8bf3", "comment": "Malware payload (AveMariaRAT)", "value": "36a4a1596eec3754ed75170d8a79d063219e48b41bbe192ced096f8070422d3bd9bb6b551683ddf01c80f7b33cd088a1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758718, "uuid": "99d92784-0df5-4c77-9313-6bc7bb87f339", "value": "T1ED846C8C328039AEC857CD3145641D7896136E6A7F1AF202AD277DA77B3F9C79E140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758718, "uuid": "b0d4fb09-f317-4145-8cc9-d60777c26136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758718, "uuid": "402f1a0e-7f75-4669-90aa-8d1f2035db4d", "value": "6144:Jxpq8vzgAqh8K3Ngmgf3dLvGCnrmTUJNfoRv6U0kNS6q3wmSHCX3YhOI:Tpq8bgAo8qW/Pd9p7fU0kNS6q3wmSHCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758718, "uuid": "0823c28b-9305-40ce-9b0c-daaf7060ca9f", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758718, "uuid": "967fb445-d216-42aa-8f2f-76964e8f31c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758718, "uuid": "5354bb9a-816f-4eb7-85cf-69e37acf9e69", "value": "14B7D8E98B8CD97F8F302BAB2B4DEA27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34f555c-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782742059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742059, "uuid": "a77d476b-1cc3-4fc0-9e96-7518d952838b", "comment": "Malware payload", "value": "eb050d5dbc25f8a5fa944039cae8f8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742059, "uuid": "72fe4ab8-7594-4641-97af-0e2257c88e12", "comment": "Malware payload", "value": "83a5fb685c965f59f05d9a3dedf8c29ed5264401fa39e5593410e85cd84328e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742059, "uuid": "b55ba33b-0c4f-429a-92f2-b212d76cfe22", "comment": "Malware payload", "value": "8dda28f890b5ecc999167965713c83b32e66ac7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742059, "uuid": "e9e87f28-8bcb-409a-8549-d41a5f172446", "comment": "Malware payload", "value": "8c5d94d2a83975ca450df4c0c4773ff1ec43752b27344938fc18bfa52d795390f12cf94514a48f8c153aec440ec79c6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742059, "uuid": "bd67fabb-6199-4565-a247-05af0ee72033", "value": "T166042AA67B116F66C168C33408F387D5A3F6369127929149F22CDB2C2E2134D6D5FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742059, "uuid": "c44a52f9-3067-478c-b530-bb2f21df7a6d", "value": "3072:C9t566YTvgahEdKRjLPp4UHWbhh9nNmjFludCdGRxP:C9t56L5TtBa3RNk3da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742059, "uuid": "c30bdfce-2966-4232-b3dc-8a38c83032b9", "value": 180292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742059, "uuid": "653c3d23-bd3f-47df-b984-57a13989e1c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742059, "uuid": "d518314a-4fe1-4c03-8ccf-f81e7d499a6a", "value": "mips.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd5a330-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782736389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736389, "uuid": "3f452c9e-d733-439e-b859-1146267db1c1", "comment": "Malware payload (njrat)", "value": "a064ea0b7ea063d9b1969e5cbe620dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736389, "uuid": "50b736f2-964b-474b-85d1-c0f8c9c1cecf", "comment": "Malware payload (njrat)", "value": "858727d7d910a029cd5238ebec8c6cfc90593347dfd2172bd896345da82a6dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736389, "uuid": "a9a3c37d-d406-4b21-95f0-465638447ed8", "comment": "Malware payload (njrat)", "value": "6c6a7c4bfad2201ee962fbc022e5441a0325f7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736389, "uuid": "de92ec2a-cd1b-43e9-85c2-b4d22fbc6648", "comment": "Malware payload (njrat)", "value": "4792cc0e0654eb29d99fa96035d931a2040fd1bf4175c987b1e143e6bee5b2b41e9fabfa886dc60c3487780ff5fa4f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736389, "uuid": "10cb3d14-ea13-4b48-ab20-53685f0e39b0", "value": "T17B25E0156E867A8DD6BF0F78C062088837F4D817C3E6E72A7FED91B05AA7B84CD06511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736389, "uuid": "9c4e7232-008c-42a7-8812-b4bccb53934c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736389, "uuid": "68074684-3cab-4206-87f1-a9b4dba5e8eb", "value": "12288:yOtQbZdW8YndFFAh4CTqsnqBBo+aFq08lWmo5xA7kOkqq8hyQLX4+JJo6F:sb2ndMhH7qBBo5Y0Q0ugONRr4wJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736389, "uuid": "7e7c749f-800c-4693-a01b-ea1b1ec6a91a", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736389, "uuid": "99768cbd-b203-4f0a-959e-58fa57c0b147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736389, "uuid": "6bfe8a1f-f00d-439a-b4c8-7066be369cce", "value": "COTIZACION VANKARV.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4763369e-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763702, "uuid": "36519a71-c592-4c1c-aa90-0e6519264c84", "comment": "Malware payload (Mirai)", "value": "c18754fc50e4c157de247b365477d68a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763702, "uuid": "40967528-5052-4f1f-a57c-aadc5c7a9be7", "comment": "Malware payload (Mirai)", "value": "85a00051bd64a07945c16f0147aee1db76afd198febeebfbc5689409d5c0836c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763702, "uuid": "4e3e7414-b5fa-4c5b-8f29-f70e62b15380", "comment": "Malware payload (Mirai)", "value": "b003ee4fefaa599787de3147ed8c086cc00a875d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763702, "uuid": "493a12e3-61b1-40be-b6e5-694eebd77436", "comment": "Malware payload (Mirai)", "value": "9334d555ef5cea673d0415713782341fbe126ad03830bef6b8e874e2d1e505fd2e17ae51703c94edd1c8283e3975f749", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763702, "uuid": "55f3b51c-3710-482a-b6cf-dd891e7dc6df", "value": "T114A3298ABC809B02C5E41A7AF91D51CD332707F8E3EE7116DC256F21678B95B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763702, "uuid": "a60c76cd-e42c-4801-8507-a3d1789c1ddf", "value": "3072:9xWwNQYuL5Af+nSy5ykzfUj1VXpLFFTQflPk:9ryiC8j1VXpLwfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763702, "uuid": "f41db0ea-e4ac-4ab8-90a1-5461b1ff40af", "value": 104048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763702, "uuid": "0764cdb6-ba6b-44b1-86a3-6cf813cb8288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763702, "uuid": "1ea7e2fd-fe19-45a9-a6cf-f559abb937dd", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22601b7d-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782712529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712529, "uuid": "39867e3e-ac9c-4c5a-bfa1-298be6b34a3d", "comment": "Malware payload", "value": "e3d538692c3578e119a03f302ca1b1ce", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712529, "uuid": "f5e47f2a-a867-4db6-8099-1d8aae8b3d00", "comment": "Malware payload", "value": "85c60e58e827d88421e0c3647da9897d33af13f436678df7f4ed433610760052", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712529, "uuid": "d48cb83b-9a5c-45aa-8bc7-3447995ba142", "comment": "Malware payload", "value": "90e11f3ff521c0bd82368b6a505d9c9cfdab9f57", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712529, "uuid": "a7a42007-5457-4bdb-9c01-c3e5184e5cd8", "comment": "Malware payload", "value": "23dddb1e21efbf839706c09b40a1e06fb69680abcb1d85ccf4b3fff293cfe4df9515403bc616b192114d14d0bc187288", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712529, "uuid": "f259fcab-47e0-4a63-8e6c-dac84a8630c6", "value": "T169468C4F73876AADC016C535D617B632C162F8220B7581CBA996E6FE1E73B804E3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712529, "uuid": "b28c3d2e-9593-48fd-b5fa-ea3e76343843", "value": "109f73cc95228e3eacd82c151b1a5e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712529, "uuid": "f9010421-ebb4-48eb-ba41-468d8338e090", "value": "98304:0N0Xp/C9YEE7720ku0JsZzcGdum8Zb6+65Z:0N0XqYEE772sdZzcGzT+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712529, "uuid": "1366771d-609c-4bf8-984a-83b2618f3fe0", "value": 5624832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712529, "uuid": "8fe2c0d0-adc4-43cf-a9da-e608e03f56b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712529, "uuid": "a31fbef9-ba0b-4058-b056-1eaa6b193b57", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1f576c-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700064, "uuid": "0e736985-d79e-4385-a504-9e8c028f7c3d", "comment": "Malware payload", "value": "5f58d8669ccd42cc342b4e91434966fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700064, "uuid": "39a8b4eb-2fdb-493a-adb0-53b605594a1f", "comment": "Malware payload", "value": "870461bd5e8a497e86459c6c3f5313a792e2c10aa605bdbd6f7108a0ea0f94fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700064, "uuid": "f334c152-6c5c-4e03-853f-3dbf2eff30c8", "comment": "Malware payload", "value": "d77e2b5e5585a624ce560cae71f578986c545605", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700064, "uuid": "54e624b5-2e86-461a-9f4e-1e7e398410a6", "comment": "Malware payload", "value": "299496ca9663b5ca5a2d60af53b881bf29b086295b6a41b7bd5c07804ba2e52a9a0fcac404e562314ef1880ddd1f5cbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700064, "uuid": "23ea52f1-5521-4d77-ace4-dbfb7323faa1", "value": "T1BA13AF8273045F2847F50EA361258EE2E8DCA85B0EDEA55A37883DA724CF3793573075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700064, "uuid": "453e7e79-de10-45a8-b34e-b8a69b3055d4", "value": "768:uIsigNEsPNRK2ASZ2jMu4bII8dYDfoUq3AQcssQF5qO05GcMjvnxfn60suj/2N3Z:tWFRK2ASZ2oRhfoh3Pcssygw/jvAujMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700064, "uuid": "cf56f3d6-7a89-4b5d-a89a-7489de0d7130", "value": 42444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700064, "uuid": "d337c465-122a-4194-855f-3f72b5a1f66d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700064, "uuid": "da06233f-3150-4fdd-853a-62790d9fd49e", "value": "afujo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dba2c7-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737825, "uuid": "dde2027e-3b2c-4e58-9727-6a56ae5eba1a", "comment": "Malware payload (Mirai)", "value": "4063fd7241923e519fe9789fdc8544f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737825, "uuid": "997beb6a-ad9a-4a3c-ba33-cdf94fbe54d0", "comment": "Malware payload (Mirai)", "value": "87557c2cccc4652b902e794246b78bb2625008d8e4bf5402664c033cec0297b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737825, "uuid": "c4b0cd8f-41e4-4871-956f-c60b34883072", "comment": "Malware payload (Mirai)", "value": "134e78d874cbeba6bcb045effcb178f0547db915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737825, "uuid": "55294af3-591e-4850-85d0-61ab44807d09", "comment": "Malware payload (Mirai)", "value": "a928a1305ca219769f20e9c0959bba148d075de527ae7f42c7e709e1e5c5aa6d633e3a26a5d3266dcb0a5ed4a6ec8e9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737825, "uuid": "21ebc533-5c34-4c3b-8565-bc477aa1ea7d", "value": "T1C6432885FCD2996AC6D013BAA72F358E33A1B3E4D1CB3603CC945B25738968F1D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737825, "uuid": "82534bfb-d336-4f29-9c36-e600659125b5", "value": "1536:nRpDfwhNTvjG82EFMH81AMLjRKqt5Z79:nRpDIhNTviTUZrZ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737825, "uuid": "580e508c-8d32-48f3-9ea9-28e8e7acca2b", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737825, "uuid": "2991e287-7147-4078-b386-90d1fa6946ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737825, "uuid": "7e317eb9-2234-410a-9409-812624b1626a", "value": "1ca93bf656595a5a1b6c44f55f17d2c838d914009df64e4f66af406bd9eac33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019fb314-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782755424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755424, "uuid": "157199a7-9c56-490e-b479-0b3ea8031c37", "comment": "Malware payload (Gafgyt)", "value": "2ae99894e55452e1ad48141d2c8bde88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755424, "uuid": "e9b29499-d2be-42d5-9dfe-f54d44d56ce1", "comment": "Malware payload (Gafgyt)", "value": "876894a47b1c46f30a174e9d7b3e26e752c25666abc6b555343d09177540114a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755424, "uuid": "dc23a704-6984-447f-9d43-3833da8dee8f", "comment": "Malware payload (Gafgyt)", "value": "c757c84e295bb4cc3791d9a9790cd4f5419d22fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755424, "uuid": "765792f5-0f44-4b8a-a810-acc9ca9f69b6", "comment": "Malware payload (Gafgyt)", "value": "69c761349c4210c1a0f2efca35c062b03419b575227a09d1aab49c309a64d15125802ab9fad6010ab45c23c0d8c14932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755424, "uuid": "9f92c68f-79f1-4533-a4a0-e0b75a4cff86", "value": "T1E3A37BA17B5EBE6FD1B24E3B8443C3113B39EE50DA472613906C7B272AB71D01E266C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755424, "uuid": "d7cf878e-3581-46dc-8bdf-36410b69e71e", "value": "1536:jjBqx/nY/auLep0/ihqOMipt0D+wVviZXcU9xaMUaQrY73wBcmXI7Pdjj:jLW2ihLptLwVviIQoYUQ7P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755424, "uuid": "9a1a921d-ced4-45b7-baf6-530bcc488343", "value": 106684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755424, "uuid": "b9b4074d-e9a7-4dcb-8c60-a1c6edb28419", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755424, "uuid": "0ac667aa-cb84-4b35-b520-a6a3884876f0", "value": "SecuriteInfo.com.ELF.Gafgyt-MV.74384715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b08ed68-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773264, "uuid": "df0284eb-be6b-4736-8d51-8c5adebb2e0c", "comment": "Malware payload (Mirai)", "value": "28095402913bbdef97f62714a279297b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773264, "uuid": "a8d24b1d-7c9b-425f-922b-caa6551091cf", "comment": "Malware payload (Mirai)", "value": "88a4b640bff61b58aef117e03723e9e426afa9b0257fda7d1b91a4f799ad844f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773264, "uuid": "866c9679-e655-4828-a63b-e37f724c02c2", "comment": "Malware payload (Mirai)", "value": "308bce0e56b5f17d770eb7a7a235b55b78c825b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773264, "uuid": "6d235782-818b-49b6-a1bc-0ab2da1f7ea4", "comment": "Malware payload (Mirai)", "value": "2d025a4da889381962d9bcf98e28ade29d47c1a48c17bea8b940df5298aa54bc383239fa8c32cab4f420bd8c2cc0a898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773264, "uuid": "5bdaf5ce-262d-4147-b1aa-99eefba080c3", "value": "T1BEA3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773264, "uuid": "da9fc1b4-e751-4848-bf97-56b6391170f1", "value": "1536:LvGefaZSdtuQ4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdg59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773264, "uuid": "36009ab3-5350-48a6-b3ce-40522907e0bc", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773264, "uuid": "cd625aa7-8d84-49fa-97cd-108e9d86ae6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773264, "uuid": "d4a9d5f8-beb8-41fe-a1ce-809606661ae9", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cb8cf9-73d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782748742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748742, "uuid": "057fee9b-63d9-49a3-8878-248c48c8f811", "comment": "Malware payload", "value": "53e153c33e1e498d3fc1bf5d28cfd7a1", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748742, "uuid": "bd75033d-749c-4aa0-a9dc-28ab31183f43", "comment": "Malware payload", "value": "88b4057f963af355ea024e3d09cdce27e41682871e9e59902a2d43329b467baf", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748742, "uuid": "137316bd-0d31-4f6d-8d84-7076715c897d", "comment": "Malware payload", "value": "eff1b3985822a6e37b6d297010d1fe835969490f", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748742, "uuid": "7ae3b69d-cc6b-4552-ae88-004c60eb8cc2", "comment": "Malware payload", "value": "0d17a22b46bf711572d727b1920f953642ed354973c514a2a01dfa1faa5d9075ddd7deb7cb649aea050dace78009260d", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748742, "uuid": "c1bee6c8-95c6-4249-bfd8-3c87d0019874", "value": "T10E263343C93AA8D6ECBE269392436DC81916539A6B25F95F0CD8F78178216F47B3D330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748742, "uuid": "e6be7097-c761-4c7e-a340-b1fc7dc5870e", "value": "98304:dUh4I/PQVZv/WLOmsjOjh5hM2hTZ8IYr02NN845HAXAVh:e4I3s6AOjhI2h+YSDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782748742, "uuid": "500cb2f0-7d71-4f81-826c-acc700cfac49", "value": 4647870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782748742, "uuid": "b3d0ce83-777c-48fa-b79e-2295df828765", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748742, "uuid": "03b768cc-2714-4221-837e-5ab3d981b47e", "value": "stego.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1684bf-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700089, "uuid": "9072a6e3-b083-4677-89ba-578371660d2e", "comment": "Malware payload", "value": "991edfc0b573b0e146ae2394bbb3130f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700089, "uuid": "15ce8d99-cd1a-44cb-bee6-fe3de8840de7", "comment": "Malware payload", "value": "89f41d2de7ee34876518940a410b55cc47bf53aa91702285f4e4080b9cce6b96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700089, "uuid": "be1e8dcb-c07d-4e40-8bf3-1e169cb5fc5a", "comment": "Malware payload", "value": "e963190e814cf80810d79e6280b9bdbe21771fb2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700089, "uuid": "e8a480a0-7c8f-4290-ac36-5e557f968a17", "comment": "Malware payload", "value": "7de1337acd139f6518108bc9759bfa81431df8d059df28fc045bed636691b8fb394627901bfac63cedafb374b6c07423", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700089, "uuid": "2d105de8-7c41-4ce7-8809-10c3017f7c84", "value": "T13C13AF6CF30859351EE877B2947C88F9AABC2AF65CC9599C5312D4A42C4AF1671E30FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700089, "uuid": "d3b4ba54-16e3-4b56-9ac6-5face854db53", "value": "768:uIsnLfAcsUYc5ZwXG8K3LFBxNkuDf/bo2xJuFW5sM5SGtEkE62iBN7e7j2N+ylWu:MrAcpYSZwXjIFBxKuDX8DFWimb52KN7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700089, "uuid": "5045872e-0bbd-4d9f-a464-614a57349156", "value": 42552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700089, "uuid": "69a40cb1-af13-4261-8022-c473ef5eb2d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700089, "uuid": "18800e2d-bdec-47e8-ab12-c3305f293e93", "value": "itufe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c8cf63-73bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782738412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738412, "uuid": "1c6d50dd-2489-4805-921f-23fc682c037c", "comment": "Malware payload", "value": "b5035d8ae43f900d476b9bf7c3b7f37e", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738412, "uuid": "c80cb862-1181-4bcb-a07e-d3142522eb0c", "comment": "Malware payload", "value": "8b6b88e9da9b663186b8df5adef234d5f301519ec99ae69914c0a7716f51568b", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738412, "uuid": "2151330b-1932-4def-90b2-a139d42e3096", "comment": "Malware payload", "value": "2ff7ae037c8c3db535654714ad2b29b9f8f17a4f", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738412, "uuid": "9db6cb9a-5a5e-45a7-ad99-07385d3d4700", "comment": "Malware payload", "value": "12b1cc8ea8bbd3c79e456996c0767d85d578ce5180a5dbe71fe99afbae6dc49e284542acb23e712efda7bb4259633819", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738412, "uuid": "0f6884e2-44b3-4a2f-9c2f-12d29167dcb2", "value": "T111F4E0169E850987F034883481F78665E9767C0E4B8089DB7FAC78F74F39A98BB36351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738412, "uuid": "c3bf5c12-21d0-4bf2-a42b-d30a1acc0c44", "value": "2b7fd29ccdbada997c7a1797b1587f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738412, "uuid": "76c90974-e3eb-4cb4-9ec3-9fbf8f563239", "value": "12288:GtJIQ1/O5TemCLGKt6bvMwoX5aNjlqjS336KdpPRjw30:GTIQZaTemCGMwhNj93KKdp5je0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782738412, "uuid": "af464b6f-adc6-4167-84c8-11a991195e7f", "value": 725240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782738412, "uuid": "8fcecc1f-512b-48e8-9b29-1d130a21aa06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738412, "uuid": "3fcd08c4-9745-4a39-bbbb-32c2e5d82235", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e45116-7412-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782776020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776020, "uuid": "672efb78-7733-4854-a5af-3971320fdc9b", "comment": "Malware payload", "value": "ddf0b410d672f6bccb66b95808757ac5", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776020, "uuid": "c8ba6a00-9140-48b6-ae49-d9d1090f2295", "comment": "Malware payload", "value": "8dcf47bc0bb0723203972ea05c1f05df6d38f61d3fe0460d6b727d9ed2bafcaf", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776020, "uuid": "55f912df-b408-4e2b-8566-144377683c66", "comment": "Malware payload", "value": "70c219a9551a2c5e196818da69bc7a431583b354", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782776020, "uuid": "71db5743-d167-4048-b0df-ff3461bb180b", "comment": "Malware payload", "value": "a689d534cb461c76fadad2c62dd207f11ae168a76c113b3d9c48e62ed43cf513a4a52b8dc0b4114dca8a5016f07e6239", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776020, "uuid": "86c20e41-9934-44b5-8954-3b847397bc5d", "value": "T10AE58C0BBCE049F9D4A9A33184AA5186BB75BC050F3223C36E50B7792F72BD19D79784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776020, "uuid": "74b4613c-e0f9-41c5-8900-4a8474af1603", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776020, "uuid": "d5ea67d3-8ba6-459d-a281-1507f596a84c", "value": "49152:oXO2PWyKBM4XAXhh4sD3MRTXi5bj2Wq/ajTFPlWbkUrnn6E:oX15hLAWQyMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782776020, "uuid": "3801d15b-5ad3-4b3d-9e28-98da83cadb94", "value": 3213688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782776020, "uuid": "64eb931c-9a17-4815-a79f-ea550300adc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782776020, "uuid": "a0d1d99a-dd0c-47a0-8f7c-575909ad2006", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94db0a1c-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "4b0a0e96-537a-414c-9602-17c5f68a5f0d", "comment": "Malware payload (Mirai)", "value": "15d4e31785a4a71892926f6dd0124a29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "3dec0569-a96b-4c7c-8327-e2590aea0d5b", "comment": "Malware payload (Mirai)", "value": "8e30f4ffcb31937362e37371f5f170c279449bba1dd05aef19a889cfb007d975", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "abbe95b2-00cc-4ccd-b4fb-30f6eea752d5", "comment": "Malware payload (Mirai)", "value": "e2484f2a6a082cadd21d9f709966913a2b840678", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "9a692595-e229-45ce-acf3-8037390a9b3e", "comment": "Malware payload (Mirai)", "value": "4c19145fe54ee6d820a19f762b1860b2a9c139968cd839ca0fc9c7ab60d9cb1de5368979d133309f90c5c13af32b98fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "9f16b2ba-e0be-46ba-bdd5-dafe723324e1", "value": "T1D314074AB9519F11D5D231FEFA9F419833136BA8D7FA7102DD206F6033C699B0B7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "5a540bb7-2082-474d-8eaf-c0dcbf1a9d01", "value": "6144:kIUWq+7fLN0bcifpBaEKc21DFjn65Ppv6mHjwzi:kIU6fxqcifpBaEK1DFjnI96mHjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765120, "uuid": "304beb04-323f-4be7-a3b5-e2c930d649ea", "value": 201408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765120, "uuid": "a69d51d5-1a5f-4c73-9a26-0f59c34ee86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "9ae0497b-7387-40e7-b3f4-c92cb127d6fb", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fc2544-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756819, "uuid": "dd90c86d-2e55-4ce8-85eb-63fe3f5a0101", "comment": "Malware payload (Mirai)", "value": "cbabf447f33df13b8c5b6d06bc2d418d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756819, "uuid": "f72a657b-d572-4e15-85b6-a3307c865c06", "comment": "Malware payload (Mirai)", "value": "8e5237db39b88f836ae0dd3aab6ad3adc4f4a60e8425d83808798a2589f386ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756819, "uuid": "563e8a0e-f489-45e7-a9ec-1d180dcefd8f", "comment": "Malware payload (Mirai)", "value": "cad10741eb2e97e971b71cbf6c6866114ee76e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756819, "uuid": "cf99b5f6-a773-479e-afa8-1ffd8d7fedd4", "comment": "Malware payload (Mirai)", "value": "8cf674dc391410553921b347189a9079c82f4bafafc6f5561c2d81832f0e58b4bab8d5346d51f74c358a82b63ca66cb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756819, "uuid": "b117a43b-ed6b-410a-b857-f186cf6a69dd", "value": "T1BEC32B8AB411DD7DF80BD9B644A31D0AB931E39156831B26635BFD93AD331E4BD02F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756819, "uuid": "f2974fa8-4900-4cd4-a3ed-f383f96276d8", "value": "3072:LcvzDtxsMxkjc3puNiPZ2SMQLqG7ypirFR0:OzDtxs3qUSMIqvirFR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756819, "uuid": "e52e41c7-d8de-4f00-88ca-9730dc0e5d9f", "value": 119228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756819, "uuid": "6f19979a-7c48-4111-9682-a54b1c2901cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756819, "uuid": "99cf026b-71b6-42cb-9204-52574ec31fdc", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6a7ca5-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769617, "uuid": "c66516a2-baa8-41ef-a67f-bba0eddf1be7", "comment": "Malware payload (Mirai)", "value": "27417ee9aa6947658eb440eaaa3d3f84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769617, "uuid": "d5b0a2ba-27df-44ed-a8ae-62d97db23ff0", "comment": "Malware payload (Mirai)", "value": "8fdd4316cd67731a4ce5d940a3c218c0ce0682c491711907e4590d4b596f8bcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769617, "uuid": "3814b28d-f95f-44ca-bf13-1019b0fc5788", "comment": "Malware payload (Mirai)", "value": "68799c71d2ce9ffefb0176462cc984e3437c2977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769617, "uuid": "09012ae2-5b9e-4fa1-8dc1-7e1c72d40181", "comment": "Malware payload (Mirai)", "value": "18940b59cc25edbc829a7a939dc2478b44bba9544676591c8206d51d7cc0a63dfe8eda3dbde923ff2f244341262daf2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769617, "uuid": "65cab987-a434-4eeb-82bb-3086c0dcbb6f", "value": "T106C32AC0F98B81F6C40B88305066F73FDB7198A95123DA9DEF999F72DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769617, "uuid": "74408cb0-50bc-40df-bdd2-ca44808b993d", "value": "3072:6FjlzYNVoZXRgn4c30tItERjnDoBMesWrhK8H5:mYNVoZhkD3OItYzDSw8H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769617, "uuid": "b79315ec-0866-4071-bcf7-b16ab347b30f", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769617, "uuid": "0884f5ae-3cb8-46ee-b863-daf146864de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769617, "uuid": "b353e95e-7874-4d22-9bcb-9a6cbe6f68f4", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf9ed15-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Ngioweb)", "timestamp": 1782742050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742050, "uuid": "80004399-fc90-4191-bb8f-7e0edc5a54ae", "comment": "Malware payload (Ngioweb)", "value": "9e463e008dd331e646a44e3cbe5d5196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742050, "uuid": "1d1df674-ae0c-47b2-9607-d03207d5cea3", "comment": "Malware payload (Ngioweb)", "value": "9008c6360192925325f2e57c29d6593015b5a3ca8dc7a81ad28f513f4436a4f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742050, "uuid": "06c0a1a3-ed69-42e0-a1dc-e92e7fdc5209", "comment": "Malware payload (Ngioweb)", "value": "723551776f3592e1a61953579d20025865a5d1f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742050, "uuid": "8f4b0c0b-5bee-4ee2-b0ea-8e941992639f", "comment": "Malware payload (Ngioweb)", "value": "9d50496f1ceefd4ffbd487dfc85a5b0408b7a84f3e14c9ca1d7e80dde97afe7ee25437f9f86f3671b49d619d53069b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742050, "uuid": "8cd7ff74-bb8f-41bb-81ee-a6816d558730", "value": "T128C3F85DF4508B27C6C0263AF69A424833735B25FFDE370599247F383BE66299E2A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742050, "uuid": "ff3f2024-dbeb-45f6-9c43-e4621b2a4447", "value": "1536:pg3iIcO+qt7Ja0h41O+ovPhvvxyCFTMr5ZPUaTd6dHMMKKu2y3V24TIrUVWOyz+p:pgSIcXi7b+WRx6r3Ue4HIhewWcsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742050, "uuid": "da261240-1d4c-43a0-b4ce-f93a99dd2560", "value": 123528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742050, "uuid": "0c0d15dc-60ec-4266-8901-ad825a6a6900", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742050, "uuid": "bc061880-0fa3-46f0-9862-3dfcb28b50f0", "value": "armv5l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d6aa05-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782713309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713309, "uuid": "463d5439-db2e-46e1-9405-a53990535787", "comment": "Malware payload", "value": "d339a58ae34c3a9f064fb2a339cbfcaf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713309, "uuid": "dc8a0998-529a-40be-96ca-b5c1774acc4f", "comment": "Malware payload", "value": "905a005f42ec2ffbdacac4278d1aeccbd698b9f95919a015c4721680e6b8c2cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713309, "uuid": "943998fd-e390-4e21-889e-d2c3fcdb25da", "comment": "Malware payload", "value": "81df2286ce5a5d0d2ee04e5237068f7694ac9492", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713309, "uuid": "c7e05d24-9e61-4baa-88ca-c670a6f2e556", "comment": "Malware payload", "value": "7933d0d0e6d9f3a89e3bae7d04e439b8eda83d583408258c50fdca7773fc9cf2e00a0a92856c4ec3b88bb0f31b708978", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713309, "uuid": "2efbfd04-38cc-4d87-929b-817c12903afd", "value": "T1E6236C6516853C24AE99C5375C7F2F0CB9A983E6310491DDBFCA3CF28C4AA9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713309, "uuid": "d63721ee-5440-48a3-886e-d70569b1e883", "value": "768:or9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:2HusZlcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713309, "uuid": "cbb97f64-c09a-428a-956c-fc44232bcf2a", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713309, "uuid": "167f21b5-1530-4054-bf3a-471776510368", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713309, "uuid": "d3234b89-6e8d-4752-84d6-d53d8d8179d7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3eb425-73a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782726778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726778, "uuid": "42c960dc-403f-471e-a71b-15f86ff19288", "comment": "Malware payload", "value": "099ff2818b6520f05becc56705aaf527", "object_relation": "md5", "Tag": [ { "name": "176-65-144-133", "colour": "#9A71CB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "selopik-net", "colour": "#12906A", "exportable": true, "hide_tag": false }, { "name": "voenast-net", "colour": "#A61A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726778, "uuid": "57649df5-6b54-4d68-9d04-6e47a1bd4767", "comment": "Malware payload", "value": "90bcee25aad73f57963757573b9ba18bd1562330fca6f705c19d8a79e3f5f74b", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-133", "colour": "#9A71CB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "selopik-net", "colour": "#12906A", "exportable": true, "hide_tag": false }, { "name": "voenast-net", "colour": "#A61A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726778, "uuid": "c92e53c2-f458-4d0a-98f0-817475ce51c6", "comment": "Malware payload", "value": "f9f87a2ac28948f21ec543211030b40dc48a487f", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-133", "colour": "#9A71CB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "selopik-net", "colour": "#12906A", "exportable": true, "hide_tag": false }, { "name": "voenast-net", "colour": "#A61A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726778, "uuid": "f9491db8-44e7-4203-b177-a3a25df757d4", "comment": "Malware payload", "value": "f200227ca7414ec3df2f7f394514ef12398697e22a40732e34a77c79de8981a7ffae74b7069cb465240e8ab38c8519d7", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-133", "colour": "#9A71CB", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "selopik-net", "colour": "#12906A", "exportable": true, "hide_tag": false }, { "name": "voenast-net", "colour": "#A61A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726778, "uuid": "89e10eda-0213-4986-a033-a7565c37ab84", "value": "T1E5129E1EC7C88CC2E0EFF1755A908155C967EAC846D700091AFC62D5BB82EFBA621670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726778, "uuid": "28c9a8de-c76c-4791-8ca2-35068388eaa8", "value": "192:yrF0JMRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+kX:K0MRm/wksuQJ/g6dI+kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782726778, "uuid": "457af6df-6ff6-48dc-9907-4984b84cbd0d", "value": 9041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782726778, "uuid": "e20235af-68cb-4a89-9e44-0eaff144251f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726778, "uuid": "a3565d52-9457-4d8a-8df6-b798aa552d54", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a375c77-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773236, "uuid": "7c906022-f459-4d09-8153-d3df2bf7993f", "comment": "Malware payload (Mirai)", "value": "f36831b2969245308a83b19da70e7964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773236, "uuid": "ea8d2ece-9495-4cbe-871f-9f95225b83ae", "comment": "Malware payload (Mirai)", "value": "916c30b5ea0d508e5bc4cfb91a51e0dc2da256a309eb6f0d9555790852077159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773236, "uuid": "0ead7bea-50c5-4482-a152-afb8e557afc4", "comment": "Malware payload (Mirai)", "value": "a4693daa615853780e4b4d8a3e8b0efb4d1bf493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773236, "uuid": "fe93d841-db49-4328-8e56-99276315a6cc", "comment": "Malware payload (Mirai)", "value": "84a4e190f5131c0d48c94838b864f0fa13a8a5acfc8ecbaa17c99cfccab4311f1f2416be18a81ba0237c48d58ae92664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773236, "uuid": "34d7942a-b325-4e32-a4e0-acfcf5defb87", "value": "T178F2D07E27508BCDCD2DC6BA90FD47E0B3540B96D1434C9FB18B3763686A8563253BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773236, "uuid": "ea109601-3183-47be-891e-766b44d15bd4", "value": "768:NNYKyukZoTMKeIGb+xTJLiEUDiq/zR46zamw5t4Tj52JgGlzDpbuR1J5:HYdWleLylLXUH/vM5tm5iVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773236, "uuid": "8412bbf9-f37e-4a89-953e-f1ae0ceb0d0e", "value": 37060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773236, "uuid": "b94dd054-437e-4f5b-8b1f-645f237b5ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773236, "uuid": "8f12d9ca-a347-432f-abff-5996e468e5e2", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0451d35-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742054, "uuid": "d26a275b-3d9a-4e78-9ffa-aefa6caf56c4", "comment": "Malware payload (Mirai)", "value": "cc8c679b08fa15e0e509ddc4c23b8cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742054, "uuid": "7f1617a3-fb3b-48dd-a79a-43e3c5c2da0f", "comment": "Malware payload (Mirai)", "value": "91c8164c0d9cc58a678c0f4b299aa8c5cc8c3e3991a53b2574548d56a167b000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742054, "uuid": "983d1c60-b100-4913-a22b-50323aef902b", "comment": "Malware payload (Mirai)", "value": "7ac37d19dfb17ffdde7c963df6d1f4719db575f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742054, "uuid": "71ce4f40-ed80-4a1a-a340-284a15554840", "comment": "Malware payload (Mirai)", "value": "dd33c66a983c0f63d63d3fc8c6e59ac775f038d17ebea5a988e708d46a3d18113b1e959ca4d43125d138d434829f2976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742054, "uuid": "e2518d54-f81a-4dd3-ac11-16324ee4c0f5", "value": "T158042942FE511AABC01ECE31461B834A13BDD48A53EB271B617CCA5D7F9A60E5CC7E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742054, "uuid": "7b405608-3852-4461-b718-19d13b4bbc6c", "value": "3072:J2yepmoOWHP7rCby/nlG3ntCbtjAXfy+s6LUb1zqY1sw2nVNXa24E+eWD33fgEvr:J2yepmo9rCW/nQ3IbtjAPy+PLaZpaRiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742054, "uuid": "de04d357-6773-4494-9e45-0439ec808e45", "value": 180320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742054, "uuid": "81556ad1-d509-499b-8039-d813a9af665e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742054, "uuid": "d80354b6-c97f-4edd-b9c9-03f0d540165e", "value": "mipsel.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f844ece-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "1911d7e0-0b2d-4d44-b14a-1cb05024c43c", "comment": "Malware payload (Mirai)", "value": "c217aed4c753b575c8ca1c804ba28487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "0dcbb972-cd96-4342-ab5e-a7d5df1bccd8", "comment": "Malware payload (Mirai)", "value": "935af0fa9a1782969009255431376cb3cc4fe5579ceef16542130abf0656c780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "223f340a-9056-4fde-89d0-48cdce7c27af", "comment": "Malware payload (Mirai)", "value": "b187dfe57ab2df36e49712e731d5a1d4110f7059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "e5841a8d-89c7-4ac2-a3cc-bf0177c739a8", "comment": "Malware payload (Mirai)", "value": "6764699c279dee552260448b51cddfeb35de36012e6e27253593af0268aadd495b9d90fa2b732f451956195f2f6c3bbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "329b5eda-f6d8-4aea-8ecf-1ecd0b7aa353", "value": "T1F9E3E809BF610EFBE89BCC3705F9170628CD555722E97B3AB530D918B64B24F26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "d13b2501-4dd7-4206-b21f-b596b41b4963", "value": "3072:iim0VCGdFX27iLZzvHzCzkBgBu4xIHtWJj4J03:iimJGdFX27iLZbzekMu4xIHtW13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775285, "uuid": "286acf3f-c561-40bd-8d30-7b2f735c5888", "value": 152896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775285, "uuid": "c0430598-35d4-4fcd-ae38-7dc5935f3d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "203989cb-c485-40bc-b513-58fc6ede2d9b", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebac6ff-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775284, "uuid": "50d9ef6d-c946-43d6-be89-a0fa6c86d55e", "comment": "Malware payload (Mirai)", "value": "2008bd0286b1a870bed86b50ae667b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775284, "uuid": "c0611e9e-de29-4188-ad23-08360ab71a06", "comment": "Malware payload (Mirai)", "value": "93635303f7c28602ea37b8ba0a420acffd527c2eea76e4791c79239d4fa4e481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775284, "uuid": "c14e948f-e3ff-4735-a534-a82609ebfcd0", "comment": "Malware payload (Mirai)", "value": "60db9d6f898bbaf8590895052c395431fcbc4e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775284, "uuid": "10611356-0c1c-4bd1-b37e-6f1c8146a5fb", "comment": "Malware payload (Mirai)", "value": "fa2fc3a8d2d804eb428f4cb0f83e7547e453913f60059d222ae2a116e46c6b7a4a5a34a12d8ee3b682e845c493094bdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775284, "uuid": "3700f5f3-7459-4bf5-8717-5cc273d0a20e", "value": "T15823F14D10505EB8DDA790BCC7844B332B6482E79462F9A599CCF9917B0DEA83C077E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775284, "uuid": "727584fc-fde8-446e-a987-5a1797c32abf", "value": "1536:QIbRcl2ehlpmgVm1PcOHdyrETMIY4VJud:nev0gnlrnIbVQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775284, "uuid": "2dc01068-de24-479e-8800-2b3dcd4a3710", "value": 49236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775284, "uuid": "0d621d5e-ba73-448f-ab6f-19381f7ceb09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775284, "uuid": "6487539c-3967-4780-9505-599a4fc8c2fa", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04616308-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737819, "uuid": "302dd71d-1691-4083-90ec-0adcba74d59c", "comment": "Malware payload (Mirai)", "value": "126d04269c574afefdf12ab5401edee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737819, "uuid": "64203442-dc22-4ba3-9da7-b29f3947ba34", "comment": "Malware payload (Mirai)", "value": "936acb9b114d7eb82ee0317efad73c230b0be6259e6e762558dabea7b68c5b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737819, "uuid": "7f71cbfa-fa5f-46db-ae87-fd17208c5463", "comment": "Malware payload (Mirai)", "value": "41ad097c0f90bbff9fcbc2426cba192b02480f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737819, "uuid": "5e44ae29-3dfa-4afb-91fb-591328851d83", "comment": "Malware payload (Mirai)", "value": "dd8c325baf2fa066e78b2f4cb1f7d9deda2eae979e799f940c22c6819c0e10be3a790cc18fd16fbcbeb50622acf09d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737819, "uuid": "80734ac9-cefc-41ff-bf0f-73804d0c2853", "value": "T1E5933A45FD819612C6D1137BFB2E328E372663A4E2DE3203DE256F22338659B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737819, "uuid": "d1a955b0-a177-40c6-b5e7-4423dce115cb", "value": "1536:OLta87G2FrspVaO3wnb8pPRLQ0YeKXffd6bqmv15:Opa87F4bPBpPVQ0+Pk15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737819, "uuid": "9c353370-4d7c-43bf-a72b-0cd8fe12afec", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737819, "uuid": "a6fdb09d-2fb6-402d-a393-d257f2488381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737819, "uuid": "0dd4ff90-8c23-4858-86e3-8f013c01d920", "value": "b944fa8b5c3ef0c253aa0fddc9d9a041c84e5b14efeaef94fd19f5fae76e6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69592a35-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756887, "uuid": "4b411780-3398-4ba7-9acf-b59fd84d5cf4", "comment": "Malware payload (Mirai)", "value": "d0c987a3b219ce6019276c1795f5690f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756887, "uuid": "c3956e89-0b91-4885-8458-35eef2fbb44b", "comment": "Malware payload (Mirai)", "value": "93bfcfabfb04fdd1c5887fd944cd33635d7a61bbb271bd69ae3771e9c58717ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756887, "uuid": "1931efe4-47f2-479c-abea-6598d4c60706", "comment": "Malware payload (Mirai)", "value": "270767c485a82d8a7048ed7e40b12c087b123f71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756887, "uuid": "b92e28a7-889f-497d-9efc-d1358f7cdf57", "comment": "Malware payload (Mirai)", "value": "30f7beaacfd95c76ed6ae9bdff814d86d6a7c3e4d31e60dfab644c2ba7354805f5e07781629f47d0a9b32980c431d42b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756887, "uuid": "ef0ae847-5bbe-4ab4-8c77-a874f320965d", "value": "T1F1A36DE4E243D1F5EC6605392173FF379A72E5BD212CCAC3D3A89A26AC125C1D506B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756887, "uuid": "c983bc15-11cb-4f2c-9f57-230c93b38343", "value": "1536:tIXJSHS9rYxquNvPmGiHdg5wxo4/82a/0QEK/kaLAKR0Rlueruvs5zQ0hscSviHv:wH9rYA4POHJxoU82aH1XRy7EYzsiH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756887, "uuid": "d3d4d325-956c-498c-9ddb-34db5ad3234a", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756887, "uuid": "57bf691e-9603-434a-8eaa-637ad6a7d4ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756887, "uuid": "fc691608-4ae8-41b6-8945-0b22a50e9a90", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950ad783-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "2a0e9e16-1f00-4490-83a2-4b3a4a79b002", "comment": "Malware payload (Mirai)", "value": "aba81d700ac4ef863ccab7b18a79ddeb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "bb89f7cb-41e9-45dd-9981-fa426029daf9", "comment": "Malware payload (Mirai)", "value": "93d8b8ecae2f71494ff55c642236a8cf29b1bef976631ec64345b7dde0fede69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "e5aac202-2e19-4545-9865-70d5c4219ac5", "comment": "Malware payload (Mirai)", "value": "1369f8bdf0998ee0d2318e8ad52bc7c1ae9b785f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765120, "uuid": "d0377dfb-77a1-4791-9b26-3a23e20d94dc", "comment": "Malware payload (Mirai)", "value": "e8057cf16baca277f35009d02771697b98fbc352f2a903dafbdf17fb3e682e22ba63e1ef567dfc9fbc02c43bd793389a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "08219751-d9a6-4f94-a0b7-d2bc73191726", "value": "T1FD24FA47B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "e4f04e8a-dfe0-4cd4-8071-413a21249abc", "value": "6144:w14YsqcDN5Twfl4ZeYalumqQ2gZ9YNJmh0jTP2:w5sN5TalVYalVTZ9gmujT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765120, "uuid": "e0bbb907-65da-401a-8cc0-c71a5fcb210d", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765120, "uuid": "7fbd1fdb-7b84-413f-a287-cd48d585944b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765120, "uuid": "23548fd5-0d17-4dcd-a392-3c92443e1b93", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a5821e-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "86a135f2-368d-4c39-b870-64b3412cfc5a", "comment": "Malware payload (Mirai)", "value": "425d653c5cf5414fe264cc2662e47fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "2310f17d-72a7-4e2c-95d3-53ff0b466738", "comment": "Malware payload (Mirai)", "value": "93dc31f8a3b23b76ff7fee20b9ee24794140968d6b71c1f82bba60e754c59244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "4cb44968-d7cf-4e7c-b9b8-2031e030d7de", "comment": "Malware payload (Mirai)", "value": "cc41ca147fae427b4e7c213ebea5736b67b71725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756818, "uuid": "ac2e1bf4-30ab-4115-9a66-55db1fd91a6a", "comment": "Malware payload (Mirai)", "value": "3c241ec6d13a8622c20b4619ae98e949c6b732b48d26d9c5855d99c1f3893c70d8fdb5dee690bf3d84dfe2cf64450a51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "4bcd08c5-45ba-4159-94a5-4187c2d4cfd2", "value": "T127C33A81F8829722C6D7227AF66E22CE332263E8D3DE71039D255F11378659F0D67B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "bc674293-06e8-489d-a39e-a162e718f013", "value": "1536:JaIL3cTx1UZPCR/eryb5thnDWW3VdMjCtehkLPuyMedhgPUpiuFxxvqHJjM:Ja+3cTkk9Z/f7PuyMoxnqHJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756818, "uuid": "13e95191-6394-4b78-a72e-bd949b284731", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756818, "uuid": "734728c5-5e51-40ae-bafd-5a9c6ffc3529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756818, "uuid": "bf598f12-e68c-423f-86d0-3560c92f2425", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c341bcb-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737833, "uuid": "fcf926c1-f431-49f2-8b5d-d83e668084a0", "comment": "Malware payload (Mirai)", "value": "d90783f2fff5846ae63cc2d2347b5221", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737833, "uuid": "8515016b-8e32-4318-a131-f9b4d8852f97", "comment": "Malware payload (Mirai)", "value": "93f0783eba22cfd00584f1759ef24a9c7bae60e5ed21721c18add059316eaf89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737833, "uuid": "30442f7e-602f-45ed-aab4-35c9b5470b9a", "comment": "Malware payload (Mirai)", "value": "ad5c895632ce9a66dbb687437c6a1030e0786e57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737833, "uuid": "e31fafe8-8170-4fc9-8d97-171801f973a0", "comment": "Malware payload (Mirai)", "value": "5c072b0e6d401b663c8415666efcd2aba2b73daf01147a3791f71fff50a88c57795192e0b810b64160195a43025bc8fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737833, "uuid": "ed916e1a-e76d-4784-b393-4b10be16330f", "value": "T1FCA32946FC814A21C5D512BEFA1E318E331357B8E2DE72229E149F3173866EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737833, "uuid": "4f643ebf-15a5-4026-86dc-07e9f7b8fed8", "value": "1536:wAnky0uiMdiA/5JHa9yiqppEGBEHQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWf6:Qxf+ppEuuik7uaRgp2x/F8ThULf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737833, "uuid": "79a15a62-4492-410d-a6eb-5e22c8b576c4", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737833, "uuid": "6b51cf2e-4c00-4c87-a184-d27995759958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737833, "uuid": "5bed1ac3-97d6-4a1c-87b5-d2dfa352a195", "value": "b0e624722a14ec752e8cb54c97fa44c49a10267f20acfd1be8c828b60bec50b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f184201a-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769571, "uuid": "85c3dfba-889a-4794-bf29-6c91a4f8cb7d", "comment": "Malware payload (Mirai)", "value": "4ceb99adcb0f4dac45989b7d3dbc1837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769571, "uuid": "eefab877-19f4-4cdd-9d91-b983cd790991", "comment": "Malware payload (Mirai)", "value": "93fbe751b61c4d15d5e861d5e1a04b5da1af1daa45801141db35df7a42e58aab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769571, "uuid": "55782b6c-ec2d-482a-b055-69e3ba57b26e", "comment": "Malware payload (Mirai)", "value": "0ef8813a443cb60f41caeabdeaefacc0a7456c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769571, "uuid": "f2e83a1c-7e30-4e27-ae82-e5f83b35bb09", "comment": "Malware payload (Mirai)", "value": "27115f381fc8df149769c9b7aa05e38e1b2ed32e27ba76f76ae8219ff1cfd1d4a4f6613f5855861fc7f071d7ad5bf6da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769571, "uuid": "57464eee-7052-4a23-8693-3536eb4e3449", "value": "T1D933029E70683988CA7CCF3CD0EF5BB48B5250E2B28B67A047366480AB0DAC3765840D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769571, "uuid": "17fd4f65-5952-4cb5-866e-6f319d24b082", "value": "768:34MsSKFz9Q3V71gRjZ6G7wxPiix0RGuoFhrzeSUADgkM4A1NW3xHAycPVSPmMMWi:qFFOh157E81u+0iEkM4xAygumF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769571, "uuid": "cc92d82e-3457-4e11-9da6-a9f788dafdb9", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769571, "uuid": "3176aa0a-9307-4a51-8ab9-fe510c6b7e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769571, "uuid": "04cff4bf-51a5-4f25-b811-44d02b56d353", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fc76ba-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762199, "uuid": "fa707f55-2105-4da0-8f06-695be797c939", "comment": "Malware payload", "value": "e17a38423bed9a8b9345eebb8a858c6e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762199, "uuid": "c4bfbd85-d168-4b34-af66-ce904abf4ce5", "comment": "Malware payload", "value": "97217d3fdfb513ad76571c3b4ffe76b68ca8564af391cc5b206790c9d888a49d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762199, "uuid": "c7c85553-2c55-4521-a262-d228b1efc193", "comment": "Malware payload", "value": "219967bbb9b729b6ff63ad1e0ac972337393053b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762199, "uuid": "20587966-b66e-4b3b-a962-1b235afd3549", "comment": "Malware payload", "value": "e8b891c473c35f0445e128dca9411bd1ab66de7dcf0fab808d0ce5a8dda9b634ed686ed3dbbc846264395e6b35ab42c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762199, "uuid": "28498c0f-38e0-4cf7-81a9-ab54daad68d4", "value": "T15AE2BF15CE00FBF86A9B86761489518F977418660CC8D3EC7B24C5D37FDEA0E908A2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762199, "uuid": "490dd4f1-7f6d-4cfb-a5e3-ac86df315a8f", "value": "768:dfclA3ppVuDbDeZLitg+jXB9oVInThVGQPryJw3WVu96:X5XuzePyLsCTPDyywuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762199, "uuid": "7f4a225e-dec2-42cb-8c01-49c3d3298c77", "value": 34151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762199, "uuid": "8f18a17c-0889-409f-a8b1-73438a87b93f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762199, "uuid": "9625ddff-3505-42d3-8420-f27306621ddf", "value": "eguge.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d03d649-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773267, "uuid": "c557c133-8723-4709-9d6b-b24614dd711c", "comment": "Malware payload (Mirai)", "value": "1b0091ac4b40b3dd644fcc71b60e2d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773267, "uuid": "02bdb7df-dddb-42ed-afc8-a1cfd0f386dc", "comment": "Malware payload (Mirai)", "value": "972d2430ad555fa14785036dfb3e9c9b36704ad9a4e7dc1a8713d03b88f24f66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773267, "uuid": "c5966a3f-1639-4b90-b8ed-2c881d14f374", "comment": "Malware payload (Mirai)", "value": "2d0758d5bb5f2e2c225711f8b1cbe3937de8f5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773267, "uuid": "8ace1a76-d3e8-4037-947e-18d4fbc423ce", "comment": "Malware payload (Mirai)", "value": "5ed44894fbff4849c7328bd47e1a24108c7f73b80006cea288ed4859a5f1b4831df27b881e2204c2c199810ad4b83ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773267, "uuid": "2712a635-0a41-4fa4-b8ed-58a858189082", "value": "T1D8831895B8814B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773267, "uuid": "9e45aa91-435a-4490-b5fb-d475aa69ec8e", "value": "1536:ijna/CzPC7fG7rnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0km+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773267, "uuid": "971b1588-c206-4550-a68f-daa5d9fdfa13", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773267, "uuid": "d815e43c-9f16-4a75-ac82-24c07821246c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773267, "uuid": "c87ac516-9995-4656-8d31-b6627826464b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db29e2e1-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782721429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721429, "uuid": "fb024a59-fbe1-4642-8386-45411cd4d7f7", "comment": "Malware payload (PhantomStealer)", "value": "775704e46b2df70f64ef8460c3b76420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721429, "uuid": "6467821e-5c72-4dc6-ad8a-7a04e64f4f11", "comment": "Malware payload (PhantomStealer)", "value": "97babf53de145c94135dc03064b261805e7c481466d42314e332156375a14053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721429, "uuid": "171494ce-c839-4471-b53c-b88fc2024e75", "comment": "Malware payload (PhantomStealer)", "value": "51eeadb596bc57ac0cd08fb1f33667026d36c74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721429, "uuid": "7a82064a-0d85-440b-be4c-69c8e432129f", "comment": "Malware payload (PhantomStealer)", "value": "7d12df58184d6364acf5f6c870c435ca035fb85b88d272e1741bcb34257554ccc16fa017a8800685690f5b11528b1437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721429, "uuid": "51d7640c-2549-467a-8e6b-a61e6a789a84", "value": "T1F97512943289DD05E4A91BB04CB1E6B423707D59A421D30F1EFABEFFB9727011866B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721429, "uuid": "6330a7a5-a184-4b88-ac84-d117634e4720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721429, "uuid": "89302884-51b4-4f7c-adda-dd12268022ed", "value": "24576:kmx3hytuenQMJuD6r81e2K2uy9Pq3mEjEHTHoYUvn0T7l3MveEu47Vr6Ryx:8unD6rMjJX9CWNTyvQSve27h6Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721429, "uuid": "e6da4014-1cb3-4693-8cc6-ab551e89c745", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721429, "uuid": "617e7d67-6987-463a-833b-01ac0a0fd81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721429, "uuid": "123cbc61-d73b-4d36-800f-ecf05964a091", "value": "W22sUD5g9u7clC5.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b34746c-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737965, "uuid": "c506bf5d-98a8-4266-9edc-94a03b8ad180", "comment": "Malware payload", "value": "a2641a06709463792d428efbe5e40f9f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737965, "uuid": "2af66500-c73a-41c3-ae8c-28abb1d4615a", "comment": "Malware payload", "value": "9829ae34ad8fc7621c7907dfc217992b84e2078c3a162730f3dd63ba8919dcbb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737965, "uuid": "57d99d6b-1c0e-4c5e-a595-50eca459aa51", "comment": "Malware payload", "value": "297c8adba5064c5877c6f048c02875056d8b9b7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737965, "uuid": "260eb30b-3e71-47b0-80c8-144adc268f99", "comment": "Malware payload", "value": "ea23de05551a6ebe5f818730abc270e62a7e62164aaedc2550e9e2c30e1536989f425f2ae94b3ff538b43638dd4050ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737965, "uuid": "1c1b4db5-4187-428b-9a0c-1a06bb1eee4c", "value": "T1C5D02EA2612302B880A20828F4E265A0B104CB7E9DA8C16CB40712E02E0431AB0903A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737965, "uuid": "3b540697-6d72-4eaa-9c61-faa0cc0ae509", "value": "6:hT4NTnGuLw5oZjw3/xwqwcBAulNXYq4HvXDG+NjVsNXYrkJ:VhGw5TwcBPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737965, "uuid": "463f4217-5f30-46c8-b254-56a890b376a8", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737965, "uuid": "3dcbb56a-da85-4afa-b64a-604ef8452b95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737965, "uuid": "cee5a362-31e1-45a0-9b79-1d4793501465", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045e56f2-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782755429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755429, "uuid": "b9c93101-4f1f-4270-bf27-5c1fbd2d7435", "comment": "Malware payload", "value": "bb9c1ef745bd3d13596a2ca80a21f82e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755429, "uuid": "372dbb65-156e-4286-8c07-99f8be7ee92e", "comment": "Malware payload", "value": "982d450543f24502d82f444a7381b7d0aed3594b14f5b30b0bbe4a0a1a7e720c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755429, "uuid": "8d6cdca4-2b61-4557-9878-8fcb1d098afd", "comment": "Malware payload", "value": "8af6f22cb10314e9a07448f9667957f9bb86c315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755429, "uuid": "029f92d4-9f48-47c5-95a9-8444999b3bad", "comment": "Malware payload", "value": "eb6cb9c7687618f0861fc5571dbed045aab462c015f660e4653b366f6af78aec65dbee0906a0d7802372ba62900e6589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755429, "uuid": "c63fc0ec-6054-4b60-9f86-2a0711e46691", "value": "T16D048D89B74DEB07C09093FB9D5F0623633138427B4A97627919721AFDE23DC9C1635A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755429, "uuid": "8621d75d-615d-42db-8f42-9c303975e095", "value": "3072:gOP7ircTSP7PeXEacVOGGCKBf6GgCtQWu+/z/v2fi4N:gW7ircTSP7Vf9KBLg8QWuI7+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755429, "uuid": "237c1893-7062-4188-8dfe-9b61948922dd", "value": 174728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755429, "uuid": "a1447b24-119c-4440-9d24-e091eb380851", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755429, "uuid": "f6edf903-59f8-4af4-95a8-ffe6a1795e26", "value": "SecuriteInfo.com.ELF.Agent-EJE.51434424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacbedf9-73a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782730019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730019, "uuid": "5fd832f4-a9de-4a6c-8ee9-1bca44e54765", "comment": "Malware payload", "value": "f9fe1334239c8ac9c045cf659510b935", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlagueStealer", "colour": "#200ED0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730019, "uuid": "ed4ae6ab-6d6e-4e0e-9a80-d028eebd63a0", "comment": "Malware payload", "value": "98deb55f79b2253dd522fe63a144be8749752eeb3c367df1f28a325668e3c64b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlagueStealer", "colour": "#200ED0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730019, "uuid": "5a462280-a99a-495a-82ce-0f8fd794596e", "comment": "Malware payload", "value": "06d09bfb5cee3db9d12eb1848c1ce0ef3da3fa75", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlagueStealer", "colour": "#200ED0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730019, "uuid": "28e93e9b-56cc-45a7-9619-be353bd9a671", "comment": "Malware payload", "value": "080f903c7b482a36d11c972902427d97e121518d76b499bdfe602cd58cb61dab28862e1369f2a216bca20f11023ecf8b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlagueStealer", "colour": "#200ED0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730019, "uuid": "858e62f2-ec07-48d9-be5b-a3c80b5731c9", "value": "T1270833B3251C4343E152217D12C6FD3953B01DDAF75083BA9F8646E8EB84A1D71BAE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730019, "uuid": "3998661f-29f9-4a46-b588-9faa040913f5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730019, "uuid": "ceab2997-a1a8-47d3-8316-e77e3b53b931", "value": "1572864:0tLozQw/a31gaNSl7fqWcoMnQxZEgnccPsDccRvz7:0ZorC3mNbq53QLFncFl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730019, "uuid": "0e68855f-4f8a-4a48-93be-a1857ab0d7dd", "value": 78541391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730019, "uuid": "340174ab-4ea6-451a-98f3-e27888649fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730019, "uuid": "27a89a6d-5312-4a6d-b39f-c5bf5a130833", "value": "EarlyPatcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7eade4b-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760428, "uuid": "3da470a2-6a01-4438-bf55-6ac58f265244", "comment": "Malware payload (Mirai)", "value": "7d34375c91392a8decc9554b86390f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760428, "uuid": "175a39d2-3495-48d9-98d2-5c820d10f9ab", "comment": "Malware payload (Mirai)", "value": "992b5b712e893fd8ae91a1e928c5ee60bc129d789d32e31cc070adef0e360d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760428, "uuid": "f3f12f61-86a5-4a8d-a30d-481df888e56f", "comment": "Malware payload (Mirai)", "value": "2e435ac91cf9141c7f50613b1daf9493ca93e764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760428, "uuid": "be681f8e-ecda-418d-a85b-0a8d6b5aeda3", "comment": "Malware payload (Mirai)", "value": "b02e2565822f8bdb0a04416b9e7efbddd9af9f077a3b495c5cf990d9f2c8f3cad549fe55d5ffa680ee3b6861531a94ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760428, "uuid": "10f69c4c-59ee-4b31-abfc-c6981730c031", "value": "T199C33A81F8C28A62D6D723BAFA6E128E332263E4D3DE7103DE256F11378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760428, "uuid": "8dc1f3c0-e6b1-4aaa-96d0-06304d69d202", "value": "1536:a7wCsAH3EkMW29wxhAH1BflYHfrewLpAd6KsbkFZlq3QJX6s0K598vom:a0C/3ED9/qLp3EZl3J6Tom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760428, "uuid": "5f218bcc-dc82-4f5a-9ab6-5e00b8af9f07", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760428, "uuid": "a34fdddc-666f-44a6-b3b8-9260c974553c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760428, "uuid": "ed3e9fc3-607a-4925-a8d9-c41629dc8704", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660d7878-73e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782757311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757311, "uuid": "5d194e2a-a53d-4975-a9b3-6a45b5a87fd5", "comment": "Malware payload (SalatStealer)", "value": "7f79817eb5e3579ce8957a42c31c65fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757311, "uuid": "8b6229b5-276f-42ff-8f7e-4f9d106a16c2", "comment": "Malware payload (SalatStealer)", "value": "9977df7ffd04173d38e0aefe3d028052e164aaa69c1facfe63af55b473dd9e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757311, "uuid": "204ed184-4831-4de2-b0bb-3e64950cda07", "comment": "Malware payload (SalatStealer)", "value": "1ceb390d2b85599cc738bfadcdddceaa01083940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757311, "uuid": "796c77fb-0882-45da-9959-af60be207c8b", "comment": "Malware payload (SalatStealer)", "value": "98172029cbcf2b8075a40522fcfc3067d284e528917cbfff43fc353f724e4042e557b1f95cc5b47bca5714f6b6e31eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757311, "uuid": "52705452-36d3-4b02-ad39-d314b79b4006", "value": "T132C66B11FADB95F2E903183141ABB37F23315D048B28CB9BEB547B2AF8776A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757311, "uuid": "4893b012-4f18-43b6-9322-d4b53ad15c03", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757311, "uuid": "cbecacfc-8cbd-48ab-a5f7-d83822487833", "value": "98304:3pKy/jOLjWCkgGNkwa6XPW4L3HxmpESO/:j/AEggDa4usTSO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782757311, "uuid": "b555853d-b25d-4b0a-9a07-cb3a88fc28e7", "value": 12573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782757311, "uuid": "0c3eec72-e13d-4134-882d-d9dff94a0940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757311, "uuid": "7d85baee-76aa-489a-ae2a-0dfd7d627161", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f0a68e-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770672, "uuid": "d661557c-0cac-47b2-a07c-8602530eb157", "comment": "Malware payload (Mirai)", "value": "53f6e757c51162ef64abbf6771f17306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770672, "uuid": "6ae83e41-5709-4930-9385-f90d1600f9a7", "comment": "Malware payload (Mirai)", "value": "99a5a14183cbc57a8d72fd7f3470aa874e046488482c8b75a5cef228ffb24314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770672, "uuid": "56ffafd5-9d8c-4792-8a0a-715fb7db593d", "comment": "Malware payload (Mirai)", "value": "8b4b20f72d3e92fdf412b8a35a8b340193187430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770672, "uuid": "474f7a0b-44fe-4b11-a7a9-646b7d1abd16", "comment": "Malware payload (Mirai)", "value": "e87bcac1d277ce8125dfb11dde8774932b19fbd59631d0413ab4b75195ff9646246102a128bff7b33a5b7fedee6424f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770672, "uuid": "5f7bb6e6-ed8f-4e4d-9f33-39c93e08a5d5", "value": "T1EDB35D22B9751E2BC4D4A8BA61F74365F1F2578A21ECC51E3D710E8EEF242503257BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770672, "uuid": "a75fa58a-98c2-474a-8b5e-a09fcb28b432", "value": "1536:X1/ik8A0iX/SSqcYI88KrNUv4oOaOHykDfZAXQChShIy6LIzifWL2Y9t9fDNWq5H:XhjoNUAo8JHR3OU9PfDNlCDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770672, "uuid": "8e4fed7a-1652-4017-bdc8-0a72892c9644", "value": 112636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770672, "uuid": "66c4584f-c7fa-49dc-b048-0c9b7ead7109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770672, "uuid": "9ea0959f-bbcc-4200-91b4-4a75b3098657", "value": "nerv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ac573f-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782736203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736203, "uuid": "728ed97f-9c09-40c2-9ce0-1820ff0b670d", "comment": "Malware payload", "value": "298d83f72d7d9d42650db6582eba9295", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736203, "uuid": "ee92463d-6c8f-4ed9-9648-5412041de67a", "comment": "Malware payload", "value": "9a1f56ab6819f79431bbe96f4a7b3ea8b565ef5680f4c46f44a57782f609a73d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736203, "uuid": "59eae579-1109-46a9-8fd7-f267be14e598", "comment": "Malware payload", "value": "453e10e312e20000ec1c47d496c39f07a870286a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736203, "uuid": "c40e0500-01d9-44a7-977e-586f7aa5bedd", "comment": "Malware payload", "value": "2d59fb0c1e75d66f6328c62a1aa1939aea153f4bd99115e62cea130238c9b33a6ed338af3aedc73ceb3ed091aca944aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736203, "uuid": "df4b044a-91b4-41d9-8ae5-20d01aaaaec5", "value": "T147D02EA3807312381062852AE3C3A884B5498B3E8842C409BE0B28204E1034AF0C0A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736203, "uuid": "7620441b-feee-46a1-b55d-91e514a2916d", "value": "6:hTQkr/fETvfHZSAulNXYq9DG+NjVsNXYrkJ:VQh7hSPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736203, "uuid": "472ad6b0-52ab-45ef-a318-0cb1fede34d7", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736203, "uuid": "71645796-b8ad-426f-95a1-296b8a48d7fd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736203, "uuid": "9beeb5ec-7c0a-4eb0-b90d-7fe4103d5f57", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a589a7f1-738d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718763, "uuid": "5b71ae0e-b0d4-416d-8e44-9bb93a478fe0", "comment": "Malware payload (Mirai)", "value": "18ada4280a45fa7b8bd72b2508a013c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718763, "uuid": "1d965dd2-220c-4448-a402-393098161a8d", "comment": "Malware payload (Mirai)", "value": "9a5a433ed802e7ebe2206b77b3317601b713cb2fe625c7e6fb8d73092b6c6b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718763, "uuid": "b1d01f12-5fca-4034-bed8-354650567a01", "comment": "Malware payload (Mirai)", "value": "a42e6c90122c6584a381f39f3bf13c5aab835765", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718763, "uuid": "43cd30ae-f7a7-40e4-82dd-b4e76532f3c1", "comment": "Malware payload (Mirai)", "value": "08868e85943d008d9ee5a6d9d2b3026bed158e286d313cdd52f9277b9ba7c4a709eba0e8416d0b78b2bb2261a64f3fec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718763, "uuid": "7ac26112-d7e5-41bb-abfc-11d6325006a2", "value": "T15AC3180FAB2C0B47C5A75AF03E3727E4879DEA6510E452C1A41AFEC147728F62126FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718763, "uuid": "7d7d6569-c77f-4211-9261-bf07f2351bcc", "value": "3072:n44gYZINCG+GmCbSvr49ghMkhrNmhuP0hl45h8p/pc:n4mCiWgFtNmc0hl45hic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718763, "uuid": "c083ba72-95b6-4283-afc8-589bfb841c25", "value": 120292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718763, "uuid": "86ed3125-6759-4265-813a-e0fd37190bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718763, "uuid": "d3c2a52b-d330-4113-bfef-daa353ef43df", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dcf34d-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782736312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736312, "uuid": "292fa48e-8627-4d2e-9f7f-8e522b31202b", "comment": "Malware payload", "value": "5b4ebfbde2b178008861d44cccff8a98", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736312, "uuid": "1fd650bc-1bc5-4dab-9ab2-7538ddda6d68", "comment": "Malware payload", "value": "9c5ccde7c7def1a5e1d416cdeb0ae21945f236828f68298b27964de0c366a0e2", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736312, "uuid": "833f2881-2403-4d0a-ac89-b1b0f919f830", "comment": "Malware payload", "value": "e38e99934c62e6066075d8c21c4894e97dcc714a", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736312, "uuid": "068fe474-add2-4bfc-8f98-ecc0a3767767", "comment": "Malware payload", "value": "033590de263010767fec4a5edd27cdc66647a70d4ec8f08c3968ba8f517b831180d81a7dbe79eb44453e829eba9544dd", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736312, "uuid": "d338eaa1-3751-47f8-bb05-494f24b2bfdb", "value": "T152F72356E2F900E8D5BAC0BCC5975627E7B2345513349BEF52A48A652F33BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736312, "uuid": "428cb181-8acb-4d4c-ac9c-8f479a39b02f", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736312, "uuid": "107f8e4a-2266-4cb3-8803-a8eca63ae8f3", "value": "1572864:L/xBXaNZ5EMSA1MG3YfjfT112gGZSZj7k54mgTfl4qlXs:rxBXWU2M+qu0P83cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736312, "uuid": "b39d063f-666e-412b-9a06-131496379419", "value": 71957176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736312, "uuid": "e9a27385-290b-49ff-8d51-54d966f8d291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736312, "uuid": "8470393b-6188-4546-813a-fef602e24c36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a07590-73a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782729948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782729948, "uuid": "181cdd7c-63f0-47fa-969c-7187a1500ae5", "comment": "Malware payload (Formbook)", "value": "aa617f59f7ef48304b1252ad5fb524ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782729948, "uuid": "7b4c58d2-20a2-42a5-aca1-c7bd177e0149", "comment": "Malware payload (Formbook)", "value": "9c7758f625e29eded8d00d62b2733c5df80a1eaa94761dc118a9c99f4db1c949", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782729948, "uuid": "1e4b2cc8-169f-464c-8762-7614621c1e47", "comment": "Malware payload (Formbook)", "value": "6fa41db794509eb65fd6dce4fec52705b1883cdb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782729948, "uuid": "67e492d8-8871-495e-aebe-f8e0d1159640", "comment": "Malware payload (Formbook)", "value": "acacc59e5ef5d3e949e47036f20b9077e985a90895b827ee0b5b968aa71935bfe389f1bfdcc0d85f8d893442b3b8a504", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782729948, "uuid": "f2e7b8f6-146a-4268-b2c5-78ccd3b38e30", "value": "T1D993FF852AA0E84C03E34F7B362FB0E5F4FB0CD76D98895BD614F8E0A1A5216DED1674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782729948, "uuid": "51933ccc-c96c-4ef0-915b-3c3ada7de4a5", "value": "768:4cIqABoFu6V3P3ZXhUJ8U6ppSSNgzgRvPnebq9fSFFHrtwLHYT3wofJv5mhPD/ju:4XBQj8Yb4VTuLPZMzowGhp/BE3+Ssu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782729948, "uuid": "bc3636a1-872e-47c3-9849-8db99cb956a5", "value": 89380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782729948, "uuid": "b8d0c020-66a0-4c77-addf-dc948f4a82ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782729948, "uuid": "c3e694be-cad0-4558-ab29-62038a8c2efc", "value": "VN0021100055_2026-06-29_0710AM_15sec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79524d8-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782769983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769983, "uuid": "26738f92-2bbf-431b-b56c-7accae4674a4", "comment": "Malware payload", "value": "f175b094625c7ead54f1b245b52f725d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769983, "uuid": "62e16f90-ad72-41b9-b440-6705319bc7b7", "comment": "Malware payload", "value": "9ccc39a1773dd571dcbfcaefec9918a3ede8c8bd216cfe523a28965bb8b48b09", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769983, "uuid": "88d2a032-e6d5-4573-9267-32b21eaa8d79", "comment": "Malware payload", "value": "342b056b3f745bcc7a09e316c3dc91583bd559b1", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769983, "uuid": "5cf8d7bf-3c03-4a2d-9a1f-fed256cb2d3a", "comment": "Malware payload", "value": "8b57b5723469a7de9dca99ae11aea7682d1040798c16f6b85f8f4107768ffcb9bf80d8f732a13a1bd9e849eb2117889e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769983, "uuid": "e4a33394-1e31-44ed-9faf-725470b264e8", "value": "T1BE93CF0BED012AD7FD48C6BF85405621AF66EB362368AFE3069344228E64FE1BC755D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769983, "uuid": "eafebc7f-1162-49df-9e95-d91c047a854f", "value": "99ff3fcee501070e0d13525d08370367", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769983, "uuid": "a590b271-854e-43c6-a2b6-8a2ae218a0fc", "value": "1536:FkBWSqT8eUbYRPnusFvDGX1JN/tAQwqms+ZfOy3smyjENYw4:TSqDgouEDwVtAQOOy3sQNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769983, "uuid": "d1b02867-c51a-4bc1-adf8-db6aab62576c", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769983, "uuid": "d8899fdf-6fea-41fc-9a0e-24f9d9212a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769983, "uuid": "45db5655-0faa-484b-a32a-c3dacef8c93e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7becfe-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756816, "uuid": "a5a71dac-7fd1-47f1-a8c2-41e56e820c93", "comment": "Malware payload (Mirai)", "value": "db49c05864bd94908f8998741bd05b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756816, "uuid": "2f1598f7-de60-496b-aa77-3ecd137b5804", "comment": "Malware payload (Mirai)", "value": "9d454938ee0fafa025eead878acdcfda46054600bc32a6523e81620e22a1718c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756816, "uuid": "ac2cbac4-997a-499c-9f36-06f546fe1ec8", "comment": "Malware payload (Mirai)", "value": "a915fba40357e62f25081f6c5b153c30fa214ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756816, "uuid": "e15e020b-341a-4022-a88f-5553e4638160", "comment": "Malware payload (Mirai)", "value": "26e7d79638989564826dfb187b0c6fcaee527b3a432f5f7ba9dbc0f49e1f14d75c8dc94b1c5ffa23d1d488ef79edb3df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756816, "uuid": "7fb94550-dd7d-4d6c-ad29-ee04be93f4f5", "value": "T1DF33F2A3B3255D91CAF16AF3D87C0C40E5D5B7E170AFF0767249400AB56336F279528A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756816, "uuid": "e0c7dbb5-e77a-4844-b3e3-253ca07dda5d", "value": "1536:q6OM456mPl2w9l4hN2YxfIDVZyjaXih90L1ghqqECQLJ:Yl56al2w9SLqu9M1gCCQLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756816, "uuid": "12cb5f3b-9a54-4fd5-a56c-b6a556a2a8d7", "value": 50188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756816, "uuid": "9f842afd-e82e-4caa-9869-3f6e78199b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756816, "uuid": "3b5ab680-b1a7-461f-a74c-031f9386a6b6", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3cb52d-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769620, "uuid": "4eca68a8-728b-4a04-9abd-336291a092e5", "comment": "Malware payload (Mirai)", "value": "75febd29890a7237158273fa5356bc69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769620, "uuid": "ca9301a8-ef45-441f-8036-656eafabff9e", "comment": "Malware payload (Mirai)", "value": "9df07e7c4d8ee93f92541c4ac5758a6734582c9e7da72031fec87c10e79be443", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769620, "uuid": "3256648e-fa43-4e7d-b97e-a7e31a1bbc65", "comment": "Malware payload (Mirai)", "value": "b5446e1fb2e645e3ea70d9232f2d0bf672bbad96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769620, "uuid": "24bf0801-28bf-43d3-8393-f19954161c78", "comment": "Malware payload (Mirai)", "value": "8fc2a44efc1ebfcc6716c7612c1a995b0f071d6dae8f5e53fd4c7fb737a25dd85fb57fef1dff753cbf288bda6a3e75cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769620, "uuid": "ac3cade3-3366-4dcc-ba41-20febb355f16", "value": "T197E3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769620, "uuid": "54818cdd-3e0a-473b-b8a1-ef2202a479ff", "value": "3072:ZhdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mYQrN:ndK+SE7ktsNOT8wR41M7qlkoKrMh8XQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769620, "uuid": "7dc04938-9b2f-48d7-b554-75f5c6b4351d", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769620, "uuid": "8b2d484f-d034-4645-aca3-85c47513ae7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769620, "uuid": "f7691a57-03fa-4500-a835-6431c5a726d9", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb20e911-7386-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782715900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715900, "uuid": "2f3e2998-4b8d-47a8-b71b-b583122766f1", "comment": "Malware payload (Formbook)", "value": "0413b542e0085c14944fb1940998d42d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715900, "uuid": "ff15446a-2231-4b1b-bed6-556df62d8342", "comment": "Malware payload (Formbook)", "value": "9df8e2bc11d551969955a0f2a146aff099851b46acc942e7dec0608bf8a39b65", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715900, "uuid": "a484fab6-5354-4bf8-b251-65ed40fcba1f", "comment": "Malware payload (Formbook)", "value": "927b5eaec6786e160bc1f55e52be53ed45053517", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715900, "uuid": "2bedb743-08aa-4ca2-a9f4-9aa20d80639e", "comment": "Malware payload (Formbook)", "value": "df3905d7da58b210019fdf08a394678ffde304d7ca14c82174edde62e31a844ad6e5d016a6fc7cbccd2ab79e24a0a06f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715900, "uuid": "b0fca49c-7866-41bd-a462-0402597939c0", "value": "T1F41413329796BE6D59CD03A092F6EDCB1709D1633BD3E9CEE02E9E810F56C85B1D2410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715900, "uuid": "ff958d9b-5840-4237-bd2f-fcee57cad4a9", "value": "3072:YuEKsQqeoqjqBSGFNa7i991il5Ee3Xbm5ctiLN9dDWNQJvOwVpbX3eSaowNtPs:Yu5hqgqT91ilqenectiLN9dDWytOYLX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782715900, "uuid": "422f0a0b-1303-48c3-8572-bf7c7b70bf8a", "value": 190599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782715900, "uuid": "93577ac0-dbbd-485d-a219-909f83eb9494", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715900, "uuid": "7faf02f6-438c-4298-a66c-83b6c7058762", "value": "PROFORMA_PDF_REVISED97475.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013057f0-73a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782727077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782727077, "uuid": "c8908de1-93a7-44a6-92ce-3dd3dd60bc1d", "comment": "Malware payload (AgentTesla)", "value": "37b192e9544aa3ace65ce18152f0cf76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782727077, "uuid": "5a708170-15bd-41c4-a8f5-ad416e72ce66", "comment": "Malware payload (AgentTesla)", "value": "9e778b6507ceb6cc34b2c8a2ed32ebe844152f36fab8ec247c1e4f85dc600b28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782727077, "uuid": "42547684-6581-4b02-b6f7-1bd87405167c", "comment": "Malware payload (AgentTesla)", "value": "6af027554147bf11031a0a9081a76942c98dac14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782727077, "uuid": "708bc893-b2b4-49bd-9a56-9cdea0b65f04", "comment": "Malware payload (AgentTesla)", "value": "1f15ca11c5159d4e517f98d959c82fe1e02559b421e32d33ebca674a04d732e1f6b9c749a3500d13fd334095f1f79430", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782727077, "uuid": "c0a9d2d6-0a36-4661-9d40-b61556679b77", "value": "T1AAC4F151B706D122DC1729B49623E6D28913BC798EA1C873B1DAFB1F36374E25C3136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782727077, "uuid": "a8d5c630-c34a-49e5-be4e-9ba3aa62ea96", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782727077, "uuid": "839ec165-5642-440f-bf59-3cbc3499a2dd", "value": "6144:LT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6ZmigpiB0e+QUDeADNRcJqOMzDzk4:LTsAXF28crKGbJZm1pVe+FR3A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782727077, "uuid": "2ffd0617-9500-4d75-938f-7eb30e172059", "value": 548552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782727077, "uuid": "373033b0-4e07-4fa8-b9dd-b5bc116a3e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782727077, "uuid": "e282b8bd-efb7-4fa6-85fb-51869b7619af", "value": "SecuriteInfo.com.FileRepMalware.35189119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab6b9f3-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698612, "uuid": "9f9eec39-dc68-407f-9012-7c21a693d722", "comment": "Malware payload", "value": "4ba2a61b47367a1cd41a6a9f04e75f23", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698612, "uuid": "b663204d-87f5-4bea-a5ca-dd72bc62e340", "comment": "Malware payload", "value": "9ee4249165fad3d43566d804784f67efbf4f38c51593377ee61158fb957cf71d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698612, "uuid": "15cf64cc-3a9e-4239-b192-75a4849d9f13", "comment": "Malware payload", "value": "56b924c1a3fde7ca884b3cf57c262bef30b4dbc6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698612, "uuid": "34bb24e6-3fe1-46bb-8f20-74a198e8f919", "comment": "Malware payload", "value": "29ec3a97aecfa851722c17c56b4f2c2a88ba3a2fe5e8cf506fc87eec77051d5ab79f04ece3b362d3649031ed1a1524ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698612, "uuid": "03e86833-75d9-4222-8c16-4655e7cadc15", "value": "T10EE29DC77220AE794B609185F7B10DE1E4D9F64205E3A1CC738426AFA69EF3935F6831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698612, "uuid": "20aad5a8-b906-4b46-8501-27430bb108c8", "value": "768:wGDE4Z0eCpAsgwBExKv0B6urbPVQibJI29VXhOixqQRS7N7Nanut7btpMNF0tb:wGjsAs1exKvENtQD29VRhqQNYbM7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698612, "uuid": "774c9b4b-3321-405a-91d8-2043b6be6e87", "value": 33426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698612, "uuid": "37b1672d-899f-45a5-ad22-cd6b11289c51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698612, "uuid": "d52049dc-76e3-4992-99d7-633560bc49c6", "value": "ufino.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02245bea-738c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782718059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718059, "uuid": "84db7210-12e7-4e22-a439-3dac3698ac04", "comment": "Malware payload (Mirai)", "value": "f04a5b951e8c21b7f733a87a434cf81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718059, "uuid": "be8b587c-9b80-407d-99ab-52bc23335f2b", "comment": "Malware payload (Mirai)", "value": "9f0b37e9febf6a6623c12c18bd1ac934de0e30459b06bc6ecaedbca722ed9e8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718059, "uuid": "eb6734f4-82ed-460f-89ad-960f293ecfac", "comment": "Malware payload (Mirai)", "value": "94e7f703327521d09eb936c7a7542f3cc5a2cee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718059, "uuid": "a88c08ed-72ce-43ff-ad28-2dac5566edee", "comment": "Malware payload (Mirai)", "value": "40b7783526fc709a070d7487b0e19c30d1a7bf8ba2a97786b8ea29ada936332b10598a5a7873f4ba494eff666685fc55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718059, "uuid": "c1fe4d30-3f61-4f29-96c0-7da25a4a12b0", "value": "T14403E120DBE69282DDB9C03760FF65254809C5295374E0FFED8820BA2C15B707E3B6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718059, "uuid": "b53f9fe9-81c9-4ed8-9736-fed01aff7955", "value": "768:d2HJeRRzOfGyM21+G/dz7/iKHK91OYIJbRWILSWleABx2zqnbcuyD7UHQRjH:YCRzGGyDAGF/rqLOY7oSWwCMqnouy8HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718059, "uuid": "92f0f509-9781-4d75-af9b-fbf776edb880", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718059, "uuid": "616839c2-3024-4f75-8795-4c184cb47a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718059, "uuid": "e34e5519-b9bd-43d7-b4d9-27751ffae7a1", "value": "9f0b37e9febf6a6623c12c18bd1ac934de0e30459b06bc6ecaedbca722ed9e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a2fa9-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760477, "uuid": "b35fa833-005b-4b17-a89d-2594a7f849c7", "comment": "Malware payload (Mirai)", "value": "2b8ca1e41edc752d1acb1971aa31b3f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760477, "uuid": "2e4c59c0-1193-4c0b-93c2-30dabac0d499", "comment": "Malware payload (Mirai)", "value": "9fca2983be54d38cc4a9c5cf4ef898103378ccf5453b898525cd5ab17b8ccc06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760477, "uuid": "5d64c73f-a866-43e4-babe-f8dfd4802aa7", "comment": "Malware payload (Mirai)", "value": "1fc45d1411cd4a4497138944b18b116e84cccc70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760477, "uuid": "9b5a6ac6-4bc7-4fce-8944-58afe22f3471", "comment": "Malware payload (Mirai)", "value": "aabcdb3ad78d3fbb6a6a76a52ae4bfcbd1d4752e6b4822d52dc038d6b334e66596d81289d56f601d49f89e90e5a9c279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760477, "uuid": "c1fcce36-665b-4aa4-9711-e5acbfb5f4ac", "value": "T18CB36DD9F643D0F9DC5705302176FB37AE72E8BA2328DA83D3E89A327C11641D456A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760477, "uuid": "61250a7b-6265-4553-af39-860feb334340", "value": "3072:GkUEooY+GDO8hUdTYTOAyWmRsQz5CLBT:GkUEooTGqJy3Qz5CLBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760477, "uuid": "268c1d1d-160c-4654-9313-414dbe527a2f", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760477, "uuid": "68400d75-ca9d-4b60-8276-a73101ca789a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760477, "uuid": "37966108-deb7-46b9-8cb5-319f10a27a7f", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640c1604-737a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782710492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710492, "uuid": "fd51344c-0370-447c-9a1b-8268500f21fe", "comment": "Malware payload", "value": "687088189f01ed5178c6a0a045b5d2c8", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710492, "uuid": "f8d2ac8b-aa43-42ec-b728-221b38120ac2", "comment": "Malware payload", "value": "a01f7e7b9c350c1fc10e5b49d84cb9fe6cd5c8e816c78c0b7b391b7fa1dd308e", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710492, "uuid": "a3578c29-f533-448f-a2a9-56d47865164f", "comment": "Malware payload", "value": "14f8daa7413ab09c8d77c02e9f0737534ccbc36d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710492, "uuid": "6e12f4a2-ecce-4eec-875e-d2053024eb51", "comment": "Malware payload", "value": "037a01487f0ef0329b3c134117d03eee50e6a9fff5f469ecf37e8be20ac7c172bb45d729e0043e1b6cd41345ed974fdf", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710492, "uuid": "caeb7875-55b2-4b4b-b51f-dab4336d08f3", "value": "T1A4C34B731B981826FD98657416CFB3679E33F2C86FE3011B2142C4E12F12F79662A99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710492, "uuid": "8da4ed98-fcc5-4fb9-b227-6d586ace6cd2", "value": "384:VGhElsLYoCN+8LpEIrdZ7rNab8erPLkzosRnhoCN+8LpUrdZ7rNab8erPm:EMF08Hab8covF08FEab8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782710492, "uuid": "91a9c766-1034-4cc0-a87f-2913c9b3e06d", "value": 119568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782710492, "uuid": "0b1b0b28-376d-4ac0-91e6-c5ed4c0018ee", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710492, "uuid": "61a586ea-9147-4c3f-bb52-525b322cc499", "value": "spawn-helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993f75f-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713052, "uuid": "e97bb2e6-3233-4feb-9269-10624fcc248b", "comment": "Malware payload (Mirai)", "value": "49ad1544d71b6ca486de89f7c36bebdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713052, "uuid": "c4908043-4298-41e1-b6a1-1b9aad8868e6", "comment": "Malware payload (Mirai)", "value": "a02da5e32c12a004632ef7adebc48188d9b57432f56fd453277dee5daf7e31a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713052, "uuid": "cd8aa903-dd32-4001-9c00-dbca00cc2c37", "comment": "Malware payload (Mirai)", "value": "62d6605ada2b8e2d44064a539b56ec9338619b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713052, "uuid": "f798927d-4847-423e-ae26-ee669bac498f", "comment": "Malware payload (Mirai)", "value": "88561125b0f4d597f85899ce3439a653c78bc694d4469631a10b584604b62c7aa463428884909f770fc087ad2e5f6bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713052, "uuid": "88d4d72d-1b56-4455-b0b5-c9e35611b347", "value": "T143E2D03725425CA0E7B198373C7C43C6A68793B8C0EE75F7392C07A663C15082DB6AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713052, "uuid": "7662b315-e596-4847-8a3d-990496255f4c", "value": "768:XeBsVPxhgIeMsgvw3VIrBtD8hmvLVnnrsXWf4ijs3UozQ:XeGVPxGlMwWBu0Rb4iOzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713052, "uuid": "7f9a0163-5f10-422b-8a1e-ac13330d32c9", "value": 33872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713052, "uuid": "830318db-2f2c-4711-80ff-88d22e4117c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713052, "uuid": "900f83bc-9453-41cf-bf80-919f5405e100", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df805dd-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756814, "uuid": "c7b81480-b01a-4ac0-88e2-5a7e29a0705f", "comment": "Malware payload (Mirai)", "value": "2a3fa51331540648a078a07eeff68363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756814, "uuid": "c0abdd93-6009-4ce1-96ba-d4daacad9857", "comment": "Malware payload (Mirai)", "value": "a05c105845163ffa309ba00e74cf1d09cc6fcf352faee03ef78ebe1722ea9c46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756814, "uuid": "ff931071-8856-41fe-82b0-0e14cfca4985", "comment": "Malware payload (Mirai)", "value": "1650f7a9c75733939b7f6fda8eaed219a0cd5320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756814, "uuid": "f890095e-cac5-4607-901c-f1c0cd09bae6", "comment": "Malware payload (Mirai)", "value": "8f8b2bc6d0a312678ef23d4db71bcf1b18ed1b51ef621f017107135cf6f84ae600e0f27d353c3c3a3b45de3caf2ce574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756814, "uuid": "c1dd8100-b4cb-4f42-98a8-9982410f8d0c", "value": "T176D3AE97F7471192C8A302F407CB6BCD2AA362825F5BD9E37C2F653B587A0DA1502B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756814, "uuid": "5e802ddf-9036-48b0-bf9b-bcea8ca29f4c", "value": "3072:2kOmLQTN+4DUzqI5Am93AaRx+4u7TgG7aq:2knQT4MUzJnAsw7aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756814, "uuid": "2cad98e4-d6ae-48af-a787-5866207b5f32", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756814, "uuid": "fd2bee44-1fc6-483e-9af0-381874903a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756814, "uuid": "2d517e4b-c4fc-4eb7-9921-79d1bf9b6c3e", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd115115-7351-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782693059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693059, "uuid": "6119b252-1bd9-4a3a-acbb-59d8f9382f44", "comment": "Malware payload", "value": "a9b6ad9380be6e60d73d38ea7605b903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693059, "uuid": "a9eb8a1a-39f5-43e4-ba04-23b33c397e86", "comment": "Malware payload", "value": "a065272b4a9a9325385485ccbf8a66b81faee8a8df478a627bbf49116d5eaf33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693059, "uuid": "d1c24d09-4e5a-4cb3-95e6-a60b4aaf6631", "comment": "Malware payload", "value": "08422b2b236831f053f936d20a79ccb6fc627a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782693059, "uuid": "7e016fa9-f51c-4628-8cec-4f2de98b8af1", "comment": "Malware payload", "value": "6db1e4a02cd552e04d4729bc7bb663d4e968605b41db7077d51b772f43a97b685f9a9ebd85562d0f4f28f47772fd7257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693059, "uuid": "05fb691b-8bd7-4504-86c8-7922d5c991ce", "value": "T1FC04975E6E228F6EF67C873047B74A25976D33DA23E1D684D1ACC1142F2025E641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693059, "uuid": "5040debe-d636-4c5e-ad82-b4f789557f46", "value": "3072:AIZZkY8BHk3fZbQ0uBKXFp/Vi/I+AR/qGhadAB:AIYY8BEhVp/I/KR/5hadAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782693059, "uuid": "ae7cfa05-1517-4cf8-917d-8fda064a2bfc", "value": 173756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782693059, "uuid": "97e044de-8363-4c75-a6d2-55d455e1a8d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782693059, "uuid": "36614019-37aa-4472-a6b8-b88c5da8673b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5edd360-73fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782767404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767404, "uuid": "a95eaedb-1a35-4f0d-9254-8c6738c9e9d5", "comment": "Malware payload", "value": "0859e80db1cb58ed756d7a43157d66ec", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767404, "uuid": "fb77b215-b575-4419-b4a3-e691e83be0b1", "comment": "Malware payload", "value": "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767404, "uuid": "f226c066-b769-4a84-af58-e0ea8b4f762d", "comment": "Malware payload", "value": "19cc2826714fb425a9b35e24301ba6ebb14c084f", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767404, "uuid": "23d5ebb3-9435-4c10-adfe-64d2a347c7c0", "comment": "Malware payload", "value": "1030fdba29ab6110131fcfc1ac9540cd58dbd1dfdf7ef8bbca10c1a636ed41ce54a0c68bb25a24ec63c693064ee61910", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767404, "uuid": "10168072-c196-4963-a8aa-c85c3ff4bf23", "value": "T19AB56C07BCE009E9D4AA533189A65286BB76BC450F3233C76E50B7392F72BD0AD39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767404, "uuid": "43015d03-1248-4c1b-8dfb-6ff3f106abaa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767404, "uuid": "f99a8a55-bcfd-489a-81ba-b77810413213", "value": "24576:QFuQ0h41r5w6dg5mFAHdHXwI2TOzLvIyfP2KliH3wtxwBele5rKDEqyUWn3B:QFune1WuQz9HZ3HIOliXLns63B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782767404, "uuid": "3c96ac98-a729-4a0b-8215-bbbcf121d212", "value": 2441064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782767404, "uuid": "3c39790d-bca4-4c99-a905-3484f2d6d064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767404, "uuid": "41f11c68-4649-486e-bfde-1ca5a9fc8719", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c158e2-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712800, "uuid": "90082932-a7d9-403c-9f03-60678bb226e4", "comment": "Malware payload (Mirai)", "value": "b312cd0018c059cf5cd209d1a68f48e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712800, "uuid": "d0c197f9-4740-4b57-9878-2374fffabfa7", "comment": "Malware payload (Mirai)", "value": "a23746f11d46b62b9f4e714bf770156db8450e7b0795f7c2126fe153db577a70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712800, "uuid": "35c8a078-b078-4161-87a2-dd3ed1217c24", "comment": "Malware payload (Mirai)", "value": "e32d3b3bfdb328d674a21bb191f652087931aa96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712800, "uuid": "e1a987b7-47fc-4259-ac2e-1b732cbf7cf2", "comment": "Malware payload (Mirai)", "value": "7e666bd4a5e53e1d4caf8e6d873bd41152b697b6bc76c6b6e004a4f5b699c613249053f19279efd138f277c7ed640937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712800, "uuid": "f1da7536-ca45-4c37-8e49-5cedbbbcf0d4", "value": "T196360997B8D14A43C4E43676B8BD81C833A34EB99B9713666D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712800, "uuid": "a2a27ce6-16f8-44c5-b96e-27085877e8db", "value": "24576:W1aBkWO3wadzwaH/9lRO8wi4HUFJAlR1anVX0ruJJeiP68sLNBojZw99oPpOiDts:AvIhO/TvWdiSd9wwyc0eLlA1snN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712800, "uuid": "7f340663-7d2c-499e-97f4-f00b45b8c331", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712800, "uuid": "7ebfc92c-ebc3-4a33-979f-d714ba9a10c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712800, "uuid": "3dd3f58c-d280-4590-a9c0-1c17d5b38cdc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bffc53-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775272, "uuid": "b51a55ec-54c4-4209-b434-a23e7863519e", "comment": "Malware payload (Mirai)", "value": "e18868a2d227452a06c2cf6bf20e7668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775272, "uuid": "09ce0644-805d-431a-a810-9a7687603eab", "comment": "Malware payload (Mirai)", "value": "a2711c76b11bc5ead48ada4bd1052a4bdbca06c1a7b7e88c2f4d4e5b44a9a3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775272, "uuid": "33b46fc3-a817-41b9-81e4-9916e49c0d5c", "comment": "Malware payload (Mirai)", "value": "ae3197f9866b509f94af45e2b5f48c4171c915f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775272, "uuid": "5b66a6c7-e717-4d47-b8e2-f1476b8f3320", "comment": "Malware payload (Mirai)", "value": "51ff4a97204bb8e25d9dbd4e041fc5fe1772cc6b925056015dd17e273ae98accf0139e74e5b7379e7713822329630ac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775272, "uuid": "be395de9-767c-44ad-b0d2-b69b21ed7705", "value": "T1C023F11441AE8C22D7784C77CEA6D3C0571BEEBBF1F661E9399413B09F1688709B86C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775272, "uuid": "28249864-0a05-4e82-9b37-655394341944", "value": "768:MNb/RVtBHCL68j28fLz6H5TwTdRDLOpUpBj9vtk7LXu37caUYt0ayfrwzcQh8ZVy:MnX5CL66fLz6ZQdLH3j9vtkfu3Jf0aI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775272, "uuid": "dd2d3b23-a5f5-4d9e-9efc-278a44ea32ee", "value": 48124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775272, "uuid": "f19db887-def2-4071-adae-7086f1b83be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775272, "uuid": "0fff813a-b6fb-4c97-88f0-cde021ec5867", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c14f96-738d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782718541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718541, "uuid": "1de0aff9-d6e3-473c-80a8-cdae84260bcc", "comment": "Malware payload", "value": "2198ca2d26c65cbe6b35e57419832f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718541, "uuid": "5190b9f2-ad7d-405d-8ad0-d299277c7d82", "comment": "Malware payload", "value": "a322645437729eb669b59486b077ac29aa949f4bc97f20651bf3d0f75dd7a507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718541, "uuid": "2d13568f-fae7-493e-ab79-8a9da1017160", "comment": "Malware payload", "value": "fec35580e4cdec66f658c29f6f170568dc0c7309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782718541, "uuid": "70dbe8ea-739d-4911-bd22-a38da4964ff8", "comment": "Malware payload", "value": "00603a4a6cd553cfa36aa9dd078c8fdeb5395dc7c73411734c282e08b9f21875026b97f81a4091caa2e2c373b8704a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718541, "uuid": "cf9d6c75-6553-479e-86a8-b18d3eb221a3", "value": "T1776733D9E94C3B9ADD28A2B55821FE17F6C8DB086D83E41637480BEBC1DD0D43E59D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718541, "uuid": "6a7b53d4-44d3-4824-ba44-372b5bde6bf0", "value": "e2a312eb12f1d00dac5e9132926c53bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718541, "uuid": "aa28ec81-cce4-4a7f-8662-96b568064955", "value": "786432:lY2U3PO69/n5l3R2I//Mbln1SI/0hNXbbaN7k:lbU3PO69/x2vTpq/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782718541, "uuid": "5fd29540-3225-41e9-b21d-045322e20cdf", "value": 31445224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782718541, "uuid": "10be724f-c84b-423d-9d68-fa41d0c4bed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782718541, "uuid": "cf37ba20-4c88-4b77-a2ac-5bbacecf282d", "value": "26312000003381626281setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c78bd52-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "e0f666aa-4a18-405a-b7e4-20cb5c0d438f", "comment": "Malware payload (Mirai)", "value": "4584c99a9f3653aac1db139b30492e6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "0f52d6d3-1883-49b1-b308-f1dcdb2752a1", "comment": "Malware payload (Mirai)", "value": "a45370fa1f96c2bdfa34cb7909d15ed30c459a58a0e35a77295c2982e0500dfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "e6264837-3e54-4f40-8469-2816b800881f", "comment": "Malware payload (Mirai)", "value": "98821d590f61d0873c494d16d81f10011e5f9e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "a9c31833-2f6f-44b5-97d5-044381af6e03", "comment": "Malware payload (Mirai)", "value": "604a36f8ff3f6f08d676b78910311031a10d9bc5962406f8ffec1fd2e9f3a65b9245939d4f87fdf673e1605e683ca318", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "0b4e9e2d-e865-43ac-9cb7-bb93d9ee5b7f", "value": "T15B831846B9C28A2AC2D0237EE67E628D33A167E4D2DFB157CC215B11378520F1E67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "e3d6eef2-ea0e-457f-ae3b-45f355c80370", "value": "1536:yhb0qwwSd9Pf0HQOCmm4NKpnCAHcxynQAPQZD73F:y10qwwSbeMQRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775280, "uuid": "a9b3c233-35db-4be3-a979-1ef017183e8a", "value": 85004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775280, "uuid": "f6f5fd91-de3e-4617-972d-a92b762e851f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "c7e27d5e-62c1-4b7f-8125-534e1298c31e", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3da6fd6-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721390, "uuid": "f858c86d-825e-411c-ab5d-081b75b49d05", "comment": "Malware payload", "value": "91daa5be3d56ecb4282609480c1952df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721390, "uuid": "07b1bcd9-549d-4433-b2ed-50aed192eb27", "comment": "Malware payload", "value": "a4678163fa000081501adcdb8af1c9c60ab14b80d3b433041cac1b39529254a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721390, "uuid": "15367ee4-26bc-4860-b4b9-42a46374aa3d", "comment": "Malware payload", "value": "2790dd48c3925fa8a293ada0b14a70c7eafabbb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721390, "uuid": "6a47fbdf-621f-4581-be85-365350306e44", "comment": "Malware payload", "value": "7c82ba216dd27c0a850b5b7cfd10d3cc61ab8b14007dd92817e05e3bdcdd808402be8f5607dd4a1dbf35570449fa1c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721390, "uuid": "9e7399b3-0f39-40f1-9aaa-e1f61a4e0426", "value": "T167E733E59BC874D6E20DCB378535D518AC72B80D0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721390, "uuid": "e6de9d62-f0d8-4541-9244-5009cbe69e01", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721390, "uuid": "bd716e82-6a2a-4d14-a641-6293a59d8fb1", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePND:jdPJKrtOsHtAsg7lxrmeVlQFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721390, "uuid": "fba79ae1-4531-4e8d-88ce-86fd0f58850b", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721390, "uuid": "d4426036-5575-43cd-8b6f-2dfc3c3711c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721390, "uuid": "05e067e5-e46c-4eeb-afcd-b12252b876dc", "value": "91daa5be3d56ecb4282609480c1952df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c0d8fd-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782697830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697830, "uuid": "eeb0c796-8efe-434f-b833-c03dc0a9ee98", "comment": "Malware payload", "value": "67010d4cc7744c5f13d50108f05350d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697830, "uuid": "7487c543-0248-447f-ad94-27e86907f614", "comment": "Malware payload", "value": "a53e13b6f5801bd209732b9125e53275ebc145fe9a2c58a2b87dd236ee00927c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697830, "uuid": "95a4c992-2a52-4a72-a345-36399d852b4b", "comment": "Malware payload", "value": "3b200c2bfbafd3df7a4039c505bd6915dff1fd39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697830, "uuid": "3b800da8-04ce-4559-8878-58538c48923e", "comment": "Malware payload", "value": "0470eac0bc318877e0eef5e2d939d8edfbf5bea78289a06a5dcf98f259f3a4e60613c6554d751da948511a2282180fec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697830, "uuid": "58f05346-afd1-4a1a-8a3a-e18be79b32c5", "value": "T1EA339E0CB1072D264A72C4DDB99324E067751AA5CAD79F7AB30BD8F92A4ED1BC4190FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697830, "uuid": "7573eefb-87ed-48b0-800e-6cfd019a5faa", "value": "1536:izTH7NNncnrY2nylB2zvo4eNMXiabhbXHCgMsI:sT5dcnrY2nyqw4eNMX99Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697830, "uuid": "078fe12d-2b8e-4080-b2f8-ad0bdb240773", "value": 52918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697830, "uuid": "64f58197-3c57-4d41-a80e-ab8d49330894", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697830, "uuid": "738b0237-4869-4eb5-b4eb-5cbafdfd2921", "value": "ocafa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbdb278-7369-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782703259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782703259, "uuid": "fe900d0d-a969-4782-804b-1ece6c4587a0", "comment": "Malware payload (njrat)", "value": "c932d4c3f54e3902d57abff3c58e09b6", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782703259, "uuid": "f5d6ba42-bea9-42da-a73c-5479e4281378", "comment": "Malware payload (njrat)", "value": "a64e0733553c506a1e0785f0bca26406abc3ce0c4256697e377a1b967be36677", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782703259, "uuid": "f87cab24-03ac-421e-99ee-2587fcd624c7", "comment": "Malware payload (njrat)", "value": "19c9e3a374e5402b52bc8402768c73b6397cf4f1", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782703259, "uuid": "ff862ef2-14e4-4b13-b712-3d4856f314e0", "comment": "Malware payload (njrat)", "value": "590f669e33e681bf10be11e2430c7eccd629b57d921a59fee518100fd8f68100ce107f7e9586f2640166073b6395a637", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782703259, "uuid": "7d8de2ee-49d4-4c68-8e1a-3d232e863a74", "value": "T13DF58C03BDA415FAC09E923288B719AA3B74BC494F3127D72E50B6782E773D05C76B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782703259, "uuid": "4e15d701-3b60-4c84-80bb-c1fa93ebebf2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782703259, "uuid": "5a485215-9faf-45fa-a36c-06e550002e87", "value": "49152:sv+pP4Y7UsI5N5wJf+ihWAH2QhX+K5sbLS2Hq9rd92Bqvn348Ow8YCPl:sml/AQx+K5sy46p92e4p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782703259, "uuid": "3bc0b116-4b84-4735-80af-8e9955cef128", "value": 3471736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782703259, "uuid": "b16d11b4-a36e-47b9-89bb-72d395201f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782703259, "uuid": "f856b01b-f93b-48aa-ba38-b21adfcf2ef4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486c52fb-740e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782774011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782774011, "uuid": "9ed19ec0-4e48-416d-bae4-1b9ef10601bc", "comment": "Malware payload (ValleyRAT)", "value": "2f3e3c0134aee76ac9876b3212116261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782774011, "uuid": "d35cc100-5354-4723-89b9-7740deb436ea", "comment": "Malware payload (ValleyRAT)", "value": "a81dd7a5c94f3f82fe489a5e9ccb5e8618f22d3846d1d74388e88e399a8de2e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782774011, "uuid": "69bbd327-5a17-49ba-92a0-7d69205b4543", "comment": "Malware payload (ValleyRAT)", "value": "f3110e6cdfb86d0f09ff61e45aa42c555ca073df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782774011, "uuid": "4e6c7759-f981-4bc9-baff-a292b6c8480b", "comment": "Malware payload (ValleyRAT)", "value": "8ab9c545b9a0257489d7bd1130ab2d2de404e54c69dbe504d22810ba2fa34c2d1d851ca8f71cafb3a630fd1036503a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782774011, "uuid": "575f5c93-f2a8-4dbf-bffb-b882182dd220", "value": "T17095D023B2CBE13EE05E4B3B45B2A15494FB6B216523BD579AE4849CCF360601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782774011, "uuid": "4e078dec-839c-4ee0-aec2-6085bec72bd5", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782774011, "uuid": "9c527add-831e-4cf6-8615-bef9b135f29a", "value": "49152:F+MRvHLywv67MZ2Z9ftchfudg87dqn7iMj:FrGwv+MYchXqdnMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782774011, "uuid": "efe3a474-7cda-47f2-ba6e-e30d33bf7c87", "value": 2049422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782774011, "uuid": "6896218f-f5f6-41dd-a367-6986cffbd6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782774011, "uuid": "7dd3e748-523f-4492-9880-9313e7c5a799", "value": "2f3e3c0134aee76ac9876b3212116261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9173f9-73d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782747312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747312, "uuid": "282c046a-6650-4d6e-9220-3500ec115885", "comment": "Malware payload (njrat)", "value": "1e3fd12fee9d2fd27642ed24cff01338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747312, "uuid": "9a522f2a-570c-4259-8e66-dca4aa9fd8f4", "comment": "Malware payload (njrat)", "value": "a834cec6b236453ee671c23326b60763880a47c93ccc595d6e566ec5f81ade88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747312, "uuid": "93742172-4738-415c-af52-8bfdf45c4057", "comment": "Malware payload (njrat)", "value": "2f299b8f3839e4259a27f4b1d8af0d2473cfe7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747312, "uuid": "f2fc6162-e93e-4c76-9874-5c2c58e0597c", "comment": "Malware payload (njrat)", "value": "9636589675cdb23c08b1d9952d03b515f17aba2285235a1db828f4bfb9e46cd501c30c7fa93df7af3fd3cbb5b329bbb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747312, "uuid": "3d178ba6-f476-45ac-891f-925ae73899db", "value": "T195E23C6DFBE64466D1BC1AB50571950013B8D003E523F77E4ECA24E62B2B3C84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747312, "uuid": "e167b5b3-2f99-4880-ab5b-32453f5c6cb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747312, "uuid": "d41e00a2-f247-417b-b9a6-ccbeff99cf65", "value": "768:JrMXvwpJbb2zxxO5GOq3zisfvAmQmIDUu0tiKCj:QkK9isXQVksj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782747312, "uuid": "3deac942-77ed-4596-bc71-8b019e46d10d", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782747312, "uuid": "1bc8c23d-671a-46f2-b2d1-1522143c79b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747312, "uuid": "816a35e6-cbc6-41f1-9669-3d1c76b96dc1", "value": "1e3fd12fee9d2fd27642ed24cff01338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0d2598-73f7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782764409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764409, "uuid": "8d8fe3e3-6125-48a6-8d56-b72824160a29", "comment": "Malware payload (RatonRAT)", "value": "df20e28812991a3607a8e8c76d09944f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764409, "uuid": "321c28d5-e56c-4d4a-aef5-8cb1cc5198d8", "comment": "Malware payload (RatonRAT)", "value": "a8ba25a210943ebeb47637a2cfc9f4f2ab2638506124c00e740d726b9069a76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764409, "uuid": "d8797247-f750-4faf-b1b6-4611bbbd5a6a", "comment": "Malware payload (RatonRAT)", "value": "4cb9812c264bc7e727d3577d4b0f5a9c50496494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764409, "uuid": "256c3e14-d640-415c-898c-148446141ffd", "comment": "Malware payload (RatonRAT)", "value": "6c76712ba87021b3d618598f38d70fcfcfe821797e3b9089f25b38d54fa3bd0aa7d13864dd8589f105d18be747468b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764409, "uuid": "3b029cec-0079-44eb-a0e5-c2e3fc2c664a", "value": "T12206CF407BD0CE1BE19F87B6B4F2061057B5EC15A796E70B2E90BAAC1CB37445E1839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764409, "uuid": "663dac1a-87ca-428f-8e61-9b5749afc4b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764409, "uuid": "a16fca39-e841-4e80-b38c-67990a065743", "value": "49152:dmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sj:Gq0WgVUuHjkDGjYQeqpgmltj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782764409, "uuid": "951fbf80-2e5e-45f4-b498-d45c625b1006", "value": 3700224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782764409, "uuid": "20cd8702-35fa-4938-a2c9-e3fd0e78d50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764409, "uuid": "cac62133-2f20-4707-b458-c69a97f53d2b", "value": "ExodusLarpWallet1.1.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3700d399-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775271, "uuid": "7a660ccf-e4d3-4d52-b239-4cb84a47a56f", "comment": "Malware payload (Mirai)", "value": "d4d974f962a6d43ecc58fcdbc7b3e97e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775271, "uuid": "0cf1788d-5ac9-4c5c-90cb-3f776c3358ea", "comment": "Malware payload (Mirai)", "value": "a8bc5383b157d561fe771cd5f9446940cd13bd2cf0ad4dba25216c836fe3191c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775271, "uuid": "17f1f1f8-4314-4fbe-b063-498740d6566d", "comment": "Malware payload (Mirai)", "value": "86fda6d0ca0db21ed620528d8659d7e6b3c9ddcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775271, "uuid": "a10513bf-62a4-449d-ad9a-51eb9882e36e", "comment": "Malware payload (Mirai)", "value": "c4f3ce146a3b3993e7fef372b084b8e0c437c6e3099144581d6f4e59874996e26f7fa48a5cb370b80b45ac6ebb2dfe20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775271, "uuid": "f68f5cf0-9be9-40fa-875d-912d73c66fd2", "value": "T1AA33F19F77D6A123CA4E7DFBF14D2BB0C60B31C5A7468645474095DCB7E2246308A4F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775271, "uuid": "de68ad3c-353d-4f2e-9656-728f74c05100", "value": "1536:9nSRr1nRi61QCvKZ+CasTKVPZf9iIz7WFAnCfC:9knRikKNOxf9iI/4AnCfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775271, "uuid": "6c34df79-ada5-47bb-9865-6c9a93cad85b", "value": 51276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775271, "uuid": "f014f057-f454-4500-8eac-5c35ec26c415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775271, "uuid": "3b663d57-21a8-4ae2-8ee2-53f3b61a7ad1", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c292d639-73c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782740716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740716, "uuid": "af6239e0-3639-42ca-9095-e334a89232f1", "comment": "Malware payload", "value": "0fa2f966f6ee43f5d877836682737150", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740716, "uuid": "af25222e-4511-464c-b06d-e26ba0359076", "comment": "Malware payload", "value": "a8cfbbb848d3d795c49860ccfc710f0298a4c8bd3ca9845f7a633b05c2c93c4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740716, "uuid": "aa860275-064a-402f-bd17-21fd1f26d10e", "comment": "Malware payload", "value": "93fb6c6782637a5e033bb0d4638189fdf25737d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740716, "uuid": "ba90befa-f6e0-4f5a-ab28-e653d94a2ec0", "comment": "Malware payload", "value": "ab94f969a2cb7511b3e159d40ab50c2624035f1e2d75f9c89006ea681d8423f57c9d470e23b2cbfe728a777d8c014ec2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740716, "uuid": "664e4dd1-df8c-4a50-b3da-425a8d1070a1", "value": "T13D236D6516853C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C49A9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740716, "uuid": "f03d03ad-422e-405e-ad57-34a22915e3be", "value": "768:Sr9NyXsZztCJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:8HusZ/cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740716, "uuid": "2fa35b42-511a-44de-bafd-7498448690a6", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740716, "uuid": "3c5b5b40-8639-4455-a2b2-fe79953e318f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740716, "uuid": "e68cdb99-1e01-44b8-b5db-12908d7cc61b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f7dcb0-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762221, "uuid": "f5f79c8e-9bb1-4b2d-b040-5f5d7bf9ccbd", "comment": "Malware payload", "value": "4afee5cc48acc82e39d0bde0ed2a4f4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762221, "uuid": "16a4819b-f01d-4567-b27f-c53aaf8d7b3a", "comment": "Malware payload", "value": "aa845a473e19c74e823be699bceee73eb1507284f0a4cd8f5f840c8fefbf9f01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762221, "uuid": "2d3cb822-4122-484c-b49c-f32001c1a2e7", "comment": "Malware payload", "value": "437faaeec06915ba1935f620ee5489631cfefebd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762221, "uuid": "dbefa602-d998-4923-aef5-04890ab89dad", "comment": "Malware payload", "value": "4602ea85bd04c1e28d59cc8df5146bde310ac85cbfd6fdcf20863d19220cbe0749da9c7df1285f89e70ba8ff69704987", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762221, "uuid": "895d7cca-b6dd-4911-ab50-fc152f732c65", "value": "T19FE2A06092734E28C370516759AC0D55EFBC28F781AE9C7D921EB0073D7B2147D2EAE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762221, "uuid": "e7c1265f-06d6-49f2-9696-9f95e4a1f5b0", "value": "768:ma0W3NrLkEXY4v6erEyz6LgDBtXwZ/ky7Tt3uvveahh7CKBgC:mW3a4ZEyWLSjsXxAN77RBgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762221, "uuid": "f03753a6-e341-4d64-a94c-ac0e6a1dee0c", "value": 34151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762221, "uuid": "d21a0de1-368c-4f49-87d8-640dceb9135c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762221, "uuid": "888ca035-ff2d-4c71-97ea-2c87dda4209d", "value": "ubiba(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6bd199-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698618, "uuid": "7735bf3a-2146-461e-90dd-7cc383ca0c5d", "comment": "Malware payload", "value": "af363f9fdc2607e325772244c59d93c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698618, "uuid": "81044859-92ef-4eda-8214-23ccba0b0d6e", "comment": "Malware payload", "value": "aac15e1d0b6c25551e6b973b6e2802dd662d33c05a41be38d1bc0f5f3b0475d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698618, "uuid": "eca386b0-b2a2-4e54-91a9-f4ee30e16976", "comment": "Malware payload", "value": "c91f7a65954185dc298c6ed4f9f243159453d235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698618, "uuid": "dc211e2c-de7b-464c-addc-fe50c682c5d1", "comment": "Malware payload", "value": "707677922fcade879b0b25346293d19e21c8753dbd317601b6f2a69513eb4675096f470203058825d317470258c324a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698618, "uuid": "f033df6d-691f-4540-9bef-d2a52217f997", "value": "T1BBE2AE393201F9652F4249067B275AE64828EC6708ED931D52DE532D0E8ED2EF7B12FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698618, "uuid": "bc644d39-ee03-41e7-bd19-63264f633640", "value": "768:MYSLOHXpn7LS5Fz/2b08af0Ap8ekDDwchVbtQMNa0tb:MYSY7m5pU3dDwchMMge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698618, "uuid": "1e1fe083-58ee-47e8-994c-bbe594d3a7a6", "value": 33086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698618, "uuid": "b2787e52-c824-4163-aafb-1e0d58c351ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698618, "uuid": "30170f39-bcea-4ccf-99b5-d6fd456c4f73", "value": "ufino(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae880f1d-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782758721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758721, "uuid": "ad227331-a04e-4586-8edc-15e0795bbcd6", "comment": "Malware payload (ValleyRAT)", "value": "91ca6805aabe73cabd12644fccf91ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758721, "uuid": "e843b0bc-911a-465d-83ea-c98fd5436813", "comment": "Malware payload (ValleyRAT)", "value": "ab168b5a63520e7cabe5d2d3917e1b9b1b388db0b3f27354bc7cd075e63cc7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758721, "uuid": "530cb49d-bcf6-4116-87f5-baa64ff3f907", "comment": "Malware payload (ValleyRAT)", "value": "a29d766799b35f8c9a4fbc3950295aedc17c7e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758721, "uuid": "af83d06f-6780-4330-9be0-c6e75a7c98fd", "comment": "Malware payload (ValleyRAT)", "value": "821df105a4cdf33f8b342153dd8453ecef36cf674220cb4192f25f20f0abc4e35fbe5f439871f510973e4ed4becd16ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758721, "uuid": "bc24fbcc-11d2-467b-afaa-d1ee0c4a1f03", "value": "T1C7F59D32FB784062CD6302704E9DF7F9E2ADBB7C0B3551C752E49A1B29311D24E356AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758721, "uuid": "28d5b3ab-f2cf-491f-bd2f-2b1f1d130c83", "value": "88547651ff45b80cfef99b174f2037b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758721, "uuid": "1e28a417-f5fe-4198-8dce-fde67471a8f3", "value": "98304:GraJctSinTjGv8PVsvbIuYS79S8fTq2dRz:GZ//gymDNk8fTq2dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758721, "uuid": "6b6ff36c-1975-428a-bc56-de8e4ccbce63", "value": 3334656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758721, "uuid": "439f7d2e-10ba-47a7-aa28-7277444c860f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758721, "uuid": "269b8463-878e-491e-96de-a01d48e11470", "value": "WinDirStatx86YHNOADMIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a06cd-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737458, "uuid": "a9ec256f-e2a3-4ece-85bd-617601fd02d7", "comment": "Malware payload (Mirai)", "value": "0b68770c5503dce81fea11c218d72589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737458, "uuid": "c28a41fa-41a5-484d-9510-a9df71adf311", "comment": "Malware payload (Mirai)", "value": "ab22ceeebcbc149dda959f5c29571f40a06830871a9be9a2f8a76a3e106c37b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737458, "uuid": "df74dcab-22e2-443f-9a09-a9c4cdef8ce6", "comment": "Malware payload (Mirai)", "value": "4c20ed40be76fca1dd99eefaa6205761ca377be1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737458, "uuid": "57ed70a1-4afd-46ea-91cf-52382e81dd6c", "comment": "Malware payload (Mirai)", "value": "a2f0817b6f12e7de085c4e4d6be6167424677da0d61d38f059e3f8db76b131195e883989d23fb94bb34aa84625a97361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737458, "uuid": "28a8a830-44cf-4cf5-a20e-5e61635c37f0", "value": "T18403E161C3EACCB5F86BE673445BA14E8C06DC18F0B8C6E65BE9B82769417203D643D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737458, "uuid": "bed9e1a4-191a-4eb0-898f-19808051891f", "value": "768:qXyZ9boRkEz8+RYgMAKusWxnqpCAa1tAxPTnvBSfGIkTa2q3MMNl7PVmIa//nbc6:qYmkC8+WrfW8pDweVnpSfGt0gIonouys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737458, "uuid": "2f0e01e1-0434-4ba8-8d35-fe254073408d", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737458, "uuid": "087c852d-688d-4364-b025-821aaef16337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737458, "uuid": "cefcaa60-795a-4630-867e-ee359a7b89e6", "value": "ab22ceeebcbc149dda959f5c29571f40a06830871a9be9a2f8a76a3e106c37b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0aacd5-73a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782730742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730742, "uuid": "2bd896af-cadb-4038-8257-8abb4fe792ab", "comment": "Malware payload (Mirai)", "value": "5af97aa9f90981612ca0324bc4b9c4e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730742, "uuid": "ec5f7b01-565c-44b5-b1da-41a524d14112", "comment": "Malware payload (Mirai)", "value": "ab50ba138f40795d86ebc15ef37e6bdf6db977cab8d9f45551690535c2e49395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730742, "uuid": "3b2f7f43-fb34-47bd-acca-e975faaf377b", "comment": "Malware payload (Mirai)", "value": "ec0f49997d5e5b1aca05c462f49cb7be299899fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730742, "uuid": "14425b39-15b6-4044-a902-77ff8d95cf4a", "comment": "Malware payload (Mirai)", "value": "a606158c5126aa124b9928470e13be1e8d67226c1eebb0bfb45e2324a9aae2307187b3b55e7ceb11ce3adba6bdeda9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730742, "uuid": "f530ea6e-59f0-42af-8b1a-8cefdfc9f5b3", "value": "T122D3FB0ABF501DBBD81BCD3705AC1A0235CC960772943BB53678DB2CB64699B4AE3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730742, "uuid": "8eef4e90-0148-43f8-a2c5-55813d0b4960", "value": "1536:RsoJceAPPngsSB5IIt1S8ASJ4m1YlZHgWpgtc7DmlSasVk0DRcRI2aBn:nJhAnngD2+NegWVDmc5lQI2aBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730742, "uuid": "cef18143-fe0c-4c5a-8154-90e3485ebd07", "value": 130176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730742, "uuid": "eadfbef8-3d04-4e5b-a94f-123fe73c144f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730742, "uuid": "38c6210c-6423-4e6c-b76b-d5792796acd4", "value": "nhL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6741a87a-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782763326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763326, "uuid": "d0f79707-0fa9-4536-b3f7-c434c369025a", "comment": "Malware payload (ConnectWise)", "value": "8f0cc1496b42ac8a140bc18d980656fa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763326, "uuid": "ee62badb-320a-4f60-8f2a-883735df9c7f", "comment": "Malware payload (ConnectWise)", "value": "abca0d9b36b85582207ec8056045c1499dfc561ad2add6f96d9a57f1683c16cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763326, "uuid": "95abe84f-af1e-45b1-be43-c4a0b27b1fc9", "comment": "Malware payload (ConnectWise)", "value": "8481f136e6ef05096f1f6061eea0f174e87dd650", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763326, "uuid": "a6f27d91-1f57-4b4e-9992-bc4152131214", "comment": "Malware payload (ConnectWise)", "value": "cc5e0f6463978d8d7cef107a96207aa273d09138e0e857e6a7b65ef756a8c2380c53e38946f3b8c9e02b5c5d9ddc568d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763326, "uuid": "7782e143-5c09-4052-8a22-14b7dca8d65b", "value": "T11C46E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763326, "uuid": "214655e5-58d8-495d-822e-a157311bde2f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763326, "uuid": "2a51d566-ed67-485d-a4aa-818dd505b425", "value": "98304:LzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:LhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763326, "uuid": "7933fce1-9234-4782-b287-5255286a9192", "value": 5687232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763326, "uuid": "e739a6a6-da02-43b1-8f65-e46e02e7e5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763326, "uuid": "205ce33a-3684-4be6-acd1-1f8a7dc119ae", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb851891-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782697861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697861, "uuid": "fe80cfb6-e9ae-47e4-84de-e83adb9e4266", "comment": "Malware payload (Mirai)", "value": "247ffdaa4641285d04513f8868735ff4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697861, "uuid": "e30206e1-3ae7-44a3-adeb-6f4c80970946", "comment": "Malware payload (Mirai)", "value": "ac613f86b27b3df61d7c881f1b0997e11521639b08132c5dd3d8f4de65901ea8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697861, "uuid": "0a8b4439-63ee-42e9-8e16-146c7243a591", "comment": "Malware payload (Mirai)", "value": "27939ec9231d51115bf8b2a26eae7a34f1c8a551", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697861, "uuid": "83a5d775-6488-4d5f-b77a-56ee4206c52e", "comment": "Malware payload (Mirai)", "value": "046f4ff7b38059c47d45e36a223e13f46736108e9de5b40bcc88bde919d3ae76e99c9343b91b864b63f66f1071e4d0ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697861, "uuid": "09850e32-d155-4879-a287-65960d4da648", "value": "T1EB01AFCA44246D40609ED91D22D75054F421D3CF15964FA4BF6C6E7DFB58D10B02AFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697861, "uuid": "23cd62df-f98d-4f9d-bf68-8972b9779a42", "value": "24:kXCKysE2hi0ziQvZohax86ecN5gaSt8bdbX:e9Qp+MsSfcN5hSt8ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697861, "uuid": "50c43886-f442-4045-9ae0-a645a382b602", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697861, "uuid": "42c132cc-b5ef-4490-92d0-dc9ee2a67b3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697861, "uuid": "fca8d08d-5584-426a-b5d0-9fa156a79f28", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3c0fb7-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775363, "uuid": "a8ad7610-8784-4097-be4a-3a2237abd6c9", "comment": "Malware payload (Mirai)", "value": "52e249d9745e9ba0e11ebc2c9395d22a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775363, "uuid": "1d0b7a07-3056-4c3b-b286-e02fbfce5f63", "comment": "Malware payload (Mirai)", "value": "acaa4f20c6d7ee0094f62a38d6f0706ed42acaad600f58741a48648cefaab5c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775363, "uuid": "ddda4c0c-126a-4416-8c42-be15d2fc9775", "comment": "Malware payload (Mirai)", "value": "7459c9ed3a53cdebebf8c9d2116b62ddc276df1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775363, "uuid": "eea3a0e2-36e0-446e-805d-712db35b2bca", "comment": "Malware payload (Mirai)", "value": "6cee5b3043a6718898e502eb955c6580481dbcfa79d2af070f258a29321c5a968aad236f50408ae2b9da6767691ef725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775363, "uuid": "096475e8-49cb-4f46-9948-2dcf1c1a650c", "value": "T113A35BC4F243D4F5FC92053421B6FB37DA72E6B92129DEC3D7A89A72EC16542C406A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775363, "uuid": "bd4b833a-9857-4e3c-9541-955475047db0", "value": "3072:/Iw5rh8wEz6mpWqxo5gGDOxP3DyyA503J:t5rh8wEzRpZZMb03J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775363, "uuid": "62d3c755-7d7b-434e-894e-809692b19df7", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775363, "uuid": "dedbb9ae-39ce-4742-b2f4-489c25b69ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775363, "uuid": "f314ceaf-8e3b-41fe-9123-d8d9faf6ad15", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c18fd4-73c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782740483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740483, "uuid": "5ffd8a19-227d-4583-912e-bfbd528e6a93", "comment": "Malware payload (Mirai)", "value": "c098a7ed7a1d36a1c23616c260ac7581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740483, "uuid": "375893e0-c2b4-463f-8897-db6c5549b143", "comment": "Malware payload (Mirai)", "value": "ace18612d01c10ee9d7d7f7ca986da72c051682bd292ac15d83b29b13b946139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740483, "uuid": "f6c11054-e8b1-4e86-9e2a-ed0c32927ad2", "comment": "Malware payload (Mirai)", "value": "766e34554a993a45c858ceb8997f16c1cca8b68f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740483, "uuid": "6d35a404-376d-4911-9cc9-d4c208d7fc3f", "comment": "Malware payload (Mirai)", "value": "9e59b076280c268669e29dfef65c4cc18b5e2851730ba613e3c76e110ca4a348c55d9972439f55e5ea5b7e735bd80cae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740483, "uuid": "c3d4a98b-9075-4523-8f81-d56646337fda", "value": "T15AB33B8B98619FBAC015B0B178FA19310719A8A14B5F0DE9B5759ED8438F5CBF00FB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740483, "uuid": "7f9d9266-04fd-42c3-b334-e89893635b69", "value": "1536:IA8l3bX9oAx81dXrF2XgqeOKHJBSB/KxxjWvCU55ZPY/j5h8p/7k4:IlcdXYXgbhHmKxxjWvZIb5h8p/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740483, "uuid": "0ed2d01c-7fa4-4474-a010-a2fd45e22f8a", "value": 108828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740483, "uuid": "037df686-8462-4f73-b406-d1613762171e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740483, "uuid": "7b4a7067-c445-48b4-bcdf-ff4eb9cad7f9", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc272e-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782755427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755427, "uuid": "16cb4c47-f54f-4011-9f87-65cefc6ad927", "comment": "Malware payload (Gafgyt)", "value": "3a2afa61e4ad5039827f0fd8e38070db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755427, "uuid": "823aa1c3-1e17-45ce-9d67-c064ed5a886a", "comment": "Malware payload (Gafgyt)", "value": "ad2a6d87aff96ecba9458d0ba78e1b6792ab303d7f2887c83867bc88e049a9b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755427, "uuid": "49c5036d-2501-4bff-b49c-5d0e6598c397", "comment": "Malware payload (Gafgyt)", "value": "8f81a451e4ac83ef5cf27ede26122f03ddbe7c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755427, "uuid": "0b7c2c1f-dd3d-403d-b79b-239fc86293bc", "comment": "Malware payload (Gafgyt)", "value": "8fea7c8bdf3e12aeb5b2d881f90e6b8e5ad4dedd233bedc39d9780039fd4bf27226d8f931af5a7407f52c7af33ea277c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755427, "uuid": "060c20d4-25a5-4149-8a7c-2cfec85a0520", "value": "T158936D46FA92D1F3E0C346331157CB5A4331ED21414ACE0AF7193A399E62B4D8A5F7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755427, "uuid": "23372de5-871e-4370-92ea-4db52fe8db63", "value": "1536:3RkFD1b56Gu0h/dXaPXArxgnEZYjg5fmrTjrp32QporJ1LbjUlWjJx:3+Fpr7h/1aPQraEAOGTjrpkXbjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755427, "uuid": "f0e75176-cfd2-4e66-ad04-3b4a94a33c2b", "value": 96860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755427, "uuid": "ae2ef4f5-1540-4cbe-aba6-b0470ced333c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755427, "uuid": "7b6734e7-d196-427b-ad00-049f7c459c4c", "value": "SecuriteInfo.com.ELF.Gafgyt-MV.89847296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacf20cb-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762204, "uuid": "64d5e98f-7686-4b1c-92e3-9533c92de35e", "comment": "Malware payload", "value": "043299d3da39ac6b984e2e3c9f0dc542", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762204, "uuid": "62f6322c-ef4d-40bb-bfeb-8616f8703839", "comment": "Malware payload", "value": "ad3de4ddb24a55a90c084459c1f81427f7e15347269bf0c6ea4feace79b7d313", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762204, "uuid": "9f4d01da-9c10-44c1-ba6d-504991d54219", "comment": "Malware payload", "value": "3530d15b76d843066dee0d6cb42fc8d938816f30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762204, "uuid": "3b356ab0-e681-4a2b-b71f-7b946e5e1e42", "comment": "Malware payload", "value": "67d79bb2227b99c14faa3036b604a6c7b27f42155e3f211a9c0266d40f1877f6072334dd7367a312051f6c7f07dd102c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762204, "uuid": "371be13d-f1a4-477d-86c6-90ea4fbf1d1f", "value": "T14203AEC4A34529C659460DD750F30188777E44D58AE53366EF0CBB83BACDB88A8BC2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762204, "uuid": "a7425aee-8e62-415d-8897-11b11936c69b", "value": "768:aW/q+NqSwUiPNAbWJgk/IowgqfMJAvcuKmrmp55B896HVoQ0u3C:a4NZDhsqfAAv9Kmre55u+P/3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762204, "uuid": "0d9087e9-c00a-4ef3-a3d1-3b4a768b67ac", "value": 40643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762204, "uuid": "641d662a-1e5b-4d76-b496-538473777107", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762204, "uuid": "4b79a244-ca54-453d-95c5-f2056b583fcb", "value": "idisu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88776274-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782717855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717855, "uuid": "b48d3c49-a434-4b8e-a4cc-5ee5e5b39b22", "comment": "Malware payload", "value": "a0ddbbabdadf9444340633f476b72c55", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717855, "uuid": "a0c155e5-ca2f-483a-a889-d31e7c6fbaa8", "comment": "Malware payload", "value": "ad4ed81f9d31472a7b600a2c6b8f02eb49d4c89c72e8f645e1e72b5b1dcce221", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717855, "uuid": "128cdbe0-4517-4391-876f-58fabc847398", "comment": "Malware payload", "value": "44c6f70b6968a8188d43d43c06f7e28577ad2277", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717855, "uuid": "a10518d2-5c64-404b-ad8c-2da65f9dedb8", "comment": "Malware payload", "value": "07f4095d428975439ad4a187d34583e2d02c04fe5c5b6a163a90f3c8c5c3dc513c9d92e2e6ee75e259febec67e4f1928", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717855, "uuid": "12a09a1f-7142-40bd-9e11-04528b556904", "value": "T19226F123BEDAC46DDDA354F351C6864254AA96EDEC0B907E12E05DC98A30C4B0752FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717855, "uuid": "69f4fb86-c080-47d3-9777-741609275953", "value": "98304:1iRAsf7cL9G73M8zIFwgdG6SFWT0jKC7sL/w9XvsNFHyVD9MjyJdlCTjh/S:MRvf7cL9GI/znCWTG30/whC0DSjyJdlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717855, "uuid": "77561e7a-10bd-4024-8358-ed6b15cb8d55", "value": 4765391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717855, "uuid": "93c40d97-0eb5-45ad-be1a-9c78a41e3b99", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717855, "uuid": "fc2d75d1-1c0c-4430-8b2b-e8dd8fe2e6bc", "value": "rat-lumma.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c369e7c5-73c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782740717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740717, "uuid": "accc44cc-8dc7-40aa-976b-1afa9b0f06dc", "comment": "Malware payload (Mirai)", "value": "61bffcd1651a77e4116b813c4176437e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740717, "uuid": "be963288-de3f-4520-be94-965592989e15", "comment": "Malware payload (Mirai)", "value": "ad5664711a862030d2197afb4a2016631e726419ecf5ff7aa1f634253645055b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740717, "uuid": "74b630ad-e402-4c07-b40e-b4c7d376ce8d", "comment": "Malware payload (Mirai)", "value": "9e680c7e14e03d880fbb103e665f682ead79eb33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740717, "uuid": "c60fe735-1d0a-4f4a-81a3-794cb1655374", "comment": "Malware payload (Mirai)", "value": "c68763163b501bbea5096306f7db50b7964ad885049ec2bd745ff7950d604c8e95eabb3b188499ec4d2f9c762eb6e040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740717, "uuid": "7e185fb4-e23f-42bf-8923-34f9408dbef0", "value": "T106E3F94DF9506B29C6E272FBFB9D52CE32271FACE3EB3011C9304B9523C5A964A36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740717, "uuid": "8cb0c01b-b6e0-460b-8d48-b0c91d5d3409", "value": "3072:+Uz7EUjkVUTPa0g8xdoBqAA0gTLKQ4EiQv5h8p/7OO:NPE7STPa0jxeBqAlgToEiQv5hAOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740717, "uuid": "68067834-8339-4b40-84e6-e299d4b934fc", "value": 145784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740717, "uuid": "913e131f-b41a-48dc-bd07-91e6390ac3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740717, "uuid": "201e6d02-40bd-47b6-b88f-303c216df578", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab13288-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782736783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736783, "uuid": "9b75a080-cbbb-4055-ad8d-99077d205cb9", "comment": "Malware payload", "value": "e39cef2eb1a635ccf6c2d0abc874aba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736783, "uuid": "4607bea5-7bff-46b0-a85f-5065d073789f", "comment": "Malware payload", "value": "ad7da22abd7da559f6b47ba7534f62c054be9818412f05d783d20d561066bd8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736783, "uuid": "9cea40af-f3d7-435e-af3f-d6f620595452", "comment": "Malware payload", "value": "63af0e9674cfb0874a42d9626b568f0a69c4df4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736783, "uuid": "74844a87-6bbb-4d21-84c8-26fc3b0db225", "comment": "Malware payload", "value": "af088f19dec30adf61d495a8dc4d3b4392d2d48928344dd9b3a080354365373d669e43cf9097f6b407bfc5655d08284f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736783, "uuid": "b344087e-ab84-4f6f-8d56-d996ed1f0db0", "value": "T1B7B50BB8749562E33A40F877801D7E1727A17EBE47590C0AC27903ACB57BE9B075E398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736783, "uuid": "7006bcfd-adb7-41d5-834c-0564ce1b6db9", "value": "3072:2fszRNjJWHsqH5aKJU29+eZyCuW2InUavKkQdVTQDDRKop3Fi0dpLk6KhMCOIoXM:EGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736783, "uuid": "1abe8ce7-9fd1-499b-bd7b-ab7a00890aeb", "value": 2478296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736783, "uuid": "92af97fa-036f-4026-bbe2-499649c9a450", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736783, "uuid": "acd91143-6e16-4d6b-b442-c3a30a0fc8be", "value": "Updated Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edb36b3-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773271, "uuid": "7e96efac-1900-41f6-80ea-fd3d2402471e", "comment": "Malware payload (Mirai)", "value": "35f1ffdd700a1de90138413f8aea7a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773271, "uuid": "62107487-4847-4d76-b8cd-002bc8852dd4", "comment": "Malware payload (Mirai)", "value": "ae90b42ef39905492d1950705c95a45466dbddb952fe7076c72d4a7a322e80ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773271, "uuid": "8018e0c2-140b-4dc6-ad40-849b38f2d793", "comment": "Malware payload (Mirai)", "value": "d33ad475106b58cdae8af9f581b61d9b6558c954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773271, "uuid": "cc234705-c2f6-4ff8-b52d-c95076c90f33", "comment": "Malware payload (Mirai)", "value": "a56839b7a8c1b3e40e0ea92fc956d61565ba2f295e59d8ce131c27a589787d3679dbfbd942fcd89d47e496b3a76aaa88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773271, "uuid": "05387730-3bbf-4807-81d0-940d45434cbe", "value": "T170535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773271, "uuid": "6b45fb08-92d0-456f-aca5-6fee63c4eb6a", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6uQWP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bnP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773271, "uuid": "68746e8e-5b77-4fa2-b799-3d3e9ac90334", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773271, "uuid": "859be818-997b-4d00-8cd2-35b8da5b52e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773271, "uuid": "4176db49-3fb3-4ba9-b75b-b1745328c4a8", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ba0013-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782712515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712515, "uuid": "52c9f521-0b8a-4985-90eb-114c5ca7fdce", "comment": "Malware payload", "value": "6d120fb20d979bca316471a1b131a658", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712515, "uuid": "281e1054-cafe-48eb-849c-169b1cf6dd2b", "comment": "Malware payload", "value": "ae9bbc99186978c554d943b81ebbd88ee08d605c3401c1b28d3a330eafb319eb", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712515, "uuid": "388282eb-be30-4440-ad53-4372755badff", "comment": "Malware payload", "value": "ab565e3f8a1299b859594ecc8a416d651516bf0d", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712515, "uuid": "2f9c2782-ce5d-4812-8fc4-258c28c0476e", "comment": "Malware payload", "value": "71288ec4f48230d7396912c1f754da989fd601e1d2e129e1287f1023d6fecdd09a7009f93eb4b41003ef95dbda4ed221", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "yigu360-com", "colour": "#1FA8D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712515, "uuid": "b1d620ca-cdf2-4566-856b-50d18d609b51", "value": "T19EE5338BC5FAE4AE7C77053083D42680D327406299C394FB49E3178EE1A77459F6AD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712515, "uuid": "f11089ea-7ab4-4a26-a5f6-ac30c5a02b23", "value": "98304:hO3vV//reAIii4dMd/O2RXrg18sb7bEU8oDZzI:hO3vReuBdMd/172lb7bEtezI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712515, "uuid": "04c4da9c-760a-4249-9c00-81b3fb03c43d", "value": 3183392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712515, "uuid": "539e5b55-cb86-434e-a092-a1334be3b928", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712515, "uuid": "4bf43f77-8a8b-407a-8f97-47a024b20d71", "value": "jenniferloeffler.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe60d0f-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701144, "uuid": "84a3af25-703a-4f3a-a506-bcd4050c9fd1", "comment": "Malware payload", "value": "6683b3398329c8abf328e83d73f77f3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701144, "uuid": "310eca82-c381-4dd9-922d-b7f39f343a11", "comment": "Malware payload", "value": "aea6903557be0a19feb9d6ef7de452e9ebced6fb06b2ca98a04a0575fc3d9f75", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701144, "uuid": "49982afa-7b59-43bc-a00e-874813afb9cf", "comment": "Malware payload", "value": "6926a605a374988adb8dedcba73468b05a8e0567", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701144, "uuid": "a7ca718d-afa0-47a8-8118-96c5d70bfabb", "comment": "Malware payload", "value": "df7e6a5d1bce5b1957469843edf93b72cd715dd0dc4cbbfbaf620c0b04aca16a00599f9416564576d5797e848ab098a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701144, "uuid": "1f74724e-d003-4ad1-9364-9e1cda3ed7b6", "value": "T10103BFB352468AB5DBCA01021CCA57714EC5082A53E0F7DBDB0959C3F6E1637B91B2BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701144, "uuid": "4f309d67-9e42-4ca1-92c0-11a020d69ed3", "value": "768:2wVzATTEx9yRGjot33ieRUMLyBbXtstIk74jz/34jUvV3FF6rA66przrRoS:2SQGe3S0LPgjbEeV1mEnCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701144, "uuid": "a87fd514-deac-4af9-aea1-26e393eae5d3", "value": 40695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701144, "uuid": "fe845282-abce-4e0d-8adc-1ff50cd6d284", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701144, "uuid": "3cc74462-f50c-4bd9-a720-2293aa39fbcf", "value": "itiqo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abc988c-73d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782747306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747306, "uuid": "699ae7d2-8f09-4713-b57c-9601cdc9a585", "comment": "Malware payload (NanoCore)", "value": "5fea3f930de097794a95ced9dbae500c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747306, "uuid": "8a1ba755-2122-45cc-a0e0-fdfc01570edb", "comment": "Malware payload (NanoCore)", "value": "af154a4bb20730e0d8f7e88179b1797d8e67b23302ee2a0fa152dbd23a39a9dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747306, "uuid": "13c39bcc-dfcf-4322-a7dc-08c4d15fc0a1", "comment": "Malware payload (NanoCore)", "value": "b6c0e1b9da3c8f21bffbe878f58f3513848f3748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747306, "uuid": "ab99a294-970b-4b86-9cbd-6ccddb18ebbf", "comment": "Malware payload (NanoCore)", "value": "865eaa05e14b181c3cf240fc0c126b984ebfff07330212a1af59ddfb485619593f916769de1d6996b472a45d7e5b508c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747306, "uuid": "1db33c9d-4ffd-4a2d-ad97-bb1f19b3b956", "value": "T1D614CF563BA84A2FE2DF8679701212578378C2E398C3F3DA28D455B79F167E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747306, "uuid": "23eae590-b3d4-4f79-9eb5-16f608b610b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747306, "uuid": "aa57c49b-5612-4bb8-8be2-9c47e60edd76", "value": "6144:wLV6Bta6dtJmakIM5UF4ZMNCx5YKdiysf/u:wLV6BtpmkRUMQD/iy2/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782747306, "uuid": "8bb3c531-ce47-4690-b679-f37266f173ed", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782747306, "uuid": "e2a31084-abb5-4677-a49a-4564e5238e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747306, "uuid": "d37deb17-ad03-41f2-b54e-6f9669002467", "value": "coinx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad079fc-73a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782730744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730744, "uuid": "e5e758cc-191b-4790-ab67-0df66d7f614b", "comment": "Malware payload (Mirai)", "value": "69f1053d738f9bf654b628047884d499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730744, "uuid": "4a096ff1-1657-407b-aaad-9f41afc797cd", "comment": "Malware payload (Mirai)", "value": "af4030b2e20d415ca603cb67077181c8eb1cd5549b4d1fb849a7bbb5d93003b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730744, "uuid": "b5f52da6-0b6c-4bbc-94c9-aa46fd62cb52", "comment": "Malware payload (Mirai)", "value": "8670c927234780b92d48e86fad8d045418ab98c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730744, "uuid": "6ed50f02-b16a-4317-819c-6a430fe79288", "comment": "Malware payload (Mirai)", "value": "a44759865615a8b4c86881d47d68e45f7183c34c2dd78ac9480b185e325a43b87f91f6531433f2128030d7ce754fdaf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730744, "uuid": "403598e5-58f9-4529-ac79-45dae6cf82bc", "value": "T1E2D3E71B3F619B7CF6B4C33897B34A71A29822D136D5C280E1ACD7042E7435EA51F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730744, "uuid": "64839192-c629-4758-9154-a893a72619f9", "value": "3072:uOY0vMVmUI47SAtI/NrlHAfGsCZnmI2aByS:uOY0EVmUBtIVBHLmI2aUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730744, "uuid": "0fb252b7-21be-486d-831d-ef1537a81077", "value": 130176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730744, "uuid": "2d2e4114-2a2a-487d-b48c-38f27b5f93f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730744, "uuid": "0f4e8a8d-8393-46e3-b61a-3ce29f9f667d", "value": "yvP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db6606f-73c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782743419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743419, "uuid": "373f3be3-f4fe-4736-bade-8c237b41b06b", "comment": "Malware payload (Mirai)", "value": "c67a479516588e31d25af11cbfe4bb8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743419, "uuid": "ec2037e5-5ed1-4146-a973-2536070f330c", "comment": "Malware payload (Mirai)", "value": "afc38f84a7ef0d655eb933d98b57bbbe4afcf68caff79be80f0b2d16e88b4355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743419, "uuid": "ef25e199-0dce-48ad-b8ad-77c7a4f42cd2", "comment": "Malware payload (Mirai)", "value": "cb2c763c25fea3aa9d1958867a60a0f943f90e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782743419, "uuid": "69ee9e10-268e-40e8-b520-44a742be7805", "comment": "Malware payload (Mirai)", "value": "90dbb90ea255c602d7e8aeb1f43807c5194575ce7b9f2294468d2436837c770dd130cc8f0bb03b95a7e2c128e30c7bcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743419, "uuid": "0323c35a-d104-4fb1-b022-2ba515a090ac", "value": "T1AF530253C78EBD76C638BC26E1985703F5907BB9A1DF3222862971B34243C29D5B7E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743419, "uuid": "5d0be53b-5e50-4e0c-8f43-c9043ccea5e2", "value": "1536:6eX9cqRSiJbdlZ4DLDAWZYIOrbQY33SCWLkdz0W+nYabk2ZxlqlY4m:6ucqRSiJh4DLcQYIO3QY33NY/W+Nk2JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782743419, "uuid": "66dd328a-9d0c-42a6-a5b2-2f597520d6d6", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782743419, "uuid": "f4a60763-92a4-4ead-bd3e-d3eb676895d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782743419, "uuid": "e54efc9e-6716-4ec9-834b-c05524c38d59", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e215c7a2-739b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782724877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724877, "uuid": "1e6cbbe8-228e-4778-9e67-61a455eee94c", "comment": "Malware payload (RemcosRAT)", "value": "3736419cb312c1b8a8439eadb34daa40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724877, "uuid": "e54acd08-da3f-4ff1-aad4-5b492f7983ee", "comment": "Malware payload (RemcosRAT)", "value": "aff8f851155a1e45b120dfcf0ccd0ff9679ee0d3ae4284b09d01c88ff46b48bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724877, "uuid": "378c51b6-d1ea-431d-86e0-4791fed6738c", "comment": "Malware payload (RemcosRAT)", "value": "731ec7a0305b8e3a52e38a237cf7244e58fb3e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782724877, "uuid": "7b0c97d9-c170-46a0-a872-b0e98708deed", "comment": "Malware payload (RemcosRAT)", "value": "02fa2b36d4350541ba79c25c41bfa2146ce99111b6a549b1306932a9c089ccea63b3e8df4f9a464d2fd8344f80294de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724877, "uuid": "d4a31a91-c580-40ed-b6f0-7f6790b82e75", "value": "T12065F1D83620B74FCD528931D964ED7496A06C6AB207F2A354CB37DFB95C112DF08BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724877, "uuid": "1b3a7804-a1ab-4870-b047-15add07c60e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724877, "uuid": "93ed6c34-723a-428f-b214-a771186f58f6", "value": "24576:Fpby1BGxxhsec/LetCJTablfGQ27taHflHuzh5tX1Eqkfa8Lz1:yexGec/iKeGQ88/lOzhDiq8a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782724877, "uuid": "6e810382-5423-4eba-a145-c969ad9a48db", "value": 1444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782724877, "uuid": "df56e6eb-8849-44c7-af3f-e8088e9a0509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782724877, "uuid": "06febcdf-01b5-4c27-ba3a-80f271891524", "value": "PI_ #4950039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e600448a-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782697825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697825, "uuid": "d28c2126-66c0-43e9-9030-e6400cb739ee", "comment": "Malware payload", "value": "b1a2f5fb23227349d5d918295542de05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697825, "uuid": "86b89914-57be-43df-8bc5-f335e594a4e8", "comment": "Malware payload", "value": "b06c409f92313ddf10c70507a0ac07d9e5b9252b2e1683f15277f83c2613e5cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697825, "uuid": "dbefda8c-6ea8-470f-a320-431a0d4f939d", "comment": "Malware payload", "value": "3ff4ba6fb8d572f161b77e7c46fc5d33c666825c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697825, "uuid": "6c732616-1644-4b82-8c37-1f0165702672", "comment": "Malware payload", "value": "19d524348bc39edaee856e105c39b356d6cd27e3f989b2aa1fd49c16137848fdc33255a3f1c698673a077970182d2857", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697825, "uuid": "2e81cd6c-5401-47c7-8237-e77284c632f2", "value": "T10E33B06B92832277ADC0339CD87939A491EC554381587BBE319D6C061FC946F7A2E13F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697825, "uuid": "0a04e186-3534-4bd7-aace-f157c3cc513a", "value": "1536:XAfb8DHnUSfmbhjFRP82rUqeCPHfEQiq+zrU3eQpwsKrhMbh:L0KZqUqeCP/TaNrhMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697825, "uuid": "8884ba71-6daa-4d43-a3db-b9790ef03c66", "value": 52986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697825, "uuid": "58ba862f-1517-4fb7-9413-c81b435e5067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697825, "uuid": "dce4784a-2bed-4a00-90da-3d941596537b", "value": "ocafa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eacccb-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775292, "uuid": "d8c66d14-412d-443f-bba2-79eceec0cac7", "comment": "Malware payload (Mirai)", "value": "44b904f37625e2c455231d3d1e40ba02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775292, "uuid": "5bd61e90-9030-4ff9-b68f-060c9496185b", "comment": "Malware payload (Mirai)", "value": "b0b9bb6785cf9e0216c365a9e231eac747c3d5236b1f29677b3444acc1a918ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775292, "uuid": "fee51a33-8997-4fda-9b36-c48cd0f91964", "comment": "Malware payload (Mirai)", "value": "e0e05d2141b79e7e3d02589dd9a1530e2f29dbf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775292, "uuid": "128c53cc-476d-44b8-af56-1fc4f212a03f", "comment": "Malware payload (Mirai)", "value": "c7e3dae48a6ca9fe2c51d8c08170d00575999679567fe96e75f8d65fedf099bb82b7c4ea4c88222279219686292a9b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775292, "uuid": "c2f774a7-913c-48db-9fe1-88deb94602bf", "value": "T1ACB33980F98B80FAC5078C3461A6F63FDE32D5A94173CA9DEF959F32DA3B541911228D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775292, "uuid": "f71f6b4d-bc5e-4e93-8900-b3bc2d9881c5", "value": "3072:fAriZAVY5/QJPxHSHNeNyIVxEUfLfZk17r6Q+mTRWyh8:AiZAVY5IJZHSteNb/LjhoMQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775292, "uuid": "e6c9407a-7d17-4716-ad6c-2e0386d05e82", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775292, "uuid": "b15e078d-aae6-4e81-a091-e95d5838bf94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775292, "uuid": "765063ee-bd24-43be-9f77-7b8c1c512638", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bd9714-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737694, "uuid": "db849e76-fb50-4fa7-b7e3-1696efee4d49", "comment": "Malware payload (Mirai)", "value": "1b7c4148053149534d6d020ddb0eee00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737694, "uuid": "dcd355d2-63cd-49ed-99ba-6661ba65060f", "comment": "Malware payload (Mirai)", "value": "b0e624722a14ec752e8cb54c97fa44c49a10267f20acfd1be8c828b60bec50b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737694, "uuid": "60f6f3d9-a2f4-4632-958e-183b1856957e", "comment": "Malware payload (Mirai)", "value": "027bea302b80bf9d07b538b3e0560d45f96bd0a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737694, "uuid": "b745dcf3-0c95-41c4-a78a-05ff38bc5b7e", "comment": "Malware payload (Mirai)", "value": "98e8082ae4f2a881b96c256c4efd482ee44cf23e8df616847d4559d037a98feb1339a53b22e9913b6a6bef2a0a7a5f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737694, "uuid": "d2cb98a0-7842-499f-98d1-110f420c51c5", "value": "T10A13F1515B7ABEB8CBF5093BC17C4DCA66EA2DFC4231632366A64BB8C4440807ADD685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737694, "uuid": "a9c599b2-a05f-4d26-8e7a-a6a071b9106d", "value": "768:3/dYr66PqjnzCogWE2BaVXou1Xm05Q6Qbqv/IKQaCuyRPERbSrOg9q3UEL8p:31YnP8zhgPm5u12t6QbSCuyRPMOrOpLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737694, "uuid": "3a68f01d-3393-4be0-988c-2feea4143e12", "value": 44756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737694, "uuid": "e7c5be3e-2c0d-46d6-a0ac-8e21f0bafb9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737694, "uuid": "f253eb92-7ac7-4b57-b76c-5b38d3a64521", "value": "b0e624722a14ec752e8cb54c97fa44c49a10267f20acfd1be8c828b60bec50b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebeb9662-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782716733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716733, "uuid": "aacd2242-70d1-4553-a9ea-8950d3545a09", "comment": "Malware payload (Mirai)", "value": "e84d7d9eca8a89f8070a9e595a7593c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716733, "uuid": "bbea8949-5a33-4c7f-ba3f-18cdfc009d1b", "comment": "Malware payload (Mirai)", "value": "b1ca1a4b6c1413bfc293741097ba1a341e289c1673bc4b681b572b688c442954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716733, "uuid": "2d68ddea-2781-4d02-9579-6facf7d66ab7", "comment": "Malware payload (Mirai)", "value": "4129d3faabf8eaeed4519ad5ae3d000696914372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716733, "uuid": "5137a4b4-8755-4909-8e94-5603b92cd92a", "comment": "Malware payload (Mirai)", "value": "ae492e1a889ba22d8f68e20f9ad381340f504299c000d279477dd2fb825f7bd6091c91fcacbd1c80f07bb94a330b1601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716733, "uuid": "30fed3cf-eb0b-4474-a086-df9b60b39d92", "value": "T19B6302BC3A1713E4E98E54FD3A80B34076C45E27F17C8D56610CD1D3A67B582A0A76D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716733, "uuid": "4f1b42d4-1f93-46b9-b619-ef0695fd8ddc", "value": "1536:VpNQ+JUdb+XT1BU6MMYSJVXzgWvS0wk7ihTkIQxAJgZ4wuVSF:xQ+Gdb+XgzizzRSsnINwuVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716733, "uuid": "3ea4c33a-90da-4c13-a299-a6ed0bdc2e94", "value": 70424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716733, "uuid": "f5512089-53a3-43a7-8f69-2fd582aca7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716733, "uuid": "e444d0a6-1350-4a2e-b232-980b2c24b374", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4fdf97-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712947, "uuid": "4f921aa2-dd41-487d-b697-f48ecfc4b6b1", "comment": "Malware payload (Mirai)", "value": "70959cc32d05bb42ba5e399f9d6f146b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712947, "uuid": "28a5af58-cd23-4e3a-ba9b-c9b3b7711933", "comment": "Malware payload (Mirai)", "value": "b326f6700c07600a0d1664eaf2a757b0bcea7b993114360e04d6f7f02a97c9dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712947, "uuid": "ce3cd7bf-b54f-469c-ad96-3abf49e89f37", "comment": "Malware payload (Mirai)", "value": "c5e370526b489148cedf1974354feb1d41a10bef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712947, "uuid": "07d3e671-297f-47c9-b9f1-644332df81b7", "comment": "Malware payload (Mirai)", "value": "785c99d5bcd252b34cb7e24870eeb589a2751dfe1072813874c04feeb11730472eadaf4a2e5d0417b53e5950f256fe2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712947, "uuid": "01cc0a0a-c928-4984-865f-2acf9f03394f", "value": "T13F735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712947, "uuid": "b45721a6-b2a4-423d-94f0-f266037cd196", "value": "1536:jP+SbCGR18pspTH1+DQ2tXXUN95s0xwlWptCMR8/pW:zf4yVwpENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712947, "uuid": "5360debd-02eb-4a40-994e-b044de2ebc62", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712947, "uuid": "80e0bdc7-cd8b-49ab-813d-a61ec7d7db3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712947, "uuid": "0b011555-7a8e-4faa-b083-b4f550db7b10", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6cb5e5-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773379, "uuid": "6851b02e-2680-470f-866e-16716baef24e", "comment": "Malware payload (Mirai)", "value": "7b450c2c166f1103fea060eb4afdd40a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773379, "uuid": "f031fa2f-1ff7-41f1-8a3c-ed094b0a0fe4", "comment": "Malware payload (Mirai)", "value": "b3a346cecace10c6212e65fe8f24fb25057f1efd72b3cefd69736ed2f1f1f5e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773379, "uuid": "4766dcd8-3b94-460a-8a5b-c668124bd8ed", "comment": "Malware payload (Mirai)", "value": "2e1f1c53625376adea047f39baae16fd9ff46935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773379, "uuid": "cf9e21a1-2787-43ff-a844-d5c0cd9406b3", "comment": "Malware payload (Mirai)", "value": "18603943df306b0bab526078243052c7bc4edd0e6711ad88d6cba1f4258f919ef12c2cfb103a277332e7b60a31de338f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773379, "uuid": "15d9a264-f00b-4f4e-a31d-77b2c7d483e1", "value": "T1D9832A97F400EDBDF80AD77B4453090AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773379, "uuid": "51523678-4848-45d6-8a29-2d2cb5951119", "value": "1536:quKG91p4sgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTDxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773379, "uuid": "91e30b84-623e-4a1c-8af2-f3e4c1b57612", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773379, "uuid": "dcb8aa9b-8d0a-47a6-b334-9a3e29004ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773379, "uuid": "08366bec-67fa-41ce-b010-6568c553a912", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8c58c4-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769561, "uuid": "5a7bb0e8-5260-4cfe-8785-40abdc34a7ac", "comment": "Malware payload (Mirai)", "value": "7969a9a1347b61d12794fb7b152620c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769561, "uuid": "b3ca8232-9a9c-4ea7-838c-58ac2ef85752", "comment": "Malware payload (Mirai)", "value": "b463b4bd78682210a7876555be1251453be68c65793d48ae640ad5fa0ced1882", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769561, "uuid": "a15eb4cc-d6ea-4f04-ac07-848cced3e465", "comment": "Malware payload (Mirai)", "value": "dc871cdc2a6a4fb15c8bcbec34c4967b076d26d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769561, "uuid": "b57bb4b0-cde8-42fa-9c19-10461078c2e1", "comment": "Malware payload (Mirai)", "value": "521191d1d6f4c5e05c61b3572b525bd1a3984f71416cfdfed261f6f14771cdd42241978150f2d6f16cd7b2761856e311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769561, "uuid": "2a0c6922-9afc-451e-a4d0-6335791f0ebd", "value": "T14023F1C4F6328A89D966F276646F70870050D90E7E62C5B9C5C12469ACEAF1CAE3C7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769561, "uuid": "1b3a1dab-dae6-4eb8-add1-cfde05f7a82a", "value": "768:jQKTOSNoekrlarmeqOskbq32vfVEe6pX5scM4iSFZIGnnbcuyD7UHQRjV:jQKTOGoeO1eqh32vmD5ziAZIGnnouy8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769561, "uuid": "93e12fa5-e45c-4f6f-b2cb-46562e08d9a3", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769561, "uuid": "c3dba164-3970-4c1a-9d17-8f8542f10b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769561, "uuid": "71d4d6f0-1585-45e3-93d4-29b4f6cd1aea", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89394a6e-73a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782730741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730741, "uuid": "26095ec9-1886-48da-9c4b-55b2f21e2b41", "comment": "Malware payload (Mirai)", "value": "ce369f00ce3a53e81b25bc5981502ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730741, "uuid": "627a04fb-340b-4a37-baf9-7a8b68336936", "comment": "Malware payload (Mirai)", "value": "b46a4ea54acc819f966c8dae64594d77f5c31b27d38900e57e1706fffa31c9f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730741, "uuid": "4210ac9f-43d7-4e0e-ab9c-a6ea8f47b3e3", "comment": "Malware payload (Mirai)", "value": "793caf81bff1bdf4bdf0a6886c3eb3510f3edc6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730741, "uuid": "4d2257e9-9a78-48ce-acb6-1df97e3ba76e", "comment": "Malware payload (Mirai)", "value": "3af0e4a4fb3ac9ac64871134efcc6e4560ecd87bb8a044af83aa5fe57cb9472184c2c1d8fdfb34739c7917c321bf0619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730741, "uuid": "94caf882-bf23-470c-b2f4-bb5df7f4c9e8", "value": "T1A7A3286AB8809F05C9C1057AFE1E534D335367ACE3DE7222FE145B2C378B56B0E2A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730741, "uuid": "8eb77c54-7e1f-4c39-9408-15d0ea5edc0b", "value": "3072:KJOc2o6u3LmAOY8s4pQMJa2nD6LXlwI2aBg:KUc2o6u3LbOYV4pQYahWI2aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730741, "uuid": "7d666ab9-a498-4d05-9102-481020f2c9e8", "value": 98632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730741, "uuid": "fec12f35-adb2-4c09-8e6a-289c15ee92b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730741, "uuid": "cd694018-68cd-45ac-9b6f-829fe7d915fa", "value": "UagA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ae4328-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712805, "uuid": "f322d54e-6b85-427e-b47d-d0595f0f26b6", "comment": "Malware payload (Mirai)", "value": "5fdca2c508a717953bbc89f2f9f6bdc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712805, "uuid": "0756668e-f964-469a-88e2-911f6b7fe43b", "comment": "Malware payload (Mirai)", "value": "b4864bc11a6bfbc3cc394ab7ccaf27701bf88746caeed517b460241792b12f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712805, "uuid": "8d95ba76-d807-4914-8784-8d95f27f50be", "comment": "Malware payload (Mirai)", "value": "15d6e2952c71bf60d9397526e88047f5588044cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712805, "uuid": "8442cbb9-7509-4616-a6ac-138fd7727edb", "comment": "Malware payload (Mirai)", "value": "f12275586706a1d352adf1018068ce60fdcefc50b64eba5d2f1d2a78fad944f7f1d0ccbe8e44f6d1cf7e842c0492abe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712805, "uuid": "4578450d-ec4a-467d-bf89-5757c28555fc", "value": "T135360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712805, "uuid": "e5f6e135-cb70-4cf8-bc94-25da64187ed5", "value": "24576:MjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlNn:k559Id2QET/bY+Ay8ZWPMJyB28wAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712805, "uuid": "6f8e47ce-fa52-46cd-ada6-70bc694a4584", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712805, "uuid": "9843cc0f-0b81-471b-b119-3e2340050e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712805, "uuid": "f6145e9e-e316-45aa-8f79-46f5a32b597a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee748b3-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770667, "uuid": "37408303-e9cf-49fa-b623-a36b8cf37496", "comment": "Malware payload (Mirai)", "value": "053aed9d14db57e4b0e5894b5dee7d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770667, "uuid": "a6efb841-af07-4be2-8ced-42f310f7e557", "comment": "Malware payload (Mirai)", "value": "b5331c5a2934b2ff4863bc94d14b1ba89cb1070b34814470dce5d0e4750aca3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770667, "uuid": "f8d44655-8f86-4aaa-9ad2-eba674bbda76", "comment": "Malware payload (Mirai)", "value": "7bb9852340576399d1041d833a4441d8df80998c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770667, "uuid": "7deb8acb-bd7c-4d34-a847-f073263b168a", "comment": "Malware payload (Mirai)", "value": "5bd194fb4e76035bab55b7cf2365e710ed273f73edb866b6e80491d60454ad8464a83cd3b09f7472a9f0d15e8668b370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770667, "uuid": "598e06b8-b21f-42cf-93c3-c67b286b799b", "value": "T158D3D81E6E218FBDF769C33447B78E25A39873C622E1C641E17CD6115E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770667, "uuid": "b3e4dcf9-1c68-4ea1-a999-adac94e86b47", "value": "3072:WEyxpsn1wPuuvIJnNKBkKNQYRKMpw+grwDAg48+:Ap41wPyJnNK2Bnw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770667, "uuid": "d6bbc252-cf06-4faf-b0af-ded677794280", "value": 138276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770667, "uuid": "80c51a1b-ea2e-4125-a0e8-8b663b2e90b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770667, "uuid": "6cf7720d-d973-4655-808f-f4a2cc1938d1", "value": "nerv.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6fb0e8-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "1a1dd6f5-8c41-4f5b-9ec3-97084f8df32f", "comment": "Malware payload (Mirai)", "value": "a881c38e9259d30a8b4524fc26d09ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "64fda970-8191-4d2b-a2ac-e98dcc9b7aa7", "comment": "Malware payload (Mirai)", "value": "b5c7ac1345074e9aea48617010e887d570a53868e1802566f3f6e63bb21bfd4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "880b14a6-a84e-47d7-87da-908fd0208789", "comment": "Malware payload (Mirai)", "value": "64d98c9696c2e707360d5529bd84d890cb99d07e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775285, "uuid": "8cd1e42d-0cba-4663-b711-403b3323a8b0", "comment": "Malware payload (Mirai)", "value": "ce353f99c063cbc059fbde669e4de073998217dde131ee8386380ca20b46587886f5f119ac6548b9776bad0434a9ca52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "76ddab26-8454-4f05-a0eb-b1b30f17e323", "value": "T18DD3AD97B64721A1C86302F40BCB5BDD2E9362826F5BD8E77C2F757B583A0DB4402B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "8626e2e0-fb60-4827-8eae-22552bdc041f", "value": "3072:TCIRz+2jCWyXfhIEh9oGQVPn2ObFguvaq:T/qdRdQkyvaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775285, "uuid": "afcce96e-7f7b-46da-9b1d-c2d312b430dc", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775285, "uuid": "f8dda266-b4f7-4c3c-9a76-6cb48d27d425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775285, "uuid": "28b9fd2d-6542-42b2-8d06-87bb6d4dac89", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a908a5e5-7364-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782701159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701159, "uuid": "1c38dc43-6751-4c40-b393-4767c185df92", "comment": "Malware payload", "value": "ab26c7a9cf0af930f1a9ec7f23a24405", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701159, "uuid": "2a55762e-41ba-4e19-88a6-80bd6dbd31cc", "comment": "Malware payload", "value": "b679d7ee3c0b60c9e36f38065b5854388f9d8f859bceb6f4c20a994faea9ae42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701159, "uuid": "37aa173d-73d2-4d7e-92d5-4fedb9ab78ba", "comment": "Malware payload", "value": "e3177eab32ed4077f19dfb6ad32049fd6209b835", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782701159, "uuid": "70839410-9105-447e-995b-5fa4d0e0666b", "comment": "Malware payload", "value": "6686d35d1cc3e75f99ff63b96beb972ac4a3169dce0c6513447da30af29f9db59c4f4a6cd1592582422a3867b190c2cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701159, "uuid": "fee8f4a8-864f-4043-8e04-0e0a518e159b", "value": "T136A290435948A5BB583A96CF47B8D5CDE153F5EF7031B8AA92400217C8A5C33BC2D1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701159, "uuid": "80004fe8-dc78-4459-a732-9b266cbe6526", "value": "384:5ki1Q9SCDB+Np+eefSLdKww7x79eT5V6siKOXCEzzVswoeD1KNVL2cVFDpEVRuFS:5kiq9SCDBUpSSLdK/7x799KOytwoWsNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782701159, "uuid": "72b71841-a6ac-4ebf-bc6c-67b22f795238", "value": 21519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782701159, "uuid": "1f6474f4-2dc9-49df-9b72-fd920faf4b1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782701159, "uuid": "8b564e55-c8f9-4d5a-8c82-f74794933b49", "value": "utevu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d62b2e-737a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782710334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710334, "uuid": "3f853172-9ce2-4ac1-b36a-a57b1ad000ee", "comment": "Malware payload (RemusStealer)", "value": "f98ca83e1f97c8a5e5e93baa824dbbd4", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710334, "uuid": "942108b3-f7a2-44d4-a2bb-26e158a2bcbd", "comment": "Malware payload (RemusStealer)", "value": "b6db106e9f604fcd4fe843f791f895faf20ec5af4ec02ce2efba4e8a3c43880c", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710334, "uuid": "abf04225-49ca-43c3-89c3-e38dcdd31484", "comment": "Malware payload (RemusStealer)", "value": "8a043bbcf94729ba8db873459dd41d50019e4a06", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782710334, "uuid": "c4f9cdf7-0b30-4d40-b26d-e34a9ffc41bb", "comment": "Malware payload (RemusStealer)", "value": "b7e54e9b9c73f6bd7abbe00577b53add0c499a978b6da0e03a095f09b832552af511e19157b4ad3f32034eedf46d8a36", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710334, "uuid": "12551e71-99d6-4359-b054-9e9303022cc0", "value": "T140D54907BEA548E5C0AA923188B7569A3B75BC480F3127D72E90B7383F727D09C75B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710334, "uuid": "0b0c4764-ea8b-48a3-8a88-47057640171a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710334, "uuid": "146f76ba-b4be-45af-92fa-872091104712", "value": "49152:iq05xeAB9qbT5CJ5OAHAQq4wb3lbcvYrcT:iz209ArS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782710334, "uuid": "1575318d-dd72-42c2-8b25-7bcaf49ab14d", "value": 2752000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782710334, "uuid": "841b4007-d352-4d8e-b004-b1866e7071d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782710334, "uuid": "ee648a0b-5572-4373-b769-55e75d0ad086", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682cebb1-7356-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782695037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695037, "uuid": "28e961fb-cb63-4b4d-b5af-2894fdf0fdd4", "comment": "Malware payload (Mirai)", "value": "1b07b1abb454db6209d22ea0f5bdfdb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695037, "uuid": "22f644b0-03c9-427a-b537-203c33d0bade", "comment": "Malware payload (Mirai)", "value": "b6ee4323124dfefeb90de7e2b13e79a64a84d18bdcb10a878e4eae787fead1aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695037, "uuid": "cf52fea9-c693-4ae7-8db5-06df5e1e53a7", "comment": "Malware payload (Mirai)", "value": "3223d8522f2f29dfc084133cc3f9fc6f4fdc1067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695037, "uuid": "18fb6776-a811-4e1f-917a-e50e0f7faa2a", "comment": "Malware payload (Mirai)", "value": "67ed7f5165996cc3443828189212862f0dda960cfec7d35175fb9e0f2e6e5ce5c8d7cd5ae69f6bd695e70c1eb1d2bd83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695037, "uuid": "6af8fd55-4986-4257-b1a8-479e12d7d704", "value": "T124C30945F8515B13C6C216BBFF4E428D7B2A079CE3EE720399256F21379B85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695037, "uuid": "d0f60805-ceb8-422f-b93d-3fdc710123f2", "value": "1536:hOV67veEqdD2cZ+54VuyeTwTvXJ59XOWQbOkY8e4lxkwywl/aWH6wcKkrnSIRr:zfqd1O4lesTvXDY50r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782695037, "uuid": "aee1aef2-74ca-4b47-871a-7b35456480d2", "value": 129548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782695037, "uuid": "8bdf48e3-774f-4f68-93da-4cb2831a8b3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695037, "uuid": "011cf838-d815-4cd1-83e1-f1deaaf33ad6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2ca348-7362-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782700069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700069, "uuid": "e4bd1c62-a38d-47a2-b80a-25214c8449f5", "comment": "Malware payload", "value": "929c9a58080dd3c2acc0c7c3cb6d9942", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700069, "uuid": "0f0f6287-a359-4d48-a26f-6e392c21c354", "comment": "Malware payload", "value": "b802d47e3a508ef7a818d7a456fc6b6a14e211d76f9dfb26bf958dd2a38b59e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700069, "uuid": "6d7528bd-4b05-4493-8a0d-600ce58b2b90", "comment": "Malware payload", "value": "89aeedab6883b34dbe02df309188320d0e2dbaef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782700069, "uuid": "c54bb224-aac2-49f8-acef-b2f0d1989a45", "comment": "Malware payload", "value": "edf41a1ff9f12f4d16d59fed60b3744675f6dcadf6750dc0795272fb4b7f19e738bfe2c9f655feabbdf71f006be6641e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700069, "uuid": "1ecc8162-4a62-4a2f-9204-9d32f787ceae", "value": "T1C3139EE1EB1299FACBBB7F53046E01F09D9C896730D4B84DA7483361298FE2479A11F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700069, "uuid": "69043664-8796-422c-a7d4-73872cfb5e88", "value": "768:uIsaLAYjKQreeckYK0Fs7In13j7I+9KkVQDTZ1ywjI4JhlPCh5zJzO5KB2N9ylWh:FLljJ18F3nIYKzOwjXlas5rByc59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782700069, "uuid": "7f3dee10-a0fa-4bcc-ab51-a589c4daf40e", "value": 41976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782700069, "uuid": "2ebeff72-173b-4ef5-9a17-3f69f70660cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782700069, "uuid": "363b51c0-e4f4-4015-ba1f-237e35181265", "value": "agime.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686cd2cf-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775354, "uuid": "4969a57b-6c91-41b2-b6dd-39555175de05", "comment": "Malware payload (Mirai)", "value": "8e944b998d487449991a53f343c49e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775354, "uuid": "dd750bfa-0f39-4660-b97d-38ec24e24c10", "comment": "Malware payload (Mirai)", "value": "b854094b3d704b2d70bd0d1458a648dfce74e2a3c16cb1d88967ae12f22d383a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775354, "uuid": "fd653e1b-d46b-4de4-90f4-6be3d5cd62b6", "comment": "Malware payload (Mirai)", "value": "0d1d2e7e200a6286a552694349081ae94aa8300b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775354, "uuid": "81608a7b-6360-45f0-9f41-f5bb073e48e4", "comment": "Malware payload (Mirai)", "value": "fa5185277dd55dfa612b9224d2bf0c4eea069ba4542c186ac0698712bc5ee8809c25d26d887a8145387c0c0090fa8778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775354, "uuid": "4e6c5900-a5a2-494a-8ace-86d875765b4e", "value": "T15AB31906B8D48DFDC086C23447BE7537DC21F0ED0278B2AB67D4AE262D0DE625B1DA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775354, "uuid": "a5671774-c21a-4db9-ab85-8c92f76c8836", "value": "3072:asW5+8ePGmIMXUej+qgveJkr7NYl8l7jwe9CnWTOYb9z:asb8eemdXUej+qgveJCNjyWTOYb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775354, "uuid": "53763a1b-50a9-46bf-b6b7-f9061d21d401", "value": 112720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775354, "uuid": "2af38eed-c631-4238-8f76-a723e60df9f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775354, "uuid": "52f23d7e-d9b5-4e67-8b71-ca2edc66c5d7", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaccac5-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760441, "uuid": "ea797f04-071a-4b95-b6b3-7e174374fa04", "comment": "Malware payload (Mirai)", "value": "22fc60a1f169ba32f1bbacd8c1e47d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760441, "uuid": "5ecf14d3-6b0a-4e15-af02-960c5358d191", "comment": "Malware payload (Mirai)", "value": "b8aa791f60d4aba1a79ae853eb061702185e8673415aa7d50e0b5e9c7a2ba065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760441, "uuid": "e23ac5c3-0c40-4e27-a23f-c17c6e079e4e", "comment": "Malware payload (Mirai)", "value": "2db44128d61991ba46e81cbf444e8846c9cf196d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760441, "uuid": "b61b9c61-ccc8-449f-a27c-57f76bb4942e", "comment": "Malware payload (Mirai)", "value": "8d918afec49870fef24fae2e7f327ec4f926e67363befe1dac554babc13e19fb36679873f76f6d123fe87296b6395427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760441, "uuid": "5b0ba692-66ec-43e5-a9d1-f85f122e9c45", "value": "T154A35CD6F243D8F9EC2241303176FB379E72E5BA2128DD83D7A49A72BC52942D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760441, "uuid": "5d3fdc9a-34da-48f0-a190-0382b64f823f", "value": "1536:BnJyYba2qd7fRRI7GEBOkfmuWwqUwRdYMvYgKiBtlgALf5SZ+ZeiglJ:bFbaViGs1fmBwq9RdYifNtXD58iglJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760441, "uuid": "5f0c083b-e194-4649-acf2-7041a64a4711", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760441, "uuid": "9527bb9a-bb27-41ff-9e80-c64083bdcfe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760441, "uuid": "6a26f421-5b2c-48e1-ba05-41050012e78b", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbf8883-7390-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782719793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719793, "uuid": "11833965-bf6f-4178-93f1-b2599e4a4593", "comment": "Malware payload (Mirai)", "value": "54bef97c9f9413bb5844752865959592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719793, "uuid": "faedca23-dfbd-4881-b538-968d0f4df681", "comment": "Malware payload (Mirai)", "value": "b8c35574fe5710fbd79638cba6a00e78d22446e70dc7c1987a8ee680179d2d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719793, "uuid": "efec35e5-a5c2-4719-8e86-0245fe092bde", "comment": "Malware payload (Mirai)", "value": "f711c677fe76110431a8c8a479453797a7626b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719793, "uuid": "20868e92-dfbd-48af-92cd-5306199e976d", "comment": "Malware payload (Mirai)", "value": "17894063c95e4047668da09193130316a1d6cac604c2d772a8896b8f935176127d49ad4e7b5e74abfc457fc79182155a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719793, "uuid": "b5300461-e268-4e7c-8671-8f6938d357aa", "value": "T10E4619277A28DB0ED228213458B1CE99673A2C4646D7A527B391F30DA8F20BC5D5FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719793, "uuid": "bf3cf1c4-e298-44aa-94b3-3d3504b9810d", "value": "49152:9b02CbccirWGBnPRts2wzNdncsBeG0xjvbYNAMj260bAW5rqXJdQhJ69LZcB1V0U:SGUIEK1V0nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719793, "uuid": "f0eeaa5c-e395-445a-81a4-591285627f8b", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719793, "uuid": "969d58cd-cfa7-4b09-b3da-970fb20dfcee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719793, "uuid": "7e606714-ed0c-4da9-af11-c44e08cfe91e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80658b9-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737691, "uuid": "42059234-44f2-4697-8162-d8a1e8532087", "comment": "Malware payload (Mirai)", "value": "1884e76b1f2f4a026f5e9265488130cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737691, "uuid": "3364a031-26db-4bc5-87eb-9c8dea76a27b", "comment": "Malware payload (Mirai)", "value": "b944fa8b5c3ef0c253aa0fddc9d9a041c84e5b14efeaef94fd19f5fae76e6760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737691, "uuid": "a89643e8-3e1b-44fb-a253-b419b5f052d4", "comment": "Malware payload (Mirai)", "value": "249f4f33be6e5d2f4c3a7190a067261dec066d6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737691, "uuid": "c4734cf9-6cc6-43db-930f-c6bc8a7536b5", "comment": "Malware payload (Mirai)", "value": "19163e14bc290b3f13a5f26a32d90119fbc26e868237baad17ddbaa1b1e49b26d61d4c6a94581d6f171147f0e2e8712f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737691, "uuid": "d14dd63e-7d0b-4314-abaa-4300a4bcc1ba", "value": "T1DB13F274E24AE6416C200832ED3C09843F554F1CD3BF3B97B5A4A62D5E7A50678F14AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737691, "uuid": "234e83f1-38d7-4169-83b1-ca9857c7a2b7", "value": "768:z6kNdsuHy0d3/jjjC8f1zIXRK6DdGpowcZ+TU7MORs3Uoz9:FzLy0d3+89zIXw6dV3+g7MO8z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737691, "uuid": "ee2df650-4e5f-46c8-b49a-563dfd306427", "value": 41652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737691, "uuid": "8129f7c0-a440-4eb2-a196-675ed420a119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737691, "uuid": "931c1726-5d1d-4d31-a335-2c703fe36c47", "value": "b944fa8b5c3ef0c253aa0fddc9d9a041c84e5b14efeaef94fd19f5fae76e6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a162ee-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760365, "uuid": "2b98ecf7-7d4a-4fe3-91d1-8aebc815fe34", "comment": "Malware payload (Mirai)", "value": "8f8e6f726f057372784e441480dc9358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760365, "uuid": "a6d169c6-1419-4757-81c5-8b5e92df2889", "comment": "Malware payload (Mirai)", "value": "b9aa2c1cd4e15e072f9c6b964f7a3a760f31bb826eeff4dd09c36d3b09de07e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760365, "uuid": "e1fb06ec-b142-400d-8c96-40d8fbca7e72", "comment": "Malware payload (Mirai)", "value": "974f26d9b417cfcbf8610a1dadb14576d8e0cf79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760365, "uuid": "e8bc957e-cbc5-4d24-b70f-9bfec23ae46c", "comment": "Malware payload (Mirai)", "value": "aa90e8e4e4bbcf93169d2e325a2e585a3eae7a4144c0b202197c06f643dd665cb0e775afdd01b1313060a44d87b7f5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760365, "uuid": "4dac3a54-f5ec-4bba-a4db-b00e20b1046f", "value": "T198A3CF33C81A1DD4C09505B8B9EA9E351B63F5C112472EF726EAC6665087EE8F50AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760365, "uuid": "c1bdaf0f-40f0-4c43-8bd0-36302420214a", "value": "1536:w/Laalfz2XXBKUHfhzCKFcyW6KiLBg7QBrwfCGElkUxcd3k:wDaaNgDHf3FzWdiGYrwf+KMcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760365, "uuid": "08143b75-1218-47e8-89a7-de964cd07716", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760365, "uuid": "bab0f587-6f9d-4793-a160-59f2fbcaa0d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760365, "uuid": "c12cda77-2d95-4089-b36b-e8d6a7053e31", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbcf714-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769564, "uuid": "03e35085-2297-48ad-90b5-76d59f1a77a2", "comment": "Malware payload (Mirai)", "value": "1139e6d10e5ad07738506ada3e5f5402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769564, "uuid": "20453c6e-2ed9-465e-86b4-50c6e4c6e64c", "comment": "Malware payload (Mirai)", "value": "b9fc587f695426c9dfc01123dcb372299d4f822091fba1e9570a4edaec1a3da3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769564, "uuid": "cbc03217-02aa-4d43-8133-b393b2f55622", "comment": "Malware payload (Mirai)", "value": "fadacbefed0764bc4d47f73d030af1e2e6f7daec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769564, "uuid": "cf661805-5224-42bf-be5d-1de5168bf507", "comment": "Malware payload (Mirai)", "value": "8e131b5c1549a07c650c21f6448ac65afcbfac255ee8952353b0e35b6949b96949fdfde23501314edbea21bf8bd54872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769564, "uuid": "27711117-0005-4d75-a663-58c944af66d6", "value": "T1D033F1104D23FA31D5748C36DE6B8447111A6FFC95DEE4A3512C6F28FDCBA068AD8647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769564, "uuid": "c6585516-d3e5-4159-97ce-83ae893f322b", "value": "1536:F7DfXSjDmI+SWlIae/4nrO/fnyj7RV58weeWqvnLL:F7D6/mIldaewnq3nyHRjvBp/LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769564, "uuid": "1df6cb5f-6361-4625-9bd0-2dd44cbec373", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769564, "uuid": "84a5d109-7fa5-407c-a04d-b3bb9b66eafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769564, "uuid": "a3c43ac1-53e9-4558-84f1-763036016c40", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d353ce91-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717121, "uuid": "182801b7-bca1-4cae-bfd9-98a09cb1e196", "comment": "Malware payload (Mirai)", "value": "764ccdd8e97f07c2baf1be69f253ca47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717121, "uuid": "a5a5977a-cc5a-410d-b9d3-78d571d3f098", "comment": "Malware payload (Mirai)", "value": "ba1416203b44e54b743127aa13e638095866129b9dd38cfaaa4ca8638b63b14b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717121, "uuid": "6e12783a-7f77-4e4a-b4ab-dd0e58d5fe73", "comment": "Malware payload (Mirai)", "value": "e914ccae5aa2602ed4157a7d38438c96b76df6b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717121, "uuid": "d3456a0d-9ac8-44f5-ae18-6ae41010e74c", "comment": "Malware payload (Mirai)", "value": "22954a98c76ce102d0ab60183c965d1c59568ed5740e756de88b6e057c78822fb055e05948684ae3813faec4a7bb2da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717121, "uuid": "155fb348-4635-4db7-9cd0-1758a8b080ca", "value": "T1E313F194BA0306E4D958C03BCA3F4775BBD10FB351849D1A267E5341E2950B43AE7CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717121, "uuid": "6d3576e7-c580-4527-a140-94254d36c0e6", "value": "768:OOVSrYS3JuIk8or7wskP41exYGUWXNtVyUuyKdS10y9bJgGlzDpbuR1JT:/8DY8oXws9seYBud279RVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717121, "uuid": "c14e0bab-31a2-465d-8540-3c166f545adc", "value": 43320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717121, "uuid": "72d5c5d7-e892-407b-8bca-62ae93c29599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717121, "uuid": "1c8e4edb-2974-4858-9180-806a5b617373", "value": "ba1416203b44e54b743127aa13e638095866129b9dd38cfaaa4ca8638b63b14b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50fd6d-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713053, "uuid": "25eb37fd-fbab-4737-9a08-5fc32572c93c", "comment": "Malware payload (Mirai)", "value": "498105a864db8b61f951d22985ddb0d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713053, "uuid": "0c8ecc2c-8c23-4b46-9f4c-afb8320706c5", "comment": "Malware payload (Mirai)", "value": "ba8434f48cde1b17f64eda516e3264d2651e6a622d3421078085e17c7d1becd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713053, "uuid": "cc25f5c6-fd08-42d4-80d7-de7769c29aed", "comment": "Malware payload (Mirai)", "value": "c4e650453324c64a8ba85f89a3a1750b3ec3ee2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713053, "uuid": "400bb21e-149c-4771-b9cf-36b32fa6d02b", "comment": "Malware payload (Mirai)", "value": "3e6508bba4f36f8559a1bddf9d82a214af8f18bec6e7be0b7b7c2fac58dfb378acfe4a566d327d3555c57108283cf85e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713053, "uuid": "45507e48-c6ed-4a13-b557-143792f001a7", "value": "T16A03E0CEBA94D4ECD9ED1D36124C4F5A7B09388072BF87581901C89DB9291FAA29B430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713053, "uuid": "6208b01d-cbf0-4c03-a99c-64b5533a242b", "value": "768:MVyIwYjG0JFwNqsxcbFtcY7JIOvCEKi6gFNpdUsodnI/JbnEv/W6:MVyYjXJyqz1nCO1ptoZg63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713053, "uuid": "24566344-7742-4e5a-b59a-875686b7946d", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713053, "uuid": "ed71a381-dfad-46d2-a894-daf5c420bb4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713053, "uuid": "5c4353bf-c0f6-436e-821c-c8675281b2e1", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8693f4a1-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773257, "uuid": "c6f055e6-0de1-4a52-b78a-98151632abae", "comment": "Malware payload (Mirai)", "value": "0413bbce2c2c98b5a5e22e360b311d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773257, "uuid": "1993e0cd-0066-483a-8e22-86ce1836c65b", "comment": "Malware payload (Mirai)", "value": "bb5826a75467c0c2d1100f5c2ffbf690d93131084a999c9908f34849cc811e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773257, "uuid": "deb8219d-3ff5-4334-afcc-f6001fdd96c5", "comment": "Malware payload (Mirai)", "value": "dc8cd7b1f8a5c6d3e611e5bdbc8a66ded7ef31d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773257, "uuid": "4c3996f6-95e2-457f-942c-df95ae7270b0", "comment": "Malware payload (Mirai)", "value": "2b66814adcdfc89799b075c9621c8418d0529896223e8701d405f3bc9d20a4084ad5a1995a0fee561344f8965bb10414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773257, "uuid": "510611a6-cdb6-4e37-9f50-80634fc4ae58", "value": "T11A631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773257, "uuid": "9ef71ea4-78fa-429e-89b7-93c8a9d1737b", "value": "1536:XGBQnw68oqNi5Ivzu/GIw+D3ohyaRdWViEs/hX:XGBBa5Mg1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773257, "uuid": "bd7ba846-8695-4bff-8581-d8e26f33a962", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773257, "uuid": "d17fcec5-5f7a-4c6e-a7d2-d20c28fa2701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773257, "uuid": "51b34026-79bc-4d10-9499-f3e696392da0", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1955a380-73c5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782742579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742579, "uuid": "a08be4a2-4169-4caf-bc9b-485053059ca3", "comment": "Malware payload (Mirai)", "value": "747a4bcece10dd29192178d34b98c402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742579, "uuid": "a280e714-6fea-4e21-967d-c438582f0f13", "comment": "Malware payload (Mirai)", "value": "bb8e550b3ee0b8ad2cf726d1dfbb53997d2ff32d2364209f6d6275729b37271a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742579, "uuid": "b56e4747-a251-49d7-ae97-e9f0eab7aa66", "comment": "Malware payload (Mirai)", "value": "e9cc7b76c1f083bacfef2e2e31086375d3888460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742579, "uuid": "000130b6-5e0b-414d-a5ad-03e19000f91b", "comment": "Malware payload (Mirai)", "value": "20400c8e22ff0ca54d85fe18c4ddf056a56b4e944fa850c16643bc069e638f431b279570cd993014ce57613c6f9cc2f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742579, "uuid": "9bad21f3-eee1-4ed6-a329-a06739ef0256", "value": "T181932A42AA41C973D40311F212E79F674532FA3E58A7D986EBA43CB0EE151C19722FBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742579, "uuid": "e3c2ac00-133c-4239-a6e0-092008b9ae8a", "value": "1536:Bc0hilYVsH/noHDTYVv6SkDDv57F8cL882PgzUb6G5hIpOB3Ug:Bchl0yojEVv6dhFP92Y635hIp433", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742579, "uuid": "7c03823e-18f5-4085-9e33-7f07a38d2a53", "value": 91852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742579, "uuid": "c2aa530e-36ff-4daf-876f-65db47c3ee81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742579, "uuid": "caff9b7a-bfe5-401c-a485-e0ffc755fa79", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c99b628-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737431, "uuid": "c3cb9960-7e88-45e8-b2d5-37dbb129c806", "comment": "Malware payload (Mirai)", "value": "a71c2ac1e91cf4dd27941db9553df618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737431, "uuid": "599ec6c5-b627-47d0-9d68-5b49d1beccbc", "comment": "Malware payload (Mirai)", "value": "bbfa138bf14d1b4997fbaefb6e83816408377631e3a7a4900dbdef5b7844b9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737431, "uuid": "3f257450-690b-4dc5-8c67-77bfd331acd8", "comment": "Malware payload (Mirai)", "value": "8f51eed04f33f0e61e92e0671c514757e1a1314f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737431, "uuid": "d7f99649-26f0-407e-8c2b-3639eabcff95", "comment": "Malware payload (Mirai)", "value": "f26a41eca7d9b4bd52c3bd617f26705c8dc4ab1ad9def2991c944ae2824dadbad8aa42cad3e78839f5b3406fa6e211bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737431, "uuid": "06ff3342-a4fa-497d-8d56-d6c066cd2f71", "value": "T1B96302ACA626B045D52D5D3EB49F17068C2F828ED69ABF7D53708E5EFCB140F1700A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737431, "uuid": "eeea76ac-6acc-4db6-8048-4f07fa0973ce", "value": "1536:+w08Rf5zopmpd0o3++dBulK1u/uDSxUc2rSfJZm9b9m3u5:+w02zopcd8+bulKyuOxRVfLmH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737431, "uuid": "6de42a5e-984d-44aa-ad9b-b5d191d01158", "value": 73176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737431, "uuid": "b4c1a50d-9d0e-47ae-8a06-4289d89c9bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737431, "uuid": "bac79ce0-1059-46a4-90fb-5f2fa1391d59", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfe59b6-738f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782719527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719527, "uuid": "57d7e7b6-ad3d-4555-8607-45fc0f1e7903", "comment": "Malware payload (AgentTesla)", "value": "77c5b17a0006b39c1a4c988bae6c5763", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719527, "uuid": "84a3fed3-bbdf-47a6-a892-c773389f2b29", "comment": "Malware payload (AgentTesla)", "value": "bbfe33f2fd8ba24ac333d2f81348472bb4cbdd33bf317cb55dff63d7b9be3269", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719527, "uuid": "e0ccfc4b-b14a-422d-b934-9469a5d9868f", "comment": "Malware payload (AgentTesla)", "value": "42fb563c75fad6707afb59676d09f951156adeca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719527, "uuid": "f5704c05-c4a4-4321-add6-7fbcf5f15db9", "comment": "Malware payload (AgentTesla)", "value": "4ddfd8c5429e424a4f8f663ebe109eb5aec087a56fbed52795610ed36348bc948f460f46d3a060ba71e0c183f54dc561", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719527, "uuid": "9a4b8066-66b0-4fc1-8561-6422937b9300", "value": "T100C4F1A1B645D123DC1729B49223D2D2D917BC399E91C973B1EAFB1F23374E25C22329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719527, "uuid": "3c179867-801a-47cb-ab05-12c6f9a97822", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719527, "uuid": "e1e1873e-de6c-40b1-ab3f-c9b3a4730191", "value": "6144:cT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6ZN8I2kTz41CbbX0XqevgLnOMzDzh:cTsAXF28crKGbJZN8IwWbXoq4grN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719527, "uuid": "99ed06ae-4ec0-4937-a3c0-e93b17fde1d9", "value": 556784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719527, "uuid": "a62b7c8e-55cb-481c-bce8-14403423bec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719527, "uuid": "431dde2d-80d0-4eb6-996e-872c18e3f631", "value": "PLK-4-26-03017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462cc8ab-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782713019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713019, "uuid": "84810652-f6a2-4775-994f-1ceb1eb21c4b", "comment": "Malware payload", "value": "bd1506eb44e650c6678156fa02f00b8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713019, "uuid": "9d868926-84e8-47a8-9ddc-705d45c6d22d", "comment": "Malware payload", "value": "bc05297a1f1b6bcb9bfd5bfc6083362acc7e233f087796ff584c0b77a7813f93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713019, "uuid": "a42c574e-b989-4b0d-92b6-ff62c3ff3e76", "comment": "Malware payload", "value": "be73174cb3e437140ace8f31dc6de5597a5cb8d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713019, "uuid": "6325ba3f-ed56-415f-97aa-cf883f3a5ff7", "comment": "Malware payload", "value": "574f4d7ec7bde2552e654477307a236dd4cc928a9f3dd5ae2f6c5ece84658dbae837ced58f5b4856e212834a7eacedb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713019, "uuid": "3ccc6f26-436b-4e31-839b-fa3663c8d6f5", "value": "T165636A71DE1206B74F43AB88BCA50261C9BDC318862345F0F6D98B0D910A9ECF77D29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713019, "uuid": "132a85d8-f3fe-446f-b247-3eddc47cf0d4", "value": "1536:OguSKY0/wM+aV1K+/0qmF3G9UzLTGi7Ql:OVeM+KZ/0qmIUzPn7Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713019, "uuid": "8152939f-e02e-495e-94a3-535711905427", "value": 67961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713019, "uuid": "e5956138-9fd1-4dcf-946a-7f938787f322", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713019, "uuid": "502e539c-eeb4-4efd-be67-734adc2a7d12", "value": "PO06292026-0044839.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035421c-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782712875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712875, "uuid": "beb752ac-37fa-4858-8722-06045e30fd7e", "comment": "Malware payload (AgentTesla)", "value": "21880c0ba2b22b64426bdc1db714d2c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712875, "uuid": "f9fa23eb-fa77-494e-9ee7-c6fa15ac8bf6", "comment": "Malware payload (AgentTesla)", "value": "bc4b5891b1294dac280e9c24e2f63b8659d5703d28b7ffa459940b266f00b822", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712875, "uuid": "c83f99e6-adb6-4da1-80b5-b133741aeb5b", "comment": "Malware payload (AgentTesla)", "value": "f22aa32da4c1b64c15312009ddcb7dc6bf3e3cdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712875, "uuid": "efef420f-8a38-4518-be1a-c30c7e607c37", "comment": "Malware payload (AgentTesla)", "value": "55a4089b3ea00c621b5c9572298dea84dd4738af20a6a6555f352b5490157dab6de8e696b2b45c33bcee647cd9837f7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712875, "uuid": "ff3c41b1-61c7-433f-aef0-a70642bcac98", "value": "T174C4F191B609D022DC171AB49123D6C28D27BC359BA1C833B1EAFB0F67374E25C7536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712875, "uuid": "e0e539b4-a980-4afc-a63f-a8f12ae1b224", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712875, "uuid": "de2f42fa-49f0-4015-b085-26611a956eae", "value": "6144:PT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Z3DNW13e65HgU7IJYAFkISS8ozOMzDA:PTsAXF28crKGbJZTNihgU75AsS8oj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712875, "uuid": "4eb68d7c-9fb4-40b1-9dc8-393ebe4c96e5", "value": 569952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712875, "uuid": "c3ea5114-b278-4608-a0de-3e2a9c55db92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712875, "uuid": "6ee26538-4075-40ab-8a7f-db4c752faa16", "value": "SWIFT_Payment_Receipt_26062026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bf0edf-739d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782725717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725717, "uuid": "d8e45f00-335e-4ba7-8346-9fd69230dfe0", "comment": "Malware payload", "value": "9f2055250e808462bd22a2f1149e032a", "object_relation": "md5", "Tag": [ { "name": "45-88-186-141", "colour": "#82F6D4", "exportable": true, "hide_tag": false }, { "name": "bcrfix-com", "colour": "#2F12BF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "tamweelke-com", "colour": "#9537EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725717, "uuid": "589edf42-8e85-451e-b65e-12073480e6c6", "comment": "Malware payload", "value": "bd0a608efa84ecc093b4754d75fbdbac524b12f28ef8b43b8f62347c80edf4d9", "object_relation": "sha256", "Tag": [ { "name": "45-88-186-141", "colour": "#82F6D4", "exportable": true, "hide_tag": false }, { "name": "bcrfix-com", "colour": "#2F12BF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "tamweelke-com", "colour": "#9537EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725717, "uuid": "4c7d9c55-4e09-4e5b-99d9-3ba482954c1b", "comment": "Malware payload", "value": "44d01410ab1c1808fd80cf1b5486af7ac8119548", "object_relation": "sha1", "Tag": [ { "name": "45-88-186-141", "colour": "#82F6D4", "exportable": true, "hide_tag": false }, { "name": "bcrfix-com", "colour": "#2F12BF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "tamweelke-com", "colour": "#9537EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725717, "uuid": "43f05b76-6f1c-45fd-85e0-e29102696a7b", "comment": "Malware payload", "value": "7f702c5731667788d2f6dbb53bfcef9259ed93127513292dd7292e2c25902a284d59a5dac784099624cca9891dc88aa9", "object_relation": "sha3-384", "Tag": [ { "name": "45-88-186-141", "colour": "#82F6D4", "exportable": true, "hide_tag": false }, { "name": "bcrfix-com", "colour": "#2F12BF", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "tamweelke-com", "colour": "#9537EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725717, "uuid": "066ca27c-6b61-43a1-aefe-b71cda91aaa4", "value": "T11E12AE1DD7884C82D0ABF2B12B908105CA27DAD447DB00095BF892E9BBC1EFB6931631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725717, "uuid": "b506c5e8-c587-472a-bfb8-680e9dfe1d8f", "value": "192:nF0vWVbXnRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+l:nFz5nRm/wksuQJ/g6dI+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782725717, "uuid": "b392b703-c1b8-4c65-a22c-3f0ceb1d9c1d", "value": 9028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782725717, "uuid": "4ebcfba8-2b1d-436f-bf0e-d1156ba6fd13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725717, "uuid": "5394921e-dae6-41bc-af68-9604588407a7", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1df998c-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698597, "uuid": "ff3f1e5b-4ba2-43cf-b7e9-e8724188c9d4", "comment": "Malware payload", "value": "69b599c3d245b05b196caf7593b9faf2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698597, "uuid": "ac0788f4-4736-4076-9b51-0b563eca4dbd", "comment": "Malware payload", "value": "bdab6551dedbd693115c3dea5d6f98473368be63debdbd2f38fe8d40d8d0089a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698597, "uuid": "bc199dc4-1139-4fde-b475-96a74b756d01", "comment": "Malware payload", "value": "07d362113536269735cc4160b08fb2c9e6aeafb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698597, "uuid": "d5cd285a-982a-4487-b81e-61793be28782", "comment": "Malware payload", "value": "9202ca08cbd4e37cfd6f2333ab65b9f07f4fc60f8eab9607c191d6d5a2f8e7a74206379b870cecf93cbf8e7b8707c628", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698597, "uuid": "0b1ad4a8-22cf-4f45-b047-ee2e31559f67", "value": "T1DC33AE917405BF0E2FC6CD321AB32494CFBE157356F0838AC905D9910ECD966A6273B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698597, "uuid": "117c1c12-fe64-4933-bc74-2165569f133d", "value": "1536:/xuNnUz4hu/xxubBEmOb63jM3nmDwcuJ4rMyW:6UzIualXWdgfuJiMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698597, "uuid": "dde381d0-7854-42ef-9f13-5a446113a5cf", "value": 52874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698597, "uuid": "dc0969e3-5854-4e8a-8c2b-94ab65f1b826", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698597, "uuid": "1092d897-0b63-4121-a8f2-d095a69a67f5", "value": "ocafa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb637ba-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756815, "uuid": "e38977d9-5cd6-4012-a57b-d3dd3b7f6017", "comment": "Malware payload (Mirai)", "value": "b01155f8363949c4fda4f4c010b27125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756815, "uuid": "fe458e83-8cef-497e-9930-f0a5147292f6", "comment": "Malware payload (Mirai)", "value": "be4a96f9d0b9dc81beaa335cb4e31a80e576527500319668f31eca63b7a6c521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756815, "uuid": "64210b0b-6994-4cbd-bd86-8889a8292dbc", "comment": "Malware payload (Mirai)", "value": "9b2dd087b4d5a56c844354d94760b67fe96b40e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756815, "uuid": "be38a553-efd2-4e23-8aad-64789f16b1f7", "comment": "Malware payload (Mirai)", "value": "2cb1fb9d8b1a3dd290a886afcad98c8faf642af48c40c4812bca5a2b6a52deaaedb35f4040b289e02d7800a699f0f6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756815, "uuid": "b0d91c1b-767b-4bb5-a6ea-535553059f34", "value": "T14B13020B96F69986D0EE50700A576A4605149F140CDD5673FCFC793B2616F3D9C38BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756815, "uuid": "97ebaebc-bebd-456f-af95-568af4379078", "value": "768:2z9vpTBLmn7dS9m9xQhcvGwXv43dc7XQT2Sh8EOIV/ZJgJJpFaa/K7nbcuyD7UHk:25NBiZS90ihaG5Nc7gh8+La3a7nouy8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756815, "uuid": "c4b14885-0f4f-4cd7-af41-6a91236bee5d", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756815, "uuid": "689ff1a9-06e7-4ea1-8415-cc48441db3d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756815, "uuid": "d8c93740-67b6-4d2a-b80a-a4af19f41976", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a67b91-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737847, "uuid": "450ed533-a6a1-4854-a5cb-dc2bf259b122", "comment": "Malware payload (Mirai)", "value": "d6eef8134574c2c351d6df6e1b056fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737847, "uuid": "e1796087-2b85-4b7c-aa5b-e195128401a7", "comment": "Malware payload (Mirai)", "value": "be9250a99049841f8b86322c5c0b939d2362ccf243ed56432063cb740318de78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737847, "uuid": "59046bf2-f5f1-43aa-bd35-2bc154138437", "comment": "Malware payload (Mirai)", "value": "6d5b2b97ac58457980d3181a3ff9731c5eda37ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737847, "uuid": "2975ac6c-89a3-4700-ab33-ff257e9c2e9f", "comment": "Malware payload (Mirai)", "value": "20c286fefc7c0df350d6875848730b28c0357155872d32eee7018179cdc5cdb7e8d458d98fee513b85681fcd5b7fb83c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737847, "uuid": "edb0705c-dd42-4207-adeb-23696748b9d0", "value": "T135834B0273580D43D1671EF02A3F37E5C3EBD59121E4FA89660E9B4681B6EF2158AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737847, "uuid": "6c478a82-24e5-4e42-9bdd-1e88ff9acac8", "value": "1536:WUkRQYIdAipbNdtp4OlEFL+wmCWoyntMvB5:RkzI7bpdEF3mvkB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737847, "uuid": "7d8c339e-7dd2-429a-b7ae-b5c3165d34b0", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737847, "uuid": "6ff4e012-ad5d-448f-8ee0-3199dd769d58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737847, "uuid": "58dd84c5-6664-4889-84d3-18c4c42afb41", "value": "1884e88c748a2cf8fe53bb7817c07dca47378ad21daebcb978479ea30401f0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5d3a99-73af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (751Stealer)", "timestamp": 1782733187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733187, "uuid": "4fa34b7d-5acc-4314-8bdb-6e45eb9f9627", "comment": "Malware payload (751Stealer)", "value": "2b6e8271cb30771e3065d62060c68573", "object_relation": "md5", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733187, "uuid": "6abe25a7-20a1-429c-92fa-8653f1181b50", "comment": "Malware payload (751Stealer)", "value": "bee4e24128c232853bc1decc9e5db2cf0fcb14538936adf01d6356beb4ac820c", "object_relation": "sha256", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733187, "uuid": "129f2e2a-8beb-42b3-948f-8ccae29052ca", "comment": "Malware payload (751Stealer)", "value": "3abdd429ea20c4c940681796d0e03dad5473b6d8", "object_relation": "sha1", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782733187, "uuid": "bf2086c2-e8e1-4c1f-bafa-b66adcb0e7db", "comment": "Malware payload (751Stealer)", "value": "3a67809075b75ad946043af2e7625ae2ed6d7153cb8dfcb8778a292984f6697a494affa231dd2c61a78b30f43ebda3b3", "object_relation": "sha3-384", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733187, "uuid": "200bec1f-d8fa-40d2-8833-cf60f68d0498", "value": "T12A85F116A7E114FDC1AFE134CD625502E9B6FC9347749DBF43A889A12E333808D7AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733187, "uuid": "4c3962ac-0dc2-417e-bd31-0852d030c24a", "value": "8d8029e87dbf652ff8d7bb1768ceef69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733187, "uuid": "9c684437-3849-4f57-9764-bd670ac0c44f", "value": "49152:GxmWKdEuKOulAvMaHVv/1kBtjwLeQecy:GxLyKOusMapKB9xQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782733187, "uuid": "fc97c550-583d-4f77-9742-59d5fd0b21d9", "value": 1719296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782733187, "uuid": "8c23b317-77c8-437e-b1af-917984a923c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782733187, "uuid": "0a4ed1fe-0a85-4032-9395-66b9747eed45", "value": "Nitro Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad5f90d-7361-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782699605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699605, "uuid": "a508d406-a8f7-4c71-ac63-21a34d699003", "comment": "Malware payload", "value": "a5aef8d54c8367f07c66d57275d92a80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699605, "uuid": "bb439f10-f6e7-49b1-acb6-467a2701402e", "comment": "Malware payload", "value": "bf518e21862fa63253571ee264068225bde1eb36a67e89c4b6a8b834be6c7f01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699605, "uuid": "38d07207-a444-4468-a152-ca1078e80abe", "comment": "Malware payload", "value": "e4287d0a46cb18b7babb9deca2daff9809576187", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782699605, "uuid": "b1cbe137-d6a9-4dd5-a66b-ab1e312de03b", "comment": "Malware payload", "value": "6c7a6fd45799702fad9ff8ec79b4ca0044a97db7751cb066fa9f2bf4b40862ee571f72ffe0799a4299fea9d287ed34b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699605, "uuid": "163e5a8a-f7f5-423e-97aa-54b48c0db829", "value": "T106536BCB675A2637A9520BFB60C90FC53534A9DEA7D318F7271D220428C5C39E6F8792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699605, "uuid": "0f235a2e-382d-4e04-8415-1f00f3f0bcf8", "value": "1536:SG+mKFWdX/qg/Dfg43LLYvW+HGGO/t1O0Lco/LIwpVqb3m2dKc/93RFp/Pm0BcWj:9+mKFWl/qg/koL0vfdO/t1/LcojdCb3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782699605, "uuid": "d1928b36-6f14-48fa-8bcd-d9113eac2bc3", "value": 64016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782699605, "uuid": "07ec0bb7-bdd1-4633-9447-4dfaabcc19cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782699605, "uuid": "500e668a-8d18-4baf-b5dd-d697df8b0ec1", "value": "exawa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84416540-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770676, "uuid": "82b3167b-57b2-4a3c-a27a-f8bcd317fd9a", "comment": "Malware payload (Mirai)", "value": "7fcb7b1c465156e8b0a627157cdb11ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770676, "uuid": "6bce25cd-b761-4f67-8539-0efda61690fd", "comment": "Malware payload (Mirai)", "value": "c15510299e739d04f78a611d2cee455ac3e49004ff19ca5707a7728a54213772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770676, "uuid": "d9db2625-ebe7-4235-aa14-cc3d4927bdd8", "comment": "Malware payload (Mirai)", "value": "985c0626a83fac8a6ae0388cf166382f5a3ce207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770676, "uuid": "003fd862-a9a7-4dce-abfa-25820b1f6075", "comment": "Malware payload (Mirai)", "value": "717c35110c1a4f8e5bde33e1b136c9c7ad175e62475c8bbd951db23d0adc8677c90aeddba5363cee6b239002ded3b72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770676, "uuid": "2c547de6-9edb-471c-8cc5-6d321ce3ba96", "value": "T1E1A329C1F68B84F9D54B48704066F33FCE32E5268071C9AEDF99AF36DA37641921629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770676, "uuid": "ece0a8b8-cd2f-4e88-9d88-f1327b6cb5a2", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3s6yNCoUKcnsEW+QuY09RO:ZTFPbQ0yhOEckEUI6A12ZHTz1qmn0jWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770676, "uuid": "3f1ee1de-d5fe-4b93-bef5-444e775a4d1d", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770676, "uuid": "8f8a41c4-2c48-4a31-88aa-1affd73788e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770676, "uuid": "7a0dbcc2-dacd-4ab2-9ba3-4a90d98b6d2e", "value": "nerv.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2ccf16-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782736702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736702, "uuid": "5490449a-2f3a-4732-9a85-a054125fdf4a", "comment": "Malware payload (XWorm)", "value": "5d0187e315d4b6e97f19e5f8b0158ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736702, "uuid": "da4595f8-25aa-45de-90c9-37cd33a45eec", "comment": "Malware payload (XWorm)", "value": "c1a9bbd83fb51bd76cb2891dee3ed8d09b698c4d224e84cbe711eb8a2ed4fbd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736702, "uuid": "3c643204-3d8e-4e48-a671-6c137ed7c0d6", "comment": "Malware payload (XWorm)", "value": "15223a2f90a07d0d264f14031a52a65a2738b83a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736702, "uuid": "63b5bf26-2b26-4074-99b4-8f668f832f26", "comment": "Malware payload (XWorm)", "value": "a609f5e94ab6a694ab5b840a1cbac77f2722089723944b0af784d1852b6ccb2a8bd02edc7af0dff582b2177f20c8f3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736702, "uuid": "85e1ff8a-8ec5-49e3-9b11-6e76f7e76afa", "value": "T190C5786D17CC666EB201FFE1C61B6F1BAF1A2F83258084D566F99D9FCCA4045B3980B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736702, "uuid": "0bc2e675-164d-47d2-94d5-c52357990cff", "value": "768:TAoIv9rCIhiH9jmsSfF3DRKcB5WZS8iO4DqwkErnB1hbzzDOmAg+m7s9S9Gh95bb:Tjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736702, "uuid": "e97b9001-3286-4d5f-a24d-330512c475df", "value": 2589167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736702, "uuid": "32b76201-e951-41d8-bf62-f2fb023a3696", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736702, "uuid": "055fb4a6-c909-4ab0-8561-19268ba02d11", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc95fecb-73bc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782739041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739041, "uuid": "4c936b96-0d4f-4504-8bde-333838c13cef", "comment": "Malware payload (Mirai)", "value": "044a56ea05ab79b5ec31a592305738a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739041, "uuid": "48f0ddf9-96ac-4397-8e58-13045afcb344", "comment": "Malware payload (Mirai)", "value": "c1efa8ad01e045b828c73f7f49c3d9dff3f80d5afafbea378a68d9fc7a58f6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739041, "uuid": "b90a9621-f2d0-40d9-a26f-c566c704ca74", "comment": "Malware payload (Mirai)", "value": "dbe7f9a6b1483df19a5a7f446a84b8ec6fa791d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739041, "uuid": "93053396-f2c8-412d-a4fc-e616d0958da2", "comment": "Malware payload (Mirai)", "value": "7eb3f6da6d500464f459c8b3b1b9b742054ff09ddf6ee200869d6df974a00c3ac3bf207040ba5d9a432d0c09f3f4d0ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739041, "uuid": "020de9f3-504a-4a98-862b-32739f66b36c", "value": "T1ED931A46E603C5B3CC0315F212E7AA6F4A31FE3A8C62DACAEB543D64FB125D162117B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739041, "uuid": "8e9dc0d1-153a-4238-8fc8-5f0949c366e8", "value": "1536:HhvMqpDpn5I6Kv9HX6rrEfLk0ULuXR6qXUP2nlT+3RW9mwqa8C00p9ns9HXLeb1K:ZMqVp5I6Kv9HX6rrEfLk0ULuXR6qXUPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782739041, "uuid": "8b19305d-f0f9-4939-97cc-a358b86db332", "value": 95436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782739041, "uuid": "42d78382-6bc5-43dd-81a7-ec671445a38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739041, "uuid": "7f2ecde0-1f92-482f-afd7-8b1a5471be71", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12f8727-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721359, "uuid": "b9efa8c6-360b-4c7b-9b84-d64001aaf0d2", "comment": "Malware payload", "value": "41c6da2906d609f1c4328ca3eeb29dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721359, "uuid": "033d1157-2ec4-49b6-83f8-2ff101260b39", "comment": "Malware payload", "value": "c24379ef553c003470df9cda18319bdc72dd06e3d488c7d9212c79beaf82b3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721359, "uuid": "afa75d05-e83f-4bb9-a72a-52566685aa60", "comment": "Malware payload", "value": "a007cec4fc23e9efaaf73eedc7740e03c44551ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721359, "uuid": "77a7b5ef-30c6-4790-94a5-15d2449dae90", "comment": "Malware payload", "value": "ee8c3b7779926d99b4b87b968147fd3b5755d979f2f7c4da0f9d3f39595bc51f2220cfdf7d6b9350ae0b9df2b551a032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721359, "uuid": "8ca40187-0a21-4f02-8995-9764b11e81c3", "value": "T19E422BC2B2D0D4ACC349833ED9AF4596B65538C913675AFF27B985802EC6730F23DA44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721359, "uuid": "972aecd4-568e-4f8f-9530-05a41ffc9b1e", "value": "183cf4601240c6239430ecafd27c9723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721359, "uuid": "8b93deda-2c7a-4b3d-96c7-97fa186a083e", "value": "192:O2GtsInFlkCiWWF2VgXnXdoWFW5iMWf2VNm9B0U3uOZLgusc3VOC:O3txaQVIXCfi2VNm9B0U3LKvclOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721359, "uuid": "8a9c9d79-a2e2-4fa3-83f0-11ea6f250664", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721359, "uuid": "7e20b52f-5a1a-4af6-804d-ecf2d51cce3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721359, "uuid": "b1afe6bb-4384-404f-a2a1-b9486187dcf9", "value": "41c6da2906d609f1c4328ca3eeb29dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe693ab-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712794, "uuid": "a3bfd5c3-7e34-450b-bd95-2ee4447174fd", "comment": "Malware payload (Mirai)", "value": "d04e36fa54e03eb1542b2f3854f2e41c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712794, "uuid": "0f1ae337-b8bd-4478-b691-9c889cb37c19", "comment": "Malware payload (Mirai)", "value": "c2a79ffd94bff59100503cec2e89f473d9f64ae07956fc52a0a0be81f9495d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712794, "uuid": "e2967675-a6ca-4843-914f-d7495d913749", "comment": "Malware payload (Mirai)", "value": "d6fd881d21ac50eecf77257fce6d4b142eb5c881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712794, "uuid": "0ccbf78b-f030-4bdc-a130-bc4fb1284110", "comment": "Malware payload (Mirai)", "value": "2d2d5a9fe64682d3b08715e21fd69dc6b98ae4354b725bc1fb57d4b2a1f0a190589da5f814b23b3a1e5340b153ccc463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712794, "uuid": "b3a269a7-ed0e-4bdb-8631-ec5136af1e53", "value": "T18A361A87B8D24A43C4E4367AB87D81C872A34EB99B97135A5D04FE3C3BBE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712794, "uuid": "37ccdef5-8ed8-417f-89d8-117565d0d098", "value": "49152:/ux/+ioBE1Xuz7pEFPHrh91lXKY4RY/ww6B7VUyizDXenlM17:Gx/+S1X/9HL1laY4R4m5izDXenlM17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712794, "uuid": "6f0d1713-b8fe-400c-9721-5ec3d2f7aa48", "value": 4980888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712794, "uuid": "7ab02aab-59f7-4ad5-b0d6-aaa1519cbc71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712794, "uuid": "df715628-6b07-45a1-a9f5-5f7a296e4ccb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e940f7c4-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782716729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716729, "uuid": "d76e5f0d-c7dc-4f5f-82f2-ab6ed2c4f686", "comment": "Malware payload", "value": "8bc69c5a829b2720771023bd07dabcde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716729, "uuid": "d21fb04d-92bb-4692-b3a5-66ec4b94290e", "comment": "Malware payload", "value": "c2aaba4e8900d360f446ec612930681117a2448cf41363ec5dd11eb8c0641502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716729, "uuid": "eb6c78a7-a4c7-4c97-9286-49c0e12fe5e2", "comment": "Malware payload", "value": "544e3430c5195e68d1de93b4a317eda8ff9093dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716729, "uuid": "d0d93c1b-e364-4660-a905-0f2aa987154a", "comment": "Malware payload", "value": "2bc0b9da22620cda06cedc2b32be720e4354225153ffeef360deb81f877f64f0e4d54f97d3ed9e6406865ee411077c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716729, "uuid": "a43f9358-b956-441a-96be-53f562f74d43", "value": "T133A65AD71A8A68ACC786EAFB8534703FDA03B46553AA71EF563A72EDF613D147024340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716729, "uuid": "73408da3-0cd5-4fda-a758-d41bd0cf875f", "value": "511a9f08ad049024ceadb3547f453c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716729, "uuid": "8b8b5d6a-f01d-4350-8c4e-fbd3e26c3ce5", "value": "196608:yHid9vyObfMHl8mq7/yKm9b5G8JADSIsUzxoVU7lvIcBI:VDpU+FKn9b5/yNoqZvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716729, "uuid": "bb751e49-1876-4eed-b960-850fc2df98eb", "value": 10113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716729, "uuid": "361b0653-954c-48ee-8b44-8374544225c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716729, "uuid": "bc539be0-e7d4-4acf-b3ae-3053e4f726a3", "value": "SecuriteInfo.com.Win64.AURAStealer-B.32821434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a997782f-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782758713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758713, "uuid": "d665a42d-7738-4794-bd87-ab69875729d5", "comment": "Malware payload (RemcosRAT)", "value": "09ab5c4feff684dd6ba613efa9cdafc1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758713, "uuid": "a5baf95b-8d3f-4ea9-a0fd-4534e7d16e02", "comment": "Malware payload (RemcosRAT)", "value": "c30f27cf1dfbcbd488b81283b6de247e952c70b5d0d703780b27deb16ea82f63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758713, "uuid": "cc8f29e5-f7ed-4ff8-8f59-c636d0cccbf5", "comment": "Malware payload (RemcosRAT)", "value": "0c1c1cd24627fd74df34b3c913e748e1caba2815", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758713, "uuid": "63730e18-0d11-4155-a33b-25dfe5500281", "comment": "Malware payload (RemcosRAT)", "value": "29a2b86ec37dd20900d78784f76eff283cfa867d56569900382536200aeb9daa910a85a4dc8a028b3f6507cafdd27855", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758713, "uuid": "a48744b7-6688-4132-88b1-a9bb0fa8d3a3", "value": "T111266D20813966B0AE7EC72CD52F9FAC0E5D6007162DAF5D3ABC0764A646F07758E4E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758713, "uuid": "16654df9-7a10-43fd-aec0-ce0382ab3e4e", "value": "98304:gjmRSInbG/0WNE9kvdVee75VYSYXeRYC8hIJjcJJ43qIXw/cyeFzvPrzFyaRhEr:98ykvdVT5VYpeshWAH4NXA9elFywhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758713, "uuid": "65cedfd5-91a7-4396-af3d-c2b6b68fda80", "value": 4750246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758713, "uuid": "9a74650c-b870-4d89-a0eb-d5a95c620306", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758713, "uuid": "4d98fc5e-9d5f-4d37-9434-26426344e286", "value": "Aumento della struttura salariale nel secondo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b13fc62-7370-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782706155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706155, "uuid": "c4e6e238-1993-467e-9020-169b63263abf", "comment": "Malware payload (Mirai)", "value": "c308493ba07b6cadc26afc9bc21dfbd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706155, "uuid": "b1e84954-16a8-41e4-831d-55374c71a185", "comment": "Malware payload (Mirai)", "value": "c37a77a63582b02f69f1ea71d810d9aab433af52c37ec973650e82cecf7ba6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706155, "uuid": "17c139b8-25d0-42c1-85af-a365164a041f", "comment": "Malware payload (Mirai)", "value": "99c289c724f8e28bda4fe4cd7509ab57e352b464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706155, "uuid": "92ee4495-a90d-4cea-bbde-92d91a3897c7", "comment": "Malware payload (Mirai)", "value": "f190bc8c7ee3dec6602a65916a83e3f2398ce069731c07d0414543c030cf975b587a1c44f6af886f8cc6da2ac0674dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706155, "uuid": "4f3b0731-09c9-4acf-b08e-d2716fa3db39", "value": "T1E103F1A1B250EB73DF31687BC2E448892AC737FC60F566A213D0462D77C25467CA64EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706155, "uuid": "ddc32be5-a66f-4ec7-8e0b-570b6c38117a", "value": "768:EbhbUpgfK/Awt9kQzWa8HroIyIQrngHG/KYX/Y5ZAS1xiF8jocAyfnZXu8Lf9q3d:IxUpgy449kKWToIyxn7SaY5d1xwhondI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782706155, "uuid": "35365085-9848-45b2-8401-248047442e50", "value": 38000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782706155, "uuid": "8de1afad-592d-40e6-b07d-f9688b90f93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706155, "uuid": "0d5becf1-19c1-486c-8550-3a9b49b5352b", "value": "c37a77a63582b02f69f1ea71d810d9aab433af52c37ec973650e82cecf7ba6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dafd493-73ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782758639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758639, "uuid": "51c8e3c0-9fe1-4fd2-b8ac-558e48146aac", "comment": "Malware payload", "value": "c1f3bb0022aa03a0a7e44318afdcab93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758639, "uuid": "e01a522b-46a9-4a5a-8715-882f90984521", "comment": "Malware payload", "value": "c4b8ae9b3d504e818e743b2a33c3fec1705fccf116ee12c4e6c0ed26ce1f2a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758639, "uuid": "931649ab-b9f9-43f1-a59d-362f3d253085", "comment": "Malware payload", "value": "bf45ee53f81dc626b657c8d6dd63711241df9925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782758639, "uuid": "30fe8a40-431b-4323-8c70-04b3a9950388", "comment": "Malware payload", "value": "22df9a3b163423824d4a12961549d7d4933b00ea039b12449fad89e3d7676e14a5aba3611d48860d60e6fedcc945c2d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758639, "uuid": "ae427810-1d18-43d2-a50d-2c4a210d8f62", "value": "T18BF31AA677106F66C168C13408F383E5A7F637C127A29149B22CDB2C6E6134D6D9FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758639, "uuid": "b1645d52-5784-4319-a236-39bb77222ac9", "value": "3072:VzbDhX7HN6JPS60iEN/korjTukdCvXRx4:BVLkEJ71koH4v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782758639, "uuid": "3d85be39-66ce-403d-be36-189ba3f7d3dc", "value": 171552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782758639, "uuid": "dbd47180-c813-47f5-81eb-0801098a4c75", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782758639, "uuid": "58f5f3fc-0647-4c58-ad5e-e6d6df01bc34", "value": "mips.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acfbb7e-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756889, "uuid": "b140070c-9d5e-476b-ae8e-11a64a6bc81a", "comment": "Malware payload (Mirai)", "value": "eabf22822b7258676dc773e2b9ed5ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756889, "uuid": "45613431-9e5c-4f45-bdfa-419c0ca38553", "comment": "Malware payload (Mirai)", "value": "c64a8cd9e018569f4c6e48abd730a1e5f5f721ca5cc4845fb79a122f11b79dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756889, "uuid": "30d90462-d93a-4738-9a66-4428e9499db0", "comment": "Malware payload (Mirai)", "value": "27c81441930b5ba5c8c4363e7fa461deb351d745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756889, "uuid": "e1173221-9308-4f06-8d4b-68b2783b5295", "comment": "Malware payload (Mirai)", "value": "e5eb9f0c714fb8c019151b6294f1e4c3ba0d543f540203492c4d3cc7c03e4caeff7bde40e3548de10ec1a4cc11c40424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756889, "uuid": "8fe8aa88-9c16-4773-a1f6-65a173f7464c", "value": "T1D2C33946F8824A62D5D7127AF92E218E331317F8E3DE32239E145F2137C659B0E77A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756889, "uuid": "84b70133-5924-4406-b9b0-6897fb3e335c", "value": "1536:zsnYEKmQICSgso5d1ZdHpUCOrSzEQdkMk652nAo1qN5qToah5QqXgDDRioEY8kwp:YKmwS2zEgpeArqToahFY8kwpJIzbNHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756889, "uuid": "8e57a581-747f-452d-9131-f545d2ba82b1", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756889, "uuid": "081b8a06-fb15-4e8c-99ac-e076537d13c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756889, "uuid": "a9ad69c3-351a-4330-866d-527fa5e50047", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f1e02f-7390-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782720016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720016, "uuid": "d04e77be-ebd0-4899-8bd7-1a0a3b454cb6", "comment": "Malware payload (Mirai)", "value": "e896aae3692133df56eb593cf405cf48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720016, "uuid": "031aecaa-a63d-451b-aedc-d36dcda977ac", "comment": "Malware payload (Mirai)", "value": "c6aabf503d4329e30ad84a898156321fdd1ecab656c79c617f1201642c997840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720016, "uuid": "4496eaa3-3230-49c2-b6d5-6464bd289338", "comment": "Malware payload (Mirai)", "value": "3a0d8ecc1dfcc55113ae2af7d99b192a44caa39b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720016, "uuid": "8da638cd-a8da-488c-aae5-1fd8d4d46228", "comment": "Malware payload (Mirai)", "value": "638ddca4ef61d3127eb1ad2743da9f08babe5e7ca3f572f0513b3e908f04aa3c2d5dc364c256ce0d05b4cbe13ff49246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720016, "uuid": "f2a7f45f-7640-41c7-8d53-1f5bd88d6cd0", "value": "T188A36C2B6651C47EC00BE1F01BEBA962FC61B87E0A31B04677D07E916FACCD19D19392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720016, "uuid": "67756265-83aa-4ddd-b9e8-ecd293fc20b6", "value": "3072:XEpkJHgKTpebU35QPzErLuJya+Zsr3phaTJYzl:3/5EErqwb8phamzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782720016, "uuid": "6439cb4c-cee3-4761-9e38-935bc1816fc3", "value": 100376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782720016, "uuid": "f1b9b64c-d203-433c-a5cb-396473924e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720016, "uuid": "2fec05c5-1bf9-4480-9519-4e8fdb805fe4", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0029c2c3-73e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782755422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755422, "uuid": "d5255b6c-5043-49ed-81ff-30ddd2364540", "comment": "Malware payload", "value": "b07c124617629a706191ce95c681245c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755422, "uuid": "805b3011-3660-445e-ac44-d1cff85f7411", "comment": "Malware payload", "value": "c6f41358fd04da7921ab45eef746302f1f550760997c1caac3440cb68e562ad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755422, "uuid": "ac043914-2656-44f8-b58f-16eeae705146", "comment": "Malware payload", "value": "ad16c9bdcb3556f23309122b7557df988ad986ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782755422, "uuid": "11989a6f-521a-4c9c-8059-1f70d7ff7347", "comment": "Malware payload", "value": "7a6077a5308b57d94591c0053b9231ea81be91183d9112ce64c384513ea39371373f064dbfed7770ecbac31ee4a8014c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755422, "uuid": "0c17222f-aaf2-4b42-b516-d39030f1c18b", "value": "T179C3F75DF4808B27C6D0163AF69E424833735B64FFEE370599187B343BE66299E2A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755422, "uuid": "8762fe04-21a3-47cc-9cac-fc28690f72f8", "value": "3072:gu+vS0XrhQgjqYhpAUiq4dPAxothxXVw:gu+vDrjqY7AUithxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782755422, "uuid": "bb900bd0-f4a7-4854-a9b6-3979bd4ebc79", "value": 119308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782755422, "uuid": "e6a45247-70dd-4d7d-901a-2a559c2c2eb4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782755422, "uuid": "dfc1426b-54d5-4639-9e7a-b979f699ad07", "value": "SecuriteInfo.com.ELF.Agent-EJE.21493416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cfa7a3-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775287, "uuid": "01443e0e-321b-4b4d-9d76-47d3b8a3cdba", "comment": "Malware payload (Mirai)", "value": "3979994dc971fb87738440246a701584", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775287, "uuid": "3bfd436e-e8bb-453c-b08e-ed28a526b921", "comment": "Malware payload (Mirai)", "value": "c76de2972ac27799404163a44547a789ba25aeb42570ff21d0efb92128e5cf1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775287, "uuid": "d6098e97-35c7-4777-b857-eb9e31f279d8", "comment": "Malware payload (Mirai)", "value": "10cfbaaca32297b97fcffccd51de3bd9d6d369e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775287, "uuid": "53eaefe6-dc20-47d0-bcae-c74c2df79198", "comment": "Malware payload (Mirai)", "value": "2e4bd8685ffe297ca05cea48c94923e1ba7ae8e3206bf14975cf0f5af84cbbc5c746142f353fb10b32ca2759636e7269", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775287, "uuid": "4da39259-b09c-477e-a4ec-1ff518d921be", "value": "T1A56183FB134906335CB389D732BA4444719082AB54CFAF76EBDC28A50EADECD7C42652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775287, "uuid": "04e85014-726a-48fc-9272-7ea206b7540c", "value": "24:ItS8xZsS32bhSCXkSTqlfSZQmsSlUTSCnCGgJS0Z6SdcnLSsnsNIpKksSnGMEShP:iS5wpnj/C1GXLoJJh0dYBgJsxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775287, "uuid": "3d667c47-caca-401f-9917-5aacc8e59648", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775287, "uuid": "db3aee02-4b72-4f52-be22-c7096cad9581", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775287, "uuid": "f3ec7af6-8125-4093-883f-4fbf3a342125", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a177358-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765102, "uuid": "7107814e-de8b-4536-800e-b0d17ec7049a", "comment": "Malware payload (Mirai)", "value": "da15988ff967ca7727655ae140753161", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765102, "uuid": "a551be90-fb4c-423c-b58d-521b793d5df0", "comment": "Malware payload (Mirai)", "value": "c7a2de177666b20fb96bd52d930aad512daee6a45b4fcb933aa7ee9c0ad232f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765102, "uuid": "47824e09-1b96-48d6-8230-f87624d75db3", "comment": "Malware payload (Mirai)", "value": "fc61b9c02e8780d2891e7ef87f4ac9bb53de8d2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765102, "uuid": "10916302-963e-4a70-97ca-7154193511ed", "comment": "Malware payload (Mirai)", "value": "0968faa188a3f876707370d94d59cc3ac64ab12be211302b4413a1577de37f7497e0815b2d66e1cf8e19f80b113d0003", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765102, "uuid": "f6a6f974-82d5-4bce-a4c6-1eefead8833e", "value": "T1BC243A02770D0E03D1533EF0263B1BE14BEFFDA128B5E680755EBEC59271DB22589A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765102, "uuid": "81a7a81f-9cb3-49f4-bdc5-65a20afa26c0", "value": "3072:jbcIyzN4l+s+aIQeP/LQdKhixoCNgI2xnGVpS8cJjsMnGfa:GN4o8ne30dsixBgI2xnGXSXj4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765102, "uuid": "e678a704-2cb5-4293-be55-a0555e7be222", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765102, "uuid": "290b9bd3-b7d7-4769-b11b-752a246d516d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765102, "uuid": "55fc0292-b55c-4641-9403-e64b08781d48", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d576c292-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782717125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717125, "uuid": "c3a82cf3-93cc-4bd0-8f59-0dcf454b188d", "comment": "Malware payload", "value": "ae5da2c67290cd103799ec04ddaefc42", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717125, "uuid": "31b6fc5f-f856-49a3-afd9-ec9c979ed745", "comment": "Malware payload", "value": "c8319d9f2b3f3259e04711871b8f57d959e50d9aa7daaab942a33396a83b137f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717125, "uuid": "1c4db52f-25a0-40c4-b1e5-61f85819e3df", "comment": "Malware payload", "value": "7a492d807f0525271a49522bdc49444e22517f96", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717125, "uuid": "d9450843-079a-4c0c-8477-13c300bf26c1", "comment": "Malware payload", "value": "b32a1693b03cffdab340a3e477e4d329a5fbd312e3fb36f702528d16c9b183e9b73321aee17093d0307d696bf5485ee2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717125, "uuid": "d9607db7-0692-4830-b7bd-e3dbc73bd633", "value": "T15BD02BAF918362874C52146039C115D2269D12F6A47A45A86DC6E48B92A893ECD9B988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717125, "uuid": "f00160ae-1207-4e73-8917-f74e4b6bcbe5", "value": "6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRCwCnQFEcXaoD:J0+oxBeRmR9etdzRxGezHtCQmma+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717125, "uuid": "d921a77c-c403-4514-9c77-61f0c09b4cc2", "value": 275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717125, "uuid": "7f14bea7-c17d-490c-85ac-fa76d4096a33", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717125, "uuid": "5e0d08af-9e7a-4e44-a53b-aea749671310", "value": "c8319d9f2b3f3259e04711871b8f57d959e50d9aa7daaab942a33396a83b137f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8752ff-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721356, "uuid": "04e7500d-cb51-4a45-91cc-60624fa6e1dc", "comment": "Malware payload", "value": "39a2a7b3524204f668eb6fd534039dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721356, "uuid": "d9a09492-77e8-4b37-8d00-175dbff4b990", "comment": "Malware payload", "value": "c89fccc9c30dabc9db73922996b6cc6e885a4fb3e0fdcc6a39f1b595cf1ccb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721356, "uuid": "e3bb4171-2ca5-4c0f-a4f5-a8e1325ecfd9", "comment": "Malware payload", "value": "27d65670dd41c9b3655cbdc18fecb1f0829d69e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721356, "uuid": "7e1678bd-7000-49d6-8675-bb9a99d9cbae", "comment": "Malware payload", "value": "e989ba1a0b2151cbcd5f093f102854e964369a424754191ae652c0dd6de271d0de93de8f9626f7f5aa70c0e810041863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721356, "uuid": "572529d7-5b20-483e-bc8e-8d6107049a10", "value": "T183522BCA30C3A0BDD2B98378C90B13F7DA2570E5570A9FFF43D8466826C2A153975A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721356, "uuid": "6ed91971-601f-48fc-b8df-8c055563375d", "value": "1cbfefce08822faeab3ddd0a4a3750f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721356, "uuid": "d100b1f1-7cf3-491f-9d6a-c31cc6ddd040", "value": "192:O8ivinz27ZyJaFgOXd+pfCEkJNko6CWBcmHnHebsmcSeF3VdWo:O/EzO5gOXgdCEAl6CWhnHebBleFldW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721356, "uuid": "1db8c162-0bf0-4d9b-8fe6-7968aecdc9c0", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721356, "uuid": "acf542bc-38b5-4b32-95ba-d1f80e0f0473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721356, "uuid": "55e02119-26a4-43ce-b514-2a7524d267ce", "value": "39a2a7b3524204f668eb6fd534039dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ccd8d-735c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782697821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697821, "uuid": "65b1291c-1849-47c9-bcdc-91e0eba8f4d4", "comment": "Malware payload", "value": "dda077f7de97c03571b2edf27cbd4654", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697821, "uuid": "a41a6387-7ade-4972-8db5-4bbc496a485e", "comment": "Malware payload", "value": "c8f6ff1583b1899a9a08e4116459037ef8425ed37fa5e9e0693bcd988e5ee573", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697821, "uuid": "c40e4ee5-171d-4b40-90e6-cc1b127ec758", "comment": "Malware payload", "value": "c443803bf5e4c59dde937a3dc7ef9488d50c2c14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782697821, "uuid": "8afc4818-e3e7-4ab0-a520-0b58ac921afe", "comment": "Malware payload", "value": "8647ad40269a43746c0ad0c882e117bab423bf0434989beed9928ab8b12bf54e2f147e623d67575fad3309171b6a26c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697821, "uuid": "4d6f365a-c9e7-4926-9d2b-270c4a1cdc33", "value": "T1FCE2AD37F250BE04410E1FF2AF125DD564969CB94C10B7BC931997E319E2A1AF3DAA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697821, "uuid": "390e23ce-dc77-4bb3-b0d8-a05961c012e6", "value": "768:YL4TRU3KfH9G3195N5yZcwJYxkBR4Klc9sTJ4jP5pFYbQbt4MNv0tdMl:v1C0HI6kxkYycnPdYbhM5QMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782697821, "uuid": "7c560740-74b7-401a-9dc5-d61c8b962c3a", "value": 33410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782697821, "uuid": "12fcdeec-d2a0-4ca5-b70e-553f7b810f81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782697821, "uuid": "e8070ad3-883f-4a05-a16a-8b670d1347eb", "value": "ayata.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fe4604-73aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782731079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731079, "uuid": "5fb6727e-d2dc-4942-806d-5ab37f61d653", "comment": "Malware payload", "value": "8a15efbed6200d6dd99ecc08fe1cb373", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731079, "uuid": "b724f0a2-362e-4d63-ac5b-01c0859e8bb4", "comment": "Malware payload", "value": "c9801bea9a035d4efab3093a18779c7819ea4d3c74123b1944ffa799ce634ec1", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731079, "uuid": "30e01cb8-da2b-45ba-acbc-f12a416b0d59", "comment": "Malware payload", "value": "1380a039fd911a3a834f02c48089fc8dab0caa5e", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782731079, "uuid": "1b32028b-2711-4797-ad9c-e49f32e9240a", "comment": "Malware payload", "value": "a7181046fbfaed76271c84519805f71ccb4559d739bb60e078c6215324c666ea70db50bf9bb09943ed20ba0b89b068f0", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731079, "uuid": "6f190e68-4ed5-4308-847c-3071a0a4ac2d", "value": "T1661833246F948CD6F55631399A916245E3E3BB5807B08F9F0BC06B212E275FAEC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731079, "uuid": "4ddcf76b-6138-4cd5-9b60-1f72a0470f7f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731079, "uuid": "d52ce0d3-5fc0-4e7b-8db7-297c29f8efeb", "value": "1572864:WAYyyxBU7rUFpYKHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:WfxgkAUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782731079, "uuid": "c3bd38fe-1493-4f88-97d5-3d4b7e878041", "value": 85023329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782731079, "uuid": "07f4932d-b4bc-442a-b9ac-e398d6772d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782731079, "uuid": "b5f3cb79-c68e-46ad-84e5-632142a3234a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8f9547-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782736895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736895, "uuid": "e4fa8a1c-eeae-4451-985d-bdc844f9aad0", "comment": "Malware payload (PureLogsStealer)", "value": "941a7b02fd34dea11487ddc4e1086a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736895, "uuid": "60570b19-06da-4266-805c-8415edcd12de", "comment": "Malware payload (PureLogsStealer)", "value": "c9a756a44b62f66d5b69a8ad643a52f14f9bbbe6f1aba92399e127537774f1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736895, "uuid": "999c1f26-86d7-4bd2-97fc-b9a13ec918b2", "comment": "Malware payload (PureLogsStealer)", "value": "b96e3934729b7dbeed76a2e32c0fc704113e41ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736895, "uuid": "ebe738f0-a467-48df-8fe6-d06c57c11c4b", "comment": "Malware payload (PureLogsStealer)", "value": "15907a8c7dc751dd5aec5bb12fb8ae002c98dbaeccba328be27bfc612aa9dae0d00747c1da2e1409a006ab7eec8518f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736895, "uuid": "b2383bd6-713d-497c-8bd8-93e5de448dbe", "value": "T1FD956B3EAF4B1538D1E5621091B43054528F6B0623EFE5ACA77D5DCE432398E2AF463B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736895, "uuid": "829bdfc1-e0d4-4e8d-bfc9-64307dac7e96", "value": "3072:C4Ltu6L4QV9HzT/iturYejxR5SkLjcjtIhtXdAyjYjY3sXJZ+JnJG5jVWT6H5KZU:oQVVzTOurxjxKkLQKtTcY3s3+Jnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736895, "uuid": "eb72926a-a948-4586-8b0e-25189db2dabe", "value": 1999224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736895, "uuid": "ba5aa625-b229-4395-8ae2-1f2d4e633776", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736895, "uuid": "cd45878e-3c6d-4812-98f9-87edafbdcbfd", "value": "INVOICE NO.HCAB2324.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49afbd77-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782763706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763706, "uuid": "d6163bce-ce56-4d0e-81cb-adafd2d02af0", "comment": "Malware payload", "value": "7b4d04847130d468ba30f6a9e0b2131b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763706, "uuid": "0644c44d-ffb1-433c-98ad-311f07447412", "comment": "Malware payload", "value": "c9caf3e4516b94a326bc1b0c787b0e29752e48b6ca55c72025ba7e03d32e7f8e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763706, "uuid": "398c1c21-a918-4df8-96c2-6208652e4ca1", "comment": "Malware payload", "value": "a5926bd14e98aa9bd6db236729517a748269b256", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763706, "uuid": "f2d638bd-0836-44eb-8f24-0f6c15dfac91", "comment": "Malware payload", "value": "15911f10c452218c8e2f792184e879836a4323c7f6d5ab146e92e3e8cf7ba8e5fe920c73dfc82374e6696663c3ab295e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763706, "uuid": "28e7f75d-a4eb-4eaf-a7a3-b77a64f1a581", "value": "T17314F713E3034F80F156C1B24ABE87E57ED021C356B66CE5D321DAD16B163E4AC9E9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763706, "uuid": "18a4d2dc-3e04-4a1d-b88e-101f39c83fd7", "value": "1536:MGRB6//0FAiJ/kubjHwg1DDx7cX29KyAvBzddLLab+9qp3mRAFKZj4//21D/+14W:vf6m/ku/TVtMHTcX21/+n27ikVnZpW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763706, "uuid": "ff5523bc-baff-47ab-b430-60fb7990b497", "value": 199476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763706, "uuid": "69caf06b-429c-49bc-8c5c-778479098171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763706, "uuid": "264adda6-7a98-48f6-b32d-7b2b1b5de057", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37658655-73b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782737046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737046, "uuid": "cc8e869f-1da1-496d-a51e-7326b18eb8d9", "comment": "Malware payload", "value": "75a46879fdb6d4f9c32b504e2f97f5ab", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737046, "uuid": "f38c508d-8b12-437b-85f0-d2345ea979eb", "comment": "Malware payload", "value": "c9ff9a1c70d0326468eebfb6c6edfe5dc7350a9e79c3c3e14d7f93b0893c3565", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737046, "uuid": "ea83d38a-eb98-497b-9960-e27d273f295c", "comment": "Malware payload", "value": "e0892f01bd81e1a78fc99d914f96f9ab7b56d662", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737046, "uuid": "3a984c7c-63e8-42f5-9c4c-cdc50bb20b36", "comment": "Malware payload", "value": "7662824aaa58fa9c030ded225eaf95220eac63769b092ce6b23048e6ce19a0aeae4773af4824a35212c6ab8b97e63b80", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qinfos-com", "colour": "#CA13D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737046, "uuid": "b7ac1cf9-f09d-41c1-80b8-80d212428b09", "value": "T1A5B5AF56B3C45AAAD116C93987179232C272BC524776D2CBAE96E70E1F77F804F39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737046, "uuid": "96468ed1-3262-45f1-b7c2-3ffcbc31361a", "value": "109f73cc95228e3eacd82c151b1a5e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737046, "uuid": "ff8639db-f294-4efe-be3a-e825f072329f", "value": "49152:8310VYDRmvl+BnBjQ8GBCnDXepZjtXIH/C3uDuG5fw8QJXAYnq9a26mCa5caDGQ7:IsZ+BvOZjtXIH/C3uDuG5fw8QJXAYnqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737046, "uuid": "b0312a06-48f4-4868-a9af-9c08e185a100", "value": 2477056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737046, "uuid": "6f9f3da0-3d62-44dc-be08-2e9c7dfaa753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737046, "uuid": "24687be1-9fb7-4c23-99fa-28627efb5c74", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309d978a-738a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717278, "uuid": "3412cf16-7d24-4615-b60e-f7ce018ab5ef", "comment": "Malware payload (Mirai)", "value": "9a3e61574b3e217be8f75f15315b997a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717278, "uuid": "68ce2e7e-53d6-44fb-aec9-4d9daf9904d8", "comment": "Malware payload (Mirai)", "value": "cbf03d194c38a7945303fc009d4660c8bca1d076dc8c37a037f8d3c7cd352db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717278, "uuid": "4053f72b-71c8-4a4e-9c84-9b7915d832ce", "comment": "Malware payload (Mirai)", "value": "c947a3d67927b53f33fb01e71fe03718fe6d17fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717278, "uuid": "d90b43a7-4a05-4b08-bb18-c366e0c24742", "comment": "Malware payload (Mirai)", "value": "efc395561a85e6788f1cf56553bb448bd82250c8fb2c0152adf83a0affaecd0b90464f50ea247625a6445b1fa8f3d943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717278, "uuid": "fc07ea61-7521-4184-8baf-231e23cf623d", "value": "T13943F1E6D5DAEBACC96410376C3D1E5B1CAA3F1E99E984C19DCCA02672D5E183D3C310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717278, "uuid": "2c9d2415-6e8f-4cfd-8712-098ee27de232", "value": "1536:6vaqJTATMqbb0J2MxaOP2XY3t5spm2dnouy8E:6DJkoq8gMxa3Id5s/loutE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717278, "uuid": "37370c0b-db81-4e03-a46f-76c87329c569", "value": 57712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717278, "uuid": "19bfd000-43b4-47aa-9c68-3971576ac4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717278, "uuid": "3e91ee2f-fa11-4f73-bae1-3126132da487", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74064e2e-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713096, "uuid": "6394e6aa-ec00-428f-89d4-fe3cee493a74", "comment": "Malware payload (Mirai)", "value": "7e11945bb50747a3bfa8b298e2134103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713096, "uuid": "e8f31472-8d33-4209-8958-9e414fd84d35", "comment": "Malware payload (Mirai)", "value": "cc09c8051ee600280c99f6d7d8aecc5db6e0130541bde8fc92b7311de8352efd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713096, "uuid": "e5c80ee0-01d1-42a6-8a67-45b10546b7a5", "comment": "Malware payload (Mirai)", "value": "e2421998606b8ffc9db6276c72666780fb034537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713096, "uuid": "dc54957e-be00-4345-99f8-49f5e7ad2204", "comment": "Malware payload (Mirai)", "value": "77ba27f97616f2a3f01a3dd90bdb9e3198e4685b51db58272fff1d7b400b7f4f562f1d0165355de30b029f0cb518e0fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713096, "uuid": "fa690a64-93d8-4a87-9635-d24c5b6016df", "value": "T19A631991BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713096, "uuid": "e641241f-f7b2-405b-9c3a-05bef68dfb2b", "value": "1536:XGBQnw68oqNi5IHzS/GIw+D3ohyaRdWViEs/hX:XGBBa5g01w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713096, "uuid": "fda7abc7-4a30-4d20-99d3-c683a104bec7", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713096, "uuid": "d3df46f3-7bdf-4a1c-bf5f-67160cb977f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713096, "uuid": "b1982a9f-e43a-4a10-a23a-db3e9f8b5c74", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed936a9-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756869, "uuid": "f4a51705-dc2e-4f58-a35d-fcac97a11a4e", "comment": "Malware payload (Mirai)", "value": "5d0e5e116552578543926351dffdf96a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756869, "uuid": "5c251635-ddfb-45f6-b932-0378225f4350", "comment": "Malware payload (Mirai)", "value": "cc47d776423c828afe96c456d2bb9bc9eeff934020368a7648733258c7f4843b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756869, "uuid": "3bde0c0d-1177-4d9f-9299-13df6a172384", "comment": "Malware payload (Mirai)", "value": "595d76e96eb1fa915242eb407a1a50dde03b092f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756869, "uuid": "1c555b12-1714-48ee-b9da-76582124367b", "comment": "Malware payload (Mirai)", "value": "988a888c0a90adbb9291bace81c4fa82ce66d136899f9c8318db941a7f4c9646bb9eb0e833116d73682fd6a9887eb64b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756869, "uuid": "b9dc7cd6-2fce-49be-8427-a4213d69b0d8", "value": "T1ACE3F709BB610FF7E89FCC3705E92B0528CD552721A93B36B534D518B64B28F2AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756869, "uuid": "75d57c47-0dc3-4f9b-8611-c90f7ecea28e", "value": "3072:n5Ol94Z5cThdiRYyVe1GIk2D+umKvMN2y31zYi9G7fXtHH:n5Ol94bcThdiRY0wGIk2D+umKvMN2yFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756869, "uuid": "bf2f9dc0-437e-4fb9-aa19-de57b1679ef6", "value": 148788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756869, "uuid": "b9aaeb35-ea17-48e7-95cf-994eacd098cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756869, "uuid": "6222c4c3-37fc-456c-ba15-abfdad0df9e4", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9d884f-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760434, "uuid": "f7b13095-410a-4752-b749-c32022cb15e6", "comment": "Malware payload (Mirai)", "value": "2005d74d8d3285627a6d5ded306b0278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760434, "uuid": "5431ab2f-1778-41bd-a260-d3294a777664", "comment": "Malware payload (Mirai)", "value": "cc7186e17ad56e70dd2fa7579e0674e762ad5a6810f6bca74cf960b3e3edd5b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760434, "uuid": "ec9b81b2-2bf0-4cc7-9ae7-6526cc7c712e", "comment": "Malware payload (Mirai)", "value": "9a5d7203c02862d2a79e936dbf98ce52f7f868b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760434, "uuid": "55d209d6-6f1c-4843-a0f1-b323daa64039", "comment": "Malware payload (Mirai)", "value": "4fd3d4e8c3b405df24c7eccd5a76699d89a65bee7acdbdab1b75e8f8a52017a81f349e082d8387fc4c7c373598018d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760434, "uuid": "812137c7-5845-4a1c-a134-511ef3099e2e", "value": "T1EFC31946F9828A22C5D713BEF92E118E331357B8E3DE72129E105F2573C662B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760434, "uuid": "b25f6685-da14-4f71-ae6a-6a02c69e23f8", "value": "3072:vgIcXParsxosCgx7T6ahCTdchKKRtrF98hL:vgIcXirsxbFx7OamUKKRH98hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760434, "uuid": "49035549-d753-432c-946a-d870c6bfcb45", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760434, "uuid": "78a9c216-e4c6-4290-8fc9-ac38bd6a73f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760434, "uuid": "8473df59-c8ef-4b71-81d6-6d447d5510b3", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edee078b-73b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782736923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736923, "uuid": "c8d86f3e-b837-4711-b378-4dea2505ea50", "comment": "Malware payload (Mirai)", "value": "2ad6c0faebefb72dfba8331a51014efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736923, "uuid": "16dd1b2b-749c-48db-8c08-e99f13a3de3c", "comment": "Malware payload (Mirai)", "value": "cd54f06635084acc151271934e85a13a3881162449b86f402c1f84c65af6bf17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736923, "uuid": "ea562f1b-0762-434a-82a2-a87809cb359a", "comment": "Malware payload (Mirai)", "value": "bdcea1a2e4b9ec68eed098b17ae8499e2eb2889d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736923, "uuid": "7d90bf69-d071-4871-ab5e-ba50fd6f6c80", "comment": "Malware payload (Mirai)", "value": "a2b82f4838ece4b74bc9616e32e41ebae7c11181bdb7af23823771944e910ea576b5e6939fd4e840d0d5bffd89059958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736923, "uuid": "0143e252-e96d-4da8-a3f1-fc4ceeedc967", "value": "T118D3F84DF910A729C2E271FBFB5D12CE32271FACA3DB3125CD304B9523C5AA6593A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736923, "uuid": "78efd001-032e-4c88-8ce3-7f7dcbebc51d", "value": "3072:pBsLQctgca+GHH8ZZCuo8WQhf5h8p/SI/:oL/Da+Gn8ZJWKf5hBI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736923, "uuid": "e4963837-d15c-4dc7-8186-1e4b60f27f63", "value": 136840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736923, "uuid": "fc3a6f7d-c0fe-4dac-aeb0-362100e8b3f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736923, "uuid": "50a1d5fa-97ee-47d5-8b50-89d6b8a0530d", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96960679-73f1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782761687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761687, "uuid": "cda8dd8e-3070-462c-8722-1adf2164f863", "comment": "Malware payload", "value": "9ee77df9d43ff11e2a5c4b03e115160e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761687, "uuid": "0504d9d5-d6ac-4661-a13f-60aacd8b5c0a", "comment": "Malware payload", "value": "cd6c6a71278a27b767197e79a13260850980ac9f74db66adf622ec9de7c0c772", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761687, "uuid": "b242517d-6a84-4e51-aaf8-796de8920c63", "comment": "Malware payload", "value": "9493ae9229907e1c539aaaa6ff6e36ec26ec1498", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761687, "uuid": "9ca617cc-cf75-4e75-aac5-53dd0c3aca94", "comment": "Malware payload", "value": "76ccf4d0e7e01d3b44f32612a10f09b28c66b7373b0bd664329d3ec0be6e5395073e74f98739664c9acb82d4fced485a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761687, "uuid": "7944897d-2dad-43c4-b255-2f0459e0dcec", "value": "T1D701AFCA85006C5040DE965D3A975554F820D3CE195E4FA8FFAC6E3AEB94C04B026F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761687, "uuid": "7e8236ad-1ee1-4023-ba55-76f303d84d37", "value": "24:kXCKysE2hi0ziQvZoha5lFSfRWF3UZXRMJRX:e9Qp+Ms5af03kyJRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782761687, "uuid": "6b749038-290a-4497-b3ed-5acba67862d3", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782761687, "uuid": "38f73833-2282-4529-8df8-64befdeeace9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761687, "uuid": "77fcb082-ed25-41ec-b5f7-857fd09cd023", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3110db92-73f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782761087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761087, "uuid": "b1f0e1e2-c1cf-49d0-82bf-5bb6ca6883de", "comment": "Malware payload", "value": "6b2d91ef3b600787f8f8ee08998accf4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761087, "uuid": "f98a67ac-105d-4084-8dc2-954bbf4875c1", "comment": "Malware payload", "value": "ce12a192a45aded792d741ba8f5a50fd517f4b3793ea0be25203c2c8684b3de6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761087, "uuid": "1f129bf1-0e0b-4019-9d2b-e99fc5c25dfa", "comment": "Malware payload", "value": "fe2ecfe8b73e4fb5a4bf18877a580624d31d5ef7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782761087, "uuid": "524fede2-d6e4-4f97-892b-8c9b80cb2593", "comment": "Malware payload", "value": "72d4d9c664c3629a5acb2e22054a5e1602b23fc4a9f7f01173ce795f261368e288293dbea17fcae5c4a8e6e338854d4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761087, "uuid": "13bd1dbb-48c9-43cf-94e1-e634f85ec52f", "value": "T1F5236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C49AACE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761087, "uuid": "80219093-fe15-4d7b-b4ed-e96883166f89", "value": "768:4r9NyXsZztCK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:mHusZucB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782761087, "uuid": "a64a3e42-c286-407a-b5a0-4a2fd7e58573", "value": 48364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782761087, "uuid": "1e88845d-36b0-49c0-b967-77eacdbd97e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782761087, "uuid": "d21ab8c7-2e90-4318-9b80-a54cdc255da1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d82769-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775289, "uuid": "75d3e14c-de35-4cce-886b-f196c787e6e2", "comment": "Malware payload (Mirai)", "value": "956154e8d60fb34912c0c32d22328b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775289, "uuid": "b2c5d1b2-d1b1-4554-aaf7-e544e1b14b66", "comment": "Malware payload (Mirai)", "value": "ce2684992b42f2454cfe637cbadf547545240366b9b0b79de036502d80ae996d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775289, "uuid": "5e659a2d-7499-4e6a-9757-9864c8ae2704", "comment": "Malware payload (Mirai)", "value": "795c0f1132278ce32ec475242333607cfc5c49cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775289, "uuid": "727c3904-ff6a-40aa-bfd9-979337c3a850", "comment": "Malware payload (Mirai)", "value": "c568720c4e5b704715b813eeeff0707650a5382c3b55825731ecb3bd0ab671a19a13295530f62bbaae997bcd22c47e43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775289, "uuid": "8dcde609-df1d-4006-8d8e-8b4d95306eee", "value": "T180C33945F8815623C6D7237AFAAE118E332263E8D3DF3217CE255F21378651B0D6BA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775289, "uuid": "48e52c05-059b-478f-983b-197f2a282824", "value": "1536:hUyw8WqZQzBCEfB5aYh2RMQWykWhT3ksjDOEWXjP2MNrivnDM:hUyw8LQgtDWOTxjDaT8nDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775289, "uuid": "8f0da7ee-50d7-4459-a0eb-d3da051e24b6", "value": 121220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775289, "uuid": "a9302354-c29a-47ba-b43b-1f3eddecae08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775289, "uuid": "6627bb44-cf1f-489b-874b-b95df02bb700", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c8c278-73cf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782747007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747007, "uuid": "9af6d5e0-fb4e-409f-b1de-9b0cd9e9e902", "comment": "Malware payload (NanoCore)", "value": "d11ea15f2c690f46bfc282f300f692c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747007, "uuid": "653d196e-e422-4a45-8d83-dcbd9e587d70", "comment": "Malware payload (NanoCore)", "value": "cfa1674a075c651c7bf0278f5fffc2ed2d268f4317eb41faf1d1eb03c14bdb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747007, "uuid": "1544b0c9-37c0-4f62-b80d-4afd364445df", "comment": "Malware payload (NanoCore)", "value": "999dbc13a581e26dd6e2931db152b01087d13c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782747007, "uuid": "4248e3a5-aba6-4eb0-b0a1-1d3a5c3c97f5", "comment": "Malware payload (NanoCore)", "value": "206bf21fb9e65bc54609e09050cd10d2dda717111547882b35ed6699254ae1f775872b2823b13346820cc1b16c350bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747007, "uuid": "6a074b09-ce92-4a81-b808-32cca5108041", "value": "T18E14CF6637E84A2FE2CE8579611252139379C2E3D8C3F7DE68D464B38B667E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747007, "uuid": "a8ce1edb-0a17-4023-b985-5cc9a4cd178b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747007, "uuid": "cb345a28-3e5c-4d3c-aa47-c96ff3fe5d49", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HICC5fUisD1NHmB5n7lnQidogwf:gLV6Bta6dtJmakIM5IjsDM5nZQi+nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782747007, "uuid": "19557658-6605-4f67-822c-13ecd7cca71d", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782747007, "uuid": "e1888cff-b389-44d3-95ae-083fa50e3e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782747007, "uuid": "771ce567-7dfb-4783-b341-8bc1ba4f4340", "value": "Pi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d3b438-73be-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782739949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739949, "uuid": "87ff4e17-f6af-4978-a465-76292d19296c", "comment": "Malware payload", "value": "1bd926b3f3e4127d967c251631472057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739949, "uuid": "50c5000e-6d85-4bf7-b369-b25fab2afa03", "comment": "Malware payload", "value": "cffff3d2a20e308fbfbccabd49b4de41edf7f6de57ed7a6ff0d8ac6b10a23d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739949, "uuid": "aa8a6106-6a3e-4f21-b86f-bbc96245c499", "comment": "Malware payload", "value": "e1e3c855adc6d941a79ec7fc779383ecabc05f4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739949, "uuid": "3f8aed99-5e4c-4f36-adc6-b8b94be654de", "comment": "Malware payload", "value": "da33d8530f71d5ab0e8a1a9271776ed4e72f26699851aae2640968efe455a8f9282718bae10bf3b2521c68c7f1f33e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739949, "uuid": "86986386-cffc-4512-8a33-a67bcf7b01b8", "value": "T1B0246D03B6A254FDC08AC4F0475FA356EE3778A9461B75F77B843A313912EB18E09792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739949, "uuid": "300fc18c-7e13-47c5-badd-80ce60d1b454", "value": "6144:y1OnKk6cQOs4cTlc3DI3gpPVt//XFQG0oXr+qbo:2OnK3fA/rr+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782739949, "uuid": "79fc1ace-8dbb-4df2-a626-311b950ca3ac", "value": 215248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782739949, "uuid": "b782df27-63e6-4ecd-9885-1ee44e110323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739949, "uuid": "f2f31da6-e754-4c8a-ade7-6d03b769bc7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa8f8fe-7392-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782720712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720712, "uuid": "40ae75f0-a797-4b8f-82a4-986d00e624d5", "comment": "Malware payload", "value": "6d6006b35835e520440f141be9f79938", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720712, "uuid": "eed9fcce-c794-49d4-b0e0-b420ca13fd43", "comment": "Malware payload", "value": "d02ebd5b466ec0feaa61782176f1c1bba60560468f708f7529cd1746b7a17880", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720712, "uuid": "d6148384-3645-4e5f-9834-e12e64383f65", "comment": "Malware payload", "value": "c98f8a672515e4939f64528617c254aeed494a4e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782720712, "uuid": "2bce2fd7-d36f-4264-a2fa-c6ee37536a37", "comment": "Malware payload", "value": "d949afbd7d8bcd2a564bd3efdec4fc531a08ec3af13879d5936623e8423aaa42432c70b3ba55224f62a26bb043e843bc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720712, "uuid": "3e5dbd83-c9f2-4723-9d75-2955c4f46b51", "value": "T156D502BB94F2A9539B904663EB0F2C1A339B19E13B54D345EA51905C2F3B1D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720712, "uuid": "1b502208-4784-472d-acd8-fa4a1cd4151e", "value": "49152:dOc2yD4lTPsGunEmtVH2zUveSMW57IAsb6r0kRzb3F+VnKy/6H03y:doyEFPsHnEUPWtw7Ihb6r0CQR803y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782720712, "uuid": "0b1b7aed-1425-4749-b956-e26dc471bdab", "value": 2982254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782720712, "uuid": "87814d2d-d746-45ce-a5ee-cab17d51e7c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782720712, "uuid": "49ea4146-3528-424a-b138-d988e6efa75f", "value": "PaymentXreceiptXMaju.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48843230-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763704, "uuid": "0fd3fe9f-49f5-4491-9e00-a7ebd144889e", "comment": "Malware payload (Mirai)", "value": "a3bb76662e6bea0f4bac11599c8e925a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763704, "uuid": "9e29a243-6ebc-4865-8373-0a23178f4b33", "comment": "Malware payload (Mirai)", "value": "d0ed85586eeee7b4d4d5423e50edf94540c5c7ef2467e35d8b4c7d5a625051b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763704, "uuid": "5c5786d4-3a9e-4221-93dc-e1255e60b805", "comment": "Malware payload (Mirai)", "value": "4901a76954fea8fa5233e143bacaa5331e7c541a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763704, "uuid": "5dbc994f-1e01-4f75-bf63-2b6cf1b7976a", "comment": "Malware payload (Mirai)", "value": "54dc69319add8dac16e1f4e1540f2f5b0fd0ce96d9a02d2eca2a9737eb54ad0d3fec06df665bd5ce11f71483a37ec031", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763704, "uuid": "74428c1d-5741-46dc-9219-713973945cee", "value": "T169B32849FC809B01C5E42A7AFA5D51CD33270BB8E3EE7116DC255F2167CB91B0E7AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763704, "uuid": "a3d785e1-10ef-4bd0-a53b-91cec95f8bfc", "value": "3072:3FEJ23CUBSNo+1L6tvQBZU5lTPsuLGVn1KtPKzsg2QL6G:385ldZElTPsuLu1wPKzsgLL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763704, "uuid": "60e4c445-6ab4-4024-8856-5704484b7c16", "value": 118112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763704, "uuid": "ca4da30e-0531-4c94-9707-42b7e84797c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763704, "uuid": "635949e8-9913-4ce0-bc1c-61ac3b8de6c9", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1272830b-7404-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782769626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769626, "uuid": "9d8d85e3-756d-40bc-bafd-f0e53a120b5a", "comment": "Malware payload", "value": "419a58b6f6b3c784126b46eb80443c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769626, "uuid": "b1d95ddd-435b-44e7-8cc4-4f25ae047031", "comment": "Malware payload", "value": "d0f2151853e766756740c278da3a6b3bb86ef1188f4b64126cca389e38b98e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769626, "uuid": "daeeaca8-abc5-4d7a-be32-fa997607dd94", "comment": "Malware payload", "value": "da39d223222093deefa581c2766dc52f450d79f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769626, "uuid": "5d2cfc9a-d34c-4845-83d8-b98b98e9322d", "comment": "Malware payload", "value": "bc133d766dfc2c4f1c8226f8eb1984a811793f625829e0f6975b24e083d07ea8827fb866c9ef2807d35ee7b250d0a231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769626, "uuid": "6cf77f3d-d2f3-4fcd-bce6-ad822e4b746e", "value": "T177C2C51526E80773F5BA2BB915BE5160037BB512E83AE7591ECCF08A1BE73424750F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769626, "uuid": "4d7bcb3c-b398-465f-a152-9a487b62343e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769626, "uuid": "cc9c9441-7198-43e2-8a44-39ce7a173c97", "value": "768:XUANQEkU8Dqvk6SnQbGSccrf1SbaKRts40GD6dMd9ATT:+3U3vk6SnAGSccrdSbXsWDdQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769626, "uuid": "e858db52-b685-4bf9-ab26-a42ca6b3b95f", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769626, "uuid": "d9675131-3fd2-4eb8-84d7-c0e1d7124b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769626, "uuid": "ff9551ac-f304-4de6-a2fc-f04645af705c", "value": "d0f2151853e766756740c278da3a6b3bb86ef1188f4b64126cca389e38b98e5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5d8ed0-73b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782736439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736439, "uuid": "0f622600-4fe8-412b-bd52-8378c3065e87", "comment": "Malware payload (AgentTesla)", "value": "7b4561477757da0c8df47044978f5c14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736439, "uuid": "0aec3245-5770-41c5-9fa1-fc474fedf05b", "comment": "Malware payload (AgentTesla)", "value": "d1d0df395184892b0be7e7d6a8b2e310e2e80a424a95f9076abea84782d3fced", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736439, "uuid": "e436e6d3-f42f-4ea7-bf52-424326bced20", "comment": "Malware payload (AgentTesla)", "value": "04618431cf75b803c7d84058527ed618ce138ef8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782736439, "uuid": "84b3b244-6e5d-498e-b608-5aa9ed39ee28", "comment": "Malware payload (AgentTesla)", "value": "4d629649ecb3e15db24a0213c97d47a6aecef7771ea5b0124468446a6fc4c905debe26a9029b6062414d526d42eba7ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736439, "uuid": "72344708-fddb-4af8-9bba-57cd53e8ffe9", "value": "T1F7F5E8109768A1776125E7AC953BDE78944F600318EACF1A349ED328B91CD4B97C8BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736439, "uuid": "c93e7788-331f-4bd1-a9f4-adc4600a4644", "value": "98304:1HkmFkfcUNGxaQfz3JMGa5H2VsWuYMJv5oEnr5F7K1bVzuBnUmkFjA:1LLez5ttv5oEr5F7AVzuBnYjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782736439, "uuid": "b3948490-1499-46e5-ae42-99d649c845c0", "value": 3343046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782736439, "uuid": "c91ef208-775d-4b4d-860b-67d7bd1410c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782736439, "uuid": "64a039ec-238d-4588-906a-e637f786e052", "value": "2602181 AR Down Payment Invoice Yccnet.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fbee1e-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760372, "uuid": "8a9bae44-3f03-41e6-be9b-ddc25696bdcf", "comment": "Malware payload (Mirai)", "value": "76b96d7edba77479fdc556029fe0be27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760372, "uuid": "47d71b87-6ed5-4315-8184-7a3251a2d1a0", "comment": "Malware payload (Mirai)", "value": "d276c2b960f728173bcb2f09b7f0f5891e47400b05596965ce54b761f7c57af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760372, "uuid": "5c00329a-464b-43a7-b034-f89cff70a3fa", "comment": "Malware payload (Mirai)", "value": "00a5e638a1cbaf28a35212807e5f1d3bbd15b30d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760372, "uuid": "abf7376c-1487-43fb-b410-fed6b1728ae0", "comment": "Malware payload (Mirai)", "value": "e6747c3190216e4ff45c8bae522a512e021ecf52fed019a0adb53be1583c4c89ae01820bfbd4574a98b9a7fb2807d8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760372, "uuid": "a1b32905-a21e-4953-a0f2-205173d118c5", "value": "T185B36C21B4391E27C4E0947B22F74766F1F617D924A8CA0F7E720E8EFF256502647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760372, "uuid": "718f30f5-049f-4ecf-ad94-77ec47b2e8cf", "value": "1536:Hc1EZR9LVRmL3w6ONcaaToLTMIe5ifm6p79jwYJXPGs+Xh+/tbQYm57Y84JatdKC:81aXhVPfFp7jEs+R8FQYO8AKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760372, "uuid": "8bb34fd8-3b7c-4c69-8486-187b7bb84402", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760372, "uuid": "cfb42cf4-7161-42d5-a0fb-ff51880b146f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760372, "uuid": "12ddbda6-56b6-4956-b385-dfe365ac40f4", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adf239a-73df-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782753722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753722, "uuid": "517d23a7-71da-4a63-ad05-3fa07aa3539f", "comment": "Malware payload", "value": "970a38c3669d4124da76d7a3a0360100", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753722, "uuid": "6bb9d149-7e07-4dfb-a828-ac36f919fd70", "comment": "Malware payload", "value": "d424a60c79289472e7f373fd1dff0f195af19a7da72e5c4d318f0da4f7033d66", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753722, "uuid": "1dc379b6-5c42-46b2-aabd-721c6881c0db", "comment": "Malware payload", "value": "7114fa7a6b83cb0de1a319e7c24f16fc5ef93c9b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782753722, "uuid": "be7b4063-2332-48f5-8945-57b3d607c7fa", "comment": "Malware payload", "value": "3d6aea47bc87e3dc9ee4803ff15ca7c2b527cd84cc173de2bb2a46b1ab8a6a36196e63c2b4a0b88db67d304ddc0d9570", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753722, "uuid": "006c0486-09d4-4e52-b334-5c97e6a3142e", "value": "T12EA65AD71A8A68ACC786EAFB8534703FDA03B46553AA71EF563A72EDF613D147024340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753722, "uuid": "71e917ce-aecb-49d4-93c9-6c6c4c4332e9", "value": "511a9f08ad049024ceadb3547f453c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753722, "uuid": "9c20b1c7-0e27-49c5-97ba-2430eb8dd960", "value": "196608:1Hid9vyObfMHl8mq7/yKm9b5G8JADSIsUzxoVU7lvIcBI:UDpU+FKn9b5/yNoqZvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782753722, "uuid": "1e792bfe-cc24-4a39-a821-97d6732e290a", "value": 10113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782753722, "uuid": "749f7320-f1ff-425e-99d1-1d85b8363368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782753722, "uuid": "07d27cb6-55f0-4158-bba3-dd7ddf9d78b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb50ec0-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782765112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765112, "uuid": "a3213a5a-efd6-4daa-b32d-eb49a36fad2f", "comment": "Malware payload", "value": "843c69b3838c29cda20dad06ece7ef89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765112, "uuid": "8a4ac0b1-e973-43f0-9236-a23992847a9c", "comment": "Malware payload", "value": "d44f4c753eb02d50033dd3a7cda32a67323cf9c72e4b9b087497106544fdb743", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765112, "uuid": "27dadf5c-8160-4012-8dbf-69514af1840f", "comment": "Malware payload", "value": "51405e9b9a13a714ad96503b2da0c9ee1560b1cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765112, "uuid": "1ad29572-0abf-485f-a9cc-536692b573e1", "comment": "Malware payload", "value": "9f0af9c87c51d84b3e83730043c8c1e7266b34d085dce1bf69b1dc3a9cd724cf8dcda25a7ddfc4db037bd1ed14d920b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765112, "uuid": "2090374f-548e-4ecd-a278-b7018e759a05", "value": "T166D02B4D78430CB7B4794CB976D76900C10BC20F2D05429A72CE501BAAF86113060153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765112, "uuid": "31d2de3e-8d7b-4e06-9503-9b74a56c406b", "value": "6:hfe4J+pUKUFwRVYsZdR6Y/3IFPWY3F4KdNHVK3eWOXqIKXD73IKX+N1IqN6q1IKb:Ze4J+hRN6Y8Zg3eWsOThS6O8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765112, "uuid": "5e3fe7c5-bc61-44d2-bedc-31371565b101", "value": 281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765112, "uuid": "5cee5ccc-4958-4c55-8c19-3a7c4ec8afb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765112, "uuid": "7373bf41-6dea-4dfa-8b56-ef05f653a215", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a1a84d-73a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (751Stealer)", "timestamp": 1782730329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730329, "uuid": "a7573bf5-9359-4c1a-b079-609f0a3aa566", "comment": "Malware payload (751Stealer)", "value": "70ba05a7ff17a078674bc84b04588fbb", "object_relation": "md5", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730329, "uuid": "97c30de2-350e-4519-b053-39bf64e05fb9", "comment": "Malware payload (751Stealer)", "value": "d455821efd9c2c48a9ca0105655c1d29d921537e19546f5f8aae802f7ef0f43c", "object_relation": "sha256", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730329, "uuid": "5db7f60a-d260-45ea-a8db-cd9f3e0b79ec", "comment": "Malware payload (751Stealer)", "value": "9777cd8dedb0d4a13243f1f850c0e056dc77cc87", "object_relation": "sha1", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730329, "uuid": "b133c618-ed28-42b7-b4de-f8d78eab1712", "comment": "Malware payload (751Stealer)", "value": "975c6e28e282c62a0c59fe5eb914f7940e1eee9699ac2951b86ed95aa2f324beb86fafcf503eb553bd46e7c7b6ce1d59", "object_relation": "sha3-384", "Tag": [ { "name": "751Stealer", "colour": "#3CEFEB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730329, "uuid": "f1f76f6f-2d83-4c42-8e53-9ce1230bc590", "value": "T12CA6331E96F860EBD22B723165500AF1B82D10C56246923EA7B4055954CF9CFBF2F3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730329, "uuid": "2c2054fe-1de1-479e-93d4-1c3ecb7a93af", "value": "196608:R8M6yXBIPGUcF0+K8KJTlH10bn2oNxarr04IT3Al7n+NSDzopNX:RD6yXVBK8KJZV0rLaXfo32j+NezopF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730329, "uuid": "7ddd262a-aacb-45fe-af57-b6698485b6dd", "value": 9765203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730329, "uuid": "9dd01f98-ccb3-4105-ab91-f1fe6dcdc043", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730329, "uuid": "089f26ca-50d4-4799-bc69-0fa766d92914", "value": "NovowareClient1_21_11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c1d69-73f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763708, "uuid": "a7da5f69-4d1d-4027-844c-0b55fa3ce54e", "comment": "Malware payload (Mirai)", "value": "bc3ed4efdac74bc3b4193062cafdbee8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763708, "uuid": "0bac4e1b-7ff9-4574-93de-df7e877f746d", "comment": "Malware payload (Mirai)", "value": "d54666088bc7da30f79d3436e7eb8c8753884b4803cb91c9ada58e20cf9e0b0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763708, "uuid": "316b49d2-892e-4ce8-bfc8-863d31ddd40f", "comment": "Malware payload (Mirai)", "value": "43210bc4185bb47c92fed62dd0a94a6b53f3f59e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763708, "uuid": "ebc7dc20-064b-4b3f-8670-f4482798d3f4", "comment": "Malware payload (Mirai)", "value": "7c99cf3f90decc148fc150dee47f78a808546f9a3fc904fea7416172f964a41566eb38cbe925ecc7d6b082e79b8bccae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763708, "uuid": "5e220ed5-935a-4e07-8870-0b67641ef2ae", "value": "T15EC30909BFA00FFBE89FDD3705E90B1A258C691753A93F3A7574D818F15A24B0AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763708, "uuid": "2d8f3250-7096-42f7-ba26-9a2ac6d4b6c8", "value": "1536:OaDvChObU9/olcu2AVWXmvwm15poi4o9Ioq80c6GYDTSvIlvg+xRLTPyPJkovQJa:pbCOhZ1S80c6GoSwrryPJkIX6/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763708, "uuid": "0333d324-276c-49e8-860f-beafa88f630a", "value": 126576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763708, "uuid": "64eb9d46-485e-4377-ab42-92a72eafad60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763708, "uuid": "c19ef448-73c5-4ebb-9c9c-7793c70b5b3b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284c4fcc-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717693, "uuid": "4bce83d2-c5b2-4a2f-90f4-d757dfe7671b", "comment": "Malware payload (Mirai)", "value": "4e86095914e93fbd2afe6ef2695eb5ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717693, "uuid": "c1eb3fbe-b85c-415e-8d86-e09a9792e8d1", "comment": "Malware payload (Mirai)", "value": "d57c585734d14b097b4d57ce4c44b2c8bcdc7d8c39df9d452211e80f8704f035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717693, "uuid": "99630e3f-daa3-4db3-aa70-6e766f15f9ec", "comment": "Malware payload (Mirai)", "value": "3a37bb26faa4153cf59724975729a39fa60e3b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717693, "uuid": "f447e7b9-a6ec-4408-9d2c-53a6160e793e", "comment": "Malware payload (Mirai)", "value": "d8dda7feea6e259a4b59cb367bd54de62eac35e4ea0d7a586b6f4b6c114c119e46eb5d58bf7745ad3dcf298c64f1a746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717693, "uuid": "6127171d-d7d3-4346-8f55-2e308c159d65", "value": "T140247D99BA4F7E82D2C6D3F9DF8BCB91312730958A4682F53D01132DC5C6DD988E2B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717693, "uuid": "2f5cf365-02b2-43c4-9d1e-d18f7f08aa86", "value": "3072:m/1NdGpRYIGpAtazuowkPwQmaWDvehtPJjX5cjqf:W1aRYIGGta6vkPwQmPLehXzqjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717693, "uuid": "06f451a0-01a9-43e3-90e5-ee1e72c23c23", "value": 211016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717693, "uuid": "3a160255-4195-44b3-9574-5af92608297d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717693, "uuid": "21215ea3-a924-4080-99d5-3b24d4a84fee", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01c6924-73bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782738510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738510, "uuid": "f0d048a4-e853-4981-ab0c-77af2524800d", "comment": "Malware payload (ValleyRAT)", "value": "63844cd3d2578789f0e5ca58cfddf9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738510, "uuid": "c1fc28fc-ee3d-4eb6-ad04-5560d3e82a2d", "comment": "Malware payload (ValleyRAT)", "value": "d6ca3c85df784f0b7751f67bc0b23f44f173b7be7f6344d02f26c8e28e0abad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738510, "uuid": "53dd8941-1518-416b-a86c-3b108947e8b6", "comment": "Malware payload (ValleyRAT)", "value": "ab84b6726d46e9cdc1349d2c8cfb9777dac57101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738510, "uuid": "f1c7ff1e-02c2-4d8a-be1e-39ea80ceace0", "comment": "Malware payload (ValleyRAT)", "value": "faa4241459e8facd78159e6b9e4a0392bc73ff9bdd7c62fe7e555bae8896abbdf305501c15bc0b83b618e8b600d90b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738510, "uuid": "1d7fb120-e8aa-48a0-9e6a-184490922ce4", "value": "T17E957C06B66541FCC09BD278C61A5657E7B17C86172097CF1290BAA62F73BE21F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738510, "uuid": "ad50c6c1-1a50-428c-94be-c41b1bdad1c5", "value": "49ea913537e8846d169d32fce7302ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738510, "uuid": "e64e1852-f322-48f7-a8cf-16acb193deb5", "value": "49152:S/7E4O8OBQOH7D1dCKAJg6PwcVPPbL7MyTI:SAJ9SgcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782738510, "uuid": "b60bee73-0177-4970-a521-24937e9651be", "value": 1946264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782738510, "uuid": "1f2f846b-3b23-4cc0-8f5e-61d2f47be47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738510, "uuid": "edb44204-5cac-4ef5-9a64-1d54041d4adb", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75648ff-73bf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782740348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740348, "uuid": "81169c2b-bbf3-4349-98cd-ce6930808303", "comment": "Malware payload (Mirai)", "value": "45bca0cf6a88bae183455e6de8d463b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740348, "uuid": "8f95513c-7c22-489c-afb1-904b1c8b2f7e", "comment": "Malware payload (Mirai)", "value": "d82581de8bc29cf9d9392bef16bb2146dcb38510bfdc3c6d89821d4c3ee8055e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740348, "uuid": "91f9c929-cadc-49a6-b25a-70da3f5d516c", "comment": "Malware payload (Mirai)", "value": "9b3d506e9b272867af3af3569e18afac6b6bcb3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740348, "uuid": "84917b95-0da8-43ad-b2de-20a5675ce829", "comment": "Malware payload (Mirai)", "value": "48edabe5c43703570fb95fa29ce99bab262b817e6af25a2ad5c60242e8e6093fbd9cf882fa08e72d9c6eb220dd2f341a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740348, "uuid": "fd8077e8-7b2f-4f65-b1ad-e41610972aba", "value": "T12C44E791A4159ADFCE0158FA73AC4E3427817C70861B0FBD5D5198A9A28F8DFF1C6BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740348, "uuid": "162ca50a-7b16-49cc-adde-129beffce43d", "value": "3072:VgcCn+XuFJlu+eKrFvMXxyJyTi1oL8FcFtEW/9wW3b4G5Y1:VgciAuJLkXxiy+1oL8FcF+0Z3dS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740348, "uuid": "25b4c136-5b3f-42cc-87b6-cb41563135f9", "value": 253764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740348, "uuid": "f5456368-2cae-451b-bfe1-670a06ecfa54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740348, "uuid": "c992844b-03e7-4d89-aeba-a70cb344dd14", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936e1ea6-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765118, "uuid": "175b492f-4eb0-4141-8863-9b27baccbe0f", "comment": "Malware payload (Mirai)", "value": "36ab6dfd71d2495f1b58093bb51b32a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765118, "uuid": "61e7379d-9c89-4ffd-b6dc-7d928df6b678", "comment": "Malware payload (Mirai)", "value": "d8389b3d979ac74751389b9cd146be0b3d0cfa4ca011f6c6d68589b1c47403bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765118, "uuid": "fd36a57b-beee-43c4-b190-404b1058cccf", "comment": "Malware payload (Mirai)", "value": "8cae41bfda9f551595326af895fe4568a386a824", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765118, "uuid": "7ac47e62-723d-4356-8116-eccab39716f7", "comment": "Malware payload (Mirai)", "value": "80bd906a2cb765282cb7997ed40808bf6d658473a685a5d545c5c2f09bd2d9ec6096e5a1b50519e862e937ef309c90f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765118, "uuid": "97e885ce-5305-4a83-bb3c-aa45a56e97b8", "value": "T1A514F946BD518F23C6C311FBFB9E429C3B2667A8D2EB3102DD157FA437864DA093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765118, "uuid": "bdb758a3-756f-42d7-a326-eda7bd1ab44e", "value": "3072:cLtPt6MWL5lEgAiomHxKTiNoTp6wYNR81YErz05Cw0jy7nGfYL:c5tonEvnmHkONoTowYNR6Y6lw0jdYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765118, "uuid": "42acf9af-7e0d-4db0-8418-cfb51b1d74c3", "value": 206140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765118, "uuid": "bbcafba5-4828-4045-b24c-917a35db3199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765118, "uuid": "f6a36c63-1bad-4174-8918-f7452e955106", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95c6874-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769557, "uuid": "7d48ffad-40dc-45bd-95b2-185a13fd9849", "comment": "Malware payload (Mirai)", "value": "9816e90cfa33a7601f9cd6477ebd9913", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769557, "uuid": "ed499557-aebd-48bd-8ecd-9ecee783c2a1", "comment": "Malware payload (Mirai)", "value": "d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769557, "uuid": "1c40b5e5-1ebd-4d75-9a91-b8bd4875dfe2", "comment": "Malware payload (Mirai)", "value": "64e5920f12cc3fa422681e830c60a346fc2f64d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769557, "uuid": "5c2d9b26-4750-42b4-83f0-b98ec6ca3cf2", "comment": "Malware payload (Mirai)", "value": "429a8286a0104d802c2a9bd319975ed5bf6d6d38598d9740f2552efd6f602d56b1fa596dd9b28351ceb6fe4c304d76cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769557, "uuid": "86b1ae3f-defc-4dec-8d2f-d4f3af0c0516", "value": "T10751C1C7110943322D729DE6BBBB486930D1C1AA64CBFF56E5D8B8A44E8DD0C7C62A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769557, "uuid": "a316f958-e658-4d8a-af33-43150673de3d", "value": "24:ItS/LsST+TIhOESlK3SqdASkNPsScuS9Tn9TGF7JSIQIGASE8LS3n3NINksS+orK:ibhER3SkU6T9TGFlDaLLJkrAFTVV5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769557, "uuid": "7c4f1692-1a79-497d-a466-b8a5e8325226", "value": 2759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769557, "uuid": "8d921afe-a5a4-4ece-8acb-03039d4b3f1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769557, "uuid": "2802aa71-7fba-412f-b5f3-7f3e6a56ea32", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f6e1fe-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756873, "uuid": "1e45d94b-efc1-40ae-8db4-0ae4c53f119c", "comment": "Malware payload (Mirai)", "value": "63da7bc0354228b702addb8ab7f384b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756873, "uuid": "7aee57d3-c8b0-4210-9c87-f37fe1f77f58", "comment": "Malware payload (Mirai)", "value": "d919eae315600593af28bbe603a141a69825c8290bd4022b670a1ef9c4a1be17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756873, "uuid": "5d93606c-d18f-4aa8-84d1-70cd7ad1f2a7", "comment": "Malware payload (Mirai)", "value": "ee4fc74323fe058bd9d471369dad61d59d7c5644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756873, "uuid": "638c442f-0103-47bb-91f0-a1135a35c8b1", "comment": "Malware payload (Mirai)", "value": "f8e4e0a2b77f82eeb2e2847cd625fb297ab4d97a7efe9bc3b0362760e38683c34b3442bafd78f90d961cb4595c1cd4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756873, "uuid": "b2c2467b-864c-4ab9-bef4-ffe83ea2786b", "value": "T1E983F741F8824B2AC6D4237AE66E358E3361B7E1D2CB7117DD259B21378528F0E67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756873, "uuid": "8f5158b5-40db-4382-8ec1-ec012c49798b", "value": "1536:kDGnOu9qfsI8k8zE+kOoqXr28lsELD8QMsNaeELaVLNKH:kDGOmqfsauyMMrephNKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756873, "uuid": "f60b0f39-2d20-446e-907b-e0d25be4ec14", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756873, "uuid": "b0c0aead-0b95-41cc-a194-63eeada6fdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756873, "uuid": "27de5a45-164e-487e-8aad-d389cd473639", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7437d3-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769565, "uuid": "2a295c4b-2bca-4c6a-af11-eeb0d98df255", "comment": "Malware payload (Mirai)", "value": "69043e90f1ddc0dc4ac0af8a391249b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769565, "uuid": "cb6ed710-f5b8-4f89-80b2-933ea81bf302", "comment": "Malware payload (Mirai)", "value": "d9223382acec8ee90c20f7bc6104706d35fcfdd09e760acefc54ab91619f761d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769565, "uuid": "b1f6605b-30d4-46b4-a39f-45be32f04c4d", "comment": "Malware payload (Mirai)", "value": "9b75433bb1ce014f16d4a8b70456290c7945ce57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769565, "uuid": "e56cd266-e519-43c8-9369-99a85017feca", "comment": "Malware payload (Mirai)", "value": "85b15f9e75f177d93fca81fa5377252b7bf91c991b62e7d76509da30bc6d08628791ee15e19942b361ec26e76a289449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769565, "uuid": "d1a6844e-1104-456a-8a45-5b0a593fda61", "value": "T19C23F11840A1EED4A24E86B3959EFA0E1E24D59857418CC773D0A1F3D69BB3B1F207B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769565, "uuid": "f5b0c71e-1435-4ac9-ab25-87c2bb4f976e", "value": "768:OYcUTiSFnR+ZW54r03UK12jc8/xClUv7XDXiQL+hT7x+dBAFGXYX0+nbcuyD7UHb:OYcUTiMnR+1rKm9bXDgT8KYXYXnnouyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769565, "uuid": "6928f999-dae5-43c3-a100-eb7875587649", "value": 49084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769565, "uuid": "98a25b79-bf9b-439b-9f24-a3cc50c6646c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769565, "uuid": "1f782b40-18dd-432a-8ee1-b56c66e71059", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3758bce-740b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1782772876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772876, "uuid": "8d7f6dda-13b0-4353-873a-6fb141287f4e", "comment": "Malware payload (MaskGramStealer)", "value": "798dc85674894812f6a5102126a3295c", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772876, "uuid": "8f037033-2de7-41a3-a2f8-ba978291c956", "comment": "Malware payload (MaskGramStealer)", "value": "d928467888cd402afbdd062a04e903d639086f614e7a0424dbc098aa8e8d31ef", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772876, "uuid": "5a2ae8dd-3d17-4474-a636-8e02aff58df1", "comment": "Malware payload (MaskGramStealer)", "value": "938f4bbd1a6f036e58ceab6484cd71a765eaa87b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782772876, "uuid": "791d33a1-5605-4fb3-970d-e994bee18f70", "comment": "Malware payload (MaskGramStealer)", "value": "2b870cce8b0022476ff9a5bfe22f67b6e10dcc858ac364216e2890f7153535c043a7ab0c83e5be857ee3330e704e0059", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772876, "uuid": "79a9e3fc-e541-4741-9574-12355ad839b8", "value": "T163043B1BD5D540F9EC2AC678865AE232A4B3BC591936BA4F6BA0DF052F50B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772876, "uuid": "5bdd4c2e-c043-4013-8ffc-d8efb0024fcb", "value": "e8f58099adbf7104a18801c577843dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772876, "uuid": "0d73d395-ad27-4bcc-8ff0-6eea6c6baee2", "value": "3072:sXp/pamDY4MAHDMihyHmJY7b1iDXBe2AVNAONl3k7Fsq1Y4him+:m/bHDMigHmK7+RlAVuONVQRhim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782772876, "uuid": "c8d27d9e-46a7-4fc5-993f-79aeaf1f4388", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782772876, "uuid": "55537184-309d-49db-a509-478ee2f6f7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782772876, "uuid": "7ceb8e84-8c59-4647-b72e-5326e3dbeed2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d43b40a-73ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782732009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732009, "uuid": "6dc25d47-3616-4109-851a-5c9c7406f666", "comment": "Malware payload (Mirai)", "value": "5feccdfca6c99e36976e7dd236928ed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732009, "uuid": "ad28f9b4-edeb-4275-b9ea-161214a77bd3", "comment": "Malware payload (Mirai)", "value": "d94d721a3fa33b69d3649287cc46a8d4115e726fdfbdf355a108220f77475353", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732009, "uuid": "2ff7dd73-91fe-4f86-888d-f7e1712e90b0", "comment": "Malware payload (Mirai)", "value": "2a79cf74478248a73b9c4125e058b15db0bd9374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782732009, "uuid": "7112d438-977b-46a6-9a61-64fdb6ba4369", "comment": "Malware payload (Mirai)", "value": "7fdd25f12b9d0b97758c69256e175866328b7ae493a96f08a181347ce6a6622c551efc9254ddae6d7c6e20b620e32239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732009, "uuid": "e61272d9-47f1-4342-8c5d-ba827e69c774", "value": "T1C3A36C2F7651C47FC00BE1F01BEB9962E922B87E0A35B04677D1BD516F6CCD19A28392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732009, "uuid": "d636b04e-dd31-41f6-8ae1-42c9acb9bc13", "value": "3072:vtEpQJ+Gu7ffMgWL/lTsr2NsKL8aymphaTJYAl:eZoLlsr2yrWphamAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782732009, "uuid": "5cc334d2-c25b-4420-a23d-5a05c39b975a", "value": 100952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782732009, "uuid": "ee44a546-f851-4202-af7e-0866b38d2550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782732009, "uuid": "3c1a3d4f-ed2e-4c5a-98b5-a7c6c1de6fd1", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836fa45d-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770674, "uuid": "2bb499bb-7585-4a9e-a497-80befc004d2d", "comment": "Malware payload (Mirai)", "value": "fb032ea13698949165948aab8ac657d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770674, "uuid": "c911b1a6-48bd-4d01-bf1e-8c3533fea12d", "comment": "Malware payload (Mirai)", "value": "d99cfe550c1e0731cc26677db68de552a55b90b8696dbc21a8d01ee5960f710d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770674, "uuid": "3575d604-7b18-45b7-af75-421cc241354d", "comment": "Malware payload (Mirai)", "value": "d2cb2671563dbc04f0ed68135927592921c353d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770674, "uuid": "71e76618-bc8f-4182-a30a-f379999a3db2", "comment": "Malware payload (Mirai)", "value": "251c1b127da08ed1bfa1268cc52299abdb3583edb03c4b7db0bc1f2b94d569d941223fefd0b93fab6440a7d322cb3ce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770674, "uuid": "65358e7a-c952-402e-8f0f-00ddec60d872", "value": "T1D4936BC1E653E8F5ED1705751137E33B4B37F139102DDA97DBA8AA32BCA2600D5262AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770674, "uuid": "f8ac1437-6a55-47bd-b2b6-64e6d18ab7a7", "value": "1536:Lh+jn2+ifI/EIzRBIepUGzX+VCW+XpElUx02V78OKTiI3nPKxCdg71G+dkChCq:9+jn2tA/EIzPIepUG6VCPulo7JAiI3P2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770674, "uuid": "11e70e2e-b9d7-445a-b315-a917e315182d", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770674, "uuid": "af70b687-d0ed-4c69-879e-619b69c1887f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770674, "uuid": "d58e8f20-fbbb-49c4-a277-5e8f51366ebb", "value": "nerv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7118c3e-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769553, "uuid": "5c808b9b-da97-44b6-ab21-dc3fb1f7fe0d", "comment": "Malware payload (Mirai)", "value": "1715b78361bf3665c98ea686b9244b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769553, "uuid": "35ddb786-2496-4d0b-bd10-76efa3cd3e35", "comment": "Malware payload (Mirai)", "value": "da0f35b3d900c47c5afc73503639efd545cae4c2a380b706cf512f63ece6ff45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769553, "uuid": "050caf01-17e8-42d1-9ad7-f9ea07a24a84", "comment": "Malware payload (Mirai)", "value": "b2698bb4eb6878aed7c9f82202ca4060e783bea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769553, "uuid": "0f3ed5d9-f63b-4eac-b431-a725d07ffee0", "comment": "Malware payload (Mirai)", "value": "d01608a2c971c17be397f0376642036f91188f70746af22931a42cb61e8e6046634b95d64f51d1f6b605f0c6a1fe70b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769553, "uuid": "cd3b6e86-6ba5-4bbb-aac1-6c8354ac5644", "value": "T1D0E3BEA7F7872091C96302F407CB6BCD2E6322825F9BD9E36D2F753B59760DA1402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769553, "uuid": "5bbfd051-da91-40f6-8dc3-85082a94ef64", "value": "3072:nggV8NxE67yc1LJXhs9gA2f4eNORQgi7dq:nqh5bPAuD7dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769553, "uuid": "af9cfa2c-2c2f-41eb-a8ca-e31f7e3bf4dc", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769553, "uuid": "54925a1a-f1bc-44e4-b2b3-de04b1fa3c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769553, "uuid": "99824860-1f61-47fc-b405-eed8c3e68ff9", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8871592e-73a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782730740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730740, "uuid": "51303466-8230-4645-b42e-dfa2e086bc95", "comment": "Malware payload (Mirai)", "value": "7cebcd0547914e164a1da6ea9c8b7a62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730740, "uuid": "0d14dffa-3516-44ac-a4e9-9ed087d9e99f", "comment": "Malware payload (Mirai)", "value": "da876fade492c0a5616d482b20719b985bacebc9c228b733a38b58f008c5854a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730740, "uuid": "82a729ed-03cf-415f-9373-77c7fc92dd86", "comment": "Malware payload (Mirai)", "value": "a950a6e47a946d758a735c0a9384b600b0dfab0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782730740, "uuid": "96a25c3f-8b19-4d5e-b31d-1385b7bf5848", "comment": "Malware payload (Mirai)", "value": "9bc430f592e61df6a597c64af1a8a0107a4d9ce74e2734b575a9a87f1b580a6d4c52545a866f702d1766ccc8c7e9ebe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730740, "uuid": "89b389e6-e021-4588-a79a-4d62933da358", "value": "T18FA33955B881AF06C6C246B7FF1E434D331A63DCE2DE7213FA195B5D328B52A0E2E056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730740, "uuid": "8ea18cbc-7c3c-4667-ab18-2f0e2e2e06df", "value": "3072:5gpP3tEhvIH1xfREXpToxJEF+1oVMkvp6cel9lwI2aBM:5gd3GhAfREZWP1ovvQceloI2aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782730740, "uuid": "1acf3750-223f-4621-8445-a8449b946bb3", "value": 99912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782730740, "uuid": "d56ebe5a-d622-4ba4-b871-6d7930a0a432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782730740, "uuid": "090a08ec-5683-4647-8983-28ce55e31291", "value": "CX36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f251ce6-73bf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782740119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740119, "uuid": "dd83a768-c5bf-4617-ad50-746062280f31", "comment": "Malware payload (Mirai)", "value": "d089fe4590b198e29ef0f63de96fa23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740119, "uuid": "dd17adae-0b85-4e60-90c8-57ab802e0c1d", "comment": "Malware payload (Mirai)", "value": "da88036f78cbcc99944d039f617e9c3d23461b9d2b61f45f28e4cc19baa6b98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740119, "uuid": "d366adb6-8a3d-43d7-abb7-d3a542f39167", "comment": "Malware payload (Mirai)", "value": "a387d219f6e70b215e9936acd60ecc5f7a452aac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782740119, "uuid": "375155da-bd02-4254-a7be-1b1d9f7ed783", "comment": "Malware payload (Mirai)", "value": "b4120f9bd65fb995dc2156d524f69648040cf93a6a753b45732a1e3d3b3ee55a11f09a6fad794ad6ca44de0d3bf10971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740119, "uuid": "6bc79a3e-c290-465e-9db5-6bebf9307421", "value": "T1EBC3E649FE05672FC2D2B2FBFB6D02CD322B1BADA7EB31169A305E9133C56915936110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740119, "uuid": "9fd4017e-3942-4d38-b7c0-e928df0006ce", "value": "1536:bpNvWy5GQNcUkcJVWr2liWPmfF+8dEzY+46lwCRmJDONZs3ubjChowfELKnvZ5hW:/xjdW0f46lmdSjWosiOZ5h8p/7O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782740119, "uuid": "31c60c83-3b8c-453f-afd5-d1d93eaac472", "value": 121032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782740119, "uuid": "9e11ddf6-9afe-49b3-9718-cee6403e6fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782740119, "uuid": "f74ad660-8a2d-4722-b627-3ee9fa54a91b", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8065ef90-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782770669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770669, "uuid": "87cef99a-cc50-4c84-993e-57803c664981", "comment": "Malware payload (Gafgyt)", "value": "30650fc73f5e3d3190fe23baca7f260c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770669, "uuid": "1ef9eab6-25fb-4a54-8ccb-0d1fd8074ceb", "comment": "Malware payload (Gafgyt)", "value": "da94ba7c1a962a0d6c7508118c82bc8bd7f0f47771515779594298edbe8790a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770669, "uuid": "bee76dc9-1f6b-4fa7-99ff-fa80ab730e01", "comment": "Malware payload (Gafgyt)", "value": "0d996b9aadc930493606589a784b0bfcd6d9da20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770669, "uuid": "d6a86266-dac8-4574-9d24-757df485d1cd", "comment": "Malware payload (Gafgyt)", "value": "d26f7b4b3b99657fc9c0130bf6ed5cd3cec4acff584256999a9b40d5228a9dbf44ba312e6ea93ae5df55c5845097154c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770669, "uuid": "81d81525-0899-486d-a3a6-26c19b35e53b", "value": "T171B34AD6F801DD7DFC0EDB7F4457050AB621A36216935F3A6357BE63BC310A46922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770669, "uuid": "74cf6116-3fd6-4fcc-b7e1-52c6aa3ece6b", "value": "1536:w/Fd8MNhs3SVr7fVnYMF7ZzBso1K8FJBGxtjovb5c/nLa17AuQJCPvA:KFd/GC/Vnr7Zlso1/BQolKRuQJuvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770669, "uuid": "f01eeedd-d3a4-429b-ab16-9088c5e7b2aa", "value": 114956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770669, "uuid": "d1d76d35-53ad-4f73-bf6c-6333e01c22d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770669, "uuid": "159aadac-63a9-47f6-a0bb-410d052aab47", "value": "nerv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a440b1a8-738e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782719190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719190, "uuid": "6b3ebcd9-ecc9-4b81-8cd1-564168591fe0", "comment": "Malware payload (Mirai)", "value": "b5ddfa6c3e9160e478bb6369c28a42e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719190, "uuid": "c232e9a6-e8d0-4c94-8b2b-047f6ba087b3", "comment": "Malware payload (Mirai)", "value": "da9825d3083513d613850e7dec2ce6bc4e1cc59ea8f641546a00010e04aa89a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719190, "uuid": "65643245-c28f-4f28-9e7f-064717f23fd0", "comment": "Malware payload (Mirai)", "value": "e85d4b73f59349ba5916164e699737092e654ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719190, "uuid": "4d7a6c92-9f41-42f8-8909-84965b076b53", "comment": "Malware payload (Mirai)", "value": "1d6185ef5994f6f5367828e3b464c46ca8eea67cf7ed35891c5c444fc19b58f216b90186a1d2477395a8fed4d5098c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719190, "uuid": "633d5f8c-48fd-49b4-b30a-e87398723a5b", "value": "T19653F16372129E44AF310F31C815254CB71319F9E96E1AB6174EC8FD57E2BF929B880E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719190, "uuid": "73f1c43a-2752-4036-bd32-b3b025250425", "value": "1536:J9C0yP6wtBYTTwPWGBhuSXuxJbps1FNjhuq9ortn0:3oP6UYT8PWGB4S6JNsPNjhT9Ytn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719190, "uuid": "ac6d7651-2ac1-4b41-ad89-5aca7efe7de7", "value": 66000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719190, "uuid": "1eec4d3c-e7d6-4218-a17d-a5ede391bf6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719190, "uuid": "acddac0c-ef79-43ed-a97b-cc18d9ad43a7", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee6138e-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782712953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "42249712-d5dd-47b5-bc17-8f6c40976e80", "comment": "Malware payload (AgentTesla)", "value": "b5e6d58eae2331e6588c37030c52b743", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "e96441d1-7ffd-4e77-896a-90ea15de17d7", "comment": "Malware payload (AgentTesla)", "value": "daa53c3817696b4112be21e343aae4e17bc1be1d5dab1727cc55b157e6efb1d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "e743cc86-4a07-47b6-af32-b4ca2409953f", "comment": "Malware payload (AgentTesla)", "value": "6f8358eb0408bd6ff406dffb824a2e369944f2a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712953, "uuid": "fd9bc1c5-6f89-4615-a28b-c4c45108f0ac", "comment": "Malware payload (AgentTesla)", "value": "9d62eb78a90d0f23f08ca6512fb177f0f1f6851872f7157a14d1815b6fcab2aeb9d2396fcf89bf7050c3ab9251eca926", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "1d08f835-a258-49ea-b17d-05254d51bcd5", "value": "T181363A0466A492C72A74D77A981D7FCB3D4A50F3A838CEC536FE8D3A940CF052E7465A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "b976a8e7-5c95-40e5-9e8e-63e994ffcab6", "value": "98304:t6nqUazaBbH7t/J75XoibIbtn4Q/hAy+8VabbRqx8ZGpK6nqUazaBbH7t/J78:trdmBT7t/J1XoHnaT858ZGwrdmBT7t/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712953, "uuid": "c89c4286-91bb-4af6-8731-be04cffeec51", "value": 4941844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712953, "uuid": "408ce719-c30d-4e79-af55-82954e4b1e16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712953, "uuid": "91d7bad7-2ea6-4fa7-878d-9ce37c982944", "value": "Guangzhou Seoca PO-2601055-110836.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc304df-73b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782735607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735607, "uuid": "e5b1604b-9597-4f83-ac93-38a960d41654", "comment": "Malware payload (OverlordRAT)", "value": "3a06facc46c519e4c9d7c5f82ce28e72", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735607, "uuid": "a610736c-a16a-4af8-be16-d665d5dc5b62", "comment": "Malware payload (OverlordRAT)", "value": "db29882c1be518e6addf815fd941d3c29c60d3c225dc693afb5adefb07831ce9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735607, "uuid": "566a9402-db37-42cb-bbb1-1ed1d18bb193", "comment": "Malware payload (OverlordRAT)", "value": "f9a699b47a8d3450f0d9334e25e56421bf3bb8e1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782735607, "uuid": "632cd37e-2d06-4418-a1c1-65f48e4dc639", "comment": "Malware payload (OverlordRAT)", "value": "f998b06571379104dd9bf9b31c6d0231e82036fa04ba8d6411c3d7bcdeafb86bbebf109be91c60b68ae09668095c2690", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735607, "uuid": "a4c24a37-93f8-4f50-b1dd-4e8e3e994fd7", "value": "T1F05633409E76AD6E07ACE32870AB5F1F2BB00A925CD4F1C793E579E7126FF40456B818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735607, "uuid": "99a3dc63-f04d-432a-b504-c1b1d9ed1609", "value": "49152:Ck4LDheZ4sWTSM5Iw9eUhzem4uR/pNoNTyLl7Aj5HvIrX67q1bHkjJBBSbbQI1Ey:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782735607, "uuid": "c3caa5cd-c618-487e-bbd4-d8effcc563a4", "value": 6270381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782735607, "uuid": "c5787fa8-1130-4db9-8211-b4373e9d40b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782735607, "uuid": "4b6d2e11-87af-4223-a094-9dd0ed56a224", "value": "Roblox Executor Volt.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57389674-7359-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782696297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782696297, "uuid": "edbb1d15-7866-402a-adcd-e9c119174284", "comment": "Malware payload (njrat)", "value": "b904965e2232b8131769911f703b2e73", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782696297, "uuid": "385e797f-02a4-497e-809d-ed8b44be4aa6", "comment": "Malware payload (njrat)", "value": "db6463b751ef817b9b5638571833cef10b72adfa7bf460fc2ba2448af3249496", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782696297, "uuid": "6e490001-e2d5-4418-8da8-c10782812d42", "comment": "Malware payload (njrat)", "value": "f4a562cccb3047c6f61251495e5b4b6e314ba4ea", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782696297, "uuid": "d0da3ed5-88ff-43d0-9e41-73647ba5b230", "comment": "Malware payload (njrat)", "value": "4282768ee3d0a0d5e63cf067e69156ce7c19c73df7d44d752385a30f29fe981e28da21a25f3afb45a298e966c1d272fa", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782696297, "uuid": "368b84a7-85e5-4b03-a4a2-4ddafa5526dd", "value": "T192F57C07BD9108E5D09EA33188B7569A7B74BC580F3227E72E50B7782E727C05C7AB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782696297, "uuid": "15374151-a763-4577-af69-9d5db9fd95b4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782696297, "uuid": "62c08523-4a81-48e7-b553-bb6c52dd4d61", "value": "49152:KYGq+q8ddKQW0cLI6rBoA0WAPiUG9dNpjYMIwsYJkp:K+Jyni7jYVws3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782696297, "uuid": "e757d83f-4417-45d5-b968-34a73d664022", "value": 3475320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782696297, "uuid": "88274463-d623-441b-a889-0a2181e512d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782696297, "uuid": "e5d798bd-1170-4321-960a-8be764b3b40e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c995511-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "d1305f97-aaff-4170-879a-757330b94fd6", "comment": "Malware payload (Mirai)", "value": "8046bc5957720ba1be1c3d86b43f120f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "8ae811ca-64fe-411d-b85d-10e89cd07625", "comment": "Malware payload (Mirai)", "value": "dc38fd9545732814bee53e08b3cee550cca12e0222a233912a8a91b2a178077f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "51034089-9d33-408d-9827-477cbae9657e", "comment": "Malware payload (Mirai)", "value": "de5ed98ffd6d1261bec9d28bdae9d4521a4c0d1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775280, "uuid": "3dd12157-fedb-4caa-beec-6e05f5525aae", "comment": "Malware payload (Mirai)", "value": "58da6d51ad9e6deefa01a31da290597cb34a09d8bfb2cebdfae14e81a488237b0ae7f9196ee02c0d5c54fa920534ee88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "bc36b9f9-f545-42cb-b15d-0f54b2e2d110", "value": "T11F23F151B4EF0F5FC47F7831143DB68FE628C1AA83D44E78EBE0247A2865D36156CA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "fc09438c-44be-461c-aaff-a964074ac34f", "value": "768:Ev5dETgniheMkMkSWT5lUhQ//gFVn77kGjTHSgfVHjeY4U0VWaRH8WSMEHqUVnbi:Evwrz5wHUhQ/Yb77ZPHSgtjzn0VjRcde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775280, "uuid": "31e1aefe-310d-409c-9fd9-4bd84b8b179c", "value": 46016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775280, "uuid": "caed1329-441f-420a-bc05-2e6b1fa454c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775280, "uuid": "c17530b1-5fb7-4a3c-a532-070f5fe9ef4a", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a77ae81-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775357, "uuid": "05717753-4aa1-404e-924e-4b02575caed3", "comment": "Malware payload (Mirai)", "value": "592689309b3e8c3d75a588e0b16481f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775357, "uuid": "b324773b-0140-4bc9-9e1b-36e34cb2ea8c", "comment": "Malware payload (Mirai)", "value": "dd4630f1e9597ec3de130d5abae83d28d01b4447edfdcf25b64bda9a288181e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775357, "uuid": "8c87842f-4923-4945-86ed-79b964158aec", "comment": "Malware payload (Mirai)", "value": "c3e38ec0a6004fa81695fde384c6992b9dd6ae4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775357, "uuid": "e88f3522-b47b-4446-9706-0ac189548c6a", "comment": "Malware payload (Mirai)", "value": "113db5d4e15c4b1f2663ede5b0a83233d574c8ae6e42a890bcb0cc89c79b8cfe827fcb590af89f60e99117036ed765b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775357, "uuid": "a0cfd11a-6b70-46b6-a03d-9b78bec5d59a", "value": "T19BB34CC5E283D4F9FC5605312176FB376D72E1BA2328D983D3F89A32AC61A41D416B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775357, "uuid": "d09e60e3-f6b3-4e7e-8a01-623259e0bc12", "value": "3072:vu6b5m1QwvQc+HKOcVQa7McC2h9c69CzB/:vnNm1QwvQnHxNUA69CzB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775357, "uuid": "0270f9ae-b233-4c0f-9d05-cd22993f2ca3", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775357, "uuid": "4175eb33-679c-4692-86f3-0cb2d919153c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775357, "uuid": "b1c59709-ef5f-4173-bd9e-5526318e29a5", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844b034e-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773253, "uuid": "aae9af0a-dc95-488a-8956-b97130a638bd", "comment": "Malware payload (Mirai)", "value": "eddd6e41b95444ed3fb9af91adf2253f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773253, "uuid": "8e6bd6df-65c1-4b92-a9ea-e65354ad762d", "comment": "Malware payload (Mirai)", "value": "ddd082b95397d7d25d7ee84bfdc42edd7a6dd0b9d3d5cc284869ad7fcd059088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773253, "uuid": "e52710a5-a987-4de2-9be6-6e38d826ddb0", "comment": "Malware payload (Mirai)", "value": "3cfa4834a035dbc99faf491b6be2051e15a61899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773253, "uuid": "0e73ea63-7910-4c82-a8e4-484e0f4480ea", "comment": "Malware payload (Mirai)", "value": "55c47ec19cbd1856cf4646cde89e027e2af0f838ffb44bf7513811a541dffb896df883b87e7c407c248b41e55675859e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773253, "uuid": "47a18b6d-7d03-4a22-a749-5ef28fed85c0", "value": "T167732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773253, "uuid": "9dd7cac1-882d-49bb-8d7d-8fddf6786a26", "value": "1536:86dz9MTC0XU66Ee5pk5brAMjztPz+Sbjt+UvAs/hY:86dS6EUgrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773253, "uuid": "3c76e297-cc7f-4277-af61-fe1b8498e376", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773253, "uuid": "32a1f477-5e35-40b0-a6f9-cd80cf1d56d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773253, "uuid": "b7071b0d-87fd-4c0c-b58d-5b263ce65be8", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc92e270-73f7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782764328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764328, "uuid": "f18ed041-ac3e-47f5-9084-fed3ebde509b", "comment": "Malware payload (Gafgyt)", "value": "e3422b452d518d48431848c19e2c11f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764328, "uuid": "f9d73992-ca31-480d-9831-94996d2310cc", "comment": "Malware payload (Gafgyt)", "value": "de4512a40cfdc03935663a7368c265d26ee46bd52494d50676f3376fb4d4fc62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764328, "uuid": "8f64a63b-2958-4afc-9fc1-cd8523b34e09", "comment": "Malware payload (Gafgyt)", "value": "91e8af0bad451a8489285fe9a963bae68dd17fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764328, "uuid": "9a2ef783-8c25-49be-909c-64b46fee8f70", "comment": "Malware payload (Gafgyt)", "value": "9509437aa419be1b94f0c7a9ff257c631c73e76bf9b3a9e1b14c404f5c052e977efa3798a4b86763925e1e2eaa084762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764328, "uuid": "c0b379d4-69ef-43dc-a88e-6a81d5d1d29f", "value": "T190F33A42EF401AABC01ECF31061B835613EDD48A53EB271B717CCA5E7E5A60A5DD7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764328, "uuid": "a2d8f229-a604-4b0a-85f7-26f85a227a20", "value": "3072:qDiFBG/S+CGG3zNYoCTqiyGUm+GI6QNOyjm7UM52nVDHa24qGeWDFHfgE9nN+Sq:ZFBG/S+gzNYoCdN+G7QU4mwP/QZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782764328, "uuid": "7244de1d-f7a6-49cc-957f-159edb426f61", "value": 171580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782764328, "uuid": "761f68d6-d008-479c-bac1-6f50ad6541fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764328, "uuid": "8b3c58ac-ff8a-41e5-8918-4ecf012d3a69", "value": "mipsel.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80c261b-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782716727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716727, "uuid": "a79f1fad-cff0-4d9f-b9b6-33ffcf530d43", "comment": "Malware payload", "value": "9fd4f84ae00e45e1b58cc22877c89ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716727, "uuid": "3939acb1-affc-4e3e-9883-ea408687366a", "comment": "Malware payload", "value": "de8d331bcc92465695a1d1669f6a1c1d088892273f0aca927c91b79c0aa7c914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716727, "uuid": "95c4155d-b6e7-4d3e-9732-f0f7c0878a9a", "comment": "Malware payload", "value": "01ada7c0523f4ccdb3ec4fd511b702197ecb4887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716727, "uuid": "bd51fb47-05cf-4f71-b0a9-fcba2e0123da", "comment": "Malware payload", "value": "104e9525d3f1a02162c6b6872e50d05734a88524a2c14060dcbc889e425070d194f0f5e3f730ab3875248864fdc9e608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716727, "uuid": "8413697b-ad15-4759-8abf-ee06838957cc", "value": "T188555C1ED6F629C0D0BECCF66D832D658CA13F95123C364ED6B0F26245310E269DAE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716727, "uuid": "2066ef06-f7b6-4acc-95e4-3cfc261cc4a8", "value": "c5e134cc1c1e4c253962fc1102568c64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716727, "uuid": "10f54b61-5e3d-4092-8cb7-54ff8f65ab7f", "value": "24576:0AyBvfP55dNm+t8kA+E8xLCdVcy5KiEf+usx:0pPBtOMMx8iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716727, "uuid": "abbc7b56-6c96-4a4a-a7d4-f9db4539814f", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716727, "uuid": "8d5f4850-36b3-4891-bfeb-ad46e0945f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716727, "uuid": "e22b194a-4fcf-467c-bca3-db01ed619fbd", "value": "SecuriteInfo.com.Variant.Cerbu.279087.5013.6921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10a46a2-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717118, "uuid": "e2d94e67-60f4-4134-a250-5c9a94ebfc74", "comment": "Malware payload (Mirai)", "value": "e04c9c5b393d9fe95e401055e9e3a699", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717118, "uuid": "7d071dc6-6fec-477d-8914-9dbd4ee4fdc4", "comment": "Malware payload (Mirai)", "value": "dfa63d299b084080775f4afc22373ebc398d2e8e68868d281128d876c6a5264f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717118, "uuid": "02c72562-6ccb-4f49-9241-c5524cbecac9", "comment": "Malware payload (Mirai)", "value": "25232fd674bf639f57bf071bd1a26d89dc69a44b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717118, "uuid": "0155a456-d2c3-4f35-9112-33a18b05adf2", "comment": "Malware payload (Mirai)", "value": "80fa2e9acc22bcf9cd4f58b7f6b65a9dedaf5455207a35b2fb97438bfb9b4e0fcc6a3aae3e11eda8128a30cd2c6b4465", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717118, "uuid": "6d8be1a1-7697-475d-8bd2-c019dba8b04e", "value": "T1235178CB269207317DD29D22BABA882572D8D09AA4C7EF569CD9FCE580ADD0C3C41647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717118, "uuid": "dc37d5f1-49f2-4226-9108-274f2d1cdeae", "value": "24:ItusbnIhOE53VAvPsIFTgTGF7JAKGAeLPKNINks0ryjJTPyUR57J:ivNE53C8IFTgTGFljeLNJ0ruJTPVnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717118, "uuid": "111d78ac-3f5e-4352-bbdb-6cfce7ffc559", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717118, "uuid": "e0ae869c-0b5e-4762-8b9e-f3fae11049f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717118, "uuid": "ba61eec0-15dc-4bb1-b5df-e2768023de03", "value": "dfa63d299b084080775f4afc22373ebc398d2e8e68868d281128d876c6a5264f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b26fd51-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775278, "uuid": "82a6f4c5-cbb3-41a2-9aff-7010178d1b9b", "comment": "Malware payload (Mirai)", "value": "71f81c81b6ec62e50f0e53e259f3d0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775278, "uuid": "53821a1e-7f1f-4a3e-99a1-4c51d28980fc", "comment": "Malware payload (Mirai)", "value": "e0052270db2b15bacb79524bf4b6943404ab566ddeed5e9a56b3aac87c987fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775278, "uuid": "49de9788-9fc8-43ac-ace9-ee501af0fc7b", "comment": "Malware payload (Mirai)", "value": "4c8f68af62521eb21671aa057d00ca8cc93bcdb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775278, "uuid": "65a74b6b-db5c-4eb8-8f13-cfeb6c0f25eb", "comment": "Malware payload (Mirai)", "value": "4eb8717dbd4a8a61a6f741c8f43cc017e945d1f493fed5e2dd1e6a8738b4fa35739375f203817aef68c492b690dc3351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775278, "uuid": "1a0929c8-6a32-46c1-b108-f918eb8a604e", "value": "T1FC230219F2AFC254DACD47BA2EFB55501610D5891A2DE96FEF06300BB628FA4CD320C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775278, "uuid": "e3c764b2-8b24-4420-a596-88c76061aca4", "value": "768:PXM6+V5GhFGNYewdV9ZvwSHppYzd/G1xkq9QMRZpOES8MsqUF1pLeVnbcuyD7UHT:0R5GhF3ewjvpWd/G1FaGztFkqXeVnouJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775278, "uuid": "2511d070-42f2-4492-8eef-ff15c436cf71", "value": 48932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775278, "uuid": "f674a0a6-d365-46b4-a80e-99dd9414d3ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775278, "uuid": "416df438-45e7-4843-b177-75467554945b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb66af5-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756810, "uuid": "bc7aae6b-4e4c-42c4-9a9a-3d0f723a3198", "comment": "Malware payload (Mirai)", "value": "c55b5f5c17e4965cca482296255c7b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756810, "uuid": "30bd1ee0-87da-4e36-8f0b-f264acff2f96", "comment": "Malware payload (Mirai)", "value": "e05be73ab369ea1172fbd89adfdfe4e6f0ecec45eee6ac4f11682635b95bede6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756810, "uuid": "1e5f4897-52a6-4f03-a5fe-f36813a42b84", "comment": "Malware payload (Mirai)", "value": "f858abf856d8d118848cdeceb2db63f59596b26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756810, "uuid": "8c74be55-a8d0-4fa3-b8f1-da4ac21d4657", "comment": "Malware payload (Mirai)", "value": "697036cd7e01bcf75bd327963e67ea4c7d8dde2f772f86c1c5d717b707dfbf924b667715223cd55e54226b7d5d65dd32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756810, "uuid": "897d4684-7d37-49db-b53b-144c54df4e35", "value": "T13723F189330380DFC995B0B8077147E07A3A8E75DD8298572AC9969DFCD70CD3883AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756810, "uuid": "edf3342d-cee4-4a1a-af76-72e33fdb2df7", "value": "768:+4BrhGuu6ur69QXmv2LKokkozP6WkwQ5Zm1ll4vfp0pjnDn7JgGlzDpbuR1JO:uu4r1IWK7kofk9C7g0xVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756810, "uuid": "3c9508d2-c9fc-490e-a399-ef080b5e0ef0", "value": 48600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756810, "uuid": "bac00ffd-73af-4438-abfe-a39386ea74b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756810, "uuid": "b86d9a92-4d8a-4271-af44-8e08a769a0a6", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d2110c-73f8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782764555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764555, "uuid": "356b5e54-1cc5-4f82-ae79-502aa818d7d8", "comment": "Malware payload (ConnectWise)", "value": "225177b4b0248142330264ea6071521d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764555, "uuid": "9c5bdde5-bfe6-4f78-9b54-294e4c611293", "comment": "Malware payload (ConnectWise)", "value": "e1588462d2d9be442489a15aec3cb0f64e7edc255227b1057d6a614cae5d8a5c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764555, "uuid": "11d3b2a6-2cf0-4199-81c7-5d5c85eaff60", "comment": "Malware payload (ConnectWise)", "value": "56e61a6804294266b02c7883b00b36e450b20b64", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764555, "uuid": "4925dd73-a3e3-4856-855a-dd62bb83b913", "comment": "Malware payload (ConnectWise)", "value": "041229ce34651df45cebd177a582d39f8757d00a83b808d1d91be8c1e8403062ebbb389d1d241d9028fdef53d383cc16", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764555, "uuid": "ffeca026-d4c2-423a-a825-d79543fc7dd0", "value": "T17A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764555, "uuid": "16071a58-211e-4f16-8050-cedd909d0d0e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764555, "uuid": "5946dd40-5785-45c7-af1f-12ce31d85951", "value": "98304:GzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:GhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782764555, "uuid": "ac6cfbbe-2985-48d4-9135-422031da4271", "value": 5659080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782764555, "uuid": "da1a5e95-05ae-4af2-9ad1-17f8140d942e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764555, "uuid": "6b75a760-c689-4a39-9709-8ea7f34d7783", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ca8a10-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1782717664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717664, "uuid": "9c31a1db-8181-42d6-b568-0f459628beb0", "comment": "Malware payload (DonutLoader)", "value": "d79dd6255fe42279c4248999fab3e0b5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717664, "uuid": "f15146b5-d3f7-4d8e-8ad2-90d8ba2ff52b", "comment": "Malware payload (DonutLoader)", "value": "e18f7f0fd6ca2a9be32682c74586e753e91732557268d1fb31df45cf26cd1e3d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717664, "uuid": "0ceb6db8-414c-4667-9c29-e3ba0334a9c5", "comment": "Malware payload (DonutLoader)", "value": "1ff8cf1a60fa038b3aa2cec4a985b1092553984b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717664, "uuid": "29b1ebb3-7851-406f-944e-4170c16abaa1", "comment": "Malware payload (DonutLoader)", "value": "1b6ff468617eca6a55905f5b52cf97c232f0a443a5d5bdc381f54928b6359e004db327c350758ae5ad3f02ab64e1104b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717664, "uuid": "b81a9b73-6973-4120-b7c7-26e76f4bebe5", "value": "T1FA05F1287DD60C5BBAF60276F8D2C103E6B9C1C3452965CD91DE028683CF459A7FBA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717664, "uuid": "c6093948-6e12-482a-a057-838a54c65038", "value": "24576:5fPrg2fR5CKwnYcQN2Kk0vdp3k5Dd9gHa94+im:9NWZYbhlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717664, "uuid": "e0d7d303-8558-4283-8eb2-86ceb01825ad", "value": 846368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717664, "uuid": "7991bea9-2c36-44f5-a908-ac9b87a1342e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717664, "uuid": "6b7bdbd4-2d5f-4089-9ca1-9a11d0c0c96d", "value": "tokaJciaA3o5.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3afdcc-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1782712927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712927, "uuid": "ac45656a-a930-4c40-806a-bf238b9a48e7", "comment": "Malware payload (LxBaseRAT)", "value": "81fdd8b5a1a1c960fdb5f2498e47a22a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712927, "uuid": "8dab6095-ee44-491f-83fe-78db9dfd2082", "comment": "Malware payload (LxBaseRAT)", "value": "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712927, "uuid": "c9e13a5b-decb-4e65-adad-89309a616dbf", "comment": "Malware payload (LxBaseRAT)", "value": "f29248d6cb84c6d215786eb7d6f8c3b94c26ae8c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712927, "uuid": "ae04c049-5b4e-41ef-b595-5045ac02594a", "comment": "Malware payload (LxBaseRAT)", "value": "2fbf7a736117232d48dd27c82271b88672d3d97b9e90c98c4b4558b3ba7be750ffd8521166af369e027e8b4cca8b75c2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712927, "uuid": "39f836ee-4586-4bc6-b4b9-112ad7f02289", "value": "T16335BEDDC16D05D68C053FC9BC281AC75B6987B24A7400193BBBBE485F7B4BEC20ADA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712927, "uuid": "4a5ce308-a0ff-4ad8-b290-cff2120539d5", "value": "12288:E56KZyy5NHZyioQh7AaTsQyJw6BcaobbbfqwzW3E:yXyinHY9cDbX19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712927, "uuid": "7687d674-8246-4059-bc66-4a33ad200f41", "value": 1142686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712927, "uuid": "1749283b-33d4-4417-877e-29804257a410", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712927, "uuid": "373c41c3-a182-447a-91d9-778582c8f96b", "value": "\u4ed8\u6b3e\u78ba\u8a8d\u55ae.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb408feb-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782716732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716732, "uuid": "e67714b7-90c3-46a2-912a-90d9da880d6f", "comment": "Malware payload", "value": "c3803dfe4da599236da2b1cb7f9d31b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716732, "uuid": "f8c18b83-f9d8-4a82-89f9-77a5da35be5b", "comment": "Malware payload", "value": "e2ad4624ee3d6b73ce5d5f5e5a147b3908e2d6969045de5771fe5574ba5c0f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716732, "uuid": "6d62439a-f3aa-4392-a0ce-978ddefd0a6b", "comment": "Malware payload", "value": "f16c50345512e0b386161b5c46d9f647a6c355f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716732, "uuid": "37d5eb6a-3135-4daf-8d8b-7d2eac6cc65e", "comment": "Malware payload", "value": "4ad5acc4101184a1e978dcf45cade7c97d449f0e6f8656972d8056c7da1171c82ca910c4ab87b077a8a2435c7a1ac5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716732, "uuid": "6c496a05-05f1-40e6-b9fb-09a7260e3f21", "value": "T1DB364A57EC9145A9C0EED231C5629252BA717C485F3123D72F90F7782FB2BD0AABA704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716732, "uuid": "04f032c9-05ef-4f54-9f0c-837b0c5383ee", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716732, "uuid": "cb36425c-e8d1-4187-8917-81022b4f5fdb", "value": "49152:NLtLyRe/Y9TdpEav+kf9RWt1wLvTIWSMZbTv692Y5EXRFT2PqX97/SYUJ:Y9fqkfPWaZSMBGREXyqtW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716732, "uuid": "78ae652f-c2c2-42c6-8c90-da548ed49bd7", "value": 5159424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716732, "uuid": "347b2bc9-988c-4268-99b5-5b33b2a2469e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716732, "uuid": "aa0a6d31-a927-4b43-ad7b-ed567dbb080a", "value": "SecuriteInfo.com.Trojan.Flooder.17.2462.26616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd16d5-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760424, "uuid": "2f8a6579-9bf6-467b-af6c-dce98cb41ee7", "comment": "Malware payload (Mirai)", "value": "e75e68efdb7110b795a61934e165116d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760424, "uuid": "60d2cbd7-b53a-40d5-815d-0f9b1ffc54da", "comment": "Malware payload (Mirai)", "value": "e319cdd5fc6a174f43648888d75160477401ebd1683cd7b96970deacaf70ab28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760424, "uuid": "5d3125ac-8948-4d87-9b8a-a62da91ba3e5", "comment": "Malware payload (Mirai)", "value": "3327499e81e2ef7a99a15b2ebf859ad18bf24f6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760424, "uuid": "2c10bfb7-5857-40f4-9d3c-1331c7200d62", "comment": "Malware payload (Mirai)", "value": "c8207ef136b166a2b413a0d97ee385868308f2400ed881115e559d1bbe639802dec4b382b9fa29745d4b92a9e9400642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760424, "uuid": "3e2c183f-fed2-45e6-ab57-679c8e8e7312", "value": "T164B34AC0F98B81F6C40B8C306166F63FCE71D5A94271CAADFF969F36DA776019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760424, "uuid": "2b6c12a4-2d9f-4aa0-8f0a-7c77c111058f", "value": "3072:/qyLpO5iL2SNPNmIrAzRzBJJbGnLumgptWsRCPk:L9OgL2mPNPA1Bfq/PPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760424, "uuid": "df8c8496-363a-4697-9006-b8047f13f180", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760424, "uuid": "919a1632-6ce6-4c9c-bf11-8d05a1453206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760424, "uuid": "ac649d14-6bb2-4c9a-bbac-c5ea62ca42bb", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ecc062-73be-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782739894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739894, "uuid": "0653d879-95ca-4043-ac96-bc1a2c8bcc71", "comment": "Malware payload (Mirai)", "value": "5bbca3a86d5a3feb5d3bdb06426d7d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739894, "uuid": "6f2ec1b7-a777-45f0-b630-50a3afa1c7ee", "comment": "Malware payload (Mirai)", "value": "e3d74eaffc4310832575fe78cffcda25297bcd7421746cf51e01db54670df564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739894, "uuid": "5010ac86-971b-4df1-9bec-392eb84976d5", "comment": "Malware payload (Mirai)", "value": "16159c7f77c05de60c5a4efc02951cf37fcb5650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782739894, "uuid": "61b5ea39-f6f4-444c-934a-7afbd5ec4551", "comment": "Malware payload (Mirai)", "value": "c7b1b1edcd257feabca653882326f5934a96533eea5ffc0ddac0788c3de00598a73abe614e3fb782af2283c1e93308fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739894, "uuid": "3b7ff008-4104-4570-bd3a-e71fad729c8a", "value": "T1EF8312E7EB6904B0C49772B090787D2439637B79511113EFB8E03AA909EBA283FC5771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739894, "uuid": "956e94ae-7a3a-4655-a367-d1c2d8376799", "value": "1536:muEsJqDom0WDXu/ltKtFOPLTQPKpb4QRA/Z/spy9z/K90IkQ3PrXUuYncyI0f:muEsJqsWC/IOPXQ+UkAV4AC9P3DU7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782739894, "uuid": "15bb0bcf-20e1-43a9-9f59-0fa608f02132", "value": 87908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782739894, "uuid": "66c36be1-f90a-4335-b8fa-a9c693960740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782739894, "uuid": "8ace09bd-649a-4a61-83c3-4566c1692a5d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaf5cad-7389-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717164, "uuid": "e0bcc210-40f3-4c27-adcf-fdefed087564", "comment": "Malware payload (Mirai)", "value": "b9cf83b234c8910ae3c9dfe2ce892ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717164, "uuid": "a0b54354-5cb3-415e-b79f-96e14f470701", "comment": "Malware payload (Mirai)", "value": "e4b8d4f81a891c760b43b173281c17c7d4c1a29a029c45c0604b50918ec2c41c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717164, "uuid": "fe8bb5fd-742d-4df7-95dd-670ba1fc90aa", "comment": "Malware payload (Mirai)", "value": "7e61819037a02a6af691b1fc5fb5bd1c6d5eef77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717164, "uuid": "315cb4ab-a484-4d38-b21f-83d4169d6bbb", "comment": "Malware payload (Mirai)", "value": "c2ed2bbee85abca3bd3e5e6897269b1172ac124ccb8190a7b889fbe1f7c7d0f219b95ce3efea5fc2f386e069197d92ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717164, "uuid": "4cab74d5-b5bb-4050-bb08-92763fe58e61", "value": "T1E5737DC9E983D4F6EC130A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717164, "uuid": "3b3fe476-3b87-4108-8a04-6e645b833dc4", "value": "1536:Dbsv6Xewv/mBos1LNxVZW9Z3J8h3qaccSX4:DbsiJ+BokLNx+9zs3m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717164, "uuid": "81108d50-3040-4fa5-ab63-80c283386acd", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717164, "uuid": "71d395f6-d63d-4c2d-9bc2-5eb11a768e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717164, "uuid": "fc562158-222c-4a05-80ce-7f525b1364c9", "value": "503ce8c59b24f576b99fa519226582750f8f0240b88fb5a3b531d3e66a096277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be08bf3-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775279, "uuid": "fa3ea694-a2d5-4881-923a-732addeecef6", "comment": "Malware payload (Mirai)", "value": "ced65a3f16fa51214a52ae7e48241f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775279, "uuid": "3e667463-bdf0-4f2d-a923-dd2949e1be59", "comment": "Malware payload (Mirai)", "value": "e4c51e8e44c4ad43b8007f5b39be914d658e653bbfa8ea2363e18041278306fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775279, "uuid": "a293a1a7-3142-423c-88f7-209bfc655ffb", "comment": "Malware payload (Mirai)", "value": "66db3ea83f31ecd1647a109e9c1cd9b19c1fba10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775279, "uuid": "5e34e249-4dcf-4d2e-ac19-3cf5de2a4e3a", "comment": "Malware payload (Mirai)", "value": "27377d52a644ad45ed8aaec5907c5a6adf70616d7a5975b1aaa68d6f8ad13363b2d0a8cb706ec478cf9a402747300b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775279, "uuid": "daa6ff2a-3ad4-4e92-a08f-948dd20df0ca", "value": "T1A023F164EC8BD28ED6EB24725C60E7CE27645AD4D271C0B25E13BF8517843ADB2398D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775279, "uuid": "e8f75700-f488-431c-be6f-a7c0b9a1a059", "value": "768:kDU1O7KPZL21LYyNeskXca6kKhvDFuoxygNJUaL+/lEzP4O5zVyIBXK1qh4uVcq+:+KPZ4HIvKhJuOJul85z8a4u+qgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775279, "uuid": "bb951e91-b15f-411e-a76e-2a45d7513436", "value": 45840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775279, "uuid": "1e7067d4-c99a-4c6d-94a0-adfdc59cd3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775279, "uuid": "bc5ca1a3-bf9f-4540-a975-7e318b5447fd", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b1f2ee-7406-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782770673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770673, "uuid": "41d05448-a795-43f3-bf35-2b20cbddcee0", "comment": "Malware payload (Mirai)", "value": "5e898b537f1992c3d03d036050032c10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770673, "uuid": "f9fcd112-2b86-4f26-b1aa-e84ff2233209", "comment": "Malware payload (Mirai)", "value": "e4e6ea8ea27556af7985e46eea728b71c69bf997a458dbbad629b78a5595b98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770673, "uuid": "fe90c97b-fb8f-4871-a66b-aa2befe07713", "comment": "Malware payload (Mirai)", "value": "dd8a37ea41303c03ffd171c2b67388c0f17de52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782770673, "uuid": "a5fa1244-2e86-48ce-b1c7-7815c5a7c00b", "comment": "Malware payload (Mirai)", "value": "de718356721e681906ce0288431b372fbdeab7dd9949aaae953e29a620a478e4556be542bd312dd4625246847def1173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770673, "uuid": "2d3b3802-52d7-4aff-8753-de59235250f3", "value": "T181B32986BD826622C5D423BBFA6E418E771623A8D3EF32138D215F2037C792B0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770673, "uuid": "e553824a-c970-4771-8319-06df31710c86", "value": "1536:vOlviIlGPod87HK7CnvLNUsdnYkqlGxPR+UK7as+fr0V5EYFYlTWzLxuIeJq:vOlazoiNUsdnYkqQ5+T+fr/DW/8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782770673, "uuid": "8f76fa17-38dc-4f3e-b4ca-30f9d57aefbb", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782770673, "uuid": "a99d86e5-a94f-41fc-bcb9-27632f64ba55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782770673, "uuid": "e079bd3b-fea6-4010-a7dd-84b4e88f457b", "value": "nerv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e643a8f0-7403-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782769552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769552, "uuid": "a05c56f3-2159-46bf-8f86-8c8db8acb49b", "comment": "Malware payload (Mirai)", "value": "410e4f5d9d94f5a6af6611640d407829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769552, "uuid": "da7db0b6-42aa-4ff6-b3c9-68ba67b06602", "comment": "Malware payload (Mirai)", "value": "e528cebef94e85d492a0dc4ccdb860e8b35523b1ac014b7879b587825c4610c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769552, "uuid": "0dc24298-1b74-45e6-a216-4e814229cd99", "comment": "Malware payload (Mirai)", "value": "90d6bb98ea60c32bcf2e77e1e5263d4c8decbb1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782769552, "uuid": "f2667333-069a-4801-ad4c-af3f0efce8bd", "comment": "Malware payload (Mirai)", "value": "d8ece7fd5eb96f06bbe40668f4b46839b88ed5ed9bb434d2b0d3860359d9efc3260b9fcf803d0b385e2ab6f2296ac158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769552, "uuid": "f7cd5d34-832c-4e08-9eef-d5aa5a0b668a", "value": "T1DB23F12BC89F9F89E37A7FF61CC5C08567A44FCC34809F461165EE919A8DC3AA702E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769552, "uuid": "9e21e8f2-1510-4b4f-b364-5b12e21472c8", "value": "768:JmbWUwb1HuL14plfSyLVlv9LB1SX0rpvC/BfVLOL3JsQiX8k4uVcqgw09g:J9U0sGfS8Vd9tg0BC/3LOzKdXn4u+qg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782769552, "uuid": "64049247-65a8-48b0-8923-4bd87a4285b8", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782769552, "uuid": "d3c3bd82-97e4-494b-a6a7-82a70ec8044d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782769552, "uuid": "7f37a403-6cde-44ab-a6db-f221c1e920a9", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a57c572-739c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782725132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725132, "uuid": "93d1a0d2-6c3f-4cea-866e-32ccabc1c1fb", "comment": "Malware payload (CoinMiner)", "value": "1f7c415ff2a55d180144fdd9dc7bd9d7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725132, "uuid": "4c0f717c-0b19-437b-962b-5298aedef9c0", "comment": "Malware payload (CoinMiner)", "value": "e55ed4e871eb3ed26f0c18da54eaf80dedc4bdd086e8e30876ca9572b48ea54d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725132, "uuid": "401d09e9-8b9a-422d-8be0-deb952a0adeb", "comment": "Malware payload (CoinMiner)", "value": "408efbc7aad4588890d23292b7b6cb2858791c9e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725132, "uuid": "1da5f48b-9d0f-493b-8470-ebcea6a3891d", "comment": "Malware payload (CoinMiner)", "value": "1f7ff8724f6515e7f83b00914080d879c9d74e00f5d18fed00a7c0598a4996eb739edf2d6ab0c4154a095f5f763a09c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725132, "uuid": "eaeff75c-1139-4932-a114-04ff6a0cb5c9", "value": "T1F2368D4BF1F394ACC09FC4340B9BD592AA7074B80635793B3784AA312E77EA1576DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725132, "uuid": "ce7c3af8-f579-4028-ba7a-52b43877d725", "value": "98304:WLuR3QRMNlfGukqDzX08ODfnuc0wjE/MYUPE+pdavPrjNw+3NlZmawHyRiBP:M+qpdqnNFZ3Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782725132, "uuid": "4a2997ed-5e67-4632-9367-15229f684f67", "value": 5338704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782725132, "uuid": "34df369b-363c-4142-8814-10e323e57417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725132, "uuid": "5f4420c8-c158-4ef4-85ba-39edc1ffc2fa", "value": "_up.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a40649-735e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782698601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698601, "uuid": "81fef6df-e380-4312-82ea-4d2ea139f913", "comment": "Malware payload", "value": "6c0716d3e311d602694845e6ac79a95f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698601, "uuid": "6415a9ed-9a25-4c4c-822d-7d88205b3bd6", "comment": "Malware payload", "value": "e565f0293c181f496e60c2ca690c54c61961e77fe6b180bbd8ddb99be562dfcf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698601, "uuid": "2471cef7-f57b-45d9-8b2b-50cd3c63073b", "comment": "Malware payload", "value": "677f7058bfa2b8dba732df4b7473307bc3adc8c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782698601, "uuid": "a62da7b5-9e71-4bd3-be8d-9e56654cd274", "comment": "Malware payload", "value": "cc9100bdbba867fdc609dbf495d65bc48ef8afee9bba8fe6d749648ba148509b0ba6918d7e0e081120249dc195e3489a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698601, "uuid": "99197a08-e323-4bd4-9c82-98a279524f3a", "value": "T11F33BE786705EB7C41444B220C3B1D66CCE458E1887977ECD3096A53D796A3E74E23BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698601, "uuid": "a0d153a5-b630-487b-9ef6-ae412f2830a6", "value": "768:wjBsYdEXjWrXnqYWlOsAnIoiQLBr7ppdam11WLn314uB6GTcj+snBss9g6hMD7br:GxdET2XqYRosJc3ipzJJhcMDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782698601, "uuid": "3eae2f7b-e50f-4ae9-ad4b-3b890be9afae", "value": 52754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782698601, "uuid": "52044513-a17f-4bf0-b864-9490c5612f38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782698601, "uuid": "7b6b26a1-a36b-4d76-a5bd-c082820ad8d1", "value": "ocafa(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6995c04-73f5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782763486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763486, "uuid": "66917bba-9414-42e5-b950-48d253fe0d5c", "comment": "Malware payload (Mirai)", "value": "12dea68c643c125f112b44f8142572ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763486, "uuid": "a62f34d4-bb87-4a66-b22b-387e8facca41", "comment": "Malware payload (Mirai)", "value": "e67bb6c4dd175e4b6c0affffa8950f5728e5e6883b7271c76f04cf1e9dce5e50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763486, "uuid": "2ec938e5-5d98-403e-a3bb-1904b1a6b05e", "comment": "Malware payload (Mirai)", "value": "e797caeb1e9d3b414b988623c2af2e8764ce447b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782763486, "uuid": "98037952-73c3-4e06-a3d1-2f1058977b65", "comment": "Malware payload (Mirai)", "value": "3a010360de56fa185f2b1769d320f95892ae494f0c0c8415af101a47d58de4dedf51cfe1aa4b8cd86982467465e497ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763486, "uuid": "1a3cf197-dcba-43f3-b81f-78670135b221", "value": "T18513F13164BE1732C93F023848EDBE84EC60A45C57864CE3DEE6AA791667E34A1143E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763486, "uuid": "d4e1874b-a2fb-4c08-8081-c4da06d6c9f2", "value": "768:Ji0Ga0taRyEEUplkV0+ZKRpTJZW1o9uiUqD4cnbcuyD7UHQRjHm:JTGeEY+ZKRZJcXnqD4cnouy8Hya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782763486, "uuid": "2356f51a-0b11-4cea-bcbc-cd30cc782c43", "value": 41848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782763486, "uuid": "8207f1c5-6b87-40b5-bf09-04c9853afb16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782763486, "uuid": "719a4506-115f-4020-8441-5ef8d5fb8a18", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89794122-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782765101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765101, "uuid": "32bc6d62-f86b-4e6b-b57c-0d228910948a", "comment": "Malware payload (Mirai)", "value": "5dd1e347289a0079e2f56086bfc3d554", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765101, "uuid": "c287692f-63be-4388-b2e4-46f4b5dbb701", "comment": "Malware payload (Mirai)", "value": "e759a73f9d73a6c2d72b537a31294fcbc78fcc36139ad7c97597aac8568f07ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765101, "uuid": "7f0cc8da-ea02-4054-b365-00a62491e053", "comment": "Malware payload (Mirai)", "value": "37ddc13f837080da9e88ea229b1b7d76ea8b9b52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765101, "uuid": "a326f1ce-0b42-4304-8640-76efc3d47df3", "comment": "Malware payload (Mirai)", "value": "f67623e18354512af6e9a3bdd58ad94fe55c3eb7bc5aadaf4968281a48859ba72f722a3f7af413fcd10360e80caff12b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765101, "uuid": "e39009ab-50fc-4b1c-ad49-0477df4178d9", "value": "T1CD242A02770D0E07D1432DF4267B0BF14BABAD6138FAE681750AFEC957B1DB1644AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765101, "uuid": "298bb9f2-9c13-4200-b100-baa95274e6c3", "value": "3072:FPHhqVb+taauPxZGNjoxtF9FeB1DMJrQhgLZjtgnGDJ:F2+cakxsoxT9FeTDM1QhIjdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765101, "uuid": "8e62cfc0-84a6-4dff-b0fd-7f328365361f", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765101, "uuid": "e65b642d-afad-4251-bfb6-f6393d30efc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765101, "uuid": "fa95709d-0a27-4381-a149-961c53e09908", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a27c7c0-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756808, "uuid": "60c53904-5d8f-41fd-bcfd-259ad98c435e", "comment": "Malware payload (Mirai)", "value": "fc8f4939df9a86cab992914211103272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756808, "uuid": "41794c20-ae14-40ec-a3f1-afe6fe800679", "comment": "Malware payload (Mirai)", "value": "e84e5e7af25c97cc6c09cb4cd20ef573a3d13c99a87c34ca80e2b009774ad811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756808, "uuid": "56601963-6942-4a88-95fc-74f1c389f2e3", "comment": "Malware payload (Mirai)", "value": "d5b0ea996d9c9351f4cfd5e19cb8560aefa1cbf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756808, "uuid": "7986e319-7247-46fb-aa85-47f289d32eb1", "comment": "Malware payload (Mirai)", "value": "1daf4f37ac10cbbefe4df7f15d06edb97d101390c5241086d180d54f3a1ceb833e0481b3ba579e70e3d2f3d6e68b0804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756808, "uuid": "a429e39a-f375-4b8d-a525-037ed8a6cf65", "value": "T1E2D2D0105049FBB1E920A238EAFE8583DED60277D2E7713235D0ED64DB89C9255DCB43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756808, "uuid": "b66e379a-0b6b-4e1f-b0fe-61e0f26dbbb7", "value": "768:FhY5jWq9pR+617IlBNsdFZKuAqeOUgxXqexT69s3Uozn4:FhysYIZYKuLeOXXHxT9z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756808, "uuid": "75db433a-8001-46c4-8110-460a68381ef5", "value": 31004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756808, "uuid": "4d6593ac-913d-4ab0-8cff-d3e11c96b2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756808, "uuid": "78ff626c-797c-4726-b20a-94654f34f8b4", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dedb9be-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773242, "uuid": "abdbbf1f-06ef-4f23-9973-ec5dcc53aaaa", "comment": "Malware payload (Mirai)", "value": "796fa4761ce88bae51e8d455fe03bb93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773242, "uuid": "9767b651-cd43-46a0-b452-e76239b1ad70", "comment": "Malware payload (Mirai)", "value": "e8ba36a1a044991c46b6396917dc9e9667e2d12e9365ced95fafc20dc72a1aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773242, "uuid": "dd752e4f-24c3-453d-bc0c-dcdda244e6ab", "comment": "Malware payload (Mirai)", "value": "48994e6ce55e3043e36be88af7c1df1a90cad603", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773242, "uuid": "b994a3c9-54b3-41d8-b60f-1fdca6bbc3af", "comment": "Malware payload (Mirai)", "value": "40934120a165742da9762c6ce335fed13ff1637d1b16c74fd62b69bf1cc2332ec0ed3434c3d127f8c07a42d0c3021ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773242, "uuid": "5e47194a-ee96-4612-b881-9dbe5841fe2d", "value": "T1D6735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773242, "uuid": "8b243d52-e4c0-4786-8a14-a0f94a5e29ee", "value": "1536:jP+SbCGR18pspTH1qDQ2tXXUN95s0xwlWptCMR8/pW:zf4yV0pENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773242, "uuid": "cee8245e-6230-495a-bf01-5bc27ace6e25", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773242, "uuid": "fb93747a-1c6c-435f-b914-32ebfdbd565e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773242, "uuid": "bae17a7e-6c05-4530-9bdc-bfecd4356517", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c2bab-73b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737699, "uuid": "04b80bff-e115-49b3-918e-98646db0b2b1", "comment": "Malware payload (Mirai)", "value": "e56ba96ee0578532ada858402d7c6e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737699, "uuid": "231f9646-56e7-44e9-8545-79cf4d1e4d7d", "comment": "Malware payload (Mirai)", "value": "e97f2dd80a3cfdacd185d78c000d55258ceb64c3008964b5ffb76a005b2c0c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737699, "uuid": "6bdf272d-ddcd-4e92-b88a-8fc1f7ccfa96", "comment": "Malware payload (Mirai)", "value": "57acaf80fe499e99235bcefad74ab3df2d09caea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737699, "uuid": "7b5f5aa0-efcf-4d62-8b4a-4fd13d2e0a71", "comment": "Malware payload (Mirai)", "value": "e9a13af525315317d5a9c6e89bcf49edd40ba52c74281837c3294bcafcc13b1ac6e666b8c03ad41c54891857dc5dab5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737699, "uuid": "27421478-9813-4617-800b-61f378426116", "value": "T1DC935C22B9391A3BC4E4947712F35326F1F6438A24A88B1F7D710E8EBF156D0264B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737699, "uuid": "8a655060-4b75-4fe1-ae61-c692c526aecc", "value": "1536:0fOXV9Z7eL9FSVO8+P0Qacq3KtHw8Ym5owAtQItt1B:04x2w6R9YOlW1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737699, "uuid": "3762313d-de5a-4560-af47-f3dd15bce7b6", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737699, "uuid": "989d8c84-7856-41de-8a73-4cf8b90e33bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737699, "uuid": "a113cb15-eb82-45e0-a003-c8de87408345", "value": "e97f2dd80a3cfdacd185d78c000d55258ceb64c3008964b5ffb76a005b2c0c1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c588fa5b-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782757041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757041, "uuid": "1ddabe1f-fa7d-4f80-99b6-63e0880b4ed7", "comment": "Malware payload", "value": "380b1b39361fa7d79890d8dd676f81af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757041, "uuid": "c6d8e96a-49f4-4d2d-9ee9-4d1ae6705483", "comment": "Malware payload", "value": "e9f25a0269d15dda7a1d9a676f3b33bf8635570dc921d4f1b8322a1543d1894e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757041, "uuid": "feae61e3-a0e0-407d-8057-94daf1c6b5f4", "comment": "Malware payload", "value": "df1b198beb5b099288425eb31e8244e6196a3eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757041, "uuid": "e6ca9a5c-34e6-4059-938c-be011fb89ce0", "comment": "Malware payload", "value": "90d3543f7ce3d0ba91e9d867c55e0f2f71c398dfe60094a47654cb696dc008403eeab8a8fb234ad4413438ec635677b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757041, "uuid": "bb4532bd-61dc-4b61-91ee-e95a875b615d", "value": "T1015423FF805BFCF9FDB4DAF26001FA837637284182159AA4439460BD69CB72679218D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757041, "uuid": "3d701ba5-bdbf-44af-a6f2-f3e9cdfddac2", "value": "6144:A7g9xkFeUTT3CeWBUsntbWSkuwqgiXXb31PX2BLIQj/oIy0TmXPqB3+sB15yn:A0UTTyeWKsQICiXXb31OBLIQ0IrmfqBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782757041, "uuid": "20df0ae2-0c8e-4186-8326-c400a138027a", "value": 296640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782757041, "uuid": "a6be3262-24bd-4813-b680-e477f82963a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757041, "uuid": "2379ef25-2285-4189-ba4f-c677eddd125f", "value": "e9f25a0269d15dda7a1d9a676f3b33bf8635570dc921d4f1b8322a1543d1894e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aee7a36-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782765104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "b617f0dd-bb42-4ae6-802b-e844de875f78", "comment": "Malware payload (Gafgyt)", "value": "ea88fa3a3ad3547c6569debfd0ac4165", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "d5d64b0d-9a75-4b5d-91b2-3c6ec0612108", "comment": "Malware payload (Gafgyt)", "value": "ea253e1113ecbb562adbc4db35526c92eb8d48c06b55896504bcf94e3a5aa1f7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "01bda583-a5d0-4c45-90e7-c7b58b4dc1e1", "comment": "Malware payload (Gafgyt)", "value": "35fe7bcd8695c8af43b895ffae25f680fae7a5b7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765104, "uuid": "cb4d084b-e11d-478c-88f8-d3741aae8ec7", "comment": "Malware payload (Gafgyt)", "value": "126182909aa4c442e17a280012fda80d08468dbe38d1c05cae88c908c60b93016b4b6f4836c56fd64867a3ffda108be0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "973a334e-3b08-48ac-bd5e-d82cec193336", "value": "T13A74F8113B47EC6FFD6A43B40AF78A7477DC65A22561889AE26EBF4D1F310D10D08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "2c2b4cec-9d9c-4202-8913-25ce8db3bfd5", "value": "3072:C9Q3Rf4V+JKBLCwvanDIryZTl/BDftnpj1PR2bm47Y7+4T/sgqT9AtYPVphHyGEQ:H4V+JKBLcnDImiSfhe5Vp3Eex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765104, "uuid": "0ca40c0f-ea82-4219-8bd2-5a27459a124f", "value": 342256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765104, "uuid": "e7e9737e-e451-4cab-a211-153ec342b2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765104, "uuid": "33496a3c-afee-48ce-8349-bba5f5000fa2", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221cd4c4-73ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782760633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760633, "uuid": "085f85e3-3ceb-4f1e-aa25-af52b1d7cd6b", "comment": "Malware payload", "value": "6db80ba66763db505c1eab4314129f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760633, "uuid": "d9ccc690-b3a0-41dd-8827-e52350833bff", "comment": "Malware payload", "value": "eb6e197aac617db26ef7441d616baa523fff9eace9f7330da70c830494afd455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760633, "uuid": "3ffb1133-4c43-48d3-bb7a-c6859840cdc4", "comment": "Malware payload", "value": "6a8ee3892145aafca877b36ee07428ba50b1db54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760633, "uuid": "676a85d4-a4fa-4b53-8c6f-5dd3c2a87280", "comment": "Malware payload", "value": "eba6b9fb952a3d65afd8c44330621ed09a5db98bb13c96f116592aa1056d9e55d28770fcb29fb48b756253f4d4761200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760633, "uuid": "c835b89e-cf44-43e2-8e55-b7fc19d7236b", "value": "T1E5F58C07BCA149F9C4AAA33189B75196BB79BC490B3223D32E51B2783F727E05D75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760633, "uuid": "659cb121-63eb-4ca8-b6c7-2ad93cfa0144", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760633, "uuid": "85269c1f-0b3e-4533-bfb3-0daaba559a73", "value": "49152:VciKRbAdYutwcDVETTLmUz09lkOmrDj5L1xtCynmWY0:V62pMmUjdDm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760633, "uuid": "9e188803-8765-4578-bd48-74bdf1756976", "value": 3371352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760633, "uuid": "9fc95881-3522-45a3-a9dd-831247d5a49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760633, "uuid": "245f6055-3823-4e04-b5dc-6570a0a94b45", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d0938-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760370, "uuid": "f245873c-a150-42a8-8f1f-170c4be7e32b", "comment": "Malware payload (Mirai)", "value": "b90bd8c1fd798a538f31a474072d171f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760370, "uuid": "59f996ff-5a50-4818-b9b1-c7af091a35df", "comment": "Malware payload (Mirai)", "value": "ecbbc791819eb63a8e42820f69db3222f565a8eefc88bab4aba665b523fc90c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760370, "uuid": "cf1ca649-1662-4279-ab12-0b481d26597b", "comment": "Malware payload (Mirai)", "value": "f68dbc0964720ca546092231654b456062029f4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760370, "uuid": "814687fb-7244-413d-9617-5bec8182496e", "comment": "Malware payload (Mirai)", "value": "97b24663a624ec900803698d6a6343a60a14dfce5f8b8fb8bc10edc3da3b8c63ad0c3ec4ed2a09260f3980e2bb8e9d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760370, "uuid": "24515c28-f9cb-4310-bea7-a9663340222a", "value": "T185D3AEA7B34715A1C86302F40BCB5BDD3E6332826F5B98E3BC1F657B187A0DA4506B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760370, "uuid": "2f4e9b61-f821-40aa-a315-8c3731d4996c", "value": "3072:Z+Q5oFKvrMdwF0DhIx9i8Js1J1uONg6Shq:ZPcYTcZ8+Chq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760370, "uuid": "ab664e70-b8f9-446f-9cef-649d3c0cd78d", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760370, "uuid": "3e15ee03-a9e3-458c-9627-f6d1bb6c931e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760370, "uuid": "adda5927-c590-4647-803a-2bd2e33494d0", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75abe8e6-739f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782726413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726413, "uuid": "c7804b40-99cc-4f03-9655-b8959a1f0105", "comment": "Malware payload", "value": "44beefed3dd50f7072ea20018f3869fd", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "jpgrsv-com", "colour": "#06887B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726413, "uuid": "9bcbf445-1b58-40d5-957b-1ee2f5a871e6", "comment": "Malware payload", "value": "ed31c3fbe8b164eb0525f78c8e4453654f6350bb5fb4581adddaeb671bea2cc4", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "jpgrsv-com", "colour": "#06887B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726413, "uuid": "1293ff52-fa4c-4816-8248-9aaea2aec313", "comment": "Malware payload", "value": "fbc4396655c9ed9c277776b2874e584627a933ce", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "jpgrsv-com", "colour": "#06887B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782726413, "uuid": "54df1fd0-094e-407d-a2df-81949e87fa39", "comment": "Malware payload", "value": "4f4652d1b3dd8547f13243ebdbd35bfa1792bb9332021b55fa74978cc2c88c0796ae9163398323008723d1348efca7f4", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "jpgrsv-com", "colour": "#06887B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726413, "uuid": "d3cc8a5e-05e6-4475-926e-35f47f58c5ac", "value": "T193129E0EC7C84CC2D1EFF1755AA0C155C967EAC446D700091AFC63D9BB82EFB9625670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726413, "uuid": "9538a9dc-0702-475d-9e53-0491ce66cfce", "value": "192:yrF0JQRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+kf:K0QRm/wksuQJ/g6dI+kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782726413, "uuid": "c6858756-4937-43d1-a236-902d827fddd1", "value": 9041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782726413, "uuid": "177c7c9e-54c6-4633-97cb-aeba15057384", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782726413, "uuid": "c2e45057-1d1f-4cf1-8edc-879a12b86180", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10ad90f-73c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Ngioweb)", "timestamp": 1782742055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742055, "uuid": "5e7fcb95-ed74-46a3-a5a7-000a6659360b", "comment": "Malware payload (Ngioweb)", "value": "6d134cf0cbd55aca2107da58b19dbc0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742055, "uuid": "8abd83fc-d702-4660-98e5-cd114ca649d7", "comment": "Malware payload (Ngioweb)", "value": "eee339705a00631fb445a64e19a193838a36f0cc5bd8d680c3bb10b434edbb48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742055, "uuid": "43968e57-be73-4b7e-ad74-6a42610ff76c", "comment": "Malware payload (Ngioweb)", "value": "a7875d61c9fdf690b754e83e892a4778de0325c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782742055, "uuid": "d034c31d-8818-4ce1-be4f-2ce341e636a8", "comment": "Malware payload (Ngioweb)", "value": "bf5565ee03091e3046ca4ebe86e16804c2beecfed614df3a5598fd21b5fc3a3959e0faa8f2ca6eb5f9bc07df4bd7f2bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742055, "uuid": "91c2feb8-1738-4eca-9d58-285e37f7e70d", "value": "T11FB3F85DF4508B27C6C0263AB69A424833735B65FFDE370599247F383BE66298E3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742055, "uuid": "76f50bfa-9d43-4b04-b06d-cc8c762a0ffb", "value": "1536:qGvijcXohJ+no0KygaH+OiJyOOIyPqCC+4UFXymC5b6/+FVaMnr8o5ZiF24TIrU6:qf+I6id4qHUtrI6w8aiuhjZ2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782742055, "uuid": "e6eeceec-0ec7-4e33-aabe-bfe91521c8df", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782742055, "uuid": "21a7904f-f79e-4170-ad1a-f027b340a803", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782742055, "uuid": "930de435-1dc0-4e54-a6ac-1fec41467e1b", "value": "armv7l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54336ab0-7370-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782706171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706171, "uuid": "aca31fa6-bd8f-44a8-a883-9136cec61970", "comment": "Malware payload (Mirai)", "value": "906b329750aff3c75c359ec39be17779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706171, "uuid": "01874b94-adc6-4e77-9975-6c93173e0ee4", "comment": "Malware payload (Mirai)", "value": "efcdf74cea1903c0dbe685f3d5053f5a59d584c519796fc56c4300b3cdb4ca63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706171, "uuid": "054dbd4c-5aa0-43e2-aafb-6a195c814e1f", "comment": "Malware payload (Mirai)", "value": "c077f2ad25b29fc4a816a1775fe0a0198b03b806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782706171, "uuid": "f7d5ff8c-a75d-410e-9e6a-4e99ee53961c", "comment": "Malware payload (Mirai)", "value": "13088d8c8b124e8415b006b8d124b68c8af0a7d342ac25f79282cee95d04fd0b0d38f9b9b6c66b8423f0be052c92b69c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706171, "uuid": "8519333a-f4f1-4bde-a0d9-39faed485f9a", "value": "T19A831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706171, "uuid": "79bf1b8e-31d2-410c-a68b-e190b9a82613", "value": "1536:ijna/CzPC7fG7LnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Um+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782706171, "uuid": "c9fac9ca-1221-49bc-9103-4425c1ce25f0", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782706171, "uuid": "99f3461b-39b3-44e0-94e8-f41260f2822b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782706171, "uuid": "b2d577cc-a0be-4164-b62b-d8528834474b", "value": "c37a77a63582b02f69f1ea71d810d9aab433af52c37ec973650e82cecf7ba6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ac3139-73fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782765393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765393, "uuid": "79a59db5-b0a5-425f-ada8-87a5c1764380", "comment": "Malware payload (ConnectWise)", "value": "8c28e2efde4d6215c21835af6525c520", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765393, "uuid": "baedc2ae-d5f0-4015-8c22-01a88a2019c4", "comment": "Malware payload (ConnectWise)", "value": "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765393, "uuid": "f0e53d0c-5ac6-422e-b3f5-c0e9cb78571d", "comment": "Malware payload (ConnectWise)", "value": "8b68875c094ab2e217fc4d957ed17d575bc5dc93", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782765393, "uuid": "0a5e8684-9c55-4770-9b08-5ce7d18cebf4", "comment": "Malware payload (ConnectWise)", "value": "ed928cf446b30de455791986ebbb12a10c43ee1c56c02500a8b5678d16cf7ebe73826431c198e4d46b1d51b76a803238", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765393, "uuid": "e968d91d-e8c8-4a15-81ba-100c8775e915", "value": "T172646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765393, "uuid": "a89557b8-e955-48b9-9c70-95795be2caa9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765393, "uuid": "39dd6521-6446-4ff1-9e81-ec7fa3cc80bb", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782765393, "uuid": "66c279cd-186c-4ca2-ac4a-6a8835bb4ad6", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782765393, "uuid": "3c4e7e39-2fb7-4844-926f-01de104a8cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782765393, "uuid": "f8368f5c-195d-42a9-860a-a10588836224", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50343545-739e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782725921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725921, "uuid": "9744e6f4-1e9a-44bc-ac32-59b636dc5e4b", "comment": "Malware payload", "value": "b03a356a87b68ffa8b597b842244e248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725921, "uuid": "39cb8dcf-c36b-4835-b9c8-e9da4bcae770", "comment": "Malware payload", "value": "f184e17d85445c312bd38bb15a198e919774dcb595b25339ea7a479435db4b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725921, "uuid": "0ba9d855-4ca3-43cc-a7d0-c24c84bbe201", "comment": "Malware payload", "value": "3d2c68a414d04395cff713337a31ae76e9538ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782725921, "uuid": "d48a8e6e-8510-405f-9b54-012ee92323de", "comment": "Malware payload", "value": "d795cff4ca30b8d228ca0d5d46bc2c61fa366cdcb5c870589df44b2449e8f9b407431caaf28951967e8c55210ddefa4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725921, "uuid": "c14ec764-33ee-4eb5-80c0-1fdad1f9013d", "value": "T18A0833BABCE08B51D47F9CB50873CFA4CB6C03B31969235E0B2B548DBD90A70979D4A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725921, "uuid": "f412cb89-0fc2-4f4c-b7c0-2ee2d5981eb3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725921, "uuid": "3746393b-aacf-44bc-a9ea-ac687f02bd8f", "value": "1572864:4t9IKP99ehfpA0neSZfNgJtWEd5lGLcN8daRJNV2yaCOfUuolzIsAOTn4A37:4UKDyRA0JC3xf8LHdanNV2yyfUJlM2DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782725921, "uuid": "faf748d8-d798-419b-b6d8-0bdde5bf1dc2", "value": 77479913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782725921, "uuid": "146f1685-f102-4066-97fa-f54e03982e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782725921, "uuid": "479956af-f7be-4008-a8da-f8a636437cc2", "value": "Manager_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda023af-7385-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782715447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715447, "uuid": "5bf8a678-775f-43f2-b544-8be316839f45", "comment": "Malware payload (Mirai)", "value": "018a52bdb5ae8d77972b493cb7103d78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715447, "uuid": "2955b347-a8d6-441a-a3a4-9d0565838e15", "comment": "Malware payload (Mirai)", "value": "f1d0a9b723edbda4fe5cfec6c1f379df073f684a8147c2fd1e5b53e1fa066eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715447, "uuid": "5a36e3d3-fc63-483d-9a9c-f6a7dbcb78e8", "comment": "Malware payload (Mirai)", "value": "6dc2f85035aa6f50ab56a6c933c7c7fc82fcf944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782715447, "uuid": "88881c3e-d6bd-40d0-9588-feb218a004f2", "comment": "Malware payload (Mirai)", "value": "f55dc7cd01f5649e0156f13e9460033123d1aefc0bcf1b15b0a633decde1b28ff3d1c6cad55742dba4ba67ba01e5469f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715447, "uuid": "13b2308a-3eef-4b41-a459-ba457f7c2898", "value": "T16963013BDE0BF37AEDE2553263745A4462570E75CCBB90D05B2A86A8B0C70D9907DB07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715447, "uuid": "6e5f3e35-b0ce-4ed3-ab62-6729878ec237", "value": "1536:fPrWuaZyNVEp99asg1rdT4ufwFISI+7Tq87ea/HyNq:fPrWuyyvE9wsSG/E+7T8jNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782715447, "uuid": "d69200a4-62d0-476d-a17b-6578a5660544", "value": 69848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782715447, "uuid": "bd0fdd23-cbb3-47ae-b371-5a46fa683338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782715447, "uuid": "0953bb57-24cc-4e4f-9a15-e148958354a0", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c526f348-73f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782762195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762195, "uuid": "63fcce3a-953e-4203-84df-a18e863a15ed", "comment": "Malware payload", "value": "acf2f56d89b6153df09897f075751db6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762195, "uuid": "38704b59-9f77-4c0a-b05b-6579af153aa0", "comment": "Malware payload", "value": "f3c81e4783350c9d1f879d896a840979d70694c4e73ed111dfd216d8f61d3604", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762195, "uuid": "e5fecd0f-5485-4cc5-acbc-6964ad6ac641", "comment": "Malware payload", "value": "e1c1cae07f5d3f58c8dd2d2015a011275a292fc9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782762195, "uuid": "ba658b69-5f88-4bee-b488-3b5b71827f14", "comment": "Malware payload", "value": "2a873cbd6ca82ca87ebee6c09a4c8a04e2bfbbccf92bd413c393c1183e4efcfcfd311ae313cca17940f89db7de94ec52", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762195, "uuid": "5cf6b424-0356-4f75-8693-55290312278f", "value": "T15C039FB06200ED6BEB171524CE996A84CEEC19774FC4E788FBCE2CC359CE951D62119D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762195, "uuid": "df902dd9-3f9c-4e42-823b-49b8d5f2edcb", "value": "768:XKbXLdDZxl+uXkntqFHUA7963KxD6c4H/0Uco/u0phQAXcEFeqNPPiK:XExXXkntq6s96zc4Hp/7Bs0PPiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782762195, "uuid": "1776d6eb-72ba-4666-8b44-5a312e829a5d", "value": 40643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782762195, "uuid": "d581e0e7-0ee5-4b02-b50a-68bd3271270c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782762195, "uuid": "9df029fb-c041-4e21-a6af-9502a40c262c", "value": "edoga.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0217b0-738e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782719206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719206, "uuid": "12b9e727-1e27-4423-8261-53e011931aa0", "comment": "Malware payload (Mirai)", "value": "3aadaa1040b039f6cc27190c1446a855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719206, "uuid": "4269e8c3-ea54-4902-b0c8-7a702c1c8ec1", "comment": "Malware payload (Mirai)", "value": "f410b2bcca8e7d238eb632e423615e99643f2f7676fc257b1a175e9a4e30fef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719206, "uuid": "134daa73-1e08-4677-8d49-38600854c6d4", "comment": "Malware payload (Mirai)", "value": "d8b2c2dd14eb37f61986b0c393f9b2d8aaa73308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782719206, "uuid": "5000febe-e1bc-491a-a4df-744c8970ee95", "comment": "Malware payload (Mirai)", "value": "1e757988de741bcb0c164aaf3945a02be5c3468c717dfdb5841c20af705960394280954d2c2eb0547f3a156e28b8f277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719206, "uuid": "c49b1347-674f-4d9d-b949-5d0b419103cf", "value": "T1B8140842BD51AF27C1E222B7FBAE428D37196B69D1EB32069C317F5037C68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719206, "uuid": "d5bed355-e3e9-4e6a-b788-0f22dd0caa2b", "value": "3072:K98fHBhkjhlLr/BIkPvCvxd5ffRiey5cAv5BmHCYu/2ctIyEE88H3:K97K5nQh5cABBmHCl/28IyEE88H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782719206, "uuid": "14940b17-f88f-4fca-88df-d3a560e7246a", "value": 205828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782719206, "uuid": "90a70a5c-4a1e-4b7c-8134-8c2203b9ca3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782719206, "uuid": "dccf586e-3ce3-4a96-88ff-4d4b09e01277", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b05a837-740c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782773237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773237, "uuid": "67f2e83d-a1ee-4bfc-b123-1e63e1fc5d24", "comment": "Malware payload (Mirai)", "value": "ec5d20c474c57178927808f21b857bae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773237, "uuid": "5d0ec758-70ee-42ba-88e5-ac2ff232c61b", "comment": "Malware payload (Mirai)", "value": "f46ee46298b90eb04b1c15e4e4cecc8a4e5a7730c654d58261c9c846084249ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773237, "uuid": "0efc8a7f-abcf-4f5a-b1c0-07d1fef0c715", "comment": "Malware payload (Mirai)", "value": "916539d6363dadf5d4af44e16b403eba1b954fc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782773237, "uuid": "55e7f760-6190-469e-b025-b108e88a78d0", "comment": "Malware payload (Mirai)", "value": "769fbd578e5985d12a3b44d3951254042728d3956c30f342a407cad7e1183e6a73d6865e66a833ee913de97acae65ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773237, "uuid": "e98b2d3a-faf4-4181-821f-7959cf18ef04", "value": "T16303F1DD9FE9ECCECC6D89B7175D27C7AD242240339B46846644CCCD37271A618468BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773237, "uuid": "8de9c486-e283-471d-8c15-aa21b486bb71", "value": "768:MVyIwYjG0JFLyEJCVsffisu6A15pPV25F0hZjUCa1Bzz+hbpzxlkK5/WV:MVyYjXJ07Vsfq7FHJ8QjUF1BzKZ5h5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782773237, "uuid": "08860e10-21fa-44e5-8d26-586fd95656a5", "value": 38104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782773237, "uuid": "4a2456de-eb93-435c-a9b7-9515bb23f205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782773237, "uuid": "0488ba61-1773-4746-926a-53e6b2993ed0", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4ff49f-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775281, "uuid": "f23a51d7-f54f-450c-8139-5758f1370f50", "comment": "Malware payload (Mirai)", "value": "388b4572e749fc4a4477ff659641067f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775281, "uuid": "02495345-00c2-4df9-94ce-9b6cc3e4c7ea", "comment": "Malware payload (Mirai)", "value": "f49c3c78218ea5a3a0fb99f8dcb42251d4781e2f21ed3b9f3b7f9fd4e58e3ec1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775281, "uuid": "0b2d4cab-7076-4fd4-b0f2-2e2bcd0a15a8", "comment": "Malware payload (Mirai)", "value": "5231f58da2ed74c9d693e59ee8ee175e0df4eee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775281, "uuid": "e28d1726-24da-4931-bc0e-64b932c16d2c", "comment": "Malware payload (Mirai)", "value": "4774505e4cfecf814755053ff1e9f623b366db418b41693c350b3906ffd67b08bb039fe0aaab65839bd9445cd2ddf9fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775281, "uuid": "8e25c8c8-56a8-42c8-a0c7-09a145917302", "value": "T15D33F2D2451690D3C76095B5EE39ABC70C991EECE478ED7342A00AAE6CCD649BED3083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775281, "uuid": "d38c0f63-3eab-4407-8500-5ae637cc2a0d", "value": "768:ohBrFO+Syh+ykozizz6yFQWhNIv2hZO+SuDrITOeGReHTJ0MvAK9oZuXUFG8AtMk:ohxFOyhZP+PhKuhGu3Ii/RezJlocPXLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775281, "uuid": "e512bb71-f6da-4783-9570-abe70be9a09f", "value": 50712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775281, "uuid": "8d308e17-cf42-4e11-8a60-1313fe3b989a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775281, "uuid": "0ea75a0b-87f1-403b-9a27-ff76576bd074", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f299f28-7393-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782721329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721329, "uuid": "1cef03c7-8372-4a2c-aa2e-7a75853f7b22", "comment": "Malware payload", "value": "76113d03f729e629c04b975782669f89", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721329, "uuid": "a06631c9-a294-4b09-8bb3-439a6923c895", "comment": "Malware payload", "value": "f508e2d2e579165673b7d62d6c591b1abbcf137171b80cd78156a080223d1aa7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721329, "uuid": "f06df09d-4834-4af3-b263-d1b83344b035", "comment": "Malware payload", "value": "ff191ebad4fbf14619e6a2f7bced63adf993a508", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782721329, "uuid": "bd67d88c-3785-4e25-a5fc-f376bb43c7fd", "comment": "Malware payload", "value": "1407378cd7e9596f922c11dc8476b667a50222b665ec87e007287ac5e6f23ca56ea6b051067d574bbbd8545e5650bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721329, "uuid": "6e43c3a2-0811-4b9b-8cbd-5d0f5fe8310c", "value": "T15C236C6516817C24AA99D4371D7F2F0CBDA983E6320492DD7FCA3CF28C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721329, "uuid": "0858e925-4d68-4713-8947-73bcf269b127", "value": "768:hXRWNGxV79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:blxqcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782721329, "uuid": "71473dbb-f962-476b-b012-844ca3946400", "value": 48368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782721329, "uuid": "628941b7-3492-4e59-b497-3f1297256d57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782721329, "uuid": "68d8bdff-ee94-412d-8f49-6bd201fbcfd7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2445e95b-73e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782757200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757200, "uuid": "593dbc63-a62c-4775-a6b3-d7fd721c83ee", "comment": "Malware payload (SalatStealer)", "value": "5563f909b93845410a8014ddffa5adf6", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757200, "uuid": "4bc4e438-8b6b-41e3-9e49-dc38716c2855", "comment": "Malware payload (SalatStealer)", "value": "f59b521321526c8e255c6e5a9ed71d063349cab55a4a0b7207c6aa0039fb32be", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757200, "uuid": "64a4b18f-9c99-44fd-a6b6-09bffabc3b99", "comment": "Malware payload (SalatStealer)", "value": "58be67baa9a3323e8f0554ff45147668d5abf8ba", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782757200, "uuid": "a84b4e64-e587-4e3d-acf0-282ff0a7aabd", "comment": "Malware payload (SalatStealer)", "value": "bb48177068112fbd0a76b6d4ac1212c588f6a845570211623065668928cfc766456b23e346d9ab7e19052fc83aa2c5a7", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757200, "uuid": "fa9245df-8199-4666-a59a-b35280818721", "value": "T154F533AD046A9BD5D02116F44E1FDF35F15CC8EB82A5E06E311A4E2B67013C7A7732E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757200, "uuid": "34c80e66-2e4b-426e-b374-998fced6594c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757200, "uuid": "5f39786e-db2b-405f-8c91-7ca51511e441", "value": "98304:VZPTz6KPAHwWmmwo2riq21jPnQsnrcY5GpdQMixiH7:ff6NFmmwlriq2Vndf67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782757200, "uuid": "73407880-9295-461b-b809-3ef2802181b8", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782757200, "uuid": "b017084b-72d3-4c48-af2f-15a8ed2cb091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782757200, "uuid": "8c130f2d-b99c-4f33-8df7-c14a50d8d382", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811fd390-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760363, "uuid": "b4a0f870-bedc-4fe5-ac46-97f40fb027e8", "comment": "Malware payload (Mirai)", "value": "d9d13a7ca6e83c3a387c5a477ea21b69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760363, "uuid": "97d79496-d60f-409e-b7b4-7feaf49f8b62", "comment": "Malware payload (Mirai)", "value": "f5abf45db7a0c112812b5673b19f1990ca7ddac41998cf5d127c5acfbe682451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760363, "uuid": "ccb975df-884e-4268-9931-f9ce7a9bf202", "comment": "Malware payload (Mirai)", "value": "ef79b7657a4f125c0553763a070435bed6e9e32d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760363, "uuid": "129217c2-5298-4073-aa47-62702f0888ec", "comment": "Malware payload (Mirai)", "value": "abaa0866f6d0943587a88d31c411dac382a1554ecc5b704d8887caa166f6ddee9305ba460d1036547c12ca3483b9640d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760363, "uuid": "22836a5b-7dbe-4578-974a-b460fa2797b7", "value": "T1CF23F1BC97555AE0D1AC91B50BBC4B163DC60E08C153FC0BB947D94BC91FAA931C7E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760363, "uuid": "2f652451-6ff2-47e6-a808-47291071806e", "value": "768:3jTSKR+heSxInwqkiWJ8yKr4rNuLPeFaZZgLMaolk7gvNDtOhC0hJgGlzDpbuR1U:TdRWCwu7yi4RS+oZ+7gzOhC+VJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760363, "uuid": "53d5d365-3e96-4232-9838-5059038fb650", "value": 48520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760363, "uuid": "d9892390-f88b-4a0e-acd5-8d5b4c23e0f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760363, "uuid": "9d11900e-8684-4138-9e36-1f62dc3b21d0", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747e7e5c-738a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782717392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717392, "uuid": "42e668fb-c701-498b-837f-84d101436d0d", "comment": "Malware payload (Mirai)", "value": "18ede7ac20d4ffc9246c2efa16b9c90f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717392, "uuid": "3fbf6546-4e3c-4152-83cd-0a0aaf88e498", "comment": "Malware payload (Mirai)", "value": "f6f536a2c8f4ed70d4850c70ca015e4bb98788a8eb1255b127e3113e944c007d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717392, "uuid": "f00d81f2-ab20-4675-a820-06058477ebf8", "comment": "Malware payload (Mirai)", "value": "d5e1752594a746241ebe3a960e673fbd9b98e7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717392, "uuid": "9a9ebd26-a1b6-4b6b-a041-7c0e570bea01", "comment": "Malware payload (Mirai)", "value": "c5a5d5c1f752a9b2088e13eeff9a90d3e3741a2f813c960bf4a6c2ea99f540b754eb75dbc9a703040a3ef0bc9153d3e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717392, "uuid": "743fd582-fee3-40de-ac93-a1b5532003dc", "value": "T115F30981FA43CBF6E44707F011B7A7334531FC3A442AE686DB65FEB269619C0E64A358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717392, "uuid": "1efc1399-bd37-4520-803d-89a94af7b67f", "value": "3072:N0ztbeCQMTgABOIEsoXcr0EuPDeNjvYgWESDYY8BcI5bRk5XFMKmJJLhePI+7W3G:CpbeCQMTgABOIEsoXcQEuPDeNLYgWESx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717392, "uuid": "70fc092d-a2bf-4acb-8e83-eba95cbac7d3", "value": 163216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717392, "uuid": "1f49ef2e-5c16-41ce-881d-459d312e7a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717392, "uuid": "e3d54531-0ff4-42fb-ac29-6a0a77fcaaa7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bccf72-738b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782717669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717669, "uuid": "90d3eeb8-97f9-413c-ad27-564b4c0c1119", "comment": "Malware payload (RemcosRAT)", "value": "9da05a57853cf4696e85a0cb1a97883e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717669, "uuid": "4fd86700-6739-41ee-929f-6e3010369deb", "comment": "Malware payload (RemcosRAT)", "value": "f7830a521176927a1119039a8854a2b849bfaa16078acc28a547a25f555c817e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717669, "uuid": "fb19f764-8670-4d71-8e68-2321c69981f1", "comment": "Malware payload (RemcosRAT)", "value": "310848e7dc6f6f099b855338fff7749e8f287dfe", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782717669, "uuid": "c5b840ce-7d03-48f9-beaf-fa0f6b123c48", "comment": "Malware payload (RemcosRAT)", "value": "3e79522f8e934c23c3215b28891e26e926eee33e5030d884dc2a999cd1c7e978679ad29d6c1b3a349a89a90da38d99e5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717669, "uuid": "8b391214-dba3-4ff3-94f2-27b23b240689", "value": "T14AE4F049B695D88AC6B95BB19FC2C0D7810EBD628E4E4167718E7B4F2F32E51ED03242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717669, "uuid": "2e473053-54ee-4bb5-a982-f9acbc82d280", "value": "12288:SqjP1wRBME1LrwC5yzcdd1OJTa9CekmxVfof8jZJnnoe:zPErztOJe95kmxVfoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782717669, "uuid": "6001bfdc-9361-4a3f-91b3-9b6b7e9c1891", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782717669, "uuid": "cec2dad1-c752-4b2f-b1b6-fea4d5533ce7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782717669, "uuid": "9a11af54-2517-42a6-aba1-6b66ed094300", "value": "Mitsubishicorp_PO06292026-0022391_Speifications.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7344b0f-7388-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782716725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716725, "uuid": "0a039c9d-1c74-4c61-8b54-7721a929c5d1", "comment": "Malware payload", "value": "a24d77aa6858371a144de4714c836b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716725, "uuid": "a60729f9-09f2-4cad-8763-2495a0935e96", "comment": "Malware payload", "value": "f815f56850b17cf2746c8abecf74c5d57f4ffe13649e4e307e7e2ed6eb6ae4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716725, "uuid": "ce9d0991-1ac0-409d-a5ff-db20b179e24f", "comment": "Malware payload", "value": "e94397cc9bbbb90d5158455a11c6ab4ad72924c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782716725, "uuid": "1ccf1510-4190-4d63-a232-e52929bea884", "comment": "Malware payload", "value": "386ac3559d53a36937f2fb8ed23dc25ae6684c1e8b904f191e78ae7541c4a82468dea09a4fb6f5e7063b5027dcc795d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716725, "uuid": "9b450a30-0546-40b4-8d17-64be09ceb803", "value": "T1AD66F103E1E78EF4D12BD67D46629373A924B4884E33B11C29A5F37A5FE0934A15EB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716725, "uuid": "1c326adf-f64f-43bd-88a3-ffb84d745938", "value": "f4370cc938bb845cc38a9cab3d4fc048", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716725, "uuid": "f0166a9c-a09d-4ebe-a5c7-c7fc25548102", "value": "98304:fXmhh3guqgneFHNxZemyphjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErL:fg/nudemyujpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782716725, "uuid": "8b40d519-bd1f-4a03-9fb7-e9f3958ccc2e", "value": 6546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782716725, "uuid": "94c0e41f-1050-48cb-8ca4-e6988c5a0171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782716725, "uuid": "5437bf6d-19a2-467b-a16f-df8972c27946", "value": "SecuriteInfo.com.Variant.Ulise.605269.12010.2550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0fee33-7411-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782775360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775360, "uuid": "d7c2983b-09f4-4d57-891a-02e1efee28cc", "comment": "Malware payload (Mirai)", "value": "2e02ffbe81751903828746b2c6b4b533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775360, "uuid": "44db085e-4fef-477a-8898-b127e99dbc08", "comment": "Malware payload (Mirai)", "value": "f897580a09ebb3dd3cdeb3df81b4627a0e1ae4adf72982e1005d291c4096d14b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775360, "uuid": "55da8578-2e07-4ad3-951e-feb83d9c787a", "comment": "Malware payload (Mirai)", "value": "348fa0846a633238d8ed21225bbf700d9c2ad8b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782775360, "uuid": "747da81d-7942-4063-87fb-e2b15f63077e", "comment": "Malware payload (Mirai)", "value": "c16b578e4724bbad353b52c25b8070667bfaed484299cf4376ea76ca862592c70e44d4ea233fec9ba63e712c9261fd4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775360, "uuid": "8f3e9023-f022-4e49-9946-5344c1221e63", "value": "T150B34B1273180B57C5934AB02E3F1BE587FEE5D021F8BA89260FDB5A4675E371489EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775360, "uuid": "475fc726-b0d7-41be-b9ef-c98b960c99dc", "value": "1536:XLSoHAS7nGBqLNqyFrn+MB4K4SNiVx2+P96+puSdw+B7dmge:XL9nGkyR/Sgr95umege", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782775360, "uuid": "85472ccd-69fc-42f2-816a-b33140f488af", "value": 116300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782775360, "uuid": "138af5c8-709f-41ae-ac17-7d94f851710b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782775360, "uuid": "f47d18cd-30e8-4f81-8d5c-76acf62110ff", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba478243-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760458, "uuid": "2f692d30-758a-4d94-a3fc-53d507d51703", "comment": "Malware payload (Mirai)", "value": "e60393101314b8eee4c40c3b6f8f226e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760458, "uuid": "9ee74a39-a0fe-405f-acb0-72192bbd75cb", "comment": "Malware payload (Mirai)", "value": "f912f751aa64a84d3d3cbf3b12553da06ee96fd34afe24b5fcc9a78de446eaac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760458, "uuid": "948aec62-7e91-4398-8838-c8818fbacb1b", "comment": "Malware payload (Mirai)", "value": "91fb6ad60c1aa780c32f4dabd3e16cab403383d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760458, "uuid": "fc572270-c245-4e10-b21e-c1fc2fdfc4c5", "comment": "Malware payload (Mirai)", "value": "23caf9bed8cfc428e0506c183bb66b06958f22a6c65f82821d04820b98707868f3b39d539fd15df8e381874da7a1de6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760458, "uuid": "79cb1b83-e8f4-4641-bd0f-932d73ee07e2", "value": "T140144B46EA414E13C4D7137AB6AF024A333297A4D3DB73069D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760458, "uuid": "7ea14dc6-8a7c-42f3-9f17-72357ecf5e57", "value": "6144:bJT3wkaBVDCzZ8lJaxTZb1chksNCW90ev3b5M/9/Gg:bJrwkaBxC2lJaxTZb1chkmftju/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760458, "uuid": "a2220364-f685-4024-8b33-c4baa3d4ec25", "value": 201655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760458, "uuid": "04e47035-abf6-4c91-8af9-62b7086673d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760458, "uuid": "b5bdfdad-989a-44b5-bd9a-83aaff027536", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5159050f-73d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782748686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748686, "uuid": "b9be71ee-464d-4520-b644-1f0449380a77", "comment": "Malware payload", "value": "c8c4df8f6d394fb3911e75d491b6c564", "object_relation": "md5", "Tag": [ { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748686, "uuid": "61a9ed91-96eb-44c6-acc8-cb82eb3a711d", "comment": "Malware payload", "value": "f92d9dccd7472d97d292c1949b331866e03c6d56bed507c92f2b46c9a66939fb", "object_relation": "sha256", "Tag": [ { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748686, "uuid": "2a2ddb9c-4cde-45b8-b27b-b90d6717954e", "comment": "Malware payload", "value": "a91fda0e9ed49e55d121ffd22e91a13dfad7cea0", "object_relation": "sha1", "Tag": [ { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782748686, "uuid": "bb5ac39c-3f1e-4df9-8a39-04f9e656de14", "comment": "Malware payload", "value": "fc8f48ee2a6013af21f85aa9e737229003e66f3f323aedd85b1ec3c4e1e44c77f2720eb2023ccda9a713a9edfb705fa8", "object_relation": "sha3-384", "Tag": [ { "name": "kzaa-co-za", "colour": "#3173AA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748686, "uuid": "abcd742a-2044-4005-8bdc-ce54bbf4ae9f", "value": "T14112AF10B466C5EFD82EA6C7110EA770CEA13AE9174098D28B9938B77D21BC3F5512D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748686, "uuid": "a4d85805-5bdf-40fd-bd56-a09994d7d52c", "value": "192:5xqzU8y7TCvrHWHntWaxMRCDID7BCb3bOIJXRU87H6AeoFWE+Dxx:5xCATCCJeUDC1C/OI5cAeE2xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782748686, "uuid": "44b08b9b-a306-49bd-91ac-18cb68ac7874", "value": 9372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782748686, "uuid": "7faee775-07d6-4ade-8ec1-426aa8236579", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782748686, "uuid": "755df983-e851-44f7-9957-882a7e9021d4", "value": "B C document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650e7ad1-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756880, "uuid": "48567e98-24f6-4963-934f-423bfab95e84", "comment": "Malware payload (Mirai)", "value": "86c8ea441c8221b9d8bd8be0b96bd684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756880, "uuid": "dee6127d-6a85-4999-a616-3a9478b578ac", "comment": "Malware payload (Mirai)", "value": "f99f90b6aec15825aaf35f6add0bd283876e8a567a72ece2f0b14506fd35e243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756880, "uuid": "2891a7d8-988b-4da2-a063-bd3fe1dd84e0", "comment": "Malware payload (Mirai)", "value": "b90476712de521a8b75a48341a84e93bf825a006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756880, "uuid": "5f2f699c-df36-40d1-83e3-2582a87ea97c", "comment": "Malware payload (Mirai)", "value": "842881bd96363e88a758293283bdb8f4b88a41eb3e191a0d26bc4e1ad248d182274f01076abdc06e1b16f2c21e7cd845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756880, "uuid": "252a6b8e-560e-4d60-84aa-fd717ca2da12", "value": "T1EDE3E61E6E218F3CFBA9C23047B79E26965933C637E2D585D1ACD7011E6028E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756880, "uuid": "40bad657-3990-4f2a-9bb7-39052ee6dc56", "value": "3072:W4Nauasp1gUCTZWp+rChmy0kV4jgnzCiiwnPmUqtqB/lhPRbJh1WI/P2ADzRXT+6:9Nauasp1gUCTZWp+rChmy0kV4jgnWitJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756880, "uuid": "82ab54fb-fec0-4f2d-8e84-7db4c9fa11f3", "value": 144692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756880, "uuid": "ad1d5736-8785-4cd0-8672-b11bcb6a1d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756880, "uuid": "d3bc516f-8fff-4fc7-8c1b-0441bd2b18f0", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b1a3ac-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782712988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712988, "uuid": "2f9a990e-2526-4db6-8a5b-0b5710c3a076", "comment": "Malware payload (Formbook)", "value": "2cbbc2dfcb4c2eee97bf191d2f640171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712988, "uuid": "9b96df9f-1466-4738-983f-a9a5f0e64fd5", "comment": "Malware payload (Formbook)", "value": "f9dcaff0a6dd0a000a3fbf630cb0e15bb359d8926ac4405402c42493132177e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712988, "uuid": "3285fb5d-e3ed-4376-8e1c-4017e11a5639", "comment": "Malware payload (Formbook)", "value": "a2147858182f429e20d9a4ab4497f011d0835e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712988, "uuid": "41fc515f-8b59-4dca-9839-9e260ac83694", "comment": "Malware payload (Formbook)", "value": "73e94ae86adb84ed86ff1f76ffef59712ab1895121415b60cc1ccd87d48702300505a591d83af040c7bbba9fab415a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712988, "uuid": "f9b6fd64-d6cf-4b59-a3b7-79d80f681f2c", "value": "T1DB3501C03B2EB719CE614935A579FEB942E91EA8B010F9E25EDC7B47796D210AD0CF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712988, "uuid": "adf5a653-994f-4c15-8870-844581193b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712988, "uuid": "0c0649de-4c92-47b8-ad62-e7af103bc0b1", "value": "24576:71BQ/br8BMtkmndR9i8d/mRq+Z+DbSOL849d8Av1:7mX8q+mndRA8mRqG+Dbhg4z8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712988, "uuid": "01ab417d-6cff-4039-815f-93e460746f34", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712988, "uuid": "a53c433e-59b7-4414-80a2-d22a60208240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712988, "uuid": "1fbf0354-4ea1-4ea2-a72d-850fd83ec35e", "value": "BOQ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b10d30b-7400-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782767976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767976, "uuid": "07c189ab-0e56-4655-96b7-81a471992973", "comment": "Malware payload", "value": "373c6e4c88aa9825e4a9d0e0acc607e0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767976, "uuid": "972c6f1c-6976-498f-aa8d-763ac06032ec", "comment": "Malware payload", "value": "f9ec92c119c5381c026e91da6c816068156e36e41ba0c12e17e2befad67feeb4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767976, "uuid": "07cc280e-cacb-4d46-8af4-d6b93b2b19f8", "comment": "Malware payload", "value": "0d810a19e5c763ae6d8567737b11b8e8f59c3aa6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782767976, "uuid": "ecf0bf27-86e0-480c-92fb-46a09ade2293", "comment": "Malware payload", "value": "08547e4a54287218b5853ffdc852fc1a4b47a6a7e3987987bdf138baa63e733ddfd4d641c5925d070a48d403dbadfb4a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767976, "uuid": "1b5e2b64-f28a-4fd4-95f7-b4b35ed135eb", "value": "T1467733249BEA6BF4EC015539E72366C6673DBC766325EBB70B98C620BC319E02530573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767976, "uuid": "26205381-0459-4ddb-baa3-3dabfcfb10aa", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767976, "uuid": "ed735b6c-0365-43e5-8047-80d3b5194d0e", "value": "786432:yA73Fbrpoh3qY+sZ7LdPiJ2PSMmdrXBOXlX2vHV5X:ymFbI6Y+sZtKJ26fdTKl8HVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782767976, "uuid": "25c56a8b-04db-45d8-b068-e3d7a1bb1cc2", "value": 34328368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782767976, "uuid": "96130736-b023-4e7f-8efd-94ba605721a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782767976, "uuid": "4acf159f-9feb-4d74-958e-718116675e0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2a329c-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712949, "uuid": "26fb70c2-b184-4807-aa04-5094a0ff1f23", "comment": "Malware payload (Mirai)", "value": "494c53ab3c47802a001a12e17afbc7d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712949, "uuid": "44c486ba-dcdf-4684-b7aa-8a237ce9bb3c", "comment": "Malware payload (Mirai)", "value": "fa88c24c7ff68410fbbb6b3e8abe81a24db92b66a0059dde51f7e9255ddf82c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712949, "uuid": "256992f1-dd80-4852-9c7c-c36b9404433d", "comment": "Malware payload (Mirai)", "value": "0cd8e697879fe54cc13787d2f8fe5fdb68896ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712949, "uuid": "00cb5e54-bae2-45dc-b396-b13bd0862ce7", "comment": "Malware payload (Mirai)", "value": "c7d5fe1623c309300077d0e6a900542c599bcf1b6e0e552b5e50b8acee9bdb24f27be8cb60c0646822f9bb1093e81da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712949, "uuid": "1ac32425-95ff-4d89-9ec3-c258e27ac9cc", "value": "T11AA3192ABC816B15C9C10576FE1E538E33232BACD3DE7213FA145B2C378B56B0E2A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712949, "uuid": "d1402284-1960-43b3-8794-57640b24fb66", "value": "3072:XOfbWo6uDemAOba2P8xQMUaDPDrzXls0CkwxNs78:XQbWo6uDebOeA8xQVaXzFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712949, "uuid": "0fde329f-0b48-4b3e-a314-04d8f8c6f662", "value": 98440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712949, "uuid": "d9cde9e8-9f90-4076-a4d1-7fe71e1fb63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712949, "uuid": "7acb171e-a66a-4f0e-9c28-281f7e4c6e4d", "value": "CaLP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6184a3cd-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782760310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760310, "uuid": "1d6af744-1653-4c11-ba42-58b159dd846c", "comment": "Malware payload", "value": "739a1fe8d16d90efaf451d5e1429e6e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760310, "uuid": "5c150bd0-31d4-4080-af9b-53b2220bb20f", "comment": "Malware payload", "value": "faa5d65ba56b6200d9aca632f4d58d558022064f4db22e77f659ebdbd97b4e3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760310, "uuid": "c36b05f4-8387-4a99-93c1-176eb18543e5", "comment": "Malware payload", "value": "f4b823f32d8b7e38dd435c42ead7713eb42e2289", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760310, "uuid": "62818152-2f01-4e92-8a2b-ed7841d5f8ac", "comment": "Malware payload", "value": "b69964fbf579b0147767c543db8005113dc04bb09a62d6019dcc99effb3858b46b08a27d47c6a638775d7274023736ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760310, "uuid": "964ea129-eb36-4239-ad14-592cbeb5a9b9", "value": "T10BD196E790B0FF3388845A1BF456F43CF46F23B26D740268356D39EAA1D0606B5A754E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760310, "uuid": "aaacfa14-14de-4137-a872-5b4f9c961b12", "value": "192:kTyloSdeQgQ5RQAQ5gQgQ5PQgQ52ak5cak5tak5ZXTylAKx6EFMeCF+xgvIyvUq5:hgQ5OAQ5RgQ5ogQ5215c15t15ZifJKUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760310, "uuid": "dca7e502-ecaa-45ba-a022-fd4c512f10d1", "value": 6377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760310, "uuid": "39ca9596-79c8-476d-b883-6e3232f51ccc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760310, "uuid": "6cce8b06-92dc-44ce-a76e-5433d28f5fe5", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ad5e96-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713310, "uuid": "e3d6e722-48ba-4de5-9ed8-b8f0eef589cc", "comment": "Malware payload (Mirai)", "value": "d70668a2cc0713403c6847cdc2bbbd67", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713310, "uuid": "6a4abaf3-520a-4cb2-8926-d2784e61f871", "comment": "Malware payload (Mirai)", "value": "fad3d1dbc219f7bc516803296662fee23d09a64671aa3ab72215ef8774900c5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713310, "uuid": "6b6fb46e-f396-4612-ac93-b4b9c84e4330", "comment": "Malware payload (Mirai)", "value": "7ce4b025dd8ce087152dff90f1aa03bca711ec0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713310, "uuid": "d8284d01-6e98-4d11-aec3-a7417d47f093", "comment": "Malware payload (Mirai)", "value": "e2e267e64de1037af36d461523ecb3bcfd497cb53647f2f1b7342e1a62c9b208a962474376ce58a9970a347f16335ab2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713310, "uuid": "654303df-a0c5-410f-be2b-f4b5b39132b4", "value": "T19E018CCA85009D0050A9BA5C36DB5994F821D3CF25474F75FF6C2E2DEB84804B0AAFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713310, "uuid": "02c10120-2c8f-49fe-96c5-ac26fb19df7f", "value": "24:kXCKysE2hi0ziQvZohaTu1YV1bBcXozP5nXKWX:e9Qp+MsTu16bBcY5KWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713310, "uuid": "4b8bb6c3-a735-4aeb-9442-1f9cc4f2cf21", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713310, "uuid": "1b46e439-e2d0-4085-b5bb-3632032b49c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713310, "uuid": "30df5722-8aab-4274-9117-1da67f36fd5c", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c335b5-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737840, "uuid": "dafd3a0a-1d3e-488e-95c4-f9dafedf1f14", "comment": "Malware payload (Mirai)", "value": "6687405ac15c1b3868468655bd5ec1ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737840, "uuid": "cf784e7c-60c3-4506-8d17-49957b0a4f32", "comment": "Malware payload (Mirai)", "value": "fb639082b1fe79af4b3f35e712264766d246fb8517f0790c74e7eb55dc727d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737840, "uuid": "886aa476-3437-4101-a2ab-2e18a97aef21", "comment": "Malware payload (Mirai)", "value": "841169cf4934528164d53df2e71c41b9981c2f03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737840, "uuid": "f191a1a3-d0a2-471a-8f88-70e809d75950", "comment": "Malware payload (Mirai)", "value": "1453e8ab0e8712d6f60c5037cf4dc06fa20b96e1e048af7b54f15c3bd672f11bb0e9657fa0e661e7de9ff7898472ae3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737840, "uuid": "995458cc-568f-4300-afa6-6b2ef4947632", "value": "T1BE045C46EB818A13C0D71779B69F524633239BA4D3DB33069918AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737840, "uuid": "bf637750-cb95-49a1-841c-a0cc9a991a15", "value": "3072:OUsd6o+DImaehF/h9PZpgBmsXCKiHUdMQy3d0fM/9bezpFM:OUUKLaehF/h9RpwJCDH0MQy3dEM/9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737840, "uuid": "bf4d387b-123e-43ca-ba58-06870a003dd1", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737840, "uuid": "7ec744ac-9fb9-47dc-b87a-5988634d961d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737840, "uuid": "2c4acb76-0783-4104-8cc6-20f0ae2b353c", "value": "000d4a4b5135df4d0b404ce5c9cea4b7440eef5fa5cab482d8c2043725bd1d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7575ab55-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713098, "uuid": "2412b901-4673-4de8-8bf1-f4128cba9896", "comment": "Malware payload (Mirai)", "value": "24a6e1401803644f6680687cb513e3f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713098, "uuid": "987dd100-e846-4853-aceb-c5157c23b079", "comment": "Malware payload (Mirai)", "value": "fbd493a92c9c5179eb412655ef981e47cb5340411f711525295e311aaad276df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713098, "uuid": "47ff6b1b-8975-43a1-90e6-a55cf564c1a7", "comment": "Malware payload (Mirai)", "value": "487c867732dbef32815e568542e15e202e2d7ed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713098, "uuid": "7d1f848a-ba69-416c-992c-42a76cf31e68", "comment": "Malware payload (Mirai)", "value": "2e3df4ee4d85d41abbfcb1f20f73edab41341e0206dd5eeb4fd5f9a3ef3ede8205fdfdbff8985b75b491d7854e7954f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713098, "uuid": "353c3f8d-9021-4505-9bd2-c5dac7dc14f9", "value": "T178A3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713098, "uuid": "fa0bc950-a462-4831-a0a3-5a45c844324a", "value": "1536:LvGefaZSdtuc4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdM59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713098, "uuid": "a63ab196-14db-4056-9006-87941f5a44a8", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713098, "uuid": "681f4f18-4aad-42ec-b715-d4769f9d6b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713098, "uuid": "71b1dbf8-ce17-42eb-872f-13ddbaba9a2a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399f74dc-7358-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782695818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695818, "uuid": "96f2750d-8926-4206-902f-2479e8ef2798", "comment": "Malware payload", "value": "036181edb273bc28a74ec8715a62045a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695818, "uuid": "ef0ec812-1469-4de3-98cf-bca676e50b56", "comment": "Malware payload", "value": "fc0d4cc9b52c114ba0df0815412a0ad4349a025dc0978787754e1ea0a23f4e0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695818, "uuid": "85abf44d-9906-4096-8030-6cbec3a6f8c7", "comment": "Malware payload", "value": "19dbd33b54e264a6c3633c2d42c5d088fd369bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782695818, "uuid": "1c58d7d9-016d-45d3-ab48-3ccd66fae321", "comment": "Malware payload", "value": "a6214c0e500e4d89bcd26350e65049ef69dc3755f13a790793952a2713ae1d72042fc61c2de48be5918a817c178bd478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695818, "uuid": "656709fd-8596-4e81-9a24-4d1b937b5d66", "value": "T15A04D80AAF510EBBDCAFDD3706E90A0635CC954722A43B763674D528F54E90F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695818, "uuid": "8076d58b-214e-4e7a-9d92-7ee3d51aab96", "value": "1536:oKljPy2WqwApmhWRpNkAAmmQwCy0YgYrrO+ZiD6a6ElOi47g+JwXMCA8im4PlrRZ:bG2twwu6DxYm+GKJwXM785GHCGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782695818, "uuid": "0bf429c1-57e7-4b1e-9c26-5d8f1e28501b", "value": 177340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782695818, "uuid": "8587b0e6-f564-40d9-b620-9cd643b6c0a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782695818, "uuid": "6c3e6ee0-4a5b-4d35-8d71-fe5a38e33515", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00043bf6-73ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782737812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737812, "uuid": "243fc4d0-7d15-4ffa-a348-1c8f4a22b883", "comment": "Malware payload (Mirai)", "value": "3474156f94bbebd637f394436e869289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737812, "uuid": "52c0872a-1bfd-4b1e-8c34-13041225b022", "comment": "Malware payload (Mirai)", "value": "fc42995df5561640cbc2709950da724a97439b3399fc6a40f0ea1d8e39e4403b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737812, "uuid": "a37cfc3b-9c27-4663-a0ae-cc252a0d5414", "comment": "Malware payload (Mirai)", "value": "698e4286a8d7a2dec57544c15162d4b8233a3c21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782737812, "uuid": "b839f52b-48f4-474b-950e-56a974427eeb", "comment": "Malware payload (Mirai)", "value": "40ed4bd46c22cf07f8be6e1e3338812c831d01aba5ceae2777fc2da1d75cfa79614433a03d68e5b310161c21bf24f004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737812, "uuid": "0fe123f7-8079-4040-a7b4-232ded9442b5", "value": "T1B48329C1FA8BC0F1D91B89304067F63FCB31E9695061975DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737812, "uuid": "d5356d34-1ade-4455-ba34-fd0d31fb7d12", "value": "1536:HInlZzkj+0cO4xoPEw6HMAy0KueEMWximKjfTsv4gz9F7ET:HIlySh9is7HMA9FjwmKjfTc4DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782737812, "uuid": "e8db30c1-cc69-43ab-8c60-f757a249c9de", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782737812, "uuid": "292e9561-549b-478e-b997-eae31de5bd6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782737812, "uuid": "691793ac-d4dd-4db8-817b-df00a0105a24", "value": "0bb5f4ead4969e06720243a6cfb9be2a6aaad2de11d506f04929bd937081b939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedc098d-737f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712792, "uuid": "f48a5893-d072-40e4-b3b1-8032418e4cb9", "comment": "Malware payload (Mirai)", "value": "a1c255370f7f9d0f3efeda51d5b5eda8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712792, "uuid": "6338be77-b3d5-41c5-b6a3-9b1181ec8240", "comment": "Malware payload (Mirai)", "value": "fc5ff09d7071a78bc61c8db3bb26ed5f79292d8e27bf2cd7f406207a21a84a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712792, "uuid": "ae393f84-8bc6-4d0e-bc83-bbd1b11ea0da", "comment": "Malware payload (Mirai)", "value": "a875551bf96e3fc1612489ee0de7b1f9469dff34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712792, "uuid": "16f35be9-1492-4a53-a6ba-b4c09685ba26", "comment": "Malware payload (Mirai)", "value": "a8b8ec11fd171fa81c6b8c49c383a820a4132ca8e284f9a28cdc3559be317f3d0ed0f0dea7749a2acf1637ddcbcff493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712792, "uuid": "5c57855e-b5fc-40b3-b72d-d52a6ac1450a", "value": "T1BC361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712792, "uuid": "b2b24734-86c9-4161-ad72-45d6b3f35e21", "value": "49152:HF2ItAqee7182S4P1EiiFV8YommyEW6WcqPIxaWWNTfAhvg:l2ItzeqYX53AJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712792, "uuid": "cc02d885-024e-4fe3-b526-452e01c1c71a", "value": 4886680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712792, "uuid": "7df8ae39-9537-4d92-a0ed-52976e07e6ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712792, "uuid": "e72078ff-6142-432c-994c-12c02ae58569", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0d1a80-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782712950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712950, "uuid": "d75cc5ab-9f42-460d-ab4e-c0de654240cf", "comment": "Malware payload (Mirai)", "value": "615f7183584dc503de07b273882fa5e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712950, "uuid": "b5abf724-36ac-498f-b293-7b8b67c4b8fd", "comment": "Malware payload (Mirai)", "value": "fcdba82f542e9da59bae98a4a4b10af7b92d2c866ce488e27444e28cb7f7b42c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712950, "uuid": "b429821a-6e1c-4a56-9307-75b8e83d10ba", "comment": "Malware payload (Mirai)", "value": "085ed44328048b669d750c5ebcbae933be965e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782712950, "uuid": "11f631ea-4e0e-487d-bd42-04ea5a4ea16a", "comment": "Malware payload (Mirai)", "value": "afe1c63811660ea788521b1fdcbd901bc7374abe73d096be7210a03b96bff4b52767ab58cc31f250acec2521c81f3b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712950, "uuid": "88b9029e-e05a-43cc-93a8-9c71f7a2c717", "value": "T1C7F2E178350ACADCD424CABE51B00BA0BB1517A7D5438C0AF1AEBEF79ED74A964433C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712950, "uuid": "b80ba515-a3a4-4462-ae88-20bf827058fb", "value": "768:9NYKyukZoTMKeZgXunc9yxAi4JBk1yB0V6Xd4/WXtGJgGlzDpbuR1Jo:3YdWleZgenKW2Ju0eVUi/WXtyVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782712950, "uuid": "d5e5ab5c-147d-4cfe-bde0-a75c38e41d88", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782712950, "uuid": "ac46d117-d80f-4eb4-842f-c1b334cb5729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782712950, "uuid": "2aa87c1e-7143-40fc-bc76-9f19b675ff73", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673d8bc3-73e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782756883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756883, "uuid": "9bf08d41-2fa7-409b-8633-910dcfc55920", "comment": "Malware payload (Mirai)", "value": "c4e2ae7fa44c4ab1216deeb098d6b861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756883, "uuid": "f4b32586-d24a-4640-b695-aa797e779fad", "comment": "Malware payload (Mirai)", "value": "fd05968329776bf1ff3de1ddb3c1f30b164f2db2cd9ace279e5aabd7e17c5360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756883, "uuid": "d3f02120-65c5-449c-ad70-a07dd6dec41c", "comment": "Malware payload (Mirai)", "value": "fed9c1b9eaf060372c1a5234564deb56419ff1bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782756883, "uuid": "e79834f0-9cdd-46ae-9a9e-675944960c90", "comment": "Malware payload (Mirai)", "value": "cb455820b6ae0668971e8c8a84de16aba82fa87c9cf18cd225e64d720ca7d4c989e2129be41decfcaa07b27fd49b18a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756883, "uuid": "0e857b6a-dfa9-409a-9c52-1137b04e8e30", "value": "T107B33A02731C0B47C4931AB02E3F3BE687EAE5E021E0BA89251FCB564575EB7554AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756883, "uuid": "10ca746d-11dc-4fa8-87be-92bbd9f33d3d", "value": "1536:HtAnEytKcUAzQ4KbPRkbHzKmB1P2KNQNZAwFRzFw+RmasGG9Md4HOD1DZB:NAFpERAzKmTk0IFbmLJHEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782756883, "uuid": "375d20d6-cee9-478b-9daf-2f5a78bc5584", "value": 112596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782756883, "uuid": "5a55e2a2-b00c-45d0-8e9b-a9b31db3aaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782756883, "uuid": "a4c411e0-0442-485b-85e3-87ed9e31fb5b", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72aed1b2-7380-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782713094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713094, "uuid": "94e89245-145e-4186-8f95-0615fd273c82", "comment": "Malware payload (Mirai)", "value": "b6a5b2e00d66215d5934d4ec7cb8d5d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713094, "uuid": "9f4c04ab-7615-4e8b-a55c-66f096714465", "comment": "Malware payload (Mirai)", "value": "fecbaaf89f34ea92e5e7e4021d42467ed96cbc19c4e9cdd598c6fc253a19fd62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713094, "uuid": "74287a21-0cfe-4d57-bbbb-2d358e11e6ff", "comment": "Malware payload (Mirai)", "value": "519fda1280cc1bf4909842807c5414d29e3c49b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782713094, "uuid": "d2051add-877e-461a-9e58-88f0be724181", "comment": "Malware payload (Mirai)", "value": "45d74ecfdd9858e20480cdecba7372b42c617f27f6a70f31ac9cc159adc063211e4abb9e303a2a9c7583990b66436b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713094, "uuid": "815f6cce-57dd-4f9c-afea-b4ea812fa38f", "value": "T162633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713094, "uuid": "c772256f-cea5-4fa7-b994-e65d65d852a6", "value": "1536:9yJWBrmSTKrFcT1GwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxcT1K1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782713094, "uuid": "db4aca54-7760-4a00-8d98-e10ad7b71161", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782713094, "uuid": "71befa87-2afd-4304-b615-1fc2b5290b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782713094, "uuid": "11f5ea5e-5550-4020-ae67-a36a15a5a768", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cb2971-73ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782760369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760369, "uuid": "cafb1497-ab99-4d9a-a4c1-b0f100f9d0f7", "comment": "Malware payload (Mirai)", "value": "d772665a3fe94fc8fa2a50a3c5281898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760369, "uuid": "e840cd06-630a-4017-8ffd-633b842602c9", "comment": "Malware payload (Mirai)", "value": "ff32e0dab5044b52843772765f9c2e0b87da6b8345dc45d0c6f4f019cadc957c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760369, "uuid": "a321e171-697f-4145-94eb-0b50447687a3", "comment": "Malware payload (Mirai)", "value": "c2be3c8ca8d1a08aec5e5490547b6ee5d9ecb095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782760369, "uuid": "978b1bfa-f7a0-4645-8741-e5bab2c0373d", "comment": "Malware payload (Mirai)", "value": "9af58691042d776ca545659dcc0f42f9fa724e0b4a5844cffc9f184bc368f289907fad36eb85064921d972eb13934504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760369, "uuid": "16c06ea6-c780-4437-93fd-65532d507142", "value": "T1B623F1C721B7F7ACD84E767447E9B2C4FD64F406984602AF06A8E96CC0732648DA3E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760369, "uuid": "f82154f1-32a3-46d1-8c09-8238c97d0f65", "value": "768:7X8NaZWjWApQhQaiz2FstyjZJBCpC8HOMY2N0fX/Q4bT0s2u8vt0cuQycAqTlx0T:j2jxpMQa5SofIpfHA20XQ4s4uBAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782760369, "uuid": "30179a11-049c-4783-a1d1-33c168e40687", "value": 47588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782760369, "uuid": "fff95f57-0a9c-4fe2-973c-2464d6bf4bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782760369, "uuid": "d23cbb74-3b4d-4eb0-adf7-9bc31cd4a3e5", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ee493a-73f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782764909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764909, "uuid": "2ca3a8fd-af26-4659-95ca-57772db5ad3c", "comment": "Malware payload", "value": "f1e2f31d4dbb68642ae93c228819fc97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764909, "uuid": "502b2e7f-75c1-4c78-8407-f4c56a91a05b", "comment": "Malware payload", "value": "ff3d427dad17816af96bf163e840942b596cb534f0051d24161c9eb77d8382bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764909, "uuid": "e37897b4-6b44-418e-bab3-e421807454c4", "comment": "Malware payload", "value": "441b979816e0525b874aedf131cff8ae2792f0de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782764909, "uuid": "a60ffd53-6b91-4163-8a3a-563a78a6796c", "comment": "Malware payload", "value": "d90f81fd68ee1bf2c450efab75c3572e31a050319b3dda6377f4392b222e1b80b51f3d5adb22850d522591a9a0ca22b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764909, "uuid": "26c4f0f0-3eaf-4764-9428-4987d76ba8b6", "value": "T1B8E0864531003F7925F54E19E989D4D4BB072FF5D90C52A0F04498ADA0A515C6977E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764909, "uuid": "2dd87a9e-54bd-4bf6-b94c-ee74718bc100", "value": "6:H6s9USMA63xQ2BWub8ylKNh2w5a6BBaLr3iu3d5bR85xvMv:as9LB6BFUOlYEwBBir3iu3dj4vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782764909, "uuid": "68f4d4fe-9913-4f13-988f-2b8c0ff61c79", "value": 343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782764909, "uuid": "f995062e-f005-47b5-8e72-c3cf408ebc66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782764909, "uuid": "158aee7e-2715-4c93-b0ea-9dcaf8e5f8c8", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc58c52-734f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782692148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692148, "uuid": "5836ab77-6772-46b6-9b44-e2b369880639", "comment": "Malware payload (WannaCry)", "value": "388ed6c8e9e5ba54c49209337f0a71a6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692148, "uuid": "75f6ea83-8f1c-4f22-9d08-c0de42242126", "comment": "Malware payload (WannaCry)", "value": "ffb966fce55f67726e7f8084a1dc21b80650e5c05373529b35d93eafcfcc7e26", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692148, "uuid": "fc85a6b4-eb6a-4769-8115-a57bf73ded26", "comment": "Malware payload (WannaCry)", "value": "ed5bdffd8e51239effd147106709a026995deaee", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782692148, "uuid": "cd7929b3-6e83-4e95-8622-b2ce9bce17e5", "comment": "Malware payload (WannaCry)", "value": "11e92484ce45e6cf291768f3dcede52a26dbe8ecab16bfb1e55fb9c62b8bd0f133b68b65f67a3fc3434f23dfc35fbc40", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692148, "uuid": "bae445bd-2ea7-444f-8074-05e3534e7a37", "value": "T10036F115A2E86B64E6F31FB2217B871047767E45896B924E1760A04F0C33F5CDEB2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692148, "uuid": "4e02da27-24e3-4571-b28e-015f11a7eb2e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692148, "uuid": "f17cd439-5157-4a67-b5cd-dbdecd62ed71", "value": "49152:jnknAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DUDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782692148, "uuid": "1dfd1ab5-bf58-4063-b96c-341b638af101", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782692148, "uuid": "adae1f74-b8aa-4d08-8a8d-0ca799a64b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782692148, "uuid": "72d3a93c-7e27-4ab5-9700-8053133d351e", "value": "ffb966fce55f67726e7f8084a1dc21b80650e5c05373529b35d93eafcfcc7e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879689b0-73bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782738469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738469, "uuid": "3b99d4f3-0a98-499c-9b03-34d16772df55", "comment": "Malware payload (ValleyRAT)", "value": "a8480f1bd4fc75a68930f3c60df63955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738469, "uuid": "c417a6ae-0a69-4edc-840a-a6167dc2bc73", "comment": "Malware payload (ValleyRAT)", "value": "ffe98374173d7c2084a1a6953b308c13a8b9493294af831c23542b0d88654036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738469, "uuid": "e5c126d2-b907-44ba-97b6-e078bb1df46f", "comment": "Malware payload (ValleyRAT)", "value": "ce609cfde7d81bc7311a83e0f008a2f756912ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782738469, "uuid": "7445bb8a-d637-4e5e-bd29-98e3ba56c088", "comment": "Malware payload (ValleyRAT)", "value": "5a52933197bd74376dfba63cdae09ef2440080522f5087adec4653268058421e9245ca0a6c2555c47ec57d3feaa015a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738469, "uuid": "eee3c59d-6696-456e-886f-9db4ecd6f33a", "value": "T1B0958124B9BA812DD027FFB83EDDF89EECEB3A151545646B0041034B8A26AD0CF5B57D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738469, "uuid": "88bb9aec-fcd7-4d5c-a7fe-c756ba61a010", "value": "98509f427951e79372ff4d41a60cebc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738469, "uuid": "df83f27f-f110-4f50-85b1-6d3c0d063a86", "value": "24576:k1GtPpEp8EHtdMwfutNRyXM/5zYtzpAH/b:xhEiENdMwfutXyXMVas/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782738469, "uuid": "d37fb68e-0431-4ba1-a6b4-a7b169b8d3b8", "value": 2030432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782738469, "uuid": "326c924b-eccb-462c-af41-e7126e4aa1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782738469, "uuid": "8159239f-fe6d-4925-bda2-e7b036cc0ae7", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }