{ "Event": { "published": true, "date": "2026-01-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-02", "timestamp": 1767398581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "59ae1aef-33f8-4e20-bfcc-98fea6f32c21", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f24bf39-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337937, "uuid": "7fa317e8-5448-4dd3-a8ad-20663b108bd6", "comment": "Malware payload (Mirai)", "value": "1ec127931ec964d401bebb3afea9868c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337937, "uuid": "08057091-e6d3-4843-8bd7-24806569da44", "comment": "Malware payload (Mirai)", "value": "002c7a9a582951615e3974a375e4bdd6d5b1c999fac5a4046ea28c4c9ca15f99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337937, "uuid": "75050a6a-8fb6-4236-8fc2-4f3a7ed55f36", "comment": "Malware payload (Mirai)", "value": "6f89020743bab65b0d86359aa1bb423d823ffe1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337937, "uuid": "ed7b78fb-d92f-4ce2-80b4-f56d64f444d8", "comment": "Malware payload (Mirai)", "value": "f7ec5a57de67f55f197f07a28b18f0552e4742d95eba28252cd9cff1cee9069ef0e0a3a143e7062b808081aae30d7dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337937, "uuid": "aab32e37-337d-4565-8efd-7f48c4d84df9", "value": "T1BD44D50AAB610FFBE8ABDE3706E9170128CD641B22A97F397534D518F50A64F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337937, "uuid": "110623ce-109d-407d-ba42-b6a218cacd10", "value": "3072:VW9dGwBnd7EvrvXbnDbMq93GFwVnX70EIjGbgOdOmA:VW91BdovrXrDbMq9AwFX7mnOom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337937, "uuid": "621b6abe-c66c-4b07-8206-e67b31772f4b", "value": 258464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337937, "uuid": "009e9b79-b3b3-4d98-9d2f-1747bc73e65b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337937, "uuid": "faef1734-909b-4aa5-8a2d-40524a23f3b5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ebaefe-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386047, "uuid": "010677aa-1698-42f3-a9c1-6849e67f44be", "comment": "Malware payload", "value": "f710626649a218a5873e16ae2b7e91b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386047, "uuid": "28c8f32e-00b6-456e-a2e0-36cb708aa573", "comment": "Malware payload", "value": "00652bd3b30869a383b7e981c63e4bfea22270a656bdfdbfd0a59c18c9e524ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386047, "uuid": "b3f8c05c-1f19-4c21-8be0-f3b24632b679", "comment": "Malware payload", "value": "bedb79991eb88fb9c2e211ec45be96de19e7c09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386047, "uuid": "cfdd83ba-8901-41f0-aea0-f9dafdfdb636", "comment": "Malware payload", "value": "543e94e349111f066feb5c3a008ea8af2d7dd68eb5e7e2a9948b46cf723cd9fd9e247ab27ea516ac88fac047b4b6c542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386047, "uuid": "955a7553-5cce-46ba-88e3-327662f73e17", "value": "T1080633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386047, "uuid": "00ebc3fd-dca3-4e01-af89-ce97328afc02", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386047, "uuid": "53f48ca4-ed29-4734-ae16-46dfb9f1e0e1", "value": "98304:aIT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:P2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386047, "uuid": "7fe64e44-e29c-4fe4-85d0-51b131efedcf", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386047, "uuid": "0109a2aa-b416-4667-b261-bdb778201bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386047, "uuid": "c769d155-04b3-429a-9b64-f46c63fda03f", "value": "f710626649a218a5873e16ae2b7e91b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b30a28-e7e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767361243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361243, "uuid": "e10452e7-c6a2-4211-90bc-195c8da152aa", "comment": "Malware payload (Mirai)", "value": "4e60f5828009f955b3be25343f97b192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361243, "uuid": "5c04d022-53f7-4908-a20a-1ebd1dd3b1f7", "comment": "Malware payload (Mirai)", "value": "00dd73cff72a12175d42036f0f348e720b1e0e9660170fa1dcd502dfe5b42b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361243, "uuid": "b9fa0f4f-f345-4814-88e1-cb4b52e1efbd", "comment": "Malware payload (Mirai)", "value": "788eef07f3522c41a452508ee778a153ce170444", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361243, "uuid": "6a1f5158-71d3-494e-81cd-3fe607ca28e4", "comment": "Malware payload (Mirai)", "value": "7acfdb5398142e12d0c3943ee4aab7e573bbfd370b9d6bb41c44372eec88188ac27a3e952d0864b3d13c266bca7b1add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361243, "uuid": "dbe23668-f5a2-4f1e-9a51-0c40f4481c7b", "value": "T15773016625082F78CB17C67E1AF443906C319FF2D46859A5E120F44754AECBCBDEB4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361243, "uuid": "e479697b-849d-475f-b619-401164020246", "value": "1536:w7ktf6nCYDSjoCFpDcwdRdBasxwMuH3WgwQKbXSQZ2FkyRGn0+mSNgRUVuVJuX:UkJwNCFZ39BaQyWJQ2Z2FkKGn0+VWWuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767361243, "uuid": "e8a10af2-e503-4888-a6f7-4e182601f606", "value": 77272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767361243, "uuid": "148acc23-146c-4670-8ca0-db8f5dddcd94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361243, "uuid": "fa22bc71-c889-4717-a45d-aee353b95de6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdabc7ad-e7b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767340780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340780, "uuid": "e70b1f9d-7070-4029-8d35-029e04f16546", "comment": "Malware payload (Mirai)", "value": "d68e28a3c80bf2cbde9860fca31619f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340780, "uuid": "d8ff848a-f6c8-49c8-b7a8-afdd93f4979d", "comment": "Malware payload (Mirai)", "value": "019ae00e3b366fde413e43ed647aed206898e22490fcf18e1ae1860ce8e0aa7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340780, "uuid": "e97db548-61c0-43a2-a685-00c5f7e37c96", "comment": "Malware payload (Mirai)", "value": "a501b87120d944966cc5e9ae77a6ad47380bc51e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340780, "uuid": "e6f67060-7fe2-4cb6-8ad5-b69ee7a7414c", "comment": "Malware payload (Mirai)", "value": "65c426e64abaa6dd88dd68d7b7dbcb65e95fd285f728ed727fd6c5d873a9633c18fa3d5ed05cfa55c795d55cce0f378e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340780, "uuid": "bf5e0539-f3a7-414d-8562-697a013b4274", "value": "T1A4A35B92BD81DA13CAC561B7FB1E428C772703B8D2EB3303DE259F21668A51B0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340780, "uuid": "4b0e83f6-8ddd-447e-82a8-68e8804cbc9f", "value": "3072:8wnNRE+sQ3WxrWKXb6HFc5lpDobJrRhYa:3nNqP6swi5nDo1Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340780, "uuid": "4534b564-85c9-40ee-af85-c4763241421f", "value": 103716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340780, "uuid": "c34252fc-5f4c-4b00-8054-790f7e1d2e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340780, "uuid": "9d3e2bcb-5653-4e88-a309-10f8e4186468", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c18400a-e7a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337019, "uuid": "8931ce8b-c58e-4859-b351-f082c2b34707", "comment": "Malware payload (Mirai)", "value": "8dbb398be67f73d445bb2ebcb3347a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337019, "uuid": "e5b2582a-0a7d-47cf-bae5-3833581e84f5", "comment": "Malware payload (Mirai)", "value": "01a27251f2c7d8d5abdd3a90683da7aee5780998eaa799ec663b62347c5379b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337019, "uuid": "bca48f54-6de3-4736-b9f5-25a8ac26a785", "comment": "Malware payload (Mirai)", "value": "3089450d8125aaec9db09072593cf0a178e2aa3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337019, "uuid": "2a5348db-efd7-4500-84c3-09f825d0223b", "comment": "Malware payload (Mirai)", "value": "ca566c72e9cadc4d06107505818e49a97c7d2fea17c941a13fa8d059d2b6e366daff719f5d7f93e53b3f7f5b251b78dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337019, "uuid": "2694644b-a5aa-4a42-b465-37679132d545", "value": "T1DA837B12557C2B16D1E0B576127743A7B2E52A8D0484EB9FBD760E4FFF322C0292B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337019, "uuid": "de7629ae-6a8d-4c84-89b6-27886699303c", "value": "1536:EGV99iV+HChaLYx+8SBb5L/zo8T5dtPJ97uaBO6aS7nP8ydlr3kg+z71YEgt37:EGxHK3+8W5377w6N3kg+z7GNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337019, "uuid": "e1ef292c-7283-46a1-b0d5-c2fa753f1db8", "value": 84748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337019, "uuid": "a2df78ed-15a9-4428-9b20-d6847f712827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337019, "uuid": "45c745bc-22a6-4df9-ac7c-f8e378716097", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2837e916-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385949, "uuid": "a168b32a-3876-4204-8b37-e8acc9813f17", "comment": "Malware payload (Adware.Neoreklami)", "value": "d2be5323b8832a62bdc3346ea2c64e37", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385949, "uuid": "27f53dae-0977-42a7-a8a0-e50080f6fc61", "comment": "Malware payload (Adware.Neoreklami)", "value": "01c9316450115ad0162660b662e1cdf9b11f03c8c18112e8b7abe2394bd34b9e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385949, "uuid": "5ee506ef-f1a3-46b6-9ec3-0abf6a1c0144", "comment": "Malware payload (Adware.Neoreklami)", "value": "cf1b8eda3737d815509f045182893b48171d2df0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385949, "uuid": "9aa2a4d5-aca0-4125-8bc4-4b52ca1a1d3a", "comment": "Malware payload (Adware.Neoreklami)", "value": "286576bcf238ba4f552038c91bae1d068420fff0424d717928b04de6c73552e2c2241bbf1bbeb2154fd638727b884d7c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385949, "uuid": "3902981d-39d0-4684-aea0-06901f48ca50", "value": "T14A7633203AF9D6B8FA1F023394E41F9909FBC3849A74569337E95B2D2F3DD949067422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385949, "uuid": "8c02f447-3cde-4b7e-9351-bdda78a9a791", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385949, "uuid": "20e08cb6-f1dd-4ac8-b193-30725d4e8333", "value": "196608:P1Om3de4fpHKhj4vC3VuTu/RvFgGdm96erxsMqSdokORMuKc:tOQnKZ4vquTu/RvldmgeXq+ok6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385949, "uuid": "570c6f36-e78a-49b9-a480-8a0b15bd7ba5", "value": 7621108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385949, "uuid": "dfffb99b-6ff0-43b2-9ee0-a727bfe33757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385949, "uuid": "949f17e8-1e4b-4fbe-ab22-26ad4b179a74", "value": "d2be5323b8832a62bdc3346ea2c64e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578779b8-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386028, "uuid": "61c87422-a2d2-4303-8551-69e6592b1593", "comment": "Malware payload (GCleaner)", "value": "f0122096683b3833ad501abc5b39c2cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386028, "uuid": "08b75506-851f-4834-90c5-840463a5e5c3", "comment": "Malware payload (GCleaner)", "value": "01e958d424793f15f8294cfa62aaee648fd6bc1041cd6eef48a0701bb67b1394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386028, "uuid": "6708e80a-8300-4ce2-bf40-20cdeb535b5a", "comment": "Malware payload (GCleaner)", "value": "b0297e81dc132cc4a62cf1cc66fe2c523a418c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386028, "uuid": "54ede260-c03f-4a10-a389-2cbfcf976a27", "comment": "Malware payload (GCleaner)", "value": "bc0b7d1b43d18e62b86312e63cb63723a7df515810b60192b86a2bdb037fa20b08c4535a3fb813a315334a24179f3ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386028, "uuid": "c0d82800-b11b-4d6a-a3a0-10ac6dd77080", "value": "T1AB06E01DA171792FE09316369C0611B0AF24F8807F1F1B81F3F7DB8DCE99A6A2964359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386028, "uuid": "660861fb-f8ee-4c68-b9e9-73fe43f745bb", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386028, "uuid": "cab4a23d-fbc5-4887-84e3-f8b3e2d47ce2", "value": "98304:HS/NFNANW/Wjs2HoHQQaHvET29JTe7YFW3nU2Z4qAx0wE647lxg8OJ/:yV8NWOrHMaHvEATPonUo4qAx0D647Y8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386028, "uuid": "d8904f89-729b-4914-b504-537543d23d02", "value": 3918096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386028, "uuid": "971e21fe-dee1-4400-b9dd-0b7ab50e2468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386028, "uuid": "4d437f2b-515c-4f01-adbd-2e3aa5cac319", "value": "f0122096683b3833ad501abc5b39c2cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4054ca-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386009, "uuid": "7af77abd-804d-4107-9945-d86f20ddb59a", "comment": "Malware payload", "value": "ebfc74b8a14fafca1522574ebe2c42f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386009, "uuid": "aaffd9cd-1a59-4021-b233-603c0a95086e", "comment": "Malware payload", "value": "020da42a82027810b83cf16b3ca25413c7b62936592c3062aa53b96aa9a413b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386009, "uuid": "85f5d320-dcbe-4dba-be18-6b49d1056857", "comment": "Malware payload", "value": "fa38b4fdc8d7b1e31ff404da7925531365b43725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386009, "uuid": "cb5caf25-2878-4a73-ae84-2b90d833b883", "comment": "Malware payload", "value": "1948204a78a8b2f87fb2e7ef255b552018fcb5f6dbdd715dadd4b9a09788f63b5b49a717b635cae0a3b2738b4c711377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386009, "uuid": "74b4b4b0-aed1-4e04-ba44-a11c3df18906", "value": "T1810633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386009, "uuid": "b79d598e-4354-4e22-88e4-9e59ac63f728", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386009, "uuid": "abc043fc-d806-44aa-9afa-7c2fd95538f2", "value": "98304:afT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:s2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386009, "uuid": "66f4e341-4a6f-4b09-8656-a3999089257c", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386009, "uuid": "4eaf39ff-06f2-4956-a924-09641ce07965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386009, "uuid": "9a29716b-9b4e-49d8-8838-3da707e631c5", "value": "ebfc74b8a14fafca1522574ebe2c42f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd07abde-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385393, "uuid": "adff8b2f-8ff7-4ea9-9ef3-3bd7b7d3e268", "comment": "Malware payload (GCleaner)", "value": "1e470ebdc85d86e4f4bedba56e0007f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385393, "uuid": "47545605-d468-4432-ba67-81c45304666a", "comment": "Malware payload (GCleaner)", "value": "0294d0f11da4d1836b56e31bbdcd81398d53092f27d097796f076d2daeeaba79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385393, "uuid": "b179dae0-7196-4818-89b5-274cdcfbde6a", "comment": "Malware payload (GCleaner)", "value": "e7e3e68ea11153b9c45b2a0f5465f2dad6fa8227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385393, "uuid": "c052d861-a06e-4584-b94b-f51ebee8b0a8", "comment": "Malware payload (GCleaner)", "value": "96dae6b6872feb3c662eae43913f585d0aec06f4ed9239dbe7b60a9749064d1c29618efd6e7db7aca31f4382832cfdc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385393, "uuid": "9e18b4cd-aa40-441f-86bc-a77e1fa0bab0", "value": "T18516DF3ADF46DEEACB3237FD4C2FB71885F26F40C764931566B42A4A5EAE3409025187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385393, "uuid": "b0d3a84a-083e-4106-8fc6-1b569740800f", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385393, "uuid": "016994fa-3ade-4dc5-9e2b-ddbe7bc071da", "value": "98304:kyamz7Zy3VRDcUun5rUzoAEbyqUxdUJaMrC:kIz7+oPn5qoPyOaM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385393, "uuid": "c50650e8-01f6-4b5e-a0a9-8d54b36357ff", "value": 4391184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385393, "uuid": "413d0c1f-3ea8-49a2-8292-86e58f3bf407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385393, "uuid": "2316dbfd-9ba1-4c75-a232-82a221485eb7", "value": "1e470ebdc85d86e4f4bedba56e0007f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ea4cdb-e80a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379370, "uuid": "62b5009a-51b6-4801-b837-3fac8de699f5", "comment": "Malware payload (Mirai)", "value": "edc880eab42de1cf4310bf2975cd3c03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379370, "uuid": "0698b294-a3d9-4582-9093-ae54078d82ad", "comment": "Malware payload (Mirai)", "value": "0382cf67b086099821169e66df26436f7924afd6f88cc5d2c01f77a89cb44f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379370, "uuid": "8c694553-996a-44fc-afd7-99c1c3b38401", "comment": "Malware payload (Mirai)", "value": "7425994a893900bddd99298d258f9bac5c7be7a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379370, "uuid": "369239b6-4798-4856-8e8b-f822341d5c88", "comment": "Malware payload (Mirai)", "value": "fbd474134ff5cdb3e41cbe0fbff281d4997138d304750330f7a5106bd218eb6047d07f8e966a4e6c9e09ade9e374797c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379370, "uuid": "ff09675d-84e9-4e39-9543-5032a04628d1", "value": "T15E34E80ABFA10FF7E86FCD3752EA0B45218CA40622693FB63574E918F54E24B59D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379370, "uuid": "d2477c9a-55ad-4ce3-821a-f730ffd101e7", "value": "3072:RF55hzV5+X+Shf84T7xFxRYI5UtcbJTZ9tjX2xI+m:P5zVMX+Shf84T7xFxkcbJTZTiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379370, "uuid": "425e07e6-7463-4165-89bc-e70bb74c7838", "value": 240768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379370, "uuid": "9b7a4d23-7a12-4b5d-adee-9099746b1e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379370, "uuid": "ea46a26b-1dc9-4349-a690-c979d8e4c29f", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acf86f0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385711, "uuid": "8aaf8e0d-93b1-4cf4-aaf8-c21d732762c1", "comment": "Malware payload (Adware.Neoreklami)", "value": "8a13ba0a0a0a9b61ddec7d12b3db7255", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385711, "uuid": "313a5105-1ea1-4225-9bb0-e55d6658192d", "comment": "Malware payload (Adware.Neoreklami)", "value": "044bd85cb4736e0db1491b5af902e9c74f9e0f34d9299edc0e4f0d7be7a2937b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385711, "uuid": "a3a3d16f-473a-4eec-be41-38d1b6668da7", "comment": "Malware payload (Adware.Neoreklami)", "value": "c8a475265275d3428eeda35fdf4c923b9810d968", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385711, "uuid": "d9928ecc-995a-405a-ac0f-dd09e6365eed", "comment": "Malware payload (Adware.Neoreklami)", "value": "99d09b9a20a367f267a5c9458dc81296e9ded8394c8e6947f7d3d295c4673bccf808df25a1418b562e986ca0f46d9289", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385711, "uuid": "92dc7ed7-9bec-49c0-9d36-02621498c9dc", "value": "T1F476330174F092B5EDCD21B043787FE254DCA66B0F234E3363889391A57F609A65BBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385711, "uuid": "d296c1c1-fcda-4ea7-a121-53185972e2a0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385711, "uuid": "36e1582a-47e6-4db3-b6b7-508a56ab5864", "value": "196608:P1OqLQyKPajFTS3DLByvnn6e3RxrHt91Bpy4iW/Alha5QU75Mt8WVQs:tOoQyKUFTSzqnBRxLCxhyn2tHVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385711, "uuid": "19cd25c4-3ab6-4d2d-a2e7-be66c12eefde", "value": 7575593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385711, "uuid": "e61d1886-09c7-4901-883b-e3a831f90b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385711, "uuid": "c116ec26-71bb-4281-8767-8f378f30209e", "value": "8a13ba0a0a0a9b61ddec7d12b3db7255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee015c9-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385503, "uuid": "0064710a-0390-4e87-916f-11f76f58e2aa", "comment": "Malware payload", "value": "49c72a90b9f469429d7919fed0bd2077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385503, "uuid": "c64c9d77-262c-403a-a3b2-6f74ddf71030", "comment": "Malware payload", "value": "0485cb0d63b66f1c3ab59f66ad5859b30a19a330f532b630b0981e56d61dae03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385503, "uuid": "328d04d1-cacc-4d80-8c98-a9b3aca41e0e", "comment": "Malware payload", "value": "1513aeaa1571713a92ad47af919514409cae9a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385503, "uuid": "5685d656-b4b1-49e0-b1a4-f362f9fbe566", "comment": "Malware payload", "value": "79dcd7d260e5991c772c7f2bd990c2f4b66014c16bb57a6b8d53b5a2e8ce39f943dde9bee0e0ee67b08882ab202f3048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385503, "uuid": "60c8ec89-f7a5-4f19-9cca-e4406cc2cf6c", "value": "T1100633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385503, "uuid": "ebb8ed5a-621a-4527-853d-75f968a87057", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385503, "uuid": "847e8b34-de78-4a2b-bf58-7858a37af516", "value": "98304:anT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:s2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385503, "uuid": "1d730700-0c73-4b16-a20f-767a14c7b6ce", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385503, "uuid": "b2af7793-b0f6-4bd3-9b10-80b790d1eee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385503, "uuid": "c9b1a6f1-2137-4be4-9032-f309e47f3d50", "value": "49c72a90b9f469429d7919fed0bd2077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9560292d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385702, "uuid": "6b2cbbc2-cb62-4ef1-99af-80d7bc529522", "comment": "Malware payload", "value": "87cd2d9cb046a93615d3da0546a68ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385702, "uuid": "9e536f26-113e-4ad1-abf0-fb79f41b5764", "comment": "Malware payload", "value": "050e09bcdbc645198de246e91905ffc571c019a54e6d72a90e6aa11dc8b5429c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385702, "uuid": "89d63ffb-3ac9-46ec-8c88-b04b76dca654", "comment": "Malware payload", "value": "840373ea727045236b8b21dd6c0c573085afa3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385702, "uuid": "92e9f627-4ef7-4902-be67-e30201cdc2f2", "comment": "Malware payload", "value": "5f38cfa25bc767a15485b223662d9827bff38cc9699c8d034b2e4d3051e0b78c17e1a4128ef65930af1c7370b54ac6d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385702, "uuid": "bb7fd7ca-b71f-4804-820c-85f782b3aa6c", "value": "T19B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385702, "uuid": "e509e582-56f7-4022-87c2-6c110804ee78", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385702, "uuid": "cfee02db-d36d-48d7-a8c6-602571f6ba44", "value": "98304:aMT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:n2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385702, "uuid": "4dbd76d8-e31e-4656-a93f-7ca9ab74ee6d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385702, "uuid": "fa304b0b-de40-47d2-8e9b-2d3d4beab74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385702, "uuid": "dbaa301e-11ba-42e6-92a4-d1a0f6232f8d", "value": "87cd2d9cb046a93615d3da0546a68ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcfda34-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334308, "uuid": "a97f216c-b51d-4839-8d5b-034626ef5a64", "comment": "Malware payload (Mirai)", "value": "dba1cbbabcde6ca78f53cceaf93cbd2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334308, "uuid": "b411afe2-9ec4-48b8-8db8-6e54b307f4fd", "comment": "Malware payload (Mirai)", "value": "05611f97deb4b36500d3d3f1e3f4879998a99e76d4969a7cc43797be45e4afe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334308, "uuid": "4aa210f4-f79c-40de-b79f-4f749ec5fea5", "comment": "Malware payload (Mirai)", "value": "df9f72bfbdf0db2dcf5df649934dc288fc3e7af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334308, "uuid": "a1516dca-a690-4186-b5cb-c289440b7323", "comment": "Malware payload (Mirai)", "value": "c0b7836f14cbd959465dcf8ddf620fc56890b71b57089ad7050281c3d51ec544d9a20e12846b08453f16e99b56fcff9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334308, "uuid": "04bc464e-6d09-4c6e-9dde-6a90036fe408", "value": "T1CE534D01731C0A47D1A76EB03A3F17D1E3FEA9D022E4A989351EAA89D1F5D3251C6ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334308, "uuid": "cf70520d-b078-4368-a7eb-173864cba187", "value": "1536:brRYCnui7l7ysVMfrF6MQWf1VuHefGqaxj0UIKTPuF0b0:huwYrFlXcQUIsPXb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334308, "uuid": "4148bc0e-c29a-4702-b20b-8912e324afc4", "value": 64472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334308, "uuid": "a87cd242-cca4-46d4-a830-0e249c72bc3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334308, "uuid": "af87eb98-7195-4916-ad42-d91f18db7abc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d21bd3-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385330, "uuid": "edf80ca9-9415-44c0-92e8-57e2efc2ca3e", "comment": "Malware payload (GCleaner)", "value": "0202fea6beb1475ed1e371620457ca5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385330, "uuid": "083d40b6-6924-4baa-8d23-f74f1f77d246", "comment": "Malware payload (GCleaner)", "value": "056ffeab3c9b39301b25904b42a46bd56c663574393ed4d4b76c4ac04abb7f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385330, "uuid": "cb0065dd-5e59-44e9-9fcf-11ea869bcf93", "comment": "Malware payload (GCleaner)", "value": "5362754c82f14739989f2e239702b9c8d2361956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385330, "uuid": "0f93a0eb-6eee-48e1-8654-7444e6b7831b", "comment": "Malware payload (GCleaner)", "value": "109d280216c782198e961de99279f18a0699cf627dbbcdbaaeb5ba322084ea0ca27d7067911f75e66480cc74fff1cb78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385330, "uuid": "4017c8d3-3b37-473f-b20b-af575849e753", "value": "T10346DF39FCD21DF2D5629B355BA7D2B62827BD97D43EE6563EB884C80EC104026BC193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385330, "uuid": "2e3b2c78-6ef6-46fe-9b8f-86628d36730d", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385330, "uuid": "bb7deae2-80f2-4d0e-8d2b-b94b998da1a8", "value": "49152:/XAc2SFkDIisPryFvMdSYL8NWglmSUnztDWfsg9o+sx9trjYl1I/N2Wt:/XAcFkktryFvMfFgle8fsgeHnjYHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385330, "uuid": "98072b61-dd14-487d-9eb4-3092e3385597", "value": 5691152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385330, "uuid": "94bde7b8-7bcb-487c-874b-26ce111d9dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385330, "uuid": "015d3a92-76aa-48b3-8b43-a8e25b1021da", "value": "0202fea6beb1475ed1e371620457ca5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95cc3fe-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385360, "uuid": "26422315-0920-439d-b664-cb868d07edef", "comment": "Malware payload", "value": "0eee8a56bcd047104d83fc95df66b9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385360, "uuid": "10b84e3a-22f4-4271-9cd5-13344e3e8bce", "comment": "Malware payload", "value": "057594def26710c95fee9f857a1fff0a7650ebaf631981b583a9c64be3761475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385360, "uuid": "38272eaa-373e-4efe-9171-1e9e0feb6301", "comment": "Malware payload", "value": "a0b2bcb5ec926d0e99dd2b1c1ce9fc28d162395d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385360, "uuid": "ae8e1d80-d30b-4d29-beb0-bebc6e619827", "comment": "Malware payload", "value": "3433c82b120e93665ff7abbbadeb54fab364c14a6ea75391dd4d86139ed46caacf78b5fe6f2c5bd899cfb79f621cb56a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385360, "uuid": "83ba9ce2-4130-4e52-b748-a76973df41e2", "value": "T1F00633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385360, "uuid": "3fbd1763-6dc5-4ed6-8e2a-1d1872766edd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385360, "uuid": "432b51dc-125b-4976-be91-c67eadae7f86", "value": "98304:aVT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:+2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385360, "uuid": "e84ff280-4aa2-4e63-8ab8-e08ea647be34", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385360, "uuid": "3993be67-018d-4ec8-9fe9-e1ae7f3a337d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385360, "uuid": "6c3d013e-a1be-48f3-99a3-6e26856363bf", "value": "0eee8a56bcd047104d83fc95df66b9bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a0eeb3-e78d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767325414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325414, "uuid": "f8cb0f5f-cddc-413f-826c-8be762f81d87", "comment": "Malware payload", "value": "864461e88e2e215818df285750091c91", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325414, "uuid": "2de0936b-b483-458e-9af8-c4859dd5dcd7", "comment": "Malware payload", "value": "059b1bb3fddcc859274b02f061ee234211ad0735c857469b38d12b684ad0e03a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325414, "uuid": "674d11e4-add4-4c9e-a17b-1adebfbd4c70", "comment": "Malware payload", "value": "83e5ae0ad4ccbcd8f0289d8abf52bf4841ef82eb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325414, "uuid": "91f451a9-b3ab-4845-ac8d-03402ff4bdc0", "comment": "Malware payload", "value": "971a30141bc6d2f82bbe85e23f8c2fca68f8ec44860565253fb300833aa5bc9f20f376094be3636816b175343dcb9366", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325414, "uuid": "925b07d3-4166-453e-99bd-f963ab7f6e98", "value": "T11956E00BACA51CFAC0A9927188775149BB60BC451F3267D73EA0B3782F72BE09D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325414, "uuid": "ddba8204-eb4a-4a6d-ad7d-1b17e77c199e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325414, "uuid": "1b4a3aae-6bf6-4845-a5f5-610c218e1c45", "value": "49152:jKTAbZYcgdRz99JfcVFW5FG+JNR1SRMEm+uEmEjeOefrlXfewxAjHUMDhcW8L81N:jKU+rR1Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767325414, "uuid": "adaae87e-ed4c-4984-92db-21050e806d94", "value": 6279336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767325414, "uuid": "e88a58c9-f1bc-417d-a009-57d914dbf758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325414, "uuid": "1a507e7c-b9ca-4b77-84a8-ce246d17d0cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d961b92-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393366, "uuid": "02c83581-7223-444e-bfac-b02a52259e9c", "comment": "Malware payload (Mirai)", "value": "f83492cdfe3684912dd515a6ea13cadf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393366, "uuid": "f2e068ea-62f7-4aea-81e0-e317a8a8dd4a", "comment": "Malware payload (Mirai)", "value": "060347a137f6bafe79c63cf59f1926c52c07b7faab9a06ad1253f1aaf3e8106c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393366, "uuid": "f334a226-fd80-476f-b154-707f8a6c3ea2", "comment": "Malware payload (Mirai)", "value": "e5a6c8e9de26d07379d424735dee9d0f6bcb2130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393366, "uuid": "cf04f8c2-da78-405d-98d9-3c6bbd115fed", "comment": "Malware payload (Mirai)", "value": "ee4275fcead1df1a0c7368b990807cbfc9025c1254b6396cd84bb9bee5edc144892c4573816c5ec0d3eab5c264f23703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393366, "uuid": "73d435e9-6d65-479d-947e-baae676cca25", "value": "T1F18302D6CCAFF253D2989E79C820AF3C76833D640FBF00CDA4690759669082DCA55C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393366, "uuid": "b2aba7de-dd9d-43e1-a992-88209c714956", "value": "1536:sBVe0VDY6WGEt5p0oaiY5XkVH03tbo8NjoCXt4DBH7zfGNOG2ROEExKN+87ssl7z:6Ve0WnttD0oaiY5XkV6tbo8toSt4DR7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393366, "uuid": "6cc1eb31-862f-4575-b2f1-f1fb0dec2827", "value": 88104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393366, "uuid": "9d41866f-119d-4bf7-b2b4-923cdb666aff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393366, "uuid": "1260b4fc-89ec-4669-8283-030c2ed3a455", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e86b0-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381389, "uuid": "f8a8865d-f729-419a-9778-e5a493f62062", "comment": "Malware payload", "value": "0690b5e712782756d2ea7aa997321757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381389, "uuid": "879d4c6b-4935-4f53-a435-84357a68f72a", "comment": "Malware payload", "value": "0626a2c5dd3201a4870f7c760675ce57536bf4abf5e708b578cc10c01547d424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381389, "uuid": "3251e72c-643c-4f6d-af81-de018b02a795", "comment": "Malware payload", "value": "15504521415e4e8d8c577b53b8dd7d18863cbe6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381389, "uuid": "ec7fdde8-5348-4f9e-beaa-b7b8b072f137", "comment": "Malware payload", "value": "ddc849da09314b49e40ce17062e754c3edf90d79696020fd019728c5e8577535ad6d971bf9df32de2355a7938f57caf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381389, "uuid": "245aaa3e-2ee3-43f4-a9d1-fc052801e9cc", "value": "T10BD4CF52F172DEC7C0134BF81029E330471AE9F11372A590F27AD3A91D839A5FE997A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381389, "uuid": "b4095d0d-0e67-4e2e-8b96-ae47b88ef50a", "value": "12288:bR1B+x6pFjXtfcN9x4yaexSW+M6ku1kBaRxs9X8pPKHw:dPXtEN96USWHDKKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381389, "uuid": "27463e7f-d3f3-404d-a4f8-3b63d5ba36d4", "value": 608068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381389, "uuid": "1cf7d310-64ad-42f9-b98a-17943cd1aa48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381389, "uuid": "01ec4673-737c-4f1a-bfcc-417962c148d5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62836b8-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385784, "uuid": "0ba932c8-c44b-4f04-af0c-8af5dd712f86", "comment": "Malware payload (GCleaner)", "value": "9e0eda6a59941d78b120473d7aa213b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385784, "uuid": "96fa72a5-849d-426a-9a38-792229d77b5d", "comment": "Malware payload (GCleaner)", "value": "0639f1ed615d4ace8f3cdf75c0c51f527b1c413cfaee1f99f153d2dbea200ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385784, "uuid": "20784eb5-bfba-4748-a175-11ff095baff8", "comment": "Malware payload (GCleaner)", "value": "cd0af6997d3a20c658f8674165b01dbf2f62a51d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385784, "uuid": "cbd65e38-36c4-4cc6-8984-164acee313e3", "comment": "Malware payload (GCleaner)", "value": "9091ad050c57c11627a4ad899ab3e81135557141cfe99f6fcd68c2e822c9e460b445d9e1cc9196c2dffc9ee3fa595dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385784, "uuid": "35384893-61e6-4b14-8d46-e6d7a9a0dc5b", "value": "T1D346E0ECEC57C0E2F2E25638D5CA2D745E35ACF1E3B51266A6480C4FEE15A429F44E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385784, "uuid": "16a30780-5599-46b0-946d-2f07c07ac7d1", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385784, "uuid": "9c778753-6efb-4054-bbde-c1d3cda96ec5", "value": "98304:Wnt0TGaFw1jDGDROxy1MPoGT5upjrrWRpBn7j:W6UdDGDrMAGVR7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385784, "uuid": "77446dc7-7f90-44f9-9976-c3c66fc78d5e", "value": 5873424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385784, "uuid": "02ca9f3b-4f91-4e7c-a731-49af220bde3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385784, "uuid": "1118ba5f-92f8-460d-bf7d-89935b8d54d4", "value": "9e0eda6a59941d78b120473d7aa213b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11841972-e808-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767378179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378179, "uuid": "e34ca3e5-d13b-4367-8db4-3a2aed16b862", "comment": "Malware payload", "value": "09bba0bea436a87862d887897f94de56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378179, "uuid": "d97b6f44-368f-4ffe-ad75-e745e3424254", "comment": "Malware payload", "value": "067d5974518744f8d050c0e6b3225eb265033d3ed9b459dc1c9586b5fa78e395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378179, "uuid": "882fb183-90a3-4cc3-90e3-be72c7f127be", "comment": "Malware payload", "value": "761ad7827d0a4ab794ddb22b88bf9d4d77cb56a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378179, "uuid": "24fea20d-76a1-45ad-891b-70f01e55f76b", "comment": "Malware payload", "value": "ce947880c6f53827b8612cefdee28c266026040005f6b9f0f6ab8007d5337b721b3c2657db7e4d8e6b217cdeb690a9cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378179, "uuid": "1a098544-1eda-4c82-b8ca-110fc173d20a", "value": "T18F086B4262EA04C4F9F7DA759AE66617C673BC162F30C5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378179, "uuid": "464b0989-13ec-440e-8c9d-c7d53844eb78", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378179, "uuid": "6caced79-363e-4640-9dff-43820fba364a", "value": "393216:BkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNO:B5NmdsJY62A0y8Xy5rs3wbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378179, "uuid": "276ab70a-00b9-41d6-978b-46338505e9ce", "value": 82125158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378179, "uuid": "dbe9f868-d84e-4dc3-9313-13787f735893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378179, "uuid": "d8aecd35-3c94-4d51-8b81-8a05caca27e3", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63db8c1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385757, "uuid": "d62317b8-f11f-47af-97b0-1552d33b0553", "comment": "Malware payload (Adware.Neoreklami)", "value": "966503bc7a323843d2611d99a8b9e370", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385757, "uuid": "1fca41f3-fa10-40ef-af12-272942f080bd", "comment": "Malware payload (Adware.Neoreklami)", "value": "06a35609e964e92c0f26dea80e820e425ae1e292b91e5e40d3bb313225b2cd55", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385757, "uuid": "890304b5-b9c7-468b-9c71-858dd897e284", "comment": "Malware payload (Adware.Neoreklami)", "value": "0f414e38ac5b6d60e617175604aeb9d19be37d84", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385757, "uuid": "e72a91d3-1645-4191-a4ea-f52986042a6b", "comment": "Malware payload (Adware.Neoreklami)", "value": "6c9ca37a0015d39de6927487c6c3d9dd546c3988f39a7659564c0191c9e892202e818f5d542822331421cff5954e4daf", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385757, "uuid": "4a1c99d7-a6ea-483f-ba04-5744dbc753d4", "value": "T10176332274E2A0FBE5E79973CE0E6FD460E3E266483056B747E248793735A96000D79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385757, "uuid": "dc7b3956-3bc6-4505-9fee-f9a9380f98d3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385757, "uuid": "204d8a63-532e-4e12-a6a8-d06fcdb71baa", "value": "196608:P1O6D8izeA41MkKxOqIVKeX+y4hoAltLGUbXVG3EhWuMphC5OS:tO6oCebRKx6seXH4LljXVG3aEQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385757, "uuid": "55b8b0c3-f136-49c3-a517-3013457ce8b5", "value": 7533141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385757, "uuid": "45b2b2b8-13bc-4c65-932e-18891b03536e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385757, "uuid": "61e6b7e5-1dcb-4030-a677-146055433e9a", "value": "966503bc7a323843d2611d99a8b9e370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d030d5-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316878, "uuid": "85c08119-6c8d-4afd-8526-90310945f6f6", "comment": "Malware payload (Mirai)", "value": "d3d1eb5f75df783c501ac1420f2fd558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316878, "uuid": "7f554df5-c01a-45a1-9f94-246d98c5c3f4", "comment": "Malware payload (Mirai)", "value": "072bb6da961381acb696165b4dd74f2ec7dec25e0d5777c2b9bed158cfe34548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316878, "uuid": "4ae6009a-de0b-4c51-b4a4-5aeb6664bd55", "comment": "Malware payload (Mirai)", "value": "83480beedce699102c867bb2e82fc15310c674f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316878, "uuid": "47c6b080-d740-47e9-b64c-40bfac3e9c9b", "comment": "Malware payload (Mirai)", "value": "bb1ac01c4edce954ce30328ffd9486c830321677609022c8bd447e119fb5bca2320ce94551a96fe3d5a22f749c26027f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316878, "uuid": "0006ae9a-5af7-4c4e-8fc3-ad040b9e1807", "value": "T11344B60E6E228F7DFBA8877447F79A20975833D626E1D585D1ACD2001E6029E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316878, "uuid": "e24c3503-e9c6-4e94-af25-cf59e618b2f4", "value": "6144:4xee67PxbfSpaeIlDPNYq8eV3fY/B9RKqF15I52pFa:erS3Lw/BueZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316878, "uuid": "3020800b-aad8-4aed-a040-692d215021df", "value": 255072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316878, "uuid": "0fa4a61c-4f3c-4cc6-9faf-5d57ebdf29ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316878, "uuid": "be8354c1-032e-4e17-a5ff-082e73d87e38", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861467e8-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767381382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381382, "uuid": "4b5c3d36-19ff-4c1c-a771-62511b71d483", "comment": "Malware payload (Gafgyt)", "value": "68fbaf4c01f41b9120c96c54e2a66068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381382, "uuid": "8d530abf-2432-4cb7-bc34-cf738fe306a3", "comment": "Malware payload (Gafgyt)", "value": "07525473bd43ddcc9f7acc55b0728b60c1f24068025d5a02b9af179bdd5f191d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381382, "uuid": "8b025767-9bb4-402e-8a17-f9c7b6f55c94", "comment": "Malware payload (Gafgyt)", "value": "ad56ebdc9c846a08e8e0ea659687fb812d87840f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381382, "uuid": "dcd9781a-80db-47fd-ab1e-f563acd3535e", "comment": "Malware payload (Gafgyt)", "value": "6d8d6f93fe0fcbb9cfd0b5f9ff00b63908ad1bee7dc38aae85ca2af7da915753eb2e1e2bbdd66a62b4705ff5f5c798e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381382, "uuid": "748ed2ca-4512-4834-a87c-c80b559c2fa7", "value": "T14D156BD1EAD3C0F2E56340F0105E9FEA0E34A1266057DAF7E6802966B871FD26B4736D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381382, "uuid": "6b2a0662-81a2-4944-996f-f5458aa1ecae", "value": "24576:DfY8v7KQhKnhRApWU3yGFKp9Dw0ELIUPT:M8jKQhKnh6300", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381382, "uuid": "fc6b8bd6-3e3d-404c-835e-81c8097d663e", "value": 915520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381382, "uuid": "8f94351b-c1ae-4f71-afd4-a70f02c90f00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381382, "uuid": "03529962-c814-4dd0-bbd8-6544198ffae5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfbc92-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385436, "uuid": "d588d41f-7657-4eb0-a48d-518d739f9595", "comment": "Malware payload (Adware.Neoreklami)", "value": "28bdb29fe3038570a4b35146cbb6593c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385436, "uuid": "b7a280ef-9aba-4b00-a983-2ac05b17b62c", "comment": "Malware payload (Adware.Neoreklami)", "value": "07794b6e558eefc7785721814a7403a931f71164f3555128a4805c9422b072c4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385436, "uuid": "74b34197-5255-49db-b189-b31e4fa5fc82", "comment": "Malware payload (Adware.Neoreklami)", "value": "c8a3586316681822bc069bdafe188c3b8c5f50cb", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385436, "uuid": "11711ff3-20b7-414b-8ae4-746d8e555f4e", "comment": "Malware payload (Adware.Neoreklami)", "value": "8016531d4298d1d8f8ab25b8b32440206057c8e81eb365eaed8edcdbdd8129e2d44ac26249149bfa86895f41965f17bb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385436, "uuid": "4f61bc41-feb7-4086-909e-dcf00c97ac0d", "value": "T12A76332D69D6897CFB31213387197F53E2F6E92407878463A7C9872C3CB5CE18976298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385436, "uuid": "a6cedd3b-4bda-4c0d-acd6-dc68f9810536", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385436, "uuid": "feb0e27e-54d9-43b1-aaea-26e77bec7de9", "value": "196608:P1O8X1RE+f1JiXbgcLH3Y4qw1MGSiSTvf1RfiCMH5BwDMAf7sA:tO8Fu41JiXtM4qw19JSTvNBuDAzsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385436, "uuid": "6a959334-29e8-495d-a86b-0ecd9bbd1a80", "value": 7516023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385436, "uuid": "9f32c327-0b2e-45d6-a79a-e8eed1428ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385436, "uuid": "b141dfb8-8e58-41f1-9a7f-8d3b69a375fb", "value": "28bdb29fe3038570a4b35146cbb6593c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85442a4a-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381380, "uuid": "0bbc7df9-0124-4f47-a74c-0427f47768b1", "comment": "Malware payload", "value": "12218b06830fe2ca00a8c06ba1c91053", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381380, "uuid": "48215615-ca14-46c3-b095-a510f20968ea", "comment": "Malware payload", "value": "07b269d16c83c1bf117d9157e212c772f377ab60fd5e060e0b5685c88d961e9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381380, "uuid": "78c38321-0133-49be-977f-8f94fa3b7842", "comment": "Malware payload", "value": "464f25d5fdd5ab8a9db12fc3d5ed2f184da0e3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381380, "uuid": "34a53ec7-3ec9-4534-b2db-5b6f7446b9b9", "comment": "Malware payload", "value": "a7685a4ae3aafc47e61773d0bbed2e0bfd350aed645b7635f4576515ea2bebfb518799058789c164cafc8a99db60e581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381380, "uuid": "ddd72a6d-1f9d-46a2-a6b1-22782f382b39", "value": "T197A4E05BF24B2F42C4EBD535244AC2459B5DE96733E293097F43A8BB38392768F28345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381380, "uuid": "f5ed9b4c-cacc-45a9-8769-134879037990", "value": "6144:U/YEpectizHu0pLA61lw92mgA8kXYx1785zJXIYZQoGBuBuJDo8pfZaonAf/B:U/YoqHJLxmBon78TvQoGBI+08pfZaog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381380, "uuid": "ebbf10dc-1278-4aea-88a1-8ab06df7bed0", "value": 473620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381380, "uuid": "d5354b52-a6de-4fd9-bcd1-b248e3b15c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381380, "uuid": "dc869b03-ae03-40cc-9abf-869fe4c9c039", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ce01b9-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385622, "uuid": "4dd0a30e-9795-464c-8e08-4c0b3d01169d", "comment": "Malware payload (GCleaner)", "value": "70a0dac3de1a25cfcc8d34fa3a2ca48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385622, "uuid": "626ff342-236c-4f4f-9dec-7ef4b693b2c1", "comment": "Malware payload (GCleaner)", "value": "087b9a963b7d2fab89a502c57d7c98eb5003c8b5d1530fe76796d5dff9e5026a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385622, "uuid": "bbe4dd5b-a513-4602-a5c2-756f4efb18a0", "comment": "Malware payload (GCleaner)", "value": "714ce9af1ee2f9e5c1da93dfc696e21eefd570de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385622, "uuid": "97d01b23-4171-4af8-a8e9-dbc773120cfe", "comment": "Malware payload (GCleaner)", "value": "ed18506c2b735f053834cfb60aa7b0ba12f86c6292e4dea3666f82ec5748d1feae611545fc053e03e62b76860679e3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385622, "uuid": "13af4120-87b0-4d05-b7a0-bc056c58dc7f", "value": "T12C36D056E3A5405AE42C0F3D187A8D6BC4D16F24DD0BFE2ACDDCDE9A55282D308992F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385622, "uuid": "70335f7d-9ba6-424d-a098-8a840f34cffb", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385622, "uuid": "0bb38773-1cb4-4503-bab4-444b3e82e522", "value": "98304:synS9AIxSoIGfdStifrK78wlHeRXG9nwBBfrdamiUH:sTCIYOrlwheRXhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385622, "uuid": "6bd1a03b-75b3-4ab2-9fd1-b9f2a12382e8", "value": 4884240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385622, "uuid": "1bde57a3-496d-429c-8818-d12593c8d132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385622, "uuid": "e6ad9d3d-bc51-486d-8402-17807f35fc1f", "value": "70a0dac3de1a25cfcc8d34fa3a2ca48c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04bd163-e7eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1767366071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366071, "uuid": "2fe3a863-8742-442b-9621-e333edb05046", "comment": "Malware payload (Expiro)", "value": "90bd0c05af6034180a2f4d18b7457c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366071, "uuid": "14a56979-0286-4a7c-9ad3-d23f23e2e8cb", "comment": "Malware payload (Expiro)", "value": "08c1857617a7b30f81a97a21c7b3cca99b8ad82ac868e932f8d7900f69c3d03e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366071, "uuid": "fbe17587-9523-4c4b-98bf-4481dd69daff", "comment": "Malware payload (Expiro)", "value": "bc88dd5b204cc353546829cda2867561c74b99b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366071, "uuid": "35239e7c-f490-4029-b30e-4f33ff21c9ea", "comment": "Malware payload (Expiro)", "value": "da4f206207bc397cfcbbc2b519003342ce1a03a4aaab573719f5e0f723b80fec89fc8c79bba40c13ce9716c641df202f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366071, "uuid": "e2c7db05-006a-4d93-921a-42d4de3136e1", "value": "T1A395AD22E610F465E48B49B0EC3996F6192A2C75F504ED4FFB807F9A383498779B460F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366071, "uuid": "46d355a0-5db4-485f-8c14-ed0230f51290", "value": "5e861aa3cb3d86904af03e84cd0b5460", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366071, "uuid": "cff0d0c8-4e83-4aa6-ba99-ce2497e05fef", "value": "24576:mtNOqtdZN9Opl3eVg9N9JMlDlfjRiVuVsWt5MJMs:oO0ZN2l3agFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767366071, "uuid": "a3317767-40b7-47e2-a726-26f3090f726e", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767366071, "uuid": "039f8c9e-cb4d-434a-8190-a0a2886e2cbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366071, "uuid": "ef1395fc-82b3-4002-abde-810007149c3e", "value": "QT.....hunter709834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1cec3f-e809-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378628, "uuid": "305bf31c-f886-4ade-8eac-c8e02675ce4d", "comment": "Malware payload (Mirai)", "value": "6b69045114321cbaeb1e23694abad5b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378628, "uuid": "25059de5-3ee1-4679-8749-1cd10167eb92", "comment": "Malware payload (Mirai)", "value": "08ffdca6369ca69add0bda15f7269bcbd3e054b08a3fb86b2cede62dc602eee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378628, "uuid": "8809e0b1-d0d5-45e7-bf59-06d6adcf509e", "comment": "Malware payload (Mirai)", "value": "7063ba20726955782c19688c6250f55105e5e7aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378628, "uuid": "fefd926f-d70a-41c3-89e2-3f709c2e1cf1", "comment": "Malware payload (Mirai)", "value": "862d9e78d91df9ef4af8fdb828dd9d9c3324081d9dab8c50966ea0fcf0344a1391e3f5827601ff870ac696093a9a7c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378628, "uuid": "06e4bfcb-62c0-4f84-9e35-7666d13869ca", "value": "T1CB53F247D0AEEF0ED474C8749C5BB629960C98297079ACBC0E0C1056AA12FFCEA79756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378628, "uuid": "72614f46-27c5-4e2c-9705-10dd45950357", "value": "1536:YHqKoQfvk0F6jpWoxwoB0KTq4u07BdbZnXV0BkXYzLnouy8Hy8:Y7M04IiugT0BdzToutj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378628, "uuid": "f937065b-1912-4d95-89e5-b1b9ce071fd0", "value": 64928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378628, "uuid": "6f3d7827-8ffe-4588-b38c-ac84b397ed61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378628, "uuid": "87e23d8c-b775-4d65-b8b6-e2decc8f3223", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e580945-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385610, "uuid": "7519c9c6-6a3a-4704-bb14-2a7c84aee61f", "comment": "Malware payload (Adware.Neoreklami)", "value": "6eae97e7d2942bcf772c9d877cdbc401", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385610, "uuid": "52f6eb59-7745-4eb7-a3db-aeafec4fe84b", "comment": "Malware payload (Adware.Neoreklami)", "value": "0a4a8adbecc0fb454d20d4e47a8025128bd86e0b24f9268ff76d3a2ff89b3fce", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385610, "uuid": "6fcde24c-0152-4bbb-a5d7-27b5ca9a035a", "comment": "Malware payload (Adware.Neoreklami)", "value": "b76460be7a51d5b16d4d6601f2b3c9a75d73e696", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385610, "uuid": "35fa484a-1e57-4eaa-9edf-d6fb32ad9f36", "comment": "Malware payload (Adware.Neoreklami)", "value": "a8782edf8574b001e6e569a83ab2b67b4cfbce7ac0d5d978913617102289be2f8a2302b3fc248dd0e4ef59830d36c422", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385610, "uuid": "944e7bfe-b6d3-44a2-9feb-42006c97072a", "value": "T1657633253F91407BC5E062700EB9BF89B5FFA5A84C74867B5324DD1EDA39098CB2B790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385610, "uuid": "7e7d0f1b-cf91-4090-b637-b5fb595df52b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385610, "uuid": "f34308ee-ab95-4c6b-83dc-ecd2cded00c6", "value": "196608:P1OP8gTbxl2e0WzA4NKkEG/9BCwDNIXDvS0Wh1QPy7voMR:tOP8gbxAyvNwMWcIXG0WhuEAMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385610, "uuid": "e4501f25-f281-4a52-b88b-50278d208fa6", "value": 7524390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385610, "uuid": "b67d7b57-78e4-4dce-9f18-606aa8c9c2c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385610, "uuid": "e54f8502-bd26-47ab-a5c9-46902c85c23b", "value": "6eae97e7d2942bcf772c9d877cdbc401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98060ac-e7da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767358704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358704, "uuid": "91d8b576-e176-4dca-9df6-9bb4edb09602", "comment": "Malware payload (Mirai)", "value": "1d33247abca4a74d9e803932308891b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358704, "uuid": "6d4b65a8-3f6e-4846-acc1-26056eef89ae", "comment": "Malware payload (Mirai)", "value": "0a738b152b074a3ca38a9da6d95f6423a5010e7e356739f64ced1b457a5f857d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358704, "uuid": "4c805a66-2614-4c0e-b21b-8f53b7facbd7", "comment": "Malware payload (Mirai)", "value": "5488099351655c42a4fe19de3b7595b13a1bdfc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358704, "uuid": "adc70315-1153-4b1d-a22f-3d435db1e5e4", "comment": "Malware payload (Mirai)", "value": "8c78e1b03ee260ab616d1e627e9a40977324ac7e078141ead9235bccd666ed7fa25842c6e5a10df528d2bbf24ab70ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358704, "uuid": "ef4d7bd2-d7fc-4562-9d76-e7812dd1b028", "value": "T159B37CEBF2470690C86246F007CB4BED3E2322815F27C5E73D6A657968791DF8906F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358704, "uuid": "5ec44194-e31d-4d94-b284-b3abace042df", "value": "1536:v8GGSBwmtSpt8kwkod9MML1W0goB/LWf:vVzty+kG9MML1W0goBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767358704, "uuid": "3602e422-b15d-4695-be69-95a2d4c27347", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767358704, "uuid": "04d7707d-4422-41c3-92f8-00230adaec39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358704, "uuid": "df2af60a-3cba-45b6-ac59-d8fb7531ca56", "value": "skid.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeedc509-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385852, "uuid": "2bca5ecf-af77-4858-aa96-d93b9a6ea4d0", "comment": "Malware payload (GCleaner)", "value": "b74a48ecd996174f1af2d188d5d768c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385852, "uuid": "c2fde165-93e0-43a3-8465-72a1a3c0a61f", "comment": "Malware payload (GCleaner)", "value": "0aa463ee17b8b0ad14fa904c68b0a02901d2b3ea3ad475980507a474afde2c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385852, "uuid": "7aa05ae4-b117-4e3d-b868-690ce351b8eb", "comment": "Malware payload (GCleaner)", "value": "b26988d62d6734bac1d6b72b4f54fff73f929e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385852, "uuid": "c76ba3e4-e55b-4bcd-b608-4e9ab67e5c7e", "comment": "Malware payload (GCleaner)", "value": "ebf9b11fe0c9bd190cdfaab6ada5039b53e43cf0cd18b23030c372d2531d53d2b2b5c65fd6e848b19903cce1cd77e885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385852, "uuid": "8db8cd29-a094-4452-9a19-93ccf9a0510c", "value": "T1AC06E0A3DCF376B6C0137479422F463CBC315CB3172859631ED61C899EE99E27229CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385852, "uuid": "c0b5a4bd-c454-415b-abee-8a6fe4594e03", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385852, "uuid": "8077e6de-e2d6-47d6-b894-bf893c941850", "value": "49152:QS/NdnNM3NMX5DOsM2V9CUJLKIek2VFt5OUicbYeurdn0N8Tax9HlZ5FgdC:QS/NFNA2pDW09CUgId2jicbkrdNi9FEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385852, "uuid": "a3f2743e-afa7-4d98-a4e0-fd71af0ffd07", "value": 3883280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385852, "uuid": "f987c8db-1c15-4acb-956c-e70ba58ee52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385852, "uuid": "efa585c7-6cca-424d-ab7b-4a96bbde0ab3", "value": "b74a48ecd996174f1af2d188d5d768c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cae0d7-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385387, "uuid": "6a4f359b-58f9-43dd-8547-7d854d60a78a", "comment": "Malware payload", "value": "1bce5a1318336641264ace7e7cb58795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385387, "uuid": "febff970-4625-44c9-98c0-b8a7e07cec89", "comment": "Malware payload", "value": "0ad15a8372dc8ba35b7e56aad6395260b5ab3e61e4ec04bb8d39773d869e376c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385387, "uuid": "d2eef9d6-3b79-495d-8f6a-383aff945204", "comment": "Malware payload", "value": "50f9b3f11651b4053df9871a60900ec79ca6915f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385387, "uuid": "52c98490-38a5-42da-bc5b-52e80d7929bd", "comment": "Malware payload", "value": "49eec99bca0c65ee94c989694915e18e2db87294ec201e6f2e1e1486dc1f4c03440996f442673dd3d7d3714feb45efce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385387, "uuid": "8da500fc-dcf0-4773-8c4b-e2e5db10468e", "value": "T1170633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385387, "uuid": "b2b7b3dc-730b-4067-bc1c-a4215a3fffe4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385387, "uuid": "b65035a6-a5ca-48fb-bfb1-7b16a833f28a", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:p2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385387, "uuid": "b2dde7a4-b3fa-4eb7-9f39-142c77a02af5", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385387, "uuid": "9d1fa6e1-c8c7-4079-8e10-39c83bac4828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385387, "uuid": "00ceb126-7c0b-4bef-b78c-715c48288bbd", "value": "1bce5a1318336641264ace7e7cb58795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabbf743-e7ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338977, "uuid": "722c0c19-fbe2-4a0f-835e-704aaea8a316", "comment": "Malware payload (Mirai)", "value": "e37f17530d506099487182f329ee4f46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338977, "uuid": "d3e34abe-adba-463c-8ef2-4122417992cb", "comment": "Malware payload (Mirai)", "value": "0ade4d8726ae22b9ec9f0d5f5c40656b3d2f9ab347b1f1a5f10f451372f1abe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338977, "uuid": "7388d249-4a34-49cd-9f18-e3145f3633ab", "comment": "Malware payload (Mirai)", "value": "3e818b2afac0a813525ed4b1094c5639762a2a1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338977, "uuid": "64c594ba-a8f5-4c6a-a54a-1b663a65102a", "comment": "Malware payload (Mirai)", "value": "babfc00453825013b2ab25e6e401815b970105bd6aabedcd8f99e555e8d7f1ed2a2a884d726c6bf7f89b3f118a8d4433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338977, "uuid": "f5521a81-bc75-47d8-b093-39ecf27f2fb1", "value": "T1D8F3F90ABB611EFBE85FDD3706E91B0625CC650322A83B753634D928F60A64F49E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338977, "uuid": "dd84d56a-7cd6-42f1-b159-f9857b5156ac", "value": "3072:mmQCYAdv5WOlo4pwQuUnNWMiYOUmaFTInT4:mmbYwW2CUnaDUTg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338977, "uuid": "fc712d5d-102c-4789-b340-3b6bd7572a53", "value": 162104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338977, "uuid": "73962341-b059-4866-8f68-6f34742d804b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338977, "uuid": "288840b1-84cd-4d6e-9a9a-cfbbba21c392", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dcee8a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385517, "uuid": "5a1ffeb7-0929-41c4-951d-9f64b4e7ba67", "comment": "Malware payload", "value": "4f1f3d56504422b4a6358f73e9ac836e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385517, "uuid": "18ea28d6-8eaf-4bf9-92f9-3564a491580f", "comment": "Malware payload", "value": "0ae3b9612eee861f6d7a58d7fe93f5b53ef2d09457c3b960f1f4659ce2d2b342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385517, "uuid": "e47370cb-6237-443e-9a21-997d2ff5a517", "comment": "Malware payload", "value": "e4f2254ee472c43cec1a623452c1440acbd7d6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385517, "uuid": "be23a31d-0362-4951-8a78-4c3218a6e5df", "comment": "Malware payload", "value": "32992193ab69119837dd6b87a768bd34668eb071a51f49207b6b30947d54bd438c11115e61cf581b917f1a6010612b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385517, "uuid": "157d8247-61c9-4923-b944-c8a4b3c7bc3e", "value": "T1FF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385517, "uuid": "db0c8f52-b02c-4df1-98b4-3c0c161eaab9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385517, "uuid": "3747be80-e771-4658-b580-23b7fa4edc32", "value": "98304:axT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:62w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385517, "uuid": "7d4246c5-572f-4a91-b418-edfda7c3e568", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385517, "uuid": "d958005b-ce4e-4d15-994b-7ac2528fe172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385517, "uuid": "47b4148d-d16e-4c85-9552-6e6c821a0926", "value": "4f1f3d56504422b4a6358f73e9ac836e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8190c73b-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385669, "uuid": "edf15217-ef11-43ab-9f88-a1899b06e93a", "comment": "Malware payload", "value": "7f50a6140c155bde28e566515a88f76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385669, "uuid": "6a7628be-65aa-4002-af11-cb6bc4e68b75", "comment": "Malware payload", "value": "0b72383f2707d860e6197c05d1ab4e8fecbe8f00b24e357d09d5925d86b1e111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385669, "uuid": "e8775522-cc2d-4952-b5db-8002db6501f2", "comment": "Malware payload", "value": "f86a55c44acdeb032ec16a8589332928a9b019f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385669, "uuid": "541f0a4c-d1ac-4c77-a5fc-ed2905376072", "comment": "Malware payload", "value": "b185fa3a4c32fe23b5ad831d0a9c91d0a3eab885cb6bad783dd6427b0e377c1f85c59a87df4d57e91fa8af11d4bbc387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385669, "uuid": "5cd90b82-2c89-48a0-acd1-84ab2708eb03", "value": "T1420633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385669, "uuid": "be1a17d6-a6f2-4469-aaf8-e2285b242515", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385669, "uuid": "b59bef09-8050-4014-8afe-f035b3f49299", "value": "98304:amT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:p2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385669, "uuid": "9f9ee781-b580-4d20-9f6d-7bc4588634e1", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385669, "uuid": "c4dff608-299e-46b5-9b55-7f9f498b308a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385669, "uuid": "a4ad0afb-a44a-4232-8790-fc96340d9fd6", "value": "7f50a6140c155bde28e566515a88f76f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8dcbe3-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385526, "uuid": "268fc7c1-37a2-48ed-96a7-958a7ea80713", "comment": "Malware payload (GCleaner)", "value": "52f4e288479ebe73628ea8f46614183b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385526, "uuid": "4e143685-6bab-4462-b5e6-334e56724cda", "comment": "Malware payload (GCleaner)", "value": "0bd046c68f1bfdb433a003db0d7c17eb1e271dc13d9a33197ddbc6ee7a892d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385526, "uuid": "837a65d8-cd78-4d7a-a635-325a9b2ab1ea", "comment": "Malware payload (GCleaner)", "value": "1bd7bb94d98243cd0d30f82f479a4b04ef3a2c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385526, "uuid": "68cd0a53-e06d-40c5-b8be-5da9df4d69bb", "comment": "Malware payload (GCleaner)", "value": "881f70a5a77a18bb5fbd8dbc1a7a597dece7761ac99a76b7e556636e86cd6d322f08ff3578269e00f6ac3e01fa227c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385526, "uuid": "9f2e74bd-e3bf-41dd-a8ac-9940962ab778", "value": "T17516E071EA8C4D31D99B6D792CF2F57AE31EBBEEF4498C8E04C1052939A16C56437382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385526, "uuid": "24e39999-6a60-4224-9409-d0b6b411781e", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385526, "uuid": "b383c198-afb6-4d4f-b734-0c13c0f4e688", "value": "98304:5nxpU4Nng76yB60lqR1MCWcnisnX1unY7:5x2Ag7ZB6H1VpniiYY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385526, "uuid": "bace1b02-64da-4ff0-8a64-e8e70eff283b", "value": 4081424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385526, "uuid": "319a1dcc-95a3-4438-8ef3-766cc9ab0d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385526, "uuid": "993e9634-98da-4a35-8d5d-5e8644e932df", "value": "52f4e288479ebe73628ea8f46614183b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0ae7f1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385530, "uuid": "13733fa8-eb5e-4690-8017-87a13e7b6fb4", "comment": "Malware payload (GCleaner)", "value": "5540817de96923de5cb51fc8c4b6d0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385530, "uuid": "b72143f9-f65f-4d77-868c-fbb7b921d2ef", "comment": "Malware payload (GCleaner)", "value": "0bfe228273fb96503c46c2d8de8c2f372608e21cb959a552db00240491645490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385530, "uuid": "8d6ed438-e961-48d7-a1e9-f16f695856c6", "comment": "Malware payload (GCleaner)", "value": "baa4086df187091010d8acff48c93a02b5ae0a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385530, "uuid": "b7dd0844-c9f3-4bda-8a2a-1aa3d5cb1d2f", "comment": "Malware payload (GCleaner)", "value": "a6c44bd976634bb8c2b2c702c11286aefa1f50031013ccadbc411b69f0baf967b139f53af0d4698c70efe9f4259da0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385530, "uuid": "b93b9212-2246-4f13-8b7a-870bb5868a7b", "value": "T13B36E0BAD3C0B421C111AEB9A84E6A54E36F36C0C5F45C3976A6BC0533BC385D5B67B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385530, "uuid": "51fd0ca3-9fed-48fb-9086-9c60488e092b", "value": "cde078e68994e408985ac985f5f0d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385530, "uuid": "f389f140-6450-4af3-9e46-c76791c683d7", "value": "49152:2kDkso6Mr2+STMvzqmu+dnUyTaFmk4hTExXQVIEwt40NFqmf91z+KNrQAj/Ua5px:2kDkqVQpTg6TESeQmpveDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385530, "uuid": "38d99082-7c36-49c3-9e11-101e011b9130", "value": 5236496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385530, "uuid": "e64aca70-82e7-4e1f-8fd2-3f8069694494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385530, "uuid": "1916ae8f-f5f8-447b-95ae-9c6fb565b28f", "value": "5540817de96923de5cb51fc8c4b6d0ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25eda67c-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385945, "uuid": "1671730d-d59e-4261-9701-73dddbef5bf9", "comment": "Malware payload", "value": "d1377f89287b5d4eb860e057085505b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385945, "uuid": "014caaf8-466b-49f2-bb0b-36a77b1cb29c", "comment": "Malware payload", "value": "0c8216db7ab449be9669c85d73905ba7fe49c41d0a2bf134c89e3e21d9d7d10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385945, "uuid": "86f7e388-ba33-4a93-ab41-c08b2113d01f", "comment": "Malware payload", "value": "5004114e6aa52963a41ca2cabff79d59ce604490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385945, "uuid": "4d185a9b-f08c-4db7-8c39-48f4f231088e", "comment": "Malware payload", "value": "e5363df47bcaadeb73572350ae234845ca2ba18deec719275a43afa29a3032f116d8e7d3af04fa6513a3b98b36852fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385945, "uuid": "7bc64322-79bd-466c-8b25-96fc56a53c9d", "value": "T19C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385945, "uuid": "adf1b05d-1e6c-4770-81f3-8798463a041c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385945, "uuid": "9765c75c-a67a-406a-b9e8-d85ecdd6f302", "value": "98304:ahT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:C2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385945, "uuid": "ff64acb6-485f-4564-82f3-e37f59d3d20a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385945, "uuid": "ae76110f-8c07-4812-b2be-165b2dece789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385945, "uuid": "7ae99c2d-a795-46a5-ad15-8f8fbcef28a9", "value": "d1377f89287b5d4eb860e057085505b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b71a3d7-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393390, "uuid": "d99ea6a7-64ec-4980-826d-9b7a23c319d1", "comment": "Malware payload (Mirai)", "value": "ba28fcddc6d4b010431103a90c56e2e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393390, "uuid": "91f85511-3ee2-47e2-841e-0a6718eebc76", "comment": "Malware payload (Mirai)", "value": "0c8f5d3259f11c49aeadd68447a8890fae1b8f9d8dffb4aa31e3e631b74afa6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393390, "uuid": "d134b8b6-efcc-45ee-9549-cdaadded9e84", "comment": "Malware payload (Mirai)", "value": "337c111dba67567b7f3d0971b2a6a9b5da1275ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393390, "uuid": "6e5c60b4-9c08-4879-ba3c-10a99a3db9b8", "comment": "Malware payload (Mirai)", "value": "93d61e9171f5335ca429aa4ee2511e6a4d00f7ea30ea90438e82d1c35b78078061686340a675c32268c9a98012e9bc7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393390, "uuid": "50b98bd3-1979-491a-a98f-3629f84f1e1a", "value": "T18EF36B07B5C0D0FDC8DAC2B44BAFA12ADA72F4595134B21F23C4AE266E5DF216B2D750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393390, "uuid": "f78aecea-b18d-4614-94b2-f2cbc0f3c153", "value": "3072:LtVj1uCynTUXOss0PF1811E7YpleoNRUAP9CudfFXu7LE:PxkAfi+X2FRZAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393390, "uuid": "f6b5e135-c53a-432d-9846-1769d0cda7ee", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393390, "uuid": "98a8dc21-516b-4fa1-9671-e32a499d4879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393390, "uuid": "1c0ec5fd-4108-4d4b-8538-a75b90cb9402", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1a5d2a-e77f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767319412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319412, "uuid": "d6dba04a-94d0-4134-8c8d-58ef72597da9", "comment": "Malware payload (Mirai)", "value": "14c8ffa9d97e3d86fae02a4d0548a122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319412, "uuid": "9f3ccea3-bc96-4f19-af15-3673fb977352", "comment": "Malware payload (Mirai)", "value": "0cc3d1afc0913b320d4755e1af7dda4a29bdbfcdf773347ada7d966a293cc756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319412, "uuid": "3d524097-5af6-4f54-a52b-8ef0ba9ff469", "comment": "Malware payload (Mirai)", "value": "95e8978cb120bf416b4e53426ee8e7a7fb4e6685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319412, "uuid": "25e8e376-2c55-4ea8-9724-6f5f380a13c6", "comment": "Malware payload (Mirai)", "value": "896e403db385aef3c1cb431d80c85bce3440ff3d5185f2b62c1c0ad32a69fb134b23a0046a506811ae6ae4df0056043b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319412, "uuid": "a1b5446a-22ee-45fc-bab8-afef16dde1ed", "value": "T17D145AC7F800DDBDF40FE77A44230915B530B7A250935B37625BBD67E83A0A94A27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319412, "uuid": "8650b015-9b01-4a1a-8b86-805bddc1bc24", "value": "3072:y4dScd+iugrP6E4fe/B5RcE9y9Jl3qMfEpVZ3/T23y0GVwjbi7Lv2Rbo4ezdU:yE+iNcBEy933qMfqVBuy0sLvGDezW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767319412, "uuid": "88cbf6cb-5e52-4578-9cb0-130d8619bd02", "value": 208096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767319412, "uuid": "87a5d64f-cdc3-48c6-9a0f-b0342d226e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319412, "uuid": "15a20fe0-383c-44a1-80d0-edffb2d2c417", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e4af6-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767356274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356274, "uuid": "74748c49-263b-4ddb-8db2-b0e0baa764a2", "comment": "Malware payload (AsyncRAT)", "value": "3f849e8e64b1640329c89b43e2fa6961", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356274, "uuid": "d93182fc-0d9b-4b81-b4e7-f347d2e5b9e9", "comment": "Malware payload (AsyncRAT)", "value": "0d0f4d947febb264c4229cc1049ca509b90f170769076325f33688b50e027f15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356274, "uuid": "0d43893b-2418-45b6-b311-45642d0e1f41", "comment": "Malware payload (AsyncRAT)", "value": "4b60ae2d52dae1b0889d22ea5bfa521460c8d4a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356274, "uuid": "09deb2e0-4c5a-4a82-82fb-15644bda565a", "comment": "Malware payload (AsyncRAT)", "value": "3d2d020c0b170d32215ce6db495284815097c0db393098ec5415c81614df13609efdaf7dbb9be5a7341302c69df0258c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356274, "uuid": "a6b326b2-0ba4-4061-94ee-9c7fe05fdfe4", "value": "T139232B0037E9812BF2BE4FB8ACF2614546BEF5677603D54E1CD4019B5613BC68A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356274, "uuid": "d944a24c-8cfe-428b-9c10-c6613e606b3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356274, "uuid": "7166e797-0998-4c9e-b3c6-0b4178440f9c", "value": "768:Yubp5T0AfziWUIZJsmo2qFvdOyrISh2aOPIozjbrge3ieDohI4AjyZ2aBDZI0:Yubp5T0UW2OdOylH3o3bUeSeWA42EdI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356274, "uuid": "a9d61b26-e621-4f66-ba13-93a4790129f7", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356274, "uuid": "e92e49dc-12f3-4dae-b8ff-118c1bc52086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356274, "uuid": "fdaadaa7-d675-4776-aee9-eeabc2b46151", "value": "apex-finance-platform.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5fbeff-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385954, "uuid": "08cb77e8-c953-48dd-9054-5dafa9078ac4", "comment": "Malware payload (GCleaner)", "value": "d33951cc5f6e820c10b33a5f17a65ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385954, "uuid": "55f061e6-61a4-4987-9779-680bbc68d7ab", "comment": "Malware payload (GCleaner)", "value": "0d3a4fc3977a52602e3fe3b568652ecea15093e6386631773c4d656a403919d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385954, "uuid": "b6e2e88a-e695-4f49-a277-fc14d6271eb6", "comment": "Malware payload (GCleaner)", "value": "c837cb87252684739ae3e6eb7fec4e6829a8c948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385954, "uuid": "5e094f8a-eb4a-43a8-9404-9067489389e0", "comment": "Malware payload (GCleaner)", "value": "14e6889ff6272ba9f27a77ef54fbea2595ee5740e4335d5674ac080c60f38c3df65c9ae18062af3e5150ab7f5422cb9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385954, "uuid": "9589190a-859e-4fb3-91e9-3922d89c8c7b", "value": "T1E036DF10C419E572E2251A3AF8875360C80EADD1FDF36A877EE9DCECA9FD648251C0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385954, "uuid": "7f6b956b-fb17-4c4e-a31e-3e28417b418f", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385954, "uuid": "0269f976-8ffd-43c7-ae0c-4b7bfb98f172", "value": "98304:CySJ4r1lBHioDBHzvn5ETUW61KFK+SBflH:C+lBHio9TiUbsvAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385954, "uuid": "61d4dc3e-ccac-4bac-bde1-8c459f32be5b", "value": 5306640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385954, "uuid": "961111d9-3e81-47a1-9099-cc129e5edef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385954, "uuid": "143bada9-bf1d-4b06-8e6a-00efa45e0b5e", "value": "d33951cc5f6e820c10b33a5f17a65ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43387360-e7f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767370102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370102, "uuid": "feb31372-1738-4e62-b08c-48d96c993c7f", "comment": "Malware payload (Mirai)", "value": "2f2fb5346ce0d224d10532cec31520e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370102, "uuid": "2e53315c-2a4e-4a59-ae27-bb9c7d271c6a", "comment": "Malware payload (Mirai)", "value": "0dc403f7154a36309695ada9ec77afe9b7d6ef6ca6abed85b1ba196371125d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370102, "uuid": "dfb76666-d51c-438d-84a6-333d6fcaa4f6", "comment": "Malware payload (Mirai)", "value": "d208b0e8d67fb06a79bd1f61ae9d8beb54e01247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370102, "uuid": "243601d3-c8c6-4d21-be4d-817b6bee4adb", "comment": "Malware payload (Mirai)", "value": "366f360684680dc69ed9c59e4fb12058e4068d3db61f493bbc2eb5b60104c94259e6d4fd5f67dffada0267572a2a62db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370102, "uuid": "d3a7462b-bd72-447d-a25f-fdf90218fa29", "value": "T18D245BD7F800DDBDF80BE77A44230909B530B76250935B376257BD6BEC3A1A50A27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370102, "uuid": "78380601-1106-498e-8ed5-e153b7ab9e53", "value": "3072:xs3MjbSwl0nYgnr2563X1yWCA3ABd/YV3IQAqc+2QVwjbi4L7oL3tkZ2u:BbSc7ElyWf3ABdQV8B+2hL7orE2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767370102, "uuid": "705a72ef-c9ce-4ab0-b9ec-705d34d91227", "value": 212000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767370102, "uuid": "916b0767-3460-4fc6-9c11-1fa076357a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370102, "uuid": "66599357-4323-424a-8424-02d23222720c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42360a3-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385727, "uuid": "75eaff7b-453b-4431-8d8a-d8d9cef4a47f", "comment": "Malware payload (GCleaner)", "value": "8fa1c2c4c68d88a023315a7404131534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385727, "uuid": "7fee77e1-d710-4198-b5da-0f706fb6deee", "comment": "Malware payload (GCleaner)", "value": "0dcc271a1c3d93b717ee19ef64735a619f2be5767b0eed7376882352293d4414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385727, "uuid": "f467904d-89ae-4ece-8c28-a1f10621a968", "comment": "Malware payload (GCleaner)", "value": "bae00f4d407195e77952f4360e169c8366febcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385727, "uuid": "64fe64ea-af2e-4e0d-bb3e-ecd113387683", "comment": "Malware payload (GCleaner)", "value": "8e3c50b4bc2ab475991f8ebcfa13d032a5220d2324df98b9364c699dc0cb2aed167f996290a379ef5371faaa6bc068b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385727, "uuid": "71380d80-750f-45fc-ae5b-481dad5505ae", "value": "T18036DF6AED8AE13FC6AB4DB0797AEEDFC844BD01E6D6103C56D828CCE5CCB41660425D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385727, "uuid": "df32fee0-58c8-4298-82e7-51e570adfb9e", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385727, "uuid": "4c539f9a-5e76-42d7-8b1f-1ff24a1fc11e", "value": "49152:wnB/99n+1eYZ+2W6mbhFGCkq2kxYTa41APjyiWZJtJrRizWHVwF1ygt:wnFj+1qz6mbhFtSTa41A7yJBRi+wF1yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385727, "uuid": "31109637-578e-4860-833c-d3fd6ef163c6", "value": 4962064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385727, "uuid": "d83c00bb-534d-462d-aa97-1e682cde653e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385727, "uuid": "80a5d918-01b4-4306-96ac-e8f3785d72ab", "value": "8fa1c2c4c68d88a023315a7404131534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6ab3ba-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385556, "uuid": "8a10e8c2-479a-4b33-81b9-cb2fc5b9612a", "comment": "Malware payload", "value": "5e8b1f3ce625780b2c9c7084f8098cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385556, "uuid": "c9c4c3bb-8072-4679-9fcc-0b2f86875d68", "comment": "Malware payload", "value": "0deaacab9528d0cd7ff5f46abe95c91aa187da83f3f2f787b61b43b473ebd570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385556, "uuid": "e360def3-4389-4634-839b-3343eba74760", "comment": "Malware payload", "value": "7dcf8de3c5adbdc589ff44aa5023ec810491dd15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385556, "uuid": "b0783361-7ac8-4882-9acf-a60d92d35c4c", "comment": "Malware payload", "value": "4abd1a35508c26449e3f124aa021380d88c5533fc76ac51ae6f5c8c62904edd99adad7931a78d1a6ea50351776b46c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385556, "uuid": "ae2aff7c-25d3-49a9-84b2-41f6fd614c19", "value": "T1D70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385556, "uuid": "73f6c13f-4b2a-47a0-8ca3-4eae08f777a2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385556, "uuid": "2cc5c9e6-8835-4940-839b-34ffb3b3eb3a", "value": "98304:avT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:k2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385556, "uuid": "4e0c2899-aa4c-4612-b6cc-45e0cc01cfc7", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385556, "uuid": "1271cc6a-be82-4180-8884-fa5652f8bc48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385556, "uuid": "5750603a-ce28-4565-aa3a-62d2e1270315", "value": "5e8b1f3ce625780b2c9c7084f8098cdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5d7a80-e77b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317857, "uuid": "24b4af07-103a-4ee8-b36b-c7252c919927", "comment": "Malware payload (Mirai)", "value": "b851c580129e9e0e3bb4890ebabc1050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317857, "uuid": "64d4beba-91ad-448b-8fd4-0007508969ce", "comment": "Malware payload (Mirai)", "value": "0e23ae99edd0c08d90d41174eacdb6af908d9a74b92bbc42a3ad8e11b91afb8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317857, "uuid": "0fed364f-2708-4ec4-bb17-a3586e09c545", "comment": "Malware payload (Mirai)", "value": "e5e5d831d59d8773e0b4ca2f5968fc4e20fcc5e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317857, "uuid": "d5747c7a-2c5a-4707-b114-6ea3cdf8217b", "comment": "Malware payload (Mirai)", "value": "2d2dedd68ae5737e7ccea63f1e767b22285f4ff0134e58e826fd1423135bf567a7354d35243e3102e315e5176295d4c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317857, "uuid": "3b7802d2-6320-4ad3-9c93-b80342d08449", "value": "T13583C605BF610FB7DC9FCC3705B95B09299C960A21A83B3A7D34D818F25B24F59E78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317857, "uuid": "9d5881bb-0fba-47cc-96d6-08f85094d1fe", "value": "1536:GrPrNxCA6efAYHQSgvYDq5Zmko5PXI2bDc6yRNGhmAfQlu+7RX:GrjNxwefbHVaYSZmkohI2Zolu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317857, "uuid": "0f8141bc-02a3-4918-a177-97c3dd0b2a8b", "value": 86656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317857, "uuid": "56af4a32-b867-4881-8d33-df5bc60f3174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317857, "uuid": "5d5e45b6-174a-4639-8fde-86224fdce043", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b9efd6-e7ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767366459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366459, "uuid": "169e8f40-50fb-4005-982c-65b7e0df3189", "comment": "Malware payload (Mirai)", "value": "a7be32c6421b38aefb9a84c6dfddc843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366459, "uuid": "cc6f41b1-6835-489f-b2ce-ce652e457992", "comment": "Malware payload (Mirai)", "value": "0e482f4ee2a5b077f2b7e335bdf7769ccf9112851656e63a6e9123179d6be902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366459, "uuid": "9fdc9913-4f31-43f2-a1af-a52a5c4b76cf", "comment": "Malware payload (Mirai)", "value": "9afb5d62e2121d470ea875f76867bd50cd76b87c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366459, "uuid": "790f1d84-9eba-4bff-9dfb-3c648ef76eff", "comment": "Malware payload (Mirai)", "value": "9afc79425b08f7ef648d88e3d1179bd0afb0fc29b2e37918117c833d4c798f550b88d4e8d20bacf3a28655de956d6b9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366459, "uuid": "287d2849-3aaa-414e-80aa-d368dcc15fec", "value": "T12C936AD2A663E4F5F81A41701237E73A8631E4364134FB83E7A4EF73BC5268096467AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366459, "uuid": "a04f4e65-6826-4f1e-8288-3abf20868467", "value": "1536:j7KPyvvxNje0oZ1u177oAbgrSnNM6NCKa9SM5E3BvInVHEwj8XvTz2rGEIfR:nKivxVe0ygfPgr6MGK5GBwnVHFQXmIfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767366459, "uuid": "13d5c69c-e9cc-4a31-ad08-1c0bc3ec6a28", "value": 91444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767366459, "uuid": "0dab4d22-b3f6-4b0e-8441-38ec82a9ae46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366459, "uuid": "da3182e3-c9c0-4a4c-b789-3a3b81d0aa16", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d98c33e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385689, "uuid": "3e627a77-591d-4d51-b2f0-523693529149", "comment": "Malware payload (GCleaner)", "value": "85aa72dcd00506b60cce793373450aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385689, "uuid": "7a3c0dfa-e8a9-47a4-be40-d1f2eb00d9f9", "comment": "Malware payload (GCleaner)", "value": "0f72d05a8aac9212babbaf4d40276753b1dec59f40622b2558d51a9d33ea65eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385689, "uuid": "a0abd69c-661e-4f8e-ba28-68b3ac7f3fd7", "comment": "Malware payload (GCleaner)", "value": "d8571e18b33b5e0a6ba365c5c1134bed75b41031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385689, "uuid": "8ed0869c-96c6-4a6e-9fce-68b42d939c0b", "comment": "Malware payload (GCleaner)", "value": "7c4a6250ac31f55b13b0ed26f9bdce8ee31ca16a5e46a1a51abbe7697ee3ac613743782ef8867d8814f31a8bc2886184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385689, "uuid": "ae7a64eb-a085-4375-8b44-e2a00052612d", "value": "T14826D0B3F1F95CA2E528063C1F18CE6D942369EAEB359F7A4F4438075E27741E48B1A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385689, "uuid": "b67df283-0c93-487c-a1cc-67a0acc22630", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385689, "uuid": "301e17d7-bfea-41cd-8f45-e639b8fca6b8", "value": "98304:SUzNgPOjgk7evx7b00+nXOfCkZG3QAgS0Vm:FWigk7wx7b1+XvkZGglO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385689, "uuid": "f7293b21-4d9d-4537-89cb-9933a54ce2ad", "value": 4608272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385689, "uuid": "f06398a2-9f3d-428d-bbbe-8ab0a97374d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385689, "uuid": "afb9b136-ebc6-4f7c-8fc0-633fe3d8bd59", "value": "85aa72dcd00506b60cce793373450aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9913ebb2-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385708, "uuid": "6342d767-a0f8-41be-953e-f3f6236c7fa6", "comment": "Malware payload (Adware.Neoreklami)", "value": "88ca431f4df232b8ce66b0f3da8d99a9", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385708, "uuid": "1c710f79-f9fa-43b6-8b4d-5fbc2a7f9e6f", "comment": "Malware payload (Adware.Neoreklami)", "value": "0ff70279d81ff012b367a1ebd475fecdc36ba47510b47843de8ad002b37ea158", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385708, "uuid": "0a6814e0-5c28-44b3-9721-c8f4034ebbf0", "comment": "Malware payload (Adware.Neoreklami)", "value": "b4cde1833e0f5f13f70d9ec3f5a33b4b87ec1d17", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385708, "uuid": "6ef95318-27ef-4448-a187-162b01d29a0d", "comment": "Malware payload (Adware.Neoreklami)", "value": "7cc678a28e2bf3cc115641f9427380f62678510164ae9ef0bb9e3a84228aa93d2d5ed470821940e55a62a72e04892965", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385708, "uuid": "ec2adb1a-4fe7-48c0-9362-0e8efce562c6", "value": "T1557633623EE2C676CB9908705A162FD520F7E3304F678807B3816ABF57797DC8635A48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385708, "uuid": "7c372c72-9d8a-44c9-9e33-816abb280ee0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385708, "uuid": "c7efcb9f-a4ee-4234-9e37-5ba93a3a2fbf", "value": "196608:P1OUERbYVlN779u6XoyeX8F3Dw6Rmn1oTvGD5mr6ATTCUSmNA5Bw:tOUAYVlNhXtE6RM6TvkweKe75Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385708, "uuid": "2cf5865e-8ea0-42ab-96da-6c28ccf25d5d", "value": 7556898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385708, "uuid": "c9775905-1efc-4dcc-8492-8a6420981817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385708, "uuid": "4fd9c2d5-a1dc-46b4-823e-e7410b3fc14d", "value": "88ca431f4df232b8ce66b0f3da8d99a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9663f8bc-e7a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337171, "uuid": "f13dc5a9-1de7-4880-8c95-63eec8873a71", "comment": "Malware payload (Mirai)", "value": "484eec989edc7e6f899a1f4569e22e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337171, "uuid": "c7537638-5f78-449e-9a4f-45f1539382ea", "comment": "Malware payload (Mirai)", "value": "10e88373c3fba576754ff519a7d294bbbe66334f3aaf49441e4c954dca8a3dda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337171, "uuid": "6ca49a18-4b89-4662-98f1-0f35ba54c39c", "comment": "Malware payload (Mirai)", "value": "68ffb13bdf3d83d0efcfe6fbecbfdd7a46b264d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337171, "uuid": "91ddb81e-6c38-4a99-afc0-6ab65046ca7d", "comment": "Malware payload (Mirai)", "value": "1aaf2f80fb2b67ffb3a9c1284e32c63acbea7390e2f6aa3b016bb9de9daf967b0b9a5bb995eea0011d4238dfdd4a1c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337171, "uuid": "7bece26d-96ed-473f-aa16-575466396a4e", "value": "T1C0D3C75E7E314F6DF2A8C33447B78F319758239626E0C685E2ACD5052E6038D685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337171, "uuid": "73605337-b3e1-469a-84f8-a77a69b2a8a7", "value": "3072:BIZQYNKD2BasPJ8wQ/ipjPgA2vkt/dXjg6f9EECLzqTqZgW0iQLNtplQy:Bl8C/q2aLLfpuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337171, "uuid": "76ad2a90-b58b-40ee-b493-facea409bd48", "value": 131328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337171, "uuid": "88c7b9d9-af83-4be9-bd0e-20983382c4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337171, "uuid": "6312c45a-b25b-4a93-819f-473505032a2b", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43d67cc-e771-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313625, "uuid": "bf6bf74d-5078-4ea0-b3e3-6f3b247d18fe", "comment": "Malware payload (Mirai)", "value": "2251d2d0636e83c74f5183fe3d67c6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313625, "uuid": "5bce5877-f341-4cba-8b86-47554cd621c6", "comment": "Malware payload (Mirai)", "value": "11144fdd24c201e0ea537542f421ff54a6456be95f5445b90a214aa2883c6085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313625, "uuid": "74270f4a-69bb-40b6-bd7f-9d5aa09648ee", "comment": "Malware payload (Mirai)", "value": "a407bce5f92f2726185376d35d70074e4b21dfd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313625, "uuid": "440c7d0a-7853-4351-84f0-6a9592d1a316", "comment": "Malware payload (Mirai)", "value": "1fe6e330d3ea1335c5af1ba6750c027048590a50cc0afd2b0db0ab47bc2ddbe93d99d4182fc653e36ae65a8a461d27f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313625, "uuid": "82a3c518-b6b1-437a-b469-20f01d8273aa", "value": "T180238D417308C553D2975EF0293F2BF0A7BE9AA02154E385B50DFA8D81B6E336147DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313625, "uuid": "df681999-7179-4114-9c00-2a274ea7fb3a", "value": "768:DUsQpGgQMHy65lrkPr8nua7s0VchY6D3naLpu+7Rn:EH55SPU3i1D32pu+7Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313625, "uuid": "bfb4b581-708e-4c40-a8c4-0bda4da6cc47", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313625, "uuid": "5ab54fad-ab31-42d3-9ce3-d194c0f79239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313625, "uuid": "a95983d9-36ec-40a5-8566-c87d28cd06df", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf8b830-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385391, "uuid": "1ec3b4c0-d715-4fee-84a7-883a5236c8e1", "comment": "Malware payload (GCleaner)", "value": "1cd6b36d516c507d51b82ccec97ed208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385391, "uuid": "41398312-f262-4610-9adc-ce3a7d084714", "comment": "Malware payload (GCleaner)", "value": "11814ad10fadeea51e9ff6c9f2efe56786307ceadadf91ad1254c0436d836650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385391, "uuid": "6749180e-f53e-4a62-a65c-66815645dfda", "comment": "Malware payload (GCleaner)", "value": "66f65c0bce9ac325ce658be5f3b8666210cb4f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385391, "uuid": "f3947583-1fa7-482a-8875-7457e6f40a5e", "comment": "Malware payload (GCleaner)", "value": "942093348838be10271f0108947721e3e78ae9ec3e53d5ac892c048d8d3baa819571626807c2c65d49f7e2fb4ed50740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385391, "uuid": "d27bd1cf-65b7-4f5f-bc68-e3a046c2411d", "value": "T12756CFB3FCD4C83EE2660EF19B5BD29C18D77846D53444068E4A3E687A60941D9BFE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385391, "uuid": "e65b270a-e8dd-40a8-a41d-bd9f0a96d212", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385391, "uuid": "3a692644-d169-4c75-a89c-adcece36c280", "value": "49152:WnjpxPnMxbAmtiQt1WG2jzF13SqiB9eavvCTCOlGjbocmwXJ0X/rNdqe5qJsw7AY:Wn9hMtttzHEjBwqiBl4Cs0YwX4JgJxMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385391, "uuid": "3d9ac513-2780-46ca-9fe3-c9fe300fbe41", "value": 5894416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385391, "uuid": "d3023890-d0a9-406c-9cb4-bd26c2df8d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385391, "uuid": "457c7040-3db5-455e-947f-359c1e1ad9e7", "value": "1cd6b36d516c507d51b82ccec97ed208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fad0c19-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385961, "uuid": "9804cb65-fbd2-455f-836b-e196487ff93a", "comment": "Malware payload (GCleaner)", "value": "d5a3a1494e69090e46c618943b38a778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385961, "uuid": "8ae37bf9-727a-4cbf-90cb-cabb98306cd1", "comment": "Malware payload (GCleaner)", "value": "1190ad0e7db83261b0a4ef4ea123054a7aa62057940933a3efe85f82f9aa1d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385961, "uuid": "ffd86240-1ae0-4690-af73-a4494e737c2e", "comment": "Malware payload (GCleaner)", "value": "bd3c2cab4ec11b3e6ebac3b3b12dbcf76467b07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385961, "uuid": "6e133979-5148-4b0c-ac73-d629ed44eec3", "comment": "Malware payload (GCleaner)", "value": "12b66093f498a65cdd6805b5971faec77413a6de2ce3fa358400891681173c30994acb31f375af3af110cde8c58d3968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385961, "uuid": "bece8fc1-f36d-47f9-8e0d-5c6cb25e28b8", "value": "T18426E005E6E1383ED659CE3BA817496DFD9D1878D2F47C218287268E7FE867C68430D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385961, "uuid": "a61dfc3d-ba89-445d-8a81-700d5b10213e", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385961, "uuid": "3227c4d0-1f3e-460e-9b93-dae95dfaa01b", "value": "49152:LrSWNylGpVH6IfbpwnF0Ac7Qg6V7eeDESmo7XC8Rf/Ym1OQcxNEuYMw8r7gX8x9e:LrSWUl6VHdfY0N1eD5muXLcxLY2I46JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385961, "uuid": "ebbe1238-e178-42af-be53-f53e76a37f21", "value": 4705040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385961, "uuid": "42170ae3-7e5a-4b43-9d93-8f30cc4d42de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385961, "uuid": "360a2b34-ff95-4ebb-b50c-5f6b0ef555e2", "value": "d5a3a1494e69090e46c618943b38a778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce75c5a-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1767337719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337719, "uuid": "fd075178-b8a2-4a6e-ab5c-9fc04ce8ed37", "comment": "Malware payload (SSHdKit)", "value": "06a032065d85225e9c3ac3ad73e3e747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337719, "uuid": "72ca670d-b717-4406-9872-8e976538f39f", "comment": "Malware payload (SSHdKit)", "value": "11a87cdc3dd4e4d01208493d911d35afb6cba0098562236296526fa9e9e54b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337719, "uuid": "cedbcc2d-6d43-4484-88a9-fd625cc3daf0", "comment": "Malware payload (SSHdKit)", "value": "e96737d88f62a618be43af019abdaa5f882ba37f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337719, "uuid": "f5dd767c-eb41-4f97-bb10-e5386debc7d2", "comment": "Malware payload (SSHdKit)", "value": "47dc4eeff638336e0ceaec00129553f42d08e147ed3e7d64712e6a56d868189f81f44ebee0ba2ecd102b9e2974450540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337719, "uuid": "5bc41ea2-9a9b-4929-b5a8-c17168bc8bb9", "value": "T13D356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337719, "uuid": "56f31d0e-fbe9-4eec-a338-ee638ee961b3", "value": "12288:E8dASOFRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbCsO38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337719, "uuid": "f1b59b60-a045-4d10-a5f7-b45105fb6c50", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337719, "uuid": "1a7099a4-b907-4de8-90e0-9c0d054f52da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337719, "uuid": "04dfb1d1-23e0-4608-83d4-76de233dd40c", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa1c957-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393200, "uuid": "af56db97-5132-4c07-8561-601b97bd6d1b", "comment": "Malware payload (Mirai)", "value": "5909a7b498b0a8e908ddae25f96c868c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393200, "uuid": "348cec9c-44b6-435b-a016-0e4aa6b58beb", "comment": "Malware payload (Mirai)", "value": "12109e67e387315ff9ae75ee1c4b4ba41488a905da706e3d10721e0ad6b82124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393200, "uuid": "0ed9fe0f-abd8-4a67-9ea9-cf21eda48373", "comment": "Malware payload (Mirai)", "value": "4344c4abd26b488c1a28805e1a374924039f7c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393200, "uuid": "b27d4596-0902-4701-a414-99c6deee3288", "comment": "Malware payload (Mirai)", "value": "42cba863f83b4d5f47b3dcd96ceb40892ec3ec4dccd2a26415ea15e928876be03a579290921fc7c0ce86555eccf49601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393200, "uuid": "541ce2e3-ac17-4f92-879e-d23ed4cfc0e7", "value": "T1F2D30659ED419B00D5D636FAFE4F428933534B6CE3FA7102EA245B2123CAA2F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393200, "uuid": "9cb6d677-fab3-4fd9-8c30-2e3ab82966b7", "value": "3072:pygzKxVDZ7jDjFlfbmNMZIWVqc2b1UUjaFuFoYUY4oIRH/4fEzEs/FE0EG9+:wgzKxVVjDjFlfbZlqc4fjaFooYUY4x1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393200, "uuid": "b0abe376-b41c-45c5-b517-772019a0544e", "value": 141600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393200, "uuid": "c7f891f5-8cb9-483c-97c2-e2aff32bd0f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393200, "uuid": "5df0517f-a7ae-4676-9825-9a4ac68b02bb", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff7af95-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385451, "uuid": "9a66d2b5-d66a-4b3e-8498-b4a450fa3151", "comment": "Malware payload", "value": "3417439687b8f3f4a203345ce11f3541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385451, "uuid": "84687d42-ba29-48b9-9bb4-a03fd68d9749", "comment": "Malware payload", "value": "12458669357d6931b6c2b62755b69d71837f3c57127d9be5b8c67e124d960afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385451, "uuid": "3fdac508-5192-4711-b48d-6e46e9730e4c", "comment": "Malware payload", "value": "f95dd4eab3b426915e72c291f14a69f81d4c1a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385451, "uuid": "2cafe5eb-414a-442a-934d-1db3a7e747a8", "comment": "Malware payload", "value": "05702572ba9109e8ea3f331b7fefe8201efc9574605eaaf1244dc9048779d93f97eb3419322cfd8839e89f183bd893dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385451, "uuid": "5d3608bb-a269-4c7e-b270-8612b81e9d86", "value": "T1A60633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385451, "uuid": "f8f17bed-9b41-4485-b272-acad183592d2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385451, "uuid": "ae148445-a86b-4e16-a143-d16178ea200e", "value": "98304:a4T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:b2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385451, "uuid": "ccdfb98c-2b5c-4ea6-bfcb-47b5f3b5d353", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385451, "uuid": "e3ff5c7b-9d1b-4def-a58b-c10d10aa18b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385451, "uuid": "2bba60e6-4d15-4f34-98b3-c5f91791a5b2", "value": "3417439687b8f3f4a203345ce11f3541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79346f5-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385384, "uuid": "3a6d179b-a880-4596-aed4-91019107cff1", "comment": "Malware payload", "value": "1bb9796e94f186ddfef92d27b9d30f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385384, "uuid": "5ec1af0a-7c4d-4059-8b75-83ed766bebb0", "comment": "Malware payload", "value": "133d3d1d818cf8937083777383c25136b49f22bd32b64b198a4fbeba67beba8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385384, "uuid": "42db8bfa-4c6b-42e7-8ccf-1b66a9279c4a", "comment": "Malware payload", "value": "368072906464f0fbdfb138f40366692b462aef10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385384, "uuid": "a5d2c4f4-14c0-4bbc-9eb5-fb2fb3cd91a9", "comment": "Malware payload", "value": "3658371490aa34ddd4d4999fe125c455096f251fcb19de56752e73b50ad702621fa80a8eaa5d4b3fdd977c919b04f9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385384, "uuid": "20b80dab-851e-4d75-8b57-fd0b7fc26dc8", "value": "T1BC0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385384, "uuid": "2f12e631-8bf9-42b7-b4e0-560ec48ece50", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385384, "uuid": "5fe61398-2115-42d3-812a-e397012a24ec", "value": "98304:aXT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:U2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385384, "uuid": "a64cd721-6eba-4dc4-bd07-a0cbeaf499e1", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385384, "uuid": "08c4c483-ea8c-423a-9593-906c765ac79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385384, "uuid": "175e7a4a-47ce-4f1f-8d77-79576b9db6ee", "value": "1bb9796e94f186ddfef92d27b9d30f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dee5dcb-e7b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767341693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341693, "uuid": "5cec00d0-6344-4cb3-a444-8569c7bac877", "comment": "Malware payload (Mirai)", "value": "d72f1dd7c59167354fd7c127e0946387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341693, "uuid": "673ee4d4-ccf5-4ae8-951a-3ba8355cea73", "comment": "Malware payload (Mirai)", "value": "142ffdeaba0e157c4cbf4018cd9021da1adc1b0daeb2c3f18eaf9a00eb6451bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341693, "uuid": "b7cae838-4172-4628-ae24-18244708ab81", "comment": "Malware payload (Mirai)", "value": "1a5ebb45bff39a217b233a59f7c86a3aff76267e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341693, "uuid": "36c4422a-4c92-4e61-a2b3-09240d93add1", "comment": "Malware payload (Mirai)", "value": "0237fb6af3bda77c7ebd4633c8f954c8ef855eb473448e5bafe2897a025f4e480cf0a47e287c0dca4022ac5b82548fcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341693, "uuid": "2182df5d-7e2a-49fa-8153-a1f755c3dddd", "value": "T144335ACAF643D5F5FC1601381073EB72AEB1E17A0064EF86C758A936DC51A94E70A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341693, "uuid": "75e08d5d-66f1-44f1-9ac2-0f561d780a91", "value": "1536:AA86IHvFK+CMVOdbK7xxUms30byvPbaZer5:A36IH9K+CmLvVs30yvjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767341693, "uuid": "ac5d6168-27a0-45f8-86e2-2be0f8d40c8a", "value": 53648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767341693, "uuid": "559878c5-dbcc-4c97-a5e6-18ce5567f70f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341693, "uuid": "5ac778a6-6ad3-47d1-8aca-6061005f65ae", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31be9626-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385535, "uuid": "3e2a84e0-9216-4700-91a8-1094e5c84b31", "comment": "Malware payload (Adware.Neoreklami)", "value": "555905c982a90a1fce914ab149c4e01a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385535, "uuid": "5a736090-e958-4834-bbfb-b2863631bc55", "comment": "Malware payload (Adware.Neoreklami)", "value": "14b058bb9bce32ce1229778cc4611431f6e2b95b22d5c039b6090115a6fa34b8", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385535, "uuid": "a28630fc-b168-450f-9888-c0174c9fb197", "comment": "Malware payload (Adware.Neoreklami)", "value": "6dca6c70c05f7e606ec3f3327f9fcee369b60e3d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385535, "uuid": "5bb10775-a267-42f3-acf4-f6ccd1b3c9f1", "comment": "Malware payload (Adware.Neoreklami)", "value": "34e1ad7a09a75150853eefe2974703089d3d6eea133b7e2b8be71e6c89b59d74392ba984f542183485d1911d76451f05", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385535, "uuid": "d6d2b7c7-c988-4cc3-aa7c-e8d2215af78c", "value": "T1A7763330B5E7C5B6D5598133CAAB7B96F4F892064FB061071368473B9DAFA84D32C398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385535, "uuid": "9818deb5-fce3-4f7f-923a-4d0b207fd83e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385535, "uuid": "e04a9ef4-7feb-4acb-954e-45352b1481fd", "value": "196608:P1OR/qvGueRxZDG7hAP+g6+hkkC2DOakrnkeVYQqCfeD:tORXxBX2g77yV4uPfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385535, "uuid": "9ddee2fe-94ee-4cf1-9598-c2ea04a94519", "value": 7565044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385535, "uuid": "66be1fe6-8748-4ffb-b1a9-371ee5fd2d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385535, "uuid": "0df170df-82fa-4b30-94a8-cd65b51ba8d9", "value": "555905c982a90a1fce914ab149c4e01a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeccb30-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "d0d96c9d-2142-45f6-9ba3-a6989a43909c", "comment": "Malware payload (Adware.Neoreklami)", "value": "1cbe92f1e2eeafd60e39e6891f2594c8", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "434757f8-9d24-4df9-b340-2fd2239ab43a", "comment": "Malware payload (Adware.Neoreklami)", "value": "1518840d8e426941a3384f5e83aac5c4f549d1cc0feec9a3d999796da67bccbc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "70f19a15-6916-43f3-b0e2-1f9a29625d78", "comment": "Malware payload (Adware.Neoreklami)", "value": "0aa2543bee14d1ea17d3aa3c87cc32235771bd56", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "dabadd5b-4390-41e0-b434-81e10683b19a", "comment": "Malware payload (Adware.Neoreklami)", "value": "6cedb9fd726344a1a00e2c92e3ad987ec9c4ce7e15663cc163be4ad75bd0f3535409f48f3890aa8607262650563597ac", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "6235630f-e29b-42cb-80b4-776fc3a55ca8", "value": "T17A76334238FE46F7F05A6973EC4A26C4B8B8D6285B72690376948C1BBEFFB42114F514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "8a983412-e108-4fd4-a18f-bb937d2e6059", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "900d5daf-d0b3-4d96-90a1-5589ed896f58", "value": "196608:P1OyqU9od4797aa/fYLABGvSwexTYu4Ywc3CWh+HSD1zgbS5:tOyPp7aa/QMGBe1YuJR3zhIW10O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385389, "uuid": "7d365e4d-64f9-468a-8302-a779f7f36da7", "value": 7512974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385389, "uuid": "ab6b7522-ac54-4605-96f0-c1870d9e1eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "75bfc72a-73f7-41f6-8f3b-da608708db51", "value": "1cbe92f1e2eeafd60e39e6891f2594c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581d3af1-e774-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314732, "uuid": "9836ccd5-f457-4238-82e3-f8deadb3d7ff", "comment": "Malware payload (Mirai)", "value": "16fa43c12ab001c4fcb190779dbdb984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314732, "uuid": "a68729e0-1622-4cb9-b8cd-1dbb3e97dcbe", "comment": "Malware payload (Mirai)", "value": "153c37d21175c8d94c5623b0f8d6b493a911eb20bd322bad6a941eac8cb0d002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314732, "uuid": "6c5a4eca-4a5d-411e-89fd-8b820f10ade6", "comment": "Malware payload (Mirai)", "value": "24de125c0ede788d6d65556aae627e67f7ecb85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314732, "uuid": "5c4d3b36-5e0b-49c9-85a7-d6f33cf5d989", "comment": "Malware payload (Mirai)", "value": "3b8a2239b982a00097a87c6e571cdfd38a7f2552e3522750fd722e815237f5f62fd14e42126279705bdd96ab84c8ffaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314732, "uuid": "ea61224e-d139-499c-8dd1-66c9d7fae080", "value": "T16FF32A16EE50C0AAC096C1B867DBC1F2F731F8B40321372F73A9AD362E69E545B19356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314732, "uuid": "62ab89da-b452-4058-966a-c91198556c52", "value": "3072:O9zIv4E5+M+8x6RGTZ2lM9/naxqVR9EkbTuI0jelq0sX26drm:yzIv4ErU4d2lMNSc9EkbKMqNvdrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314732, "uuid": "f8e3641f-b4c9-4f65-bc8b-a6945687651c", "value": 161304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314732, "uuid": "8d7c1712-1207-4937-b770-438fb70fec07", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314732, "uuid": "3e5b7df0-953e-4c31-8d84-351f862436d9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01af98c-e835-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767397773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767397773, "uuid": "9f30febc-0bc5-4fcf-83fc-4f3a722eadfd", "comment": "Malware payload (Mirai)", "value": "acad92b73cf68c61fe980fe33a6e4733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767397773, "uuid": "c571f5d4-fb82-4f05-b06b-2defbc9fe578", "comment": "Malware payload (Mirai)", "value": "15414ad706d39b3ba5dc52180f34fef4b5247592ba4e8e7fe308204864e5d45c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767397773, "uuid": "30192828-b9e5-45f8-9ad9-ca8d38de66f8", "comment": "Malware payload (Mirai)", "value": "843e986f713c6bfc06255715af2b9bd5328718e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767397773, "uuid": "06cdc8a6-9294-4421-805d-14ddf6a8d260", "comment": "Malware payload (Mirai)", "value": "977a6873685a9deec0c9afaa9369fb37a0ff96b6849203c9acc9c200804ea056506b5fb91d56fe5dfa359b8dd6fbbab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767397773, "uuid": "696b3cc4-b59d-489b-94ab-79a896e51ce4", "value": "T12483C6097F614FB7EC5FDD3709B95B0428CC950A22A83B357974E818F28B64F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767397773, "uuid": "39f940ec-b169-499f-bd7f-c845edc96428", "value": "1536:LsFh89HG2QU4I7UUei5q9u6yr5q6Iga+07jqQqSu+7R:Lshkm2QA7LTqMS8Su+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767397773, "uuid": "632da75e-1cf9-4650-bbdf-47fa7f183b5c", "value": 87864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767397773, "uuid": "9e752742-9fc6-47e2-9c1d-1df647825a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767397773, "uuid": "86f49168-1429-4cb9-a339-4f9ffa9e2136", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab0bce5-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385738, "uuid": "875099b7-131c-4ad9-9329-62b4ccee7b33", "comment": "Malware payload (Adware.Neoreklami)", "value": "94b876fea581f2f6df595e0743977a36", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385738, "uuid": "806357a8-0130-4e11-9859-3aea152f595f", "comment": "Malware payload (Adware.Neoreklami)", "value": "1563eb53935c5f97134c641034926dfe6575e48cf17c54f9719c67c1bd6bb410", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385738, "uuid": "c247ed6c-66eb-414d-847a-a3bd1eb87b34", "comment": "Malware payload (Adware.Neoreklami)", "value": "24de839bc93b5647a2506b07fc5f42bbbf47f006", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385738, "uuid": "eed13f99-2755-40c8-9110-1b5dfba83b90", "comment": "Malware payload (Adware.Neoreklami)", "value": "98175103cfa3b96bac0de0bd00ef3a50d111726a01b072157286d703417898e130767507d87d5db94e0f767b6cd3dab1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385738, "uuid": "905f283a-d65f-49b6-a95d-d4131db7b4c8", "value": "T1A976331C3AF09A37DA2A0F349E613BD188EADF985C14C517B3FA075523F90D9457A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385738, "uuid": "865e2e5e-e0cc-430c-a4b7-f6166a5c04a8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385738, "uuid": "a82c1f46-012e-47fd-b669-ed1d90eed4e1", "value": "196608:P1OwnnktjXEJ5pc3BbpKNCZ70iTwKQ5fsyINRlCuCegGMWo:tOVoJ5pMBbp8iTrQ1k3/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385738, "uuid": "fade1678-a09e-48e4-9c4b-dea8f64c015c", "value": 7539930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385738, "uuid": "303362f6-63a9-48b6-8bef-8792d220c56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385738, "uuid": "bfd7e59f-0de9-437d-98a8-ee3f53944848", "value": "94b876fea581f2f6df595e0743977a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb629fa-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381611, "uuid": "d9e0e36f-b062-4d01-a5d9-2fc9a2d35bcd", "comment": "Malware payload (Mirai)", "value": "7df146b9b9b84651f514b7e18815f2d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381611, "uuid": "d155f326-7630-4ecf-a66a-93271cbdf4fb", "comment": "Malware payload (Mirai)", "value": "16200231a68112b1ef43b5e7866a451371f95a6efe64ce256e90c8ec0027aa0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381611, "uuid": "b8f73e23-5eed-4bbd-a111-e2fe52138aee", "comment": "Malware payload (Mirai)", "value": "e707aaf236293b72fdeccfd9c5cecb9c17721333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381611, "uuid": "dfc7ee65-dc42-414a-8648-f1e581592e43", "comment": "Malware payload (Mirai)", "value": "549d01a31a679299fa178dc0caff19c29d6c3936f38e634d10dd23335edeae61f48857b255de6f1576cf54ed6afd2d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381611, "uuid": "08b8bc75-de36-42d6-a1de-fb595117ff4d", "value": "T102335B21A8791E1BC0D0F87A62F78729B2F50B0F25A88B5E7D620F4EFF218D0555B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381611, "uuid": "f2433e78-dc6a-4fee-a4aa-03f83dbff2cf", "value": "768:atToWb7Qmnah6q9K9ZtHGEqrooT7g8LgxGvwf3eO+h92LFqB:IT9zxSK9ZxGEqrooTM8LgxtshP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381611, "uuid": "1bb8ef60-13cf-486a-acc0-6232e2700ada", "value": 54732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381611, "uuid": "a1e29698-dd9e-46ec-83d3-b11807931ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381611, "uuid": "26c8c82a-6056-485d-9616-46b085bb65e4", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4efe43f-e771-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313626, "uuid": "c6c72813-cc49-4765-b5e2-f861e8214ead", "comment": "Malware payload (Mirai)", "value": "2ca78feef8d15f4e2d399ffda58ff05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313626, "uuid": "a99a3889-f838-480b-9b41-c2fa87a18735", "comment": "Malware payload (Mirai)", "value": "16295bfb32b1357c9f155fb784c636d62c3bd9f786896fc17f4447d3f88cedac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313626, "uuid": "65d33299-b78f-472b-9c3d-0247e4ff10c0", "comment": "Malware payload (Mirai)", "value": "85c34d13eb7dbfbf3b6628ee7e86ef040eebec25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313626, "uuid": "57283bd4-91fd-4e76-932e-1d8e83ce4c28", "comment": "Malware payload (Mirai)", "value": "a4f11820afde5cfbd0e4ca1691849860ba6f5e0d3867df17ff0cdda8ad6f249131f44f03074f082382e76780f08bb03a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313626, "uuid": "8e0c4e4b-bb0c-42f9-b8e5-59efb882368a", "value": "T1FD530945BC91D616C6D462BBFA1E42CC332663E8E1DE7203DD21AF15778A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313626, "uuid": "ec8e75c8-b28a-4a87-9886-12489869ee9d", "value": "768:eRlbqPDcKRs1/RgWdDPafmkYOsgS+uGGnJm9khO9IH1mN7IZVBwzw8uJYcmu+7RP:IbxKoPafRY5gBu7nJLhWsWIWzIku+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313626, "uuid": "ec87ff93-dfec-493b-bf67-cecb55fcaed5", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313626, "uuid": "39e91423-862c-4f1d-8e2f-996a3402447e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313626, "uuid": "f450b929-0020-410c-9293-ad3723675e8b", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3814b850-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385975, "uuid": "396dc6e7-ee16-4a70-9694-d018c1a00cb8", "comment": "Malware payload (Adware.Neoreklami)", "value": "dc9971258dc2e482fc56d1c4a0357a57", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385975, "uuid": "54c6ca36-b77f-4255-8645-d089d5b2078d", "comment": "Malware payload (Adware.Neoreklami)", "value": "16a7f0095feaf36c8d5c35ba9354ab337c5cf2cbbe9311d298d11d054b421446", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385975, "uuid": "5e4dc962-7dc3-4533-bc1e-cc3015db17f6", "comment": "Malware payload (Adware.Neoreklami)", "value": "97c74468f49bac4f3a9825a21a28a85d1138e852", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385975, "uuid": "04ee9eeb-48c3-4987-b624-28528b1a8aee", "comment": "Malware payload (Adware.Neoreklami)", "value": "f27fcd5e00ad84823189628f7c2113d117bdcc9204599febf1a5c58f11677090e723bf71c1fe753e6097b07980e0dcd5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385975, "uuid": "d8e3430a-1b47-4f87-971e-9acf32fa4af0", "value": "T1537633F776E28CF1D0918931E9E0AF977869D9840F01EB8327904D1C4F3DA56D258BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385975, "uuid": "6d6cfa70-0aeb-4d50-8266-746aaaa55bb4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385975, "uuid": "862315cd-0f33-4776-82de-e1095e881fbc", "value": "196608:P1OaN3w4zoFsiPCxpAdnlZJH344f0w/0lcvgnt1q:tOaNAkoFf57HI60pZtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385975, "uuid": "019670bc-d520-4b60-9d2a-0d355ce2a7be", "value": 7563581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385975, "uuid": "a5e3e9ac-9544-46f5-9750-0c7de7cce6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385975, "uuid": "ece0bd49-073c-4ea2-b995-783eaa8d4688", "value": "dc9971258dc2e482fc56d1c4a0357a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ff2dac-e7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767362240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362240, "uuid": "f9b420a9-0a29-421f-b72e-2ac5376b4414", "comment": "Malware payload (Mirai)", "value": "5f4874e2758b3813c43693403991ef22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362240, "uuid": "07d59c2d-8a4e-4f4d-b363-69dd2a80be3b", "comment": "Malware payload (Mirai)", "value": "16be7389fd63763aa6763997fa0ffaf41ee2cfc07ea6cbed3a22ce2485e22b6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362240, "uuid": "c5ec955b-aca9-4124-8cde-d0f43f2c376b", "comment": "Malware payload (Mirai)", "value": "f94aacbc819e7dec3f4cb7e3712ee653207015c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362240, "uuid": "2a9cc870-4578-40dd-989f-fd3bc85eff0f", "comment": "Malware payload (Mirai)", "value": "c4a511d12614db4cf7d5942c0d8f10bed9663e01d0800922771b9cdc9d001563758d5192b2fbc386147d40f9326d370d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362240, "uuid": "f95e5406-455e-4fa5-a5d3-04370a47492a", "value": "T173142907B5C090FEC4D9C1744BBFB13AD976B09E123CB29B6784AF222E49E705B2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362240, "uuid": "1f836bf5-2aee-4898-aefe-3b9ecb917c3b", "value": "6144:nI8PROvlVhsPzU+yAcO3xYuIEVa465shZ:nhQAxYEVIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767362240, "uuid": "f00780a9-326d-493b-98ca-ac3dd32c1ad1", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767362240, "uuid": "b8487322-5388-4d4b-b5f8-bda1254a1a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362240, "uuid": "31720f1d-3139-412b-9bca-4ce0f677c82a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca662c47-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385362, "uuid": "0159ec98-7929-41cc-9e2a-2f560d54b286", "comment": "Malware payload", "value": "0fa65cb935ae0f2cfc7b27d68831fd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385362, "uuid": "4cf3b74a-3c26-41db-8cfc-8e7e2238e15a", "comment": "Malware payload", "value": "16ff3a1078dfbea424c3addad1b372a99b010be820c48fef39f044536e8b9e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385362, "uuid": "7452abbf-40b5-46fa-b2b6-48becc510081", "comment": "Malware payload", "value": "efea1372276fcc830555a8b6134ff1c8e303be47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385362, "uuid": "68743e92-09d1-4ac3-a5b4-f5c22943d3e3", "comment": "Malware payload", "value": "71403a964402eb94f5c7988f4d801918570ffa2124f01aba77992d15b2d4907b563de6532c0ac1086ed703f4e9565a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385362, "uuid": "8b900532-c57e-4dae-b34b-9bb27acd5e59", "value": "T1350633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385362, "uuid": "bf704c29-83ac-4328-a306-dbc6f077196f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385362, "uuid": "ca9f8376-4ca3-48de-a0c5-323dc7490d78", "value": "98304:aZT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:S2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385362, "uuid": "15665b34-70c5-4b3c-8346-be7c52ca05c0", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385362, "uuid": "5d245fff-8f22-4c73-9ee4-21096a6bf2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385362, "uuid": "41e9ec2a-6e94-4a2c-9e6e-f70a341c2d09", "value": "0fa65cb935ae0f2cfc7b27d68831fd4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171e0ff8-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381625, "uuid": "ee4dd35d-be34-4a11-99b5-93d33e1122c2", "comment": "Malware payload (Mirai)", "value": "0d37acfa684e1e41c93ba6fbbd0034b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381625, "uuid": "80a9dac8-1393-40e2-bedc-8480e29aa74c", "comment": "Malware payload (Mirai)", "value": "17152a553c6e63897dcdfb6c2f8be8e79a5877881bc39e3fb63249fe27df7435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381625, "uuid": "0ab0faac-0181-4776-a6d7-71ee724e4246", "comment": "Malware payload (Mirai)", "value": "6f2652725ac7d63e42bc912404f92632b5ed78f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381625, "uuid": "fbbe901d-e767-40d5-b43a-82d5ab365fc2", "comment": "Malware payload (Mirai)", "value": "c54e8adb3dd41b2c86c88ddfbc0958799704f2344da1da06a98714ab2a65d0d4ea390ca8ae6d27e88de906081fd15d36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381625, "uuid": "8fdc2bf8-869e-4d38-a2b4-3550d0a8a820", "value": "T1E193D81D6E219FBCFBAD863447B34A219648339627E1C685D15CEA012F7034E349FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381625, "uuid": "fff5cc04-3cab-4789-a25d-0d27ee95deda", "value": "1536:iuJv3A53+9DqddYhwK5jna4BFpoWA+L1Uxep+FLw:V3y39YhL3BFpoj+L1UdFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381625, "uuid": "8eedb8a4-7b6d-4010-a450-b7ddf4c0d743", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381625, "uuid": "b7507df3-056e-46a5-bf40-e250bb7d8e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381625, "uuid": "67c35895-5d86-4488-a1e1-c18290c10c02", "value": "meerkat.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cd6835-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385602, "uuid": "1685a531-1dee-4c15-a178-80fa0e70cd5d", "comment": "Malware payload (GCleaner)", "value": "6c0eca81092c6a3c46b9840486ee83b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385602, "uuid": "b8e40ef4-a5dc-424d-ab8d-6e69689d3a61", "comment": "Malware payload (GCleaner)", "value": "1730d92f6abf5760fbb0d03a5eae1387bcbeea2e4f25eea16e95545fbce9810b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385602, "uuid": "597189f8-6e5e-47c3-a7f1-3f56bc436c7b", "comment": "Malware payload (GCleaner)", "value": "793798d114fd9fe0544e78b46afa6a39b71304e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385602, "uuid": "68ff9afe-1d34-4d6c-82c2-5788fdb7b4a4", "comment": "Malware payload (GCleaner)", "value": "9986455a0a03274dc876184310db859edbe18b372dc2915f7243ce0e8873d074e7a612670b4322595074dddf71c95ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385602, "uuid": "abe0c681-72df-4ead-914b-013f70b237bb", "value": "T15516D001FFA08B14C7E3D23FADDF1EC81A745616D9587CC970E0B98726AA65D5E23283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385602, "uuid": "fcdaec52-af2c-400a-9c6f-8ff7da245c21", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385602, "uuid": "3ab60013-7126-4806-ae62-a72af0f40378", "value": "49152:pyjLZgtAQQxydgjWpIJcKyAMW1mLklXfPM7dtoRHV7yR5loLkN4rbTg/Vd1rnuUh:pyusxt+KyAMWy+cc9yR5Ks4rfgrxnu0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385602, "uuid": "e9ac873a-0987-4107-8ea1-1a7b3e165179", "value": 4166928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385602, "uuid": "e8a6c263-60d5-4ac8-a798-497f8360fce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385602, "uuid": "6ceb9a8d-dbbc-404e-afb3-36685164741c", "value": "6c0eca81092c6a3c46b9840486ee83b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194f4a99-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385494, "uuid": "c420f72b-6bea-48fd-bde4-8881d36444aa", "comment": "Malware payload (Adware.Neoreklami)", "value": "46798b4a1a8da9c666051f3cd746123e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385494, "uuid": "6c79bfed-68fc-4a82-b26a-8d8227c1c308", "comment": "Malware payload (Adware.Neoreklami)", "value": "17e3a4f10e5a9c2c49de65877a7e3e683c7828b6985d3780bbbd604687e825d0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385494, "uuid": "bcbeedae-d600-4269-b99e-3f63171ada6b", "comment": "Malware payload (Adware.Neoreklami)", "value": "2d4e1eb2b27bbfc040df6f26f9e99dd69a6d62df", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385494, "uuid": "13625eed-9a6a-40c7-8ce4-f2475bb94853", "comment": "Malware payload (Adware.Neoreklami)", "value": "ed5b9e7cad873a3cb2839e08b72457be39ffa78d19fe137fa372ea427718c4dc9e2dd48353cad225b9cf174e05b5757e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385494, "uuid": "75050ec6-3fdc-453d-a21d-6af4d689ba94", "value": "T1117633B031D5C4FDE22C02318ABABFD581BBC6954DA96113E3B58D3A477E137504AF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385494, "uuid": "5899ca9d-91ee-4042-89e8-abf7477d7cc7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385494, "uuid": "5df80ce5-4db3-48fe-b78c-1565493b9a77", "value": "196608:P1Ord1TmNNE7LpVS4QRNsJvqiKY+LAzYGBcdgXUKdM:tOrdIGLpMNevqiKYEAzf9UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385494, "uuid": "b685cb10-a9f5-42c0-b17d-3453c07e3381", "value": 7587934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385494, "uuid": "81d1ebaa-f79f-4dae-9e89-6034a5bc8042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385494, "uuid": "7a09fca5-8eb8-4d66-821e-87bef87fbe15", "value": "46798b4a1a8da9c666051f3cd746123e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a128404c-e81e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1767387869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387869, "uuid": "a1bdbab7-81e9-4136-b651-267b9ffb91f6", "comment": "Malware payload (Gh0stRAT)", "value": "f34dc92efcc046ac2694231d504c0165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387869, "uuid": "5d7784c7-673f-497f-946a-758285e2cf6f", "comment": "Malware payload (Gh0stRAT)", "value": "17e58940134e52257987399e55812858586702e79a0d70b568d71cb7ae632897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387869, "uuid": "90a99035-48bf-4de4-b81e-131383324a09", "comment": "Malware payload (Gh0stRAT)", "value": "a80d4ade0030d13157e5945c388ca3a239609ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387869, "uuid": "4c8745b4-ee29-46f6-a0a8-8d245ed210d4", "comment": "Malware payload (Gh0stRAT)", "value": "20ccf10aed7eb9d2770e39e7ed67ae1fd60579a3eaf30fa36fe19cb59887b2ce042b6d8a8d27e797b14c17653aee12f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387869, "uuid": "b596d019-1e1b-4fdc-8b93-ce24f959ce7b", "value": "T10AE63323B2CB613BF57E4A374AA7E212543B7E3168168C6797F4086CCE294D01E3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387869, "uuid": "b1ae9f11-52b6-4880-bf4c-f3316f675a22", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387869, "uuid": "8f3a68aa-97b9-45cd-8043-fdfcd0c5e54d", "value": "196608:4SsBeeRFIUUekAqRYmu2jGddnyWtemPM0zK13t99QWvveSmPvgOlvW5C4zAPH:4NYeRFIrAVnyyRPBO20veSmPACdPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767387869, "uuid": "0d6a65f0-50df-438b-8ce8-76430335c783", "value": 14479080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767387869, "uuid": "b428cc03-d084-4120-b521-a871c0aede0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387869, "uuid": "1db3d115-d68d-452c-ac2d-303f527a5179", "value": "NibblrAI_268581.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89b48bc-e7ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767367803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367803, "uuid": "ea88cd95-2675-43f7-bfdf-bd1aebac390a", "comment": "Malware payload (Formbook)", "value": "44796d0de9404f45b0e88f3b0a0b00ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367803, "uuid": "c2fd9577-44e3-4491-b7c8-983af0231324", "comment": "Malware payload (Formbook)", "value": "18bcbb69ee3d1e2fd3e6555bd39d384d8030cd333a4aaa924d761a01ff83fdbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367803, "uuid": "377b2f9e-e722-4d09-88d9-6b933be98c25", "comment": "Malware payload (Formbook)", "value": "85935e5d7bd9f9d9eaa2fa5a4da6c29f43258925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367803, "uuid": "1f26a97e-db02-41a5-b4e3-7cb9454eb06b", "comment": "Malware payload (Formbook)", "value": "a7373ab3e5ae0ec9e8df74c4a8c4231c5d862ff6dfaec07767120a737e0a370e3f182f2f646184af51a15337b99c3119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367803, "uuid": "d691f602-d90e-4c4a-b9af-01e68b970ba5", "value": "T11FE41219270ACB06C0E28FF25932C67427B86EDEE990D347DEE43EDBB07EA585554342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367803, "uuid": "77597aba-a82d-4a12-9b1c-e3a8712963b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367803, "uuid": "2be55a7b-dc76-4c81-8e5a-c83862e1cbfa", "value": "12288:J8Bc6UmKhaRe9FWStYJa1M5lY9gRtxLOQ9MC6dii1f10ZMWOn:Jx6vy59FrY5MCtxn976Ye+ZM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767367803, "uuid": "887d8761-466b-477e-a8c3-31cb6d4d1ac8", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767367803, "uuid": "f07ad8c8-a9a8-4987-88c7-e231c2d0d1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367803, "uuid": "8a3e57dd-2a67-472e-b55b-a7d59fa53dd6", "value": "HSBCONFIRMATIONSWIFT.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04422db-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385398, "uuid": "ae4f0a88-762e-474a-a564-c659125bce77", "comment": "Malware payload (Adware.Neoreklami)", "value": "20a8aa107c7b2cf1172c25f8ba140737", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385398, "uuid": "ba9cea5b-289b-412a-962c-782e20739a59", "comment": "Malware payload (Adware.Neoreklami)", "value": "19303048ff7360a178e5e76cc0cbe69aaea39dba4761d5e84ba9d6d6e7edda17", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385398, "uuid": "7fc6810f-662c-4246-a672-218267d4ef36", "comment": "Malware payload (Adware.Neoreklami)", "value": "965b0fb1d84b8b2914e516b5b9121ab30822caf1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385398, "uuid": "d1cbbf86-5f5e-4a90-ab71-73c6403d7f2d", "comment": "Malware payload (Adware.Neoreklami)", "value": "93594a04e4eee32b84d0f67fd3e0d711ac1f5b1dee1d6afdb1b0d25f33abe2c5f7edac24c00d52d7d306d1a43761580a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385398, "uuid": "1ca136b9-d672-4245-aaca-dbd0f5bcc6cc", "value": "T1AA7633A032D875BEE2E922325B967AD661E2D6705B100D631F04437DB87E3E1E13673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385398, "uuid": "9c02874f-64fd-4f9c-9668-444c87cf71e9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385398, "uuid": "c1d431f3-46a9-4b4b-895d-c2d6bb7b96a8", "value": "196608:P1O5Uw/RbKuYyRUtS/pXcQCn/bbMiwsPWI29ULP5eEdSirqv:tO5F/8uYyRES/pXchn/bQiwQWP9hOSi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385398, "uuid": "97014cd5-ff19-44d9-b530-238c76facee2", "value": 7573554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385398, "uuid": "c7f595fc-e5f4-47ef-b438-edb5b659ca08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385398, "uuid": "b030ee27-9040-441d-b708-83e8a3f45fca", "value": "20a8aa107c7b2cf1172c25f8ba140737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f575d7-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385883, "uuid": "9e349448-5cb1-4cb0-94ce-4820b62eb23f", "comment": "Malware payload", "value": "c168966060993b4552cf9531d2c4dd5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385883, "uuid": "6d40a590-c056-4d50-8206-8173465a1eac", "comment": "Malware payload", "value": "19835f01870b3357c6563ccdd62a3a44f9d816d580570f5ac783cbdd2d004c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385883, "uuid": "e6656f95-7823-472e-b4a3-ee86ca2aa183", "comment": "Malware payload", "value": "4ba17873d880772a5513ec88f9d222ab5d1b91f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385883, "uuid": "13cd9c98-f83a-4a8a-8011-01277293fbe6", "comment": "Malware payload", "value": "f60bc17678347293757e6c3893def04015bc98242b00df6594f3c455f7b25b071e41659b5a809cf206637c66034802eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385883, "uuid": "59277d9e-720e-41e5-bcb9-f1573f949e35", "value": "T1730633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385883, "uuid": "ff862f1f-118e-4965-9ff8-56e6ec69ad66", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385883, "uuid": "b2fbfdb2-2f24-4196-aef0-0064b1bfc02f", "value": "98304:a9T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:22w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385883, "uuid": "a756f8b2-629b-490c-a6ee-863dda6f8671", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385883, "uuid": "9d49517d-c9b5-4a3c-a3a1-340db4dd551c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385883, "uuid": "aac5cb7e-1c23-4927-a2c5-f2767cb515c6", "value": "c168966060993b4552cf9531d2c4dd5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518cc754-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377428, "uuid": "11640ad5-b9af-4faf-97cc-4fa927fa26df", "comment": "Malware payload (Mirai)", "value": "8f007273fb931dc9925c558675faeeb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377428, "uuid": "466a8c73-1e14-4b1d-9109-48662015d780", "comment": "Malware payload (Mirai)", "value": "19a00cf089b92f808016f1d60aaa71fee84cd4557fdcfe735ee9ce5b188d546a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377428, "uuid": "301dd7bb-b83a-4cba-889b-d90fbad9149d", "comment": "Malware payload (Mirai)", "value": "0746687709eea1fedea53413997fed898cf2c8a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377428, "uuid": "172b36a0-1e2a-4abe-ab88-7a27c04377de", "comment": "Malware payload (Mirai)", "value": "c8f9c79e2e88b3b8081d427c897ebdad0a81ae4d360a7f4dab74a24ae81320c6a5bf30c7aeec2c4b434aabbd4f5c573d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377428, "uuid": "f4d3702d-145b-4daa-91e6-46c1a451d900", "value": "T1EC930882BC82995ACAE4137AB66E228D335277E9D2CF7217DC104F257BC951F0D37A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377428, "uuid": "ddbaa7ec-bb7c-4fe3-a38e-81bf04fe0cc9", "value": "1536:K7ASl+yydUBvsffzW93YS72yUJkTRwYWAMPUXX2p04a7xt2FL25zP/wd8/Qj:sA6EdUBEXzWMHAcp0VxMEc3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377428, "uuid": "50f9915d-b888-4335-aaf1-a7bffe6f1081", "value": 96624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377428, "uuid": "80da79cc-cdd4-442d-bf65-0c4b80a2d34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377428, "uuid": "42cfc4b8-d84e-4379-8658-92420e05c835", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a049111-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385925, "uuid": "b7a453c3-37a7-41a9-bf08-f628b76a343d", "comment": "Malware payload (GCleaner)", "value": "cae1f7da7bee6be7d6029fa7501d1be0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385925, "uuid": "3d0f6bcb-8cd2-4d16-ada9-193c58e33579", "comment": "Malware payload (GCleaner)", "value": "1a38918a094b23b6f21269eef556533dd31c1e3139da3c1da985bb35d40a33a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385925, "uuid": "2e9884a5-ced8-4919-af6f-731f5a9259e2", "comment": "Malware payload (GCleaner)", "value": "49d28e98e8c8c864c8c2d4b76818582daf631af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385925, "uuid": "b3c7ba9a-6094-4680-9436-7f50a5c0fcec", "comment": "Malware payload (GCleaner)", "value": "fa5dce0e96ba5c3aa5599abe2c9fe697dc1707a1c44f89016b29ea4f025b7021735a5ee18e03043c9a8a5b113d842455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385925, "uuid": "2cb0aabd-44aa-4914-804c-5097a99fde72", "value": "T1D326DFEBE18005F3EAB605F55E017BB704356A75D82FC3072B948AFBA67CE836815643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385925, "uuid": "0354a7ca-6668-45ff-bd47-8cfbcccca6cd", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385925, "uuid": "66b742cb-53fa-4427-a3c2-4eee4bde30c3", "value": "49152:tnOmCMH40VKVllPv55Gdy/ymGepRrDwMwIo8YZ6itjo+8TVI4lh0en:tnwFPyBdepRrDwM1o+itjo+QVI4l6en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385925, "uuid": "139eb2ef-f46c-4bc8-bcb0-02317854083f", "value": 4792592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385925, "uuid": "fe6fb147-3518-4ed4-b5b3-78b8177a569b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385925, "uuid": "46c261a7-54c8-4216-984f-2dcbdcfb9cbd", "value": "cae1f7da7bee6be7d6029fa7501d1be0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc64b3d-e7a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337020, "uuid": "d832e716-5617-46e3-9604-855ef383e2db", "comment": "Malware payload (Mirai)", "value": "437e61969dc582f06315df59f345a714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337020, "uuid": "0694c818-e1b2-4aaf-a33d-b106716ec285", "comment": "Malware payload (Mirai)", "value": "1a922b89a7e3e39ee5e12540f835814c0543c66a15507305e2d07136f54b6b2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337020, "uuid": "f962789f-0a03-40c5-a47f-16c54e8b888a", "comment": "Malware payload (Mirai)", "value": "af7b4a26ca811911dfb94dd90c553599c46152fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337020, "uuid": "1241b234-6281-43de-baa7-c8863f9e8cae", "comment": "Malware payload (Mirai)", "value": "464997a3276dac9b180547063d013f1989916517bf309c2352d73fcefd46d2837a5cd145a76dd1dfd45c3532b98e2071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337020, "uuid": "11f0e7ab-129d-4ea5-98bd-e5736f563376", "value": "T1A5A38DD3DA92E8B1D8211075223BA3618A32F1312436DD4BEBB53F36EDA5741DB153AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337020, "uuid": "6e7e0e31-afee-450e-b0b0-2fea36c5103d", "value": "1536:ysC77+bqIimBjndjBYgEgdCEgbaBBYHytqEgI+8AnWOmhcWiILr8gJVxPogsesNV:bC7a+8bvCPbXS8HkD/Lr8gJV5oTXiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337020, "uuid": "d0154804-8e7a-4b5f-bad5-d15fc6e8032f", "value": 103664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337020, "uuid": "ad5a1d23-990e-460d-a48e-3f7e606e5158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337020, "uuid": "21bc84c6-2908-42dd-981e-47ec0d78c121", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9775ee94-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385706, "uuid": "7a8191be-55e7-464b-84b6-6c2b12a1fa86", "comment": "Malware payload", "value": "88a161ef203c90466d1405035ceb9a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385706, "uuid": "ea9602c2-0bca-4650-8c69-c565c6c662b8", "comment": "Malware payload", "value": "1aba835878f1cadb71beb1a45f6031053fde04e3c7496e9bed4a41f2263c0398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385706, "uuid": "e3aebd00-7f74-4b76-89e1-94ac8643955d", "comment": "Malware payload", "value": "586a30caf2e2059a131e3dcea154b9e3c9b6a93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385706, "uuid": "db2f7884-7fd7-46c1-8acd-2b05fc9396e2", "comment": "Malware payload", "value": "1b7f003cdf8e776df4ea911def34f276dcde41a70fc9217c6af049355ba0ffbbe5556c48ea7f0d651dc1d8fa91888dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385706, "uuid": "5bb9fe17-9d0d-4082-8a6d-498b956dfb6c", "value": "T1B30633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385706, "uuid": "eee44d6f-fc2f-4fb3-ba30-0b10c9823269", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385706, "uuid": "6c895e16-31c0-48df-87b6-8ef0743a04c1", "value": "98304:arT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:g2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385706, "uuid": "97362999-ad79-49a7-8622-df63a3f45da5", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385706, "uuid": "07660667-af68-46ad-863b-ec8248eb23b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385706, "uuid": "1bc109ec-75ef-497b-bedd-81354c797aab", "value": "88a161ef203c90466d1405035ceb9a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8c66b5-e7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767370145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370145, "uuid": "091863a5-a44e-4530-9110-3ede93fb8434", "comment": "Malware payload", "value": "5251318d67f74cf3ae92b14a18488c61", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370145, "uuid": "f11a32ba-ef4d-464d-a375-10f94c9470f6", "comment": "Malware payload", "value": "1b01df3731e1507392151ebb0200f7b5fec2fd05656eaef17b0a79e2d7770320", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370145, "uuid": "2ba17372-0c53-44b0-858e-2c22b9a7ebc2", "comment": "Malware payload", "value": "e0bc6d54b9719702372143ba28e17433394d13aa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370145, "uuid": "8c859ab6-69f9-4ad1-87b7-98158ac9536c", "comment": "Malware payload", "value": "6f5708a520ec8e961f481c4d12fcc664a95196a9c7d24b9f4016b2cd66d6948aa056a5a221049b9c54cc5dc20b483931", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370145, "uuid": "4924cd31-3e8f-437b-b4f9-c7f324dcca5b", "value": "T181A65BD3BE544229DADFE23AD87162462230B045173262D7BF650BA58D0BBC8573B72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370145, "uuid": "047cc6f5-fc87-4d79-91dd-a332bc882f53", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370145, "uuid": "3bc4fe18-87a7-42de-b22e-40ce3e5915cb", "value": "49152:jGAJqaFa/8rb/TBvO90dL3BmAFd4A64nsfJ4ZWyGn2M3UXb3cwyK15MXHaspcnuB:jvEyTFnQ78KcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767370145, "uuid": "28e0d221-df1e-4d83-9664-adb26791cedc", "value": 9938048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767370145, "uuid": "0490d13d-74d2-48d8-a6d2-5d772bce3603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370145, "uuid": "b813a57b-66d3-49c1-a32c-3b2a5b48713b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f2f34a-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385967, "uuid": "e4647c3e-6e0b-4938-8278-8822dc4f5fa4", "comment": "Malware payload (GCleaner)", "value": "d94398f2e8aa661bbed84bbbd464e5a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385967, "uuid": "ada73851-7d97-4f75-bcc7-a6a90bfdace4", "comment": "Malware payload (GCleaner)", "value": "1b80f23026662839e128f74c0b2fc0fd86f839cee4695f2a8a11eb901e9805c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385967, "uuid": "7d7b60e9-f4d2-48f9-b506-2f240478dd6e", "comment": "Malware payload (GCleaner)", "value": "b7458611bc0223ccd09e443f7d6aff0f6921c0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385967, "uuid": "e4a86887-12f6-4dbf-bd53-4bfd4cca5762", "comment": "Malware payload (GCleaner)", "value": "040e0b34f2b69f9b0b73b08cb501f0f2445c70ed340221226afc098839cb6223cfa263797c5ed4957bf128ac8d52c204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385967, "uuid": "be02a474-f1fd-43a3-ae4d-d50e3b13b86a", "value": "T13346CE32C3A8CD21E52207BE2CAB311AFC27A8E1D81D3EC9D6DECD725AD63451165B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385967, "uuid": "5eebf005-db8d-4160-aa45-fdd9ac6f6784", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385967, "uuid": "08a71d35-e534-4e3e-a9c4-b5c56fdce23a", "value": "98304:LXAcvhPxvbg0hmOz3sZe8WrnrXivSSLBFaTVnsxsPfN:L3rnhmEcU82rXi8Vdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385967, "uuid": "fbeeed01-b44c-4788-b56e-7089c01943fe", "value": 5475600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385967, "uuid": "7bb1cfa6-891d-4044-8a7b-80e841d2f6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385967, "uuid": "d5dff6a1-7609-455e-9b96-a13156eb277a", "value": "d94398f2e8aa661bbed84bbbd464e5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d70e771-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385957, "uuid": "632bd6ef-682d-4a59-affc-9ac5dc1399d0", "comment": "Malware payload", "value": "d341ca537be9aa536eb93df278e50ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385957, "uuid": "4a19179b-268b-4028-b99c-0ce6c2726356", "comment": "Malware payload", "value": "1b9fee0e8df0040379d3375c80db6229bd9fe2e60ad777a5e1c87eef86d7a7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385957, "uuid": "3be90c5a-2dc8-4994-83e7-6ffeba6e5ce3", "comment": "Malware payload", "value": "d0e6ea946320f653b4f543eb1bff7f0f52fba04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385957, "uuid": "3462a0dd-a2b3-4eae-9324-f15faef428b5", "comment": "Malware payload", "value": "d9e6a611275723c63079f4420947a25f007cac1a3dedc8e9eee07df049cc7d62fbc4c56266b1fbaf9625f474d9853c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385957, "uuid": "c2f528e7-c6bb-4de7-806c-b8f6635faf26", "value": "T1F20633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385957, "uuid": "066d9ed0-14ef-4366-bba0-ab8ec940cc3d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385957, "uuid": "878cc17e-4017-4c90-b1d1-a9ca6ac3f718", "value": "98304:aaT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:l2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385957, "uuid": "e5641d23-816a-4c7d-96cc-e50bb4c47d4d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385957, "uuid": "ca291025-b9e8-41a6-ba8a-4145c7eaaf66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385957, "uuid": "4d5902fd-16f3-42ef-9a6a-80227815b20a", "value": "d341ca537be9aa536eb93df278e50ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040b6856-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385458, "uuid": "faa36c3a-6029-48e0-b7a8-5f8876be3b24", "comment": "Malware payload", "value": "3879e1895f6f4a85b28beb17372957ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385458, "uuid": "1a57acab-5710-423c-8db0-3f867f38d780", "comment": "Malware payload", "value": "1ba3fa593799cace6569a830f3a847db424a87316ca45d8342811c59630bb122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385458, "uuid": "afcbffc9-c4f7-4643-9164-57a9a58f1ea6", "comment": "Malware payload", "value": "8ae227cf06addd080a892edef2f79a71e7a23767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385458, "uuid": "35110bf5-6140-4936-ab3d-92566e2beb08", "comment": "Malware payload", "value": "bb9587172e0a68d1cbcddf6daeafb371660e04940b9bdf6ad1894596afeea49886a40e442b8c440e7ec838066813475e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385458, "uuid": "43920650-095f-44d1-88f6-56b44e5e032e", "value": "T17F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385458, "uuid": "df89d43f-7800-4484-ac9c-d2e5fffaf53c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385458, "uuid": "712edb43-c8fc-4dd4-919e-14017abfff57", "value": "98304:aLT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:k2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385458, "uuid": "5736c38a-9487-40e9-8162-626cdd3ba8a3", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385458, "uuid": "62ffec6a-80ab-4232-af23-7e73db6d3e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385458, "uuid": "d27d7092-6ea9-4a13-a789-1548852a5577", "value": "3879e1895f6f4a85b28beb17372957ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fc53c9-e775-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315053, "uuid": "a54804f6-49e1-4158-851f-7fb95f91d31e", "comment": "Malware payload (Mirai)", "value": "21742e1e6109237144af8e1fc000fe21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315053, "uuid": "cee2da40-b91a-47f6-9126-14bfbfeab28e", "comment": "Malware payload (Mirai)", "value": "1bf3d9016dea8667ab2a592819282b9f7fa2a34edffce9e2d231211299337923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315053, "uuid": "b4125262-efe9-46b7-9180-8e493535c852", "comment": "Malware payload (Mirai)", "value": "abc1fc0d4287fd6370dddcbb1daf172c3c480aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315053, "uuid": "88af1967-d1e4-4540-b801-0ce5b7365bb9", "comment": "Malware payload (Mirai)", "value": "1f8edf4197e47735c3109e74a91cbc2153e0a39903a16fbe9ec7c4d10667387bf6ca3febc51e46e1e691e2018f63eda4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315053, "uuid": "ab1baee2-f587-4b56-b37f-100d2a686099", "value": "T1BA131A92E404FD3DEC4BEB3AC613490BB570765586910723B377FC939E72298942EE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315053, "uuid": "f49351cc-e3fd-44d0-816e-5ddc3e19939d", "value": "768:XWHPohCQOH0+wHjzEmExzSuJtOD23D/HLXYwy5bX8gUGkF2amfJ9srt7aDPlcf:X+T/H0oxWuJtOq3D/HDqhX8gQF2aaJaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315053, "uuid": "e7dbb289-e233-47d7-8f39-e9b0a0a67651", "value": 44776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315053, "uuid": "a16aead7-8e12-4b7c-9530-846ce81c79ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315053, "uuid": "4ac7f3a6-877b-46b4-9b68-db76a2835511", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e378364f-e77a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317543, "uuid": "a246649f-3ef1-4b01-a571-7c176274fa77", "comment": "Malware payload (Mirai)", "value": "5762ee1445030a6af3f994ad2cdbab07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317543, "uuid": "fc62566e-b5b8-4467-91f1-3ea26ee04311", "comment": "Malware payload (Mirai)", "value": "1c14cc75543c87ea3508f947371482350f69f472522204f6746558c74fe7402f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317543, "uuid": "5f7f9995-71be-4e14-b952-ab6c570ac7f7", "comment": "Malware payload (Mirai)", "value": "0e6b6a63444ad20195a8a14bc04e0e048eb38294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317543, "uuid": "29adc85c-58e5-435a-9466-8d148b0b5bdd", "comment": "Malware payload (Mirai)", "value": "404f75a52cb1003b2699c5e98c9bcf0471915943e84f28e9b16fa3f9db90c5ab6905586fc3a9e12f0ba4b228590b2bf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317543, "uuid": "21500f5a-5a82-4e86-8c07-4f768b6b1262", "value": "T17854E742EB416EBBC00ECE31011F878916AD849943FB577BB278C55E7B8EA0D69C7E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317543, "uuid": "231e278d-e505-480e-81e3-00f9a70df52e", "value": "6144:KEN/2Gajv4yb3nRqgeOT0g9/J+ksqhcxYerkQ0ow8c7ybW:KEKUxprkQ0ow8QybW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317543, "uuid": "d3c081fe-78f1-465b-ab68-ba47ed91e9ee", "value": 291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317543, "uuid": "6df4790b-2c76-456c-a7b3-22b0957cb9aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317543, "uuid": "ec7eceac-32e2-4cc0-8ab1-d94e85c9db6e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7db1bb1-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312719, "uuid": "aa595cbc-7fe4-4b71-946e-fe13b41fef59", "comment": "Malware payload (Mirai)", "value": "e3b0607889960148a6addb2fefe57fde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312719, "uuid": "bac9c74c-764c-484b-8125-6cfb76390c12", "comment": "Malware payload (Mirai)", "value": "1c1962028c6620438c5c3f7a268eff52dfc6f2530c352581603ee0911f9b69d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312719, "uuid": "f974b7fd-679c-4905-9b89-1a5859f4e8db", "comment": "Malware payload (Mirai)", "value": "2957ab71103b2555bcc3e5d367537193a67e3921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312719, "uuid": "844421e2-b548-42b3-8197-5cef375bf5d4", "comment": "Malware payload (Mirai)", "value": "32097f00e95fac4d4adbc26de76f65a27e43a0e4e0555811f1a11f98e799de82dbb36e68a7453c5c027b88ce1d113aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312719, "uuid": "ddfbef3d-537f-4146-a5b2-b96f2b2a597a", "value": "T16E634B22B97D2D1BC4C5A47B21F74365F1F15B0E26A8CA2E7D720E4DFF206602107AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312719, "uuid": "f66382cd-c8f4-480d-a3da-5919aa0c5271", "value": "1536:DScSMmxuY0NFohyx3ZePRgYqu4NerGLSwre+chD:eZMvNFhYtjx2e+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312719, "uuid": "48e22286-24c5-45c4-b418-5913a238b7d5", "value": 68672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312719, "uuid": "f814a6de-2c91-451c-9412-569351923b90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312719, "uuid": "09f22ca8-c4f8-4750-a334-b022fc3bd9b2", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87195ca8-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385678, "uuid": "efb039a5-099f-4cce-a294-1d96edd6f90b", "comment": "Malware payload", "value": "8171a21a3e3acac214aede2fa586554b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385678, "uuid": "dbeefe8b-e679-4306-8dd5-8327c9c2738b", "comment": "Malware payload", "value": "1c814a68946f746196f087ee181cf90b9af0de3107e2202f97ccd86a46303a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385678, "uuid": "d8795324-a1ab-47f6-8118-69912d5a56ee", "comment": "Malware payload", "value": "ab9b555fc39e14d92f0205b7abdf036e8f68aaec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385678, "uuid": "3600c388-7f43-4496-b477-b1dd6147a1ab", "comment": "Malware payload", "value": "69a7f930819727532f23f63ccfd9d5f5616d6c8db15d4c831ee742364e7c481c368a58f4327ab5b50648793496b54c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385678, "uuid": "8e736885-8e2a-4a35-9d0a-4839274953ba", "value": "T12E0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385678, "uuid": "9c998be8-7045-4f23-a016-a33c1a5d883e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385678, "uuid": "4767a1f4-d826-45d1-b9dc-f94f90ccffd5", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:m2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385678, "uuid": "2472c661-8e79-448f-8ab1-64edb5a3bf43", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385678, "uuid": "4ba53784-ea24-43dc-8cc7-09c39e8c852e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385678, "uuid": "55110e55-ffda-4fcc-ac49-a2e384f63035", "value": "8171a21a3e3acac214aede2fa586554b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd2e37d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385881, "uuid": "0c16b289-00f1-4276-8d0c-08dd259c85a9", "comment": "Malware payload (Adware.Neoreklami)", "value": "c10e1c0e5e035416b17721624a50e485", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385881, "uuid": "7a1e31dc-145e-4bbf-9f0a-62174ecb4878", "comment": "Malware payload (Adware.Neoreklami)", "value": "1c8ccf01044eabd3620acbb6cb6272a9777f21c87955414bfac0fc4f3b577b12", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385881, "uuid": "e9bbcbcb-a748-4dcb-92cd-e29f53854513", "comment": "Malware payload (Adware.Neoreklami)", "value": "a5a26d561cca6565dedb1eeff3811522cc8795fc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385881, "uuid": "1256eead-d6c7-471f-b77a-eccc59d4146c", "comment": "Malware payload (Adware.Neoreklami)", "value": "f6be92e1d9124ba10b2f95ea7832e9989bb88d0ae6f1f6e6b00b79e43c173064662ffec131fa0e77fb88a07bf43e0bd2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385881, "uuid": "c4963595-7875-4790-bda8-57f2059ecb60", "value": "T17A76336633F3C6F4D68006724994ADF862E8BD2D0D37D92B03015E9E5EAD421B2F7369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385881, "uuid": "a1bb69d3-b683-4113-be44-0054cf14d018", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385881, "uuid": "fd1fa493-d616-4add-bdcd-7c403859b23d", "value": "196608:P1OxVwj1K7UTe2vQMbNKdWA8JfEKtg9isZWTNVuTfl0lJYk1J:tOxSRTznfCKWi4WBU5WJYk1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385881, "uuid": "4be9aa25-420e-410c-a847-8c00b5c3e8bd", "value": 7565897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385881, "uuid": "382d2145-e910-41cb-a380-7fee9d22011d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385881, "uuid": "e38718dd-d026-4f97-b209-525544bc3790", "value": "c10e1c0e5e035416b17721624a50e485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b68b8a-e7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767372254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372254, "uuid": "9f3b8dff-8081-405a-9ce6-153b4a013a2f", "comment": "Malware payload", "value": "9665880c9c7275d076ee9f9538ddc8a8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372254, "uuid": "b38de6f3-638a-4bde-a9fa-f730754f5bf1", "comment": "Malware payload", "value": "1ce74327b02be7b3a4dc7c109e3f96400943fef59645eaac8347056be7089704", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372254, "uuid": "d87a4f57-3eba-4a3e-bbae-610e5801c413", "comment": "Malware payload", "value": "6eb405abc10ac58d9a3922414d5fea832d8098d5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372254, "uuid": "04355503-bef7-4b66-bfef-1a59340b4f3c", "comment": "Malware payload", "value": "5f5c1d53b693c966295d663ebba1066e24279ec056b64742bbab2e8fc636ed204a574450179a57d02e0133cf8f3a8989", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372254, "uuid": "11831b8e-6b69-42d3-ba64-5879f6385943", "value": "T16D163383B9A0041276B2C1D05876CE053BE388D959D3741889FA754FC9BC789BB89FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372254, "uuid": "46b2023c-1b34-425d-9548-0d43e293bad4", "value": "98304:IL1f+88RTpEJPGFzShYNHZfbm4uYXxi/3++LxAz7z:wfl8BpEJ6SY1bluUxhFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767372254, "uuid": "3206e519-22e4-4efd-990f-fea4b4ff628e", "value": 4317224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767372254, "uuid": "b1266288-a3ae-48fe-b212-9e2c412ebc04", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372254, "uuid": "fb85a524-4770-4366-99d3-f6b0fdf2ed3b", "value": "04844b5e15750467224c29b6fe5806e4093cd1d0ee4904dccf96831947574c85.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697fce59-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386058, "uuid": "ae8a1ab4-6b94-4a83-af16-80c4ab33eb1a", "comment": "Malware payload (Adware.Neoreklami)", "value": "fb616b460bd3898c6a1bd473da408c7e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386058, "uuid": "815b7ff1-13eb-4cb6-8b66-654f8b0e1519", "comment": "Malware payload (Adware.Neoreklami)", "value": "1d9d2e79481570a2f1db016266cf5b626b384ddab90f65b41216126536487c73", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386058, "uuid": "3a0baa63-8496-44b2-b73b-9a8a3186258f", "comment": "Malware payload (Adware.Neoreklami)", "value": "4bfa2a524382f3c1093bda9580b7d18d242295bc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386058, "uuid": "5bb867ff-71e1-42e6-ab6b-55ae7dcd5431", "comment": "Malware payload (Adware.Neoreklami)", "value": "8f642669e71f80a452c0170c54994dc086444dd4ab44858bcf491945bfc66378504007a8c61581764d2f249de92f741d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386058, "uuid": "4a3a5831-a219-4285-a016-33cb6411fd8d", "value": "T19C763311BAF3CDFEDA554932CB8C26E44442E7DD062B18B736E6111F093D6C68129ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386058, "uuid": "fb3fb964-6e72-4e32-9710-e1f3eedcf0ce", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386058, "uuid": "53f8af92-2803-44f9-9606-694ea7f95af2", "value": "196608:P1O+M8DUeN6XTcqS1HODikmpOvDJf1my96Efg1VmhOK7g1B:tO+MqsXRSZODvmQuS4GcK7g1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386058, "uuid": "c5b41033-fd3b-44e9-b623-f1863a4104f1", "value": 7565626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386058, "uuid": "950a4d52-8dfb-4a62-8607-8dbca8c95dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386058, "uuid": "0fcef493-0b91-4935-bfc7-e489edb80200", "value": "fb616b460bd3898c6a1bd473da408c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e3e91-e81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386860, "uuid": "658e68c4-f428-47b1-8c31-2f3c261922af", "comment": "Malware payload", "value": "f1f0a04552c8a1932e96f51cd585cd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386860, "uuid": "93d0baaa-8d1e-4157-b257-35be832a6c0d", "comment": "Malware payload", "value": "1dabbdc7832e2008e97080dc33d9b1bd1889febfd6a42905f5c51b7269451751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386860, "uuid": "5f91623f-d3a3-4012-96b5-6d6445938a71", "comment": "Malware payload", "value": "95eb5623d473554fbc6c65db69495a576b6913d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386860, "uuid": "2e12f7d5-c7dd-4b3f-9bcc-13773e26a231", "comment": "Malware payload", "value": "5044ef839229bce8f70828e8e93e01e05c94ddb1eb9038688c94e0cf519175abab7a8d1bcc2684f21b6eef46c5c5ae0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386860, "uuid": "bb5cbe19-9290-40d2-8048-656fa4bb21db", "value": "T11DA43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386860, "uuid": "0341ede6-5f5c-42b4-b609-03d3e90fe1ad", "value": "dc3120d7b4090566a887530f3c294893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386860, "uuid": "aff87b4f-45bd-4fd7-85d7-f513ee265a24", "value": "6144:NUKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:+KZPBhxVLCV2RcG+/CZ7VZBx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386860, "uuid": "0a3f4cc7-9946-4878-a84f-bd7d5e5dffef", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386860, "uuid": "8e6ea668-2318-46e0-b652-b80bfa6592d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386860, "uuid": "40612ad8-9c34-4463-bbd0-d7fb98cac07f", "value": "c3cad5c673e2b190e7cda997377965f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09110ff9-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335216, "uuid": "370da85d-4df3-43f9-8d14-e81e4c72cd7c", "comment": "Malware payload (Mirai)", "value": "5e6bc304ec4aeb157be0f69cb9ce0fc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335216, "uuid": "e9fde3c7-b3c0-4a4c-8a4c-c830b9908a3b", "comment": "Malware payload (Mirai)", "value": "1e31500298f69a5c93a5f4bf5ea8b63676247814c7e34d88cdfc425de3a5f917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335216, "uuid": "7d9d6f1c-366d-4fca-8cc2-60c060656aa5", "comment": "Malware payload (Mirai)", "value": "cc13bd1fc66cc87ff0f43450496e4abdb34b1074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335216, "uuid": "9160537b-9a06-4d77-8907-84db3dd6172d", "comment": "Malware payload (Mirai)", "value": "2462b8f9db17de1fb9d2bc8afc66d2537ca26310f0c96006710165d8984f571bf9929cf1a402136126c11554a83fef17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335216, "uuid": "ec86adc7-b662-4b9b-992e-a5fd777e4192", "value": "T1CA7302BE1843AD7CDCB6A132021D82D2F9B04909EDC74B5BC06F317B8A78C876167B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335216, "uuid": "8bec1df2-145e-4961-98bb-648a3056146c", "value": "1536:rjFCWhrSigxkwtAOgffIgQ6hbVZ/k8FDGjBEzM4bnBjgFIDKRrWAr:rj8WhGBWbffI1Wj/fE07uF0KXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335216, "uuid": "185098db-9208-42fb-a62f-e53aaef831a7", "value": 74108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335216, "uuid": "7ff1451d-fae6-496c-b1c8-dec15c0112f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335216, "uuid": "c197a86f-e952-4f5c-b2a5-cc21e880d883", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb937ab-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385342, "uuid": "889971d8-f617-440b-968c-52bf577748e4", "comment": "Malware payload", "value": "05ca9bdaf7b4e6bae61b13669cd7c47a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385342, "uuid": "36ff9dfe-638b-4eaa-95b1-27f728bbf475", "comment": "Malware payload", "value": "1e9d4f289987958746b28c882447b7b484bf099eff738436f27c7b6d1c17971a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385342, "uuid": "e8f946a0-ecc4-4ffa-90cd-e29542420b18", "comment": "Malware payload", "value": "d4f0bf0edca2371f68f7de01269bc78923c83c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385342, "uuid": "8332be32-cc9f-4bcf-b468-ef750307a129", "comment": "Malware payload", "value": "227cceeec5ab568e087890289885499bbe8407b2158cfa24003ea43ca47332b994639f378cd6fdab502d13c151af955b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385342, "uuid": "19d241cf-4bbe-4f21-8aa7-5b5245967fc0", "value": "T1BB0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385342, "uuid": "a93eec33-bf01-49b5-b02b-927bf76faf3a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385342, "uuid": "4d9f133e-11f8-4cb4-a5dc-62a20b5820ea", "value": "98304:aTT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:I2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385342, "uuid": "fa27984f-6ecc-4935-b83c-f353dfe05283", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385342, "uuid": "b7eed524-ebf7-4d5e-ba89-fd53c53b2e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385342, "uuid": "16e78cd8-9cf9-4005-850d-1c73d0da3e97", "value": "05ca9bdaf7b4e6bae61b13669cd7c47a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b500e48-e792-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767327623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327623, "uuid": "db01f905-3546-4b20-9d7f-b5463877fa3f", "comment": "Malware payload (Mirai)", "value": "cb0300125498770346eb0dcf0a31ac04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327623, "uuid": "af9807a3-9635-4c52-9610-2f75f66eb7d9", "comment": "Malware payload (Mirai)", "value": "1ecbded79753bd2087a0a6b9c5f9dd82a22872d9636134b47ccd91e0e365b192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327623, "uuid": "5cde439b-0d6f-42f1-b1c0-5187891d2905", "comment": "Malware payload (Mirai)", "value": "2e582e34e94f44472cb65eccdda38bc0acbc7db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327623, "uuid": "1e1ca35c-2f5f-4572-b48b-710bfc21bbe4", "comment": "Malware payload (Mirai)", "value": "325acd1b22432ddc23f65094ff587c68f737c654495892aa96817923bb555d547b5d806e0216f5084f4b71d0e45e333e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327623, "uuid": "9ca0daf4-4663-4ca3-8ae8-04994e09d518", "value": "T1B17312DC19E7680360CB0BD32E141AC626560BD5BF56F9A29BB8AA3631E14501F7CCDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327623, "uuid": "b4be08e5-2efc-432e-9fef-b7fb9eba323b", "value": "1536:J1tfdC2DT1bi7kvaDn6WljZTTb2JFXrvfhl2I2rnhxupNXKfhYSCFHLE:J1tfd9DT1m7kvaDn6WFl2LXrRl6Gf8BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767327623, "uuid": "6546cf5c-bb73-47ba-a804-a7777f58230e", "value": 75960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767327623, "uuid": "0254187a-eec8-4dd0-b52a-50e81c078f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327623, "uuid": "1e2a258c-9946-48e9-b724-802794f80dc9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65bea81-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385731, "uuid": "23d76981-6bd3-4443-b8af-0558de813eff", "comment": "Malware payload", "value": "921087fc1a1425384c03d088f0f558e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385731, "uuid": "3be3b58c-7cc8-438b-8138-2a398c6a3e0d", "comment": "Malware payload", "value": "1eeb5a239d57b82d71b46478799d0931049ed84923f3a3db153f968ee4bc728c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385731, "uuid": "7e2a1d0e-db17-4d19-993c-05e6ffa6b608", "comment": "Malware payload", "value": "09259de0d7572ee34cfc7bc202e766def134d7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385731, "uuid": "8c276865-387b-4a42-bef3-8a3db22e81d6", "comment": "Malware payload", "value": "f33a72e7bab4fb210d4f266dbd480ad1877b3605bb382a67963b47755f6649671cb8986fbe7db1d6c2584884463be3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385731, "uuid": "5f82168a-48e1-4c1b-abef-ee4415553bd2", "value": "T18F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385731, "uuid": "27e74cbd-c714-448d-93c1-df174299bc9f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385731, "uuid": "213410c2-e726-4f2c-a643-7afbda072209", "value": "98304:aOT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:B2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385731, "uuid": "be4094f2-a714-4f74-99a7-9fd8b48473fc", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385731, "uuid": "897113ac-5cb4-4010-aefb-782baf74f4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385731, "uuid": "c4c7d174-1f3d-489c-b3ee-9c81e3063b79", "value": "921087fc1a1425384c03d088f0f558e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b699321-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386061, "uuid": "642485f4-2e04-470c-b059-06b473dd2778", "comment": "Malware payload", "value": "fddb751851fbf584f94462a638d612ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386061, "uuid": "7ffd04db-cc02-4e7c-a624-29391dda4b20", "comment": "Malware payload", "value": "1f374ef19e728f690e570ace88c8d2c02a79d57867df984595c621a494b1bf31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386061, "uuid": "2f4209b2-61cd-45a0-8da5-c20e5210547a", "comment": "Malware payload", "value": "7f0b48a0e133b0c20b4d53e17b3345bbcf307de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386061, "uuid": "5a55b80c-8aa6-427c-956d-3b4506f54dfc", "comment": "Malware payload", "value": "5e1ecfeda6c5d053fe42c339318ce9c0cfc7be497ea9a324cc19a56657accece5dbce28099e7bcae343a739a8486ba9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386061, "uuid": "ee1a2a13-bd5c-42bc-bd61-18d5a1a20fa2", "value": "T1C10633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386061, "uuid": "71552b1b-a069-4170-b4b1-1d74b1767d9c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386061, "uuid": "836c2dab-3efb-4273-9633-4c8037082bfb", "value": "98304:aST3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:R2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386061, "uuid": "41cc9ae4-0fbd-4f54-ad48-2370c71068ec", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386061, "uuid": "0a3dfbb3-1267-44ff-b16c-24edbe67ff7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386061, "uuid": "4f1f65a0-7a07-4237-9eb6-5556dc4b78ce", "value": "fddb751851fbf584f94462a638d612ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18346f37-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385492, "uuid": "2c76f89e-e563-49b4-9e08-ffeea13a469d", "comment": "Malware payload (Adware.Neoreklami)", "value": "45f11f8cc4e95e380b2547674051aca3", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385492, "uuid": "4c890c9d-a4ff-4a07-9fe3-d3f765226a8a", "comment": "Malware payload (Adware.Neoreklami)", "value": "1f41313b36ca4fc9d39462e27e6ca4b5d241d3cabf7558178b23bd5def851db4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385492, "uuid": "8ca63569-6325-46b6-9347-031493463c1e", "comment": "Malware payload (Adware.Neoreklami)", "value": "6067bbe25930c3f52ecc9e74d1971eb4a0798953", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385492, "uuid": "ac70ae01-3c1d-4901-93b4-e26895e5a0a3", "comment": "Malware payload (Adware.Neoreklami)", "value": "379809edd67870abacc31a97f699e3edc33f245c123386ed29e0d4b8c36edc268ccdf28de85f8de1042000938961de98", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385492, "uuid": "106d7316-7481-4efd-86f7-edce5adae319", "value": "T100763372BBB0D3FDE60540720860628BEBE2D2D50B300C7393D65A59AF3DE05E5AE5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385492, "uuid": "a7d06042-e75b-4e01-a612-3dcf56bdc685", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385492, "uuid": "5efbeee5-dd15-4a2b-bc99-fc3d2c500dad", "value": "196608:P1O7QVCnPtgfXpK4z3oxIE2xNHh8tNkI08gDDfIUNSBPzl4oWyHLE:tOE0tgfp7LpdxNHhaNBlgDruPzldWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385492, "uuid": "0dfc0276-0537-4af5-8cf5-130b162b4953", "value": 7612087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385492, "uuid": "049d89b8-e5f7-4d95-920f-633aad4fe814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385492, "uuid": "937dc8d9-8147-446c-82d1-1746b420f5c1", "value": "45f11f8cc4e95e380b2547674051aca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936814be-e7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767371525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371525, "uuid": "2ab88db7-f775-46f6-a254-81e3b1b3e6ab", "comment": "Malware payload", "value": "da6d9f293b4b2c7b456299176dcea2f3", "object_relation": "md5", "Tag": [ { "name": "APT-36", "colour": "#7D33CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371525, "uuid": "8eb8119e-f85e-4657-bdf5-c9c399b18f53", "comment": "Malware payload", "value": "1f506782be55cf7da570ea38977f0eecfeabafa7e6d5916f08c31673af32779a", "object_relation": "sha256", "Tag": [ { "name": "APT-36", "colour": "#7D33CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371525, "uuid": "3b8d6070-3488-4e6c-9d9e-fa64cc80baec", "comment": "Malware payload", "value": "749d47b1f72119c5d63180ceaaa39280da2829ac", "object_relation": "sha1", "Tag": [ { "name": "APT-36", "colour": "#7D33CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371525, "uuid": "cdec5338-6041-40f3-88e9-d1d90d4795c9", "comment": "Malware payload", "value": "4b577138c102d801ab621167e5caef731edaca53d5da159abccdd487a34d176a128e61a1aac12327eb29d90a5d860e55", "object_relation": "sha3-384", "Tag": [ { "name": "APT-36", "colour": "#7D33CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371525, "uuid": "07c1a605-7c24-45c2-b337-678f5f7d9ef4", "value": "T1724533C3AF03B3A80CD1BF51729D6FD030689FAD1D41E918A89266DF5EF34913E86196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371525, "uuid": "53edc766-846a-48b7-9b0e-58b01e1cc1bb", "value": "24576:4YK31PbefYzSKDUL7/VprMefqO19gwbGyvQGfg33:4bPbuYOKD8wkqOu33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767371525, "uuid": "214c1ba5-e945-46f1-a92a-aff80a92a5f1", "value": 1203001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767371525, "uuid": "b3b64770-2717-4459-83a8-cbb87b23f748", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371525, "uuid": "cd412b00-45b5-4205-a7c4-c61ae8f74eab", "value": "4dd9e2085297515825416415413eae1c9632392cb159ac70e459d0ebeb2dd49d.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a31767-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385382, "uuid": "6693e567-33e2-4cc2-bf46-99b41f61735d", "comment": "Malware payload", "value": "19a00a6593ffb7bf4e1c3f46a576f071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385382, "uuid": "bb9d8e13-db12-4ffe-9ee5-126c190b52d0", "comment": "Malware payload", "value": "1f6e1526f1ca51e6e43d1a2fd0269314524e947d4226cc5c9d8167b84e706e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385382, "uuid": "50dd0715-13be-4297-bd49-bccab2d5c961", "comment": "Malware payload", "value": "73174f095d28b7df4b8ca053406e23e2af295fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385382, "uuid": "473dda36-0201-4012-9ac1-db4f43cca0b7", "comment": "Malware payload", "value": "24418ba9114530b474c48999e43dd53b086808f9d1d571d3aab4f0c88c01f9c5f01bc55e0a178c07a4ec5cb200a1920f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385382, "uuid": "31c682da-feba-4a79-9567-ee5efafa803b", "value": "T1AD0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385382, "uuid": "9f919c3b-f7df-4b2f-9ab0-3e667223875c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385382, "uuid": "d35e084c-4020-47b3-9524-11cb5a3cd8ce", "value": "98304:aBT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:W2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385382, "uuid": "fd216391-2014-4bc5-8024-8e291d69a4fc", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385382, "uuid": "cc30fd34-f46f-4151-a77c-5cba6f657cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385382, "uuid": "33471750-86e9-4d72-b78a-2a6b578aefb0", "value": "19a00a6593ffb7bf4e1c3f46a576f071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1ab3be-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385898, "uuid": "bd2de3ba-5113-4f52-9e01-7d2c456f9fae", "comment": "Malware payload", "value": "c55b53142db0a49d0dd00c3ee4ff5cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385898, "uuid": "d491160a-d44b-4168-946c-32c63ea6cae5", "comment": "Malware payload", "value": "1f76d34ec64f5d5ef08b9c2422e7b2d80aad6e86b89aa5b4c7e53d2e7e024598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385898, "uuid": "dd3a6adc-8720-465c-bd2e-41b37de550c2", "comment": "Malware payload", "value": "5d752d0a0f2ae79934ee92afbf6aa6c853ebcd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385898, "uuid": "836042dc-5d3e-4952-96ff-20fc739d7313", "comment": "Malware payload", "value": "c4f0913b7cd7e90cf41abf1010ac14dd48848b9f37077d76fea1dd29c13e1aef531e2278532b640bb3ec3ccbab50352e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385898, "uuid": "aeadca45-b088-43d2-a9aa-aa6b7f01b548", "value": "T1480633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385898, "uuid": "7f0e7ab6-b49b-4851-be33-63eec1ccc6ac", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385898, "uuid": "6c2aa893-ffd0-47bf-9c45-010361db821e", "value": "98304:apT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:C2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385898, "uuid": "f492f81b-b162-44e1-b83c-39be15b98a79", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385898, "uuid": "61a2cfa5-4326-4265-a4f6-00f128e94696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385898, "uuid": "448b183f-a440-481e-8ea1-28d8c5e301bd", "value": "c55b53142db0a49d0dd00c3ee4ff5cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b65407-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385921, "uuid": "def9d799-13b0-4e8e-a70d-ad468fc500eb", "comment": "Malware payload (GCleaner)", "value": "caa49b96d4c684fcfc3d580e2c425237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385921, "uuid": "b77b3801-4405-433d-9fcb-70e32289e9ec", "comment": "Malware payload (GCleaner)", "value": "1fb15d7db037ac6abbabcb5f9bd2a46dfa255977d7b03a92296ee041daea725b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385921, "uuid": "08189822-e000-431a-b2fa-8d9c5f0814ad", "comment": "Malware payload (GCleaner)", "value": "91da852e9ad19652d08b94a5f821232a02b3083d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385921, "uuid": "6e8c77cc-949f-4a06-b9de-f280eb16324c", "comment": "Malware payload (GCleaner)", "value": "db27b3e3f3d0a223611bafee4f3efe4a49d92b632505977411adcdf0bfc7c7d6d2cafbac78a705832cabc019315242f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385921, "uuid": "fceaab86-280d-4812-83c7-e850afbe529a", "value": "T1A956D006F36DD376DD0A28B2584569033219D9BDF51CC800F6806D6AB769DAB1CFF3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385921, "uuid": "b46f7b1b-f54e-466c-884d-c8dbe946d120", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385921, "uuid": "6bd96275-e7ec-4083-a55d-0488eeca7bef", "value": "49152:TC1IuuM4DiSEt/w3Yntqgk7+VQ8vF4aFugTFXFfjAgRm8a0IoUGTEOxE:TC1N3/w4vvF3FugRXFfjp2WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385921, "uuid": "2661c71e-e9b7-43dd-ab5f-b9ac4bb90e29", "value": 5887248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385921, "uuid": "159bfc72-2361-4e30-a995-65f0c3e7d703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385921, "uuid": "7aaecfe8-1885-46ad-b47b-3528de180c3f", "value": "caa49b96d4c684fcfc3d580e2c425237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd57cf8c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385769, "uuid": "404dab04-c0a2-46dc-8850-1109ed35eddb", "comment": "Malware payload", "value": "9ab96881d982989a1ad5ace6347b1c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385769, "uuid": "8cbe5d47-d1c5-4e91-be45-481969ef44e5", "comment": "Malware payload", "value": "1fb1c61878bfa9dd9d686419a1f73c93347177beab0e88754e6faf31d30e8ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385769, "uuid": "2b0546fc-0092-4a6a-a275-27839a954fc1", "comment": "Malware payload", "value": "017fe06e329d9219e2abccbef8d7f7f7e479a8fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385769, "uuid": "46edd7f4-9028-48e8-96e6-05321b9a6a37", "comment": "Malware payload", "value": "d105f62fc638724906925262ac8a002fe288b96a386f8b59e9cc0fb9b6716d6f26c12f3a8b8287b6ab9bca746cf70b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385769, "uuid": "2084fd53-eab5-4dad-8b69-8f631c5e2c55", "value": "T1910633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385769, "uuid": "0af7e99c-5764-4f60-8cd2-90e73f158ccb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385769, "uuid": "d9bde42b-f9d9-466b-baa6-6603a0ef0aca", "value": "98304:azT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:A2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385769, "uuid": "6ed9fdce-d12c-4f90-bd8e-ba13160e8d00", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385769, "uuid": "5cdd1051-121e-41dc-b308-fd3b31a83a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385769, "uuid": "03b8abef-1286-4455-a7af-b20cacd12dac", "value": "9ab96881d982989a1ad5ace6347b1c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2293a63f-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392381, "uuid": "6c1fff54-36f7-4068-9e11-04e71aaa9a4e", "comment": "Malware payload (Mirai)", "value": "7c44e0c2c978a4deb5a8cfd7c6bce814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392381, "uuid": "22c19f5e-b28f-4ea2-8eeb-5f7fa27aa2e1", "comment": "Malware payload (Mirai)", "value": "205066a065dea2751039af5ee548984c8ef3acf70c0334615045b38c957c3b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392381, "uuid": "39eee64c-e562-4a2c-b553-57af18d0682f", "comment": "Malware payload (Mirai)", "value": "8c4b65f5b47f7ed1d58287e91d082ff3bffde3c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392381, "uuid": "22d85463-d21d-4f50-84da-8fb5c8d2594e", "comment": "Malware payload (Mirai)", "value": "718e98fc24d9720a794581d62c9f7862a56109dc941dea3c41256fac77d4e8cf3d603b4409c9d83ebcc33468e7cbd2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392381, "uuid": "499df938-5eb9-446f-94a7-09e2554fa2e9", "value": "T104C31A06BE549FEBC45ECE70452BC30221DD98CA92F6731E3278DD8C79B970649D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392381, "uuid": "dbc4ac57-298e-44da-9649-8229fa2a57ce", "value": "1536:B8/oEheoZxJydIdnC2QVngAdcFD3ugYPYEzj61jbKWBIFo4oamtgiYKRgo4rA+uN:B8/nhfZxVJD3cYUjKjbKBF3oaS3slA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392381, "uuid": "5f6fc19d-419d-4d71-9357-b15b0eab2d37", "value": 119548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392381, "uuid": "7529308b-fd2b-46a4-ad64-d74e094eb484", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392381, "uuid": "e8e1e88e-f956-4176-99c9-6ccfc95c1f09", "value": "catgirl.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d870e2-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381621, "uuid": "5bc8fbfe-fec2-49ae-9434-6255bf6db53b", "comment": "Malware payload (Mirai)", "value": "1c2705f71ac1a3b60a0142c8fe5d9f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381621, "uuid": "f08b59d2-227b-4b6e-b4ff-1477bafabb4c", "comment": "Malware payload (Mirai)", "value": "20c4ba670090e1c26a49cf24ad08dfc8699dab666c351ebd7c72a91d683b2a66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381621, "uuid": "9f61242e-8f04-45d0-b051-c8e91c423512", "comment": "Malware payload (Mirai)", "value": "05a9073c9b6cd8a5b0e01a6afdd2481acb79fe58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381621, "uuid": "e5e159de-ee7d-44fb-b09e-f124c8d85817", "comment": "Malware payload (Mirai)", "value": "4f945d9b52f87156696d904807374ed61884e56fb604f2fb2b48d2c16b03cd94f13b44966778203ecc7b5ccd67770891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381621, "uuid": "681f4da2-d601-4831-bd36-7d4bcdcf3695", "value": "T152331895BCD29A6AC5D423B6FA2E519E3321A3E8D1DB3217CC204B1437CA51F0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381621, "uuid": "66d1ec6e-b6f3-4728-9844-554bacd6d830", "value": "1536:hAATmE7OM0WBsuy/RD+agzL6rL2yBCNt5sQ0:SATmE6M0PYkvkbsQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381621, "uuid": "4a3a8f23-9ec3-4e06-baf4-10b2abe89f2c", "value": 53356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381621, "uuid": "ed003ef7-2d79-4594-963e-d7563c3a8abc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381621, "uuid": "d0bb0bcb-59a9-43ed-a595-988510d39ec0", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654301c5-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393352, "uuid": "2c797d17-67b8-4d79-9a45-1beaeddfc7b4", "comment": "Malware payload (Mirai)", "value": "88d5fc58bd858f5165fa8a141620e5d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393352, "uuid": "f9c847e2-8c6b-4403-90df-1a6cc416b9a2", "comment": "Malware payload (Mirai)", "value": "213f09aea6eb5f172b096a0ab6a25498919e3f62af1ab845910a95ebdb9eb6fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393352, "uuid": "1a5a40f7-5ffe-473d-a96b-96c6edea1793", "comment": "Malware payload (Mirai)", "value": "a55f6e84cd138c7386af069a71cf74a3a0fab2c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393352, "uuid": "62df3eb6-edee-4cb1-bdd8-8574409735e1", "comment": "Malware payload (Mirai)", "value": "7a54c0d7f6493fbf0d412ee8490f82eb4623cf883eb72402b18a3d3c30c18b2443cfc5ed8f28ebada1ddfff9b0bfc299", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393352, "uuid": "e6d8c0b2-5b46-41b1-9940-51c39e7bbb70", "value": "T1FE042AC7F900DEBAF40AE33748530909B130B7A108925A377257357FED7A199197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393352, "uuid": "a057b8cb-823a-4c4d-9788-337ffea204f7", "value": "3072:zvSo/FXBeFv1xoCNomb0vhqkyFlf9V/8YPUtoc72Oo7HPipCdr0OV3jbihLzb7aH:bFUqzfyFZ998Tt8Tr0bL9OiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393352, "uuid": "82697eab-fd31-4a8d-b7df-944fdbe98e58", "value": 177540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393352, "uuid": "57ca273f-91bc-49eb-a68d-ae444f80028d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393352, "uuid": "d5b09493-af22-4c1a-9ff0-17e3a1afb9b8", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a0733d-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381386, "uuid": "3a501337-080e-446b-8314-d7cb6773d2cb", "comment": "Malware payload", "value": "f800b029b349d78c51cf26f43c172aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381386, "uuid": "b5f74e4d-3826-413d-ac07-358a1dd866b4", "comment": "Malware payload", "value": "2144dee6a355a09aa1828733a72daaec922ffbf2037f5dd37439ac70ff95389e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381386, "uuid": "1b5268f9-340c-47bb-b4ac-46bae609c490", "comment": "Malware payload", "value": "f07c21f05260449f0e99e1a137f6ae34064d638e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381386, "uuid": "d52b5111-7935-4be1-ace6-52ffbfc95efb", "comment": "Malware payload", "value": "64be2ab99103fdb0647c95339de286abce51e04cb64b6fab62655dacd0ed6db6e5a05b06ef2a37bc98c081886924f5b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381386, "uuid": "729d6bbe-5348-4e95-8e89-9b249cb41619", "value": "T134D42855F8809F61C6D129B6F75D42AC73070BB9D3EB71069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381386, "uuid": "4a30e67f-0327-440b-a069-3878b59efcc6", "value": "12288:VMYpt3UmSJFGRCGq/29Ov6SAYdJ/wNBU8mqb+8pflKjS:VRpt3qJCPq/2I60/wF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381386, "uuid": "4ff81b41-b774-4250-af57-35798fd2b9f2", "value": 653396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381386, "uuid": "95eccba6-f010-46bc-b927-e15438d2a0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381386, "uuid": "9b374f2b-865b-42cf-a06c-29554a1e4604", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d225a5a-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381635, "uuid": "9bfe3697-ff21-42fe-a23a-3d381d14e193", "comment": "Malware payload (Mirai)", "value": "7b9c173e347a2027b7945590531b0997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381635, "uuid": "b8d94366-dd23-4c3b-9a00-37a72489a61e", "comment": "Malware payload (Mirai)", "value": "215251dbb4e93d82d03ebc5a0865a9476a5978b28c1fb3ecb305858dfde4ddeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381635, "uuid": "48ade93b-62fc-40cc-8225-ce64d539ef37", "comment": "Malware payload (Mirai)", "value": "a638843f511551126b23c2c821fcb3eda5baa885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381635, "uuid": "0fe54c3e-74e1-49cd-8f90-165aa77d451b", "comment": "Malware payload (Mirai)", "value": "766ed4206023a291d09ecded2cd63670f8889ac1b6fd2c9a7c4ac027eb52b1d200ca354d02a6a571bf7f837babeae0b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381635, "uuid": "1cfee093-6b85-4b4d-80c6-bca1d45b8cda", "value": "T1AC639209BF611FF7EC6FDC374AE91B4525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381635, "uuid": "5f6b53a0-623b-4707-a2e8-918a117f8c49", "value": "768:zlDScD5GY2ne8i2Sxt9yYExR15I945fTemle5Re5bbvuH5XiANe1j9+E:zlDSC5G9eb249FKg4pfl8RWbriq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381635, "uuid": "8eb8f630-a37e-4f17-ad25-1bc1fc0366e4", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381635, "uuid": "117685d4-5620-4a03-aee2-0a3c17672c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381635, "uuid": "822483ff-2b2f-4b79-88e2-258001bf0090", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccdd189-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335437, "uuid": "dd176641-1472-467d-b5bc-e2ca71294771", "comment": "Malware payload (Mirai)", "value": "d98293fa33f1ed1ef5f206389aaff4ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335437, "uuid": "7a759217-d51b-4b2a-9c80-a34d12f92030", "comment": "Malware payload (Mirai)", "value": "2181538c3503557e98b0b7ba65043865398328a687f0d07d2b4484772954db69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335437, "uuid": "eb8f6e8d-fe0a-43eb-aae7-99db17c1ffc0", "comment": "Malware payload (Mirai)", "value": "e9087bb13bf8154e6811d7d7f7d4e894e5f8ba07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335437, "uuid": "bf7d6999-ee61-4a8c-a263-c2c5fe13b900", "comment": "Malware payload (Mirai)", "value": "ad3245a2994f5e5f9e28a4df138f28b83c9be3a8a65cb1528b8e69dbbc34695707e6d830bdb293f9b45b55eecdd5b227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335437, "uuid": "c196b394-fd6f-4c2c-a6e5-b9b8d69f568e", "value": "T18A44B70E6E228F7DFBA8877447F78A20975933D626E1D584D1ACD2011E6029E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335437, "uuid": "df4dc45f-1980-4f4d-8f8d-17ee555ab6a1", "value": "6144:vR96adG7vS7f5huSFv10lkVpntRtMv/br9brbHrZ:J4aR9ZZW/x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335437, "uuid": "90e2eb33-2223-4614-9dba-6756b2438963", "value": 253504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335437, "uuid": "35929beb-a28a-420a-b9d3-2400b4d62a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335437, "uuid": "3f7790da-ea92-41cb-a466-9262c230bdc5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da103a46-e7b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767341579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341579, "uuid": "8bdfabce-8957-458e-b85d-268befb30d7d", "comment": "Malware payload (Formbook)", "value": "f5abb585a683fb3fa979132db252d40c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341579, "uuid": "48dd13d4-62e8-4896-93ae-44bef047077a", "comment": "Malware payload (Formbook)", "value": "2195bd38596d37b13561952930466d37d8c73bb5c4c5866f272e4c149a057fbf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341579, "uuid": "5dc81fdc-d7f6-4fb8-9598-2ee7a523fbaf", "comment": "Malware payload (Formbook)", "value": "9471e294aba3f6e971b9aac5a4ae1c6ed8591ed8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341579, "uuid": "6166e1d5-4cb0-40ab-ba21-7c16c2e7aa0f", "comment": "Malware payload (Formbook)", "value": "fe3f81466c9f92ded85cb1c75218af9b369a4b8fc1599323559d8a2d1e8e27a409b6f2a87770ca8292a7ebae6b15472c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341579, "uuid": "79a79df8-fd33-4a6e-a4bf-d0ece3490d85", "value": "T17B3633007B0E67FBFD7F507612C553558E886973228010E8B492627C9E3AE519A7BF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341579, "uuid": "5af50427-40d3-47aa-8484-1d316800e8a6", "value": "98304:Fra4TacDPQkqObOWs9Gdo1m1ZMh5zDbO76c2y+yuynOA0bIMC5fRnDCFA4jjq:OWPQFGdo1mMXHO79N8eOA0bzC7nuFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767341579, "uuid": "ecdcc8f9-e63d-48bb-95f3-007d78fd4d8f", "value": 4974096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767341579, "uuid": "07881691-f9a4-4a5d-8220-ece23f9869d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341579, "uuid": "6a6bb283-21f1-41e8-a19e-28f447fc9e35", "value": "aaaads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76aa260-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385840, "uuid": "2a01a2bb-0cab-438e-8c0e-d282e570edad", "comment": "Malware payload (GCleaner)", "value": "b0e65de21a78ea6161d8cfb938aab45b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385840, "uuid": "6ac8b031-7753-4d8f-9e31-e8ef7f2b5bc2", "comment": "Malware payload (GCleaner)", "value": "21f5e0a5290f5447c27c264ca71d1439b3f340e8112f9540dedb3116a0e94349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385840, "uuid": "ad201a7c-9c82-4ec3-803c-147b39baa36e", "comment": "Malware payload (GCleaner)", "value": "6135c2e3e1cdaab65c4f22fc9fde01acb319bf63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385840, "uuid": "8c243694-c846-4006-af19-7daa12d764d5", "comment": "Malware payload (GCleaner)", "value": "08da817077fed656efb93b92d15a58b19fe5edd8f11a3b583c0060db8b0ffcdf52e77a8cf010b560aa3eb1df665d5fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385840, "uuid": "1c23530f-a57f-439f-b527-9ab7233899ea", "value": "T1B606E060EDD13DEAC37296708815CB78351E79A39E227D754BF3AC993F38142ADA0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385840, "uuid": "07d225d2-f423-411a-9d2e-e6127010b89f", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385840, "uuid": "144e5ddc-1b47-4f36-8d88-cac0b91fbbd4", "value": "98304:DS/NFNABf1HQhiTH3IMWQwMOT9yBnHPeRJFT/hZMiX/:2V8Bf1wwTH3xWQwhT96nWZjX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385840, "uuid": "a83363f9-bdc1-435b-8630-e5e67e0184ce", "value": 3974928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385840, "uuid": "da67f3fa-caa7-4800-84f0-9ae9b55bcb68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385840, "uuid": "07302c22-3013-4162-bfe7-e9abd0be6ebe", "value": "b0e65de21a78ea6161d8cfb938aab45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5513c439-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385594, "uuid": "d55a2177-fd86-4216-9359-12a73d2a0b24", "comment": "Malware payload (Adware.Neoreklami)", "value": "6937a0244859a4a90c0e3d5b523887aa", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385594, "uuid": "f5fa4c65-517d-4bb9-9858-2bcd3df389b2", "comment": "Malware payload (Adware.Neoreklami)", "value": "220a2fcadb783b000ce322283de10c82822e4ab3ba6acba92f4b4a9450b52364", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385594, "uuid": "08ff3224-32e9-4d92-855b-adc0561d3816", "comment": "Malware payload (Adware.Neoreklami)", "value": "b98310f1fc9a519fa7032ec379a234b994e0a73f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385594, "uuid": "c3bd362e-367b-485e-8388-4332eb4b43aa", "comment": "Malware payload (Adware.Neoreklami)", "value": "d2b32a72d99df5213639c182389ce7bc81cad01ae01a3a60e2814f0a26500852e910b03db7b83c37b3dc5afe69e59323", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385594, "uuid": "7e3e4bab-ccd5-4a6b-b166-9385987b8f65", "value": "T1B5763337BAE4E47AF9510933A430A7D0D0A6D752DE3485E7B38B0B982B3CE95811E7D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385594, "uuid": "41e90ca4-0e5c-4bb2-aed6-aa30d9a7a8ab", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385594, "uuid": "1902c36c-57bf-430d-8cc9-b94ef07e4b09", "value": "196608:P1Oeye1DliIX3zBEiK0aKK3//ZmzWgAGgrhtqMldy:tOeys8IXXADQuGgDDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385594, "uuid": "d486ed9c-fc11-43dc-a054-b4d61fb9bcaa", "value": 7514369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385594, "uuid": "936cb955-048e-41ac-a623-6bd00f0702d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385594, "uuid": "71c4bfc7-92ee-4096-bd11-3a034978965c", "value": "6937a0244859a4a90c0e3d5b523887aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e71e0a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767385520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385520, "uuid": "b84fa1da-35cb-41f8-94ef-b6897e85b7f7", "comment": "Malware payload (AsyncRAT)", "value": "023c80d2e8226c79f25d9a7097fad22f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385520, "uuid": "5c0c130c-19b3-4cbb-813e-f18bfbe8c3b6", "comment": "Malware payload (AsyncRAT)", "value": "2266f257553d0711c81bf5bb8de3d9359053e6ddbae618d12f6bee9358c2f742", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385520, "uuid": "cd61a9df-4dbb-4e5b-9a2a-47d1e66a9333", "comment": "Malware payload (AsyncRAT)", "value": "e230aed03fe1f6d88ee35f787cb8b44636fe842a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385520, "uuid": "9db2363e-7dd6-4fa1-b1fc-f76a97412ada", "comment": "Malware payload (AsyncRAT)", "value": "e6edd4c7778b4734d4efbd264c39f41498b02837d3a2329549d3775513072cf4f1af91b63da97bcdadf9d5aa8bf5faac", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385520, "uuid": "3bf3110d-8f03-4cde-b1d8-0c7ee0a555d6", "value": "T13E535B002798CA65E1AD4AB8BCF3560146B5C5772102CA5E7CC814DBAB9FFC64A137FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385520, "uuid": "99b1bb66-b1a8-4651-98c0-2b16aeb07f1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385520, "uuid": "86719f07-ddba-49e1-955e-e2b5556d743d", "value": "768:eSc6G5KVHiPRZGip9J2AtC6XZta1+mSFv7mqb2nOpwH1o5Qm/zZg8GM9Vc6KN:eS9VMntC6/a05bbbwBo3GM9VclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385520, "uuid": "679dd21f-fa16-45ea-b34c-7ec42cebec1e", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385520, "uuid": "1274c728-edc7-4511-8be1-ba1366001614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385520, "uuid": "8229147f-eabe-4a13-ac95-abe4d9c5af3c", "value": "2266f257553d0711c81bf5bb8de3d9359053e6ddbae618d12f6bee9358c2f742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7363c2-e811-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382172, "uuid": "f1d16a49-f224-475d-af07-ea6a7c053170", "comment": "Malware payload (Mirai)", "value": "dca22b81c9f435923ff0ea2d71c295e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382172, "uuid": "c5e1ca18-3d07-492e-bea1-f6725d43008b", "comment": "Malware payload (Mirai)", "value": "2277cbe612b03390ce0aeb301e7f4364b3c4d0d129a5f322d5f7dd883cd950fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382172, "uuid": "11be2a0b-686c-4044-bea5-4bfaca042b59", "comment": "Malware payload (Mirai)", "value": "94b5c6d557cadbe0c2ab9fc3469d9f653557c14b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382172, "uuid": "90685990-eec4-4b0d-9080-11d00788295d", "comment": "Malware payload (Mirai)", "value": "4fd89e04af144877b2b8238c9ebbe42f5fe692fdc5180d029af8ddd3ccd9137080f51cb23fd92e54c95af4891f4302b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382172, "uuid": "777c9913-ea2a-4b17-9d5f-2b7e7b297414", "value": "T13644C70E6F228F3DFBA8877447B79E24975923D626E1D585D1ACD2001E6028E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382172, "uuid": "dd97e445-4e98-4524-96ef-fb7f81e264d2", "value": "6144:hhT+aYCoX9JcAbkscLw6UfFxJaRBtHvAujiKCjax:b6ajstMBpoSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382172, "uuid": "ffca18c5-3e93-4f9b-8dfd-6963fe3bb238", "value": 258888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382172, "uuid": "ad9b1743-a4f4-41ec-bcbe-47407b99912e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382172, "uuid": "fe904f45-02e0-4496-b119-215e8a17ee90", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3f459a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385717, "uuid": "62cae215-870c-44e2-9466-b7f1d522f7fd", "comment": "Malware payload (Adware.Neoreklami)", "value": "8b98919807179a7f9ec581885205d5fd", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385717, "uuid": "4da50022-444a-4fc0-ac86-fc1c16e60862", "comment": "Malware payload (Adware.Neoreklami)", "value": "227aa7de2314a7974e6356caed21dec7cbd6cd9a11183764da956a995e6fed88", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385717, "uuid": "f8b58259-ee3f-4a36-86a6-edffcd76203c", "comment": "Malware payload (Adware.Neoreklami)", "value": "840f0fa3893b8c706a075dd74d9923b3521621d4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385717, "uuid": "91793dbb-067f-471d-a0fa-39aae4405b37", "comment": "Malware payload (Adware.Neoreklami)", "value": "756af7b6fe6f1dc8fa559cbaa5b2f26e4a22d240ad5202f87bc6a1125a6e53b7c65064b277541542176633e40b4f913d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385717, "uuid": "ec1c7d71-434a-4711-a5c3-1eddd58da8fe", "value": "T11B763349BDD1D2BAD6B344369A92BF51D0A6F9301C725E3B234D0AEF7638C91102B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385717, "uuid": "f5e5b3ac-696c-4af9-bd24-1af178cbefba", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385717, "uuid": "34ab28f4-9ab0-4ea6-a49f-8ee731a3c397", "value": "196608:P1O2EWXbVM+QzIz08uTYWl2SKuPfN6KpB4Ol33oAddEqHmbFEiUPY:tOubp0DTYfSJV/4Ot3oAIRiDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385717, "uuid": "0bd9dab9-26c0-4635-b360-580089a881a2", "value": 7537403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385717, "uuid": "1f150b45-91b3-4a5e-be15-397c3778f949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385717, "uuid": "534f38ff-78c3-4bac-bbf5-23a15823a58d", "value": "8b98919807179a7f9ec581885205d5fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbfacba-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385850, "uuid": "1901addb-faf4-4484-8448-30bfbe96dab4", "comment": "Malware payload (GCleaner)", "value": "b60fe3f552fd46dba35c58442c472f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385850, "uuid": "2ba7af30-f7ec-430b-8ba8-204262e76f46", "comment": "Malware payload (GCleaner)", "value": "22c24773bdb7fd649a9a3ced5024d8ad211a45ce3ec2804547f5a92afcd42a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385850, "uuid": "88465bd4-8680-4814-ada7-f31b9da169e5", "comment": "Malware payload (GCleaner)", "value": "871d9bf03a29b6ea95f8171cfbbf068d395e7435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385850, "uuid": "90664774-99d9-4f20-8b36-5c3643358090", "comment": "Malware payload (GCleaner)", "value": "fcb07bdb8b1299aec345fc8557f36a8b1322e619f4cae38cdceff7cda6ffde5934959499e2fd72d14e29cf28a48d8ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385850, "uuid": "43606268-1d63-4a60-b288-fff8a0680aa5", "value": "T1BF36E023F38280E3D05A14736B9E952CD6637FE6ECC08C7E14719E6C6A34C4A79CA579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385850, "uuid": "d7fc3ee6-20d0-41d1-9cd1-95f9241e25c4", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385850, "uuid": "5d004d9a-a709-4c87-822e-aab2f03d2711", "value": "98304:/UzNgP2uLVLAY6IYA5XANRjEKFlD+tDAwK+gCLaP:sW75AcYA+/jxRucwJgYaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385850, "uuid": "3ac4ea5e-095a-4277-be1e-b4934bb52b2b", "value": 5116688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385850, "uuid": "11a010d8-de77-418f-af95-ad7df5e5882a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385850, "uuid": "bec5966f-69d8-4388-afbc-07f5e38f0b75", "value": "b60fe3f552fd46dba35c58442c472f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6167dd9e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385615, "uuid": "7d6bfdf7-46cc-4d01-a00d-7f5a9b6a236b", "comment": "Malware payload", "value": "6f6c9c38772b869b97c2e8c4c39a9063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385615, "uuid": "9ed89da1-7925-48e0-a81e-8eb488b5442a", "comment": "Malware payload", "value": "230abeecc5dbf6a787846a05344a597fbcc241805a78b1b42f16945c5e83cf80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385615, "uuid": "8cdd5120-ce29-4882-8360-683b0e70b55a", "comment": "Malware payload", "value": "ea0570496c88bff8be118ef9a23ab55217104f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385615, "uuid": "64051448-3337-4681-a0a5-ba3eb05f87a7", "comment": "Malware payload", "value": "29462d5a75ff53faf7467f76ef87532c10eec1aa86354b4b4304e27506b94823d0bb3e88393e61d1c3a5baff2696b628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385615, "uuid": "f4debbf1-90e4-4a9f-a3f2-7ee6d26d2f2a", "value": "T1940633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385615, "uuid": "26518670-22ea-402f-acec-02d8cc3596b9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385615, "uuid": "40e9be0d-4ed6-467f-9768-8571ed320305", "value": "98304:aZT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:G2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385615, "uuid": "02af3d2d-65e9-442a-bd85-5495ebd804a9", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385615, "uuid": "42a556e0-b97b-419e-903f-3c84303507c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385615, "uuid": "dc0c0833-5b85-458c-be81-6aad7b98f80b", "value": "6f6c9c38772b869b97c2e8c4c39a9063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e087ab-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385777, "uuid": "407a555b-cd7c-41dd-9c7a-8d1fcc3b3bd7", "comment": "Malware payload (GCleaner)", "value": "9d40feacef8f17160eebb181e9b09431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385777, "uuid": "8469bca2-8dcb-4ad7-88bd-839ebb9ae879", "comment": "Malware payload (GCleaner)", "value": "24eecb35d8c59a406aa4c4bbf604dc4ad86ee0f59f08c533afce9a848fe37f7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385777, "uuid": "a2a68a1c-3c61-4272-86af-c2be7522b6dd", "comment": "Malware payload (GCleaner)", "value": "5c25cd010c843cf4215a16f86dd2b6d65dcf56e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385777, "uuid": "6926988e-b44f-40e0-a4ae-d185685d9c7c", "comment": "Malware payload (GCleaner)", "value": "70053403e5d92f9b42e50c0c2993a8ee1196c1f960d2d1382edd3ecfcb86e5a400a1c51f895fe74ed6fc8a71eb969602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385777, "uuid": "ac5e483e-e3f0-4bd0-8dca-5d83abdc916e", "value": "T1FF16BEE8FE94702BE166873C78151FE8849E6AC5EC4484E737F6098FD290649BC1F2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385777, "uuid": "61376224-b1f5-4bb4-bcfe-0d120f1dd61a", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385777, "uuid": "ef61b34c-c4b6-4691-a5dc-95db6f06be48", "value": "98304:1nS7yImGPv49+XbmRFPFSAmfWb2tOXiCjMJ:1S7yImm49zRZ/yaMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385777, "uuid": "f2db36dc-50f1-4b1f-940e-1c942f4cde1e", "value": 4174608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385777, "uuid": "a5eb91dc-0f98-4d1e-8265-b16e253e8bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385777, "uuid": "59e75761-baf2-456e-b65c-700f6dec5ab1", "value": "9d40feacef8f17160eebb181e9b09431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c5f2d4-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380468, "uuid": "cc2d025e-bfb0-4606-a379-ac5404a50d4e", "comment": "Malware payload (Mirai)", "value": "f1fb83995034fc4fd93ed4c9e51aef20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380468, "uuid": "fcf7febb-c249-48ef-9c10-eda9e28bb3bf", "comment": "Malware payload (Mirai)", "value": "2557cb3b798626092a109077211bf3f9e0580c2961bd86f99eb733360a7c2f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380468, "uuid": "3868775e-abfe-4bab-8631-352431533313", "comment": "Malware payload (Mirai)", "value": "128439df02ebf455a380fa9dacf89b84ce48d9c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380468, "uuid": "dcdd2353-de59-455e-99d8-52a76a334b93", "comment": "Malware payload (Mirai)", "value": "d831bd1c705f87ec3c7389ff17e0185ac8645190ea4aa7d20833d5be681df37223996c15f2926c1d5c65c8787f069662", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380468, "uuid": "19677bbd-db4c-4fc1-9b1e-a1e0f77c5da6", "value": "T140533C966400CD7CFC4EB6BEC4520E06F62477559E930F2BA3AAFCD35B3219C8925E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380468, "uuid": "df8bbec4-a651-43e9-bcb9-3c2a79a79796", "value": "1536:wywLYKIv1wcdGqS13HDwRXKzUuEqCC8t7F35S/dNZtDPMr:wywLYKIHFS9HTUjx7+/nPor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380468, "uuid": "0cae4391-5cf3-4947-9633-09b1122fec23", "value": 64492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380468, "uuid": "0f690c6b-fd68-4c34-821e-f6a0e7f1b852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380468, "uuid": "7d2e03ba-0870-469d-85ae-cee26e562392", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e619f-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767393348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393348, "uuid": "15ee0756-216f-43a9-95d2-fe8149dc9db2", "comment": "Malware payload", "value": "5a849c51647f30c5904ea88da7bc5edd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393348, "uuid": "df05155d-61be-4b52-b7a4-c53b8c76a038", "comment": "Malware payload", "value": "263bdc6867200b4c29eb91e6e04da967d0749412b168f4447f9f3e048e4880c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393348, "uuid": "e2362d0b-fd65-446a-9d9a-fe8636211e42", "comment": "Malware payload", "value": "f5d354fea0b86c0f700e4e407af042d9497aabef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393348, "uuid": "6cda39fe-883e-431c-8fe5-53ecd0c62b3a", "comment": "Malware payload", "value": "6c7253a600adc8c096c6bee5143c649ac458eb9e66f0e92eca25ee7d294697f5833235f513e16fbeeafdd1e179bb176b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393348, "uuid": "7d6d3e7f-4608-4502-8d0e-47a43c89d07f", "value": "T18231E58E70701841C69ACE1474E4EEC8639DA9D6B2E43732ECC12DB6C0D9E643919F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393348, "uuid": "f61f40d5-5603-4811-a6bf-039e33dc1710", "value": "24:TfDdl/CM143CnvBM/hb1a1bEZ1i2wOxx6fnZio7PCgK+C9JwCB42C1HZ:Tb/CM143CSBZZTMZio7PCyC4CvCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393348, "uuid": "4c820a05-3357-4cea-9326-9e49758a00c8", "value": 1831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393348, "uuid": "19d7c614-dc7d-493f-804f-1b2723a62bf2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393348, "uuid": "b0fd48d2-f4db-4600-be31-8ab64ea97e21", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd0a59c-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380643, "uuid": "8d42113e-3a96-4e4b-974a-24c8534e5fa0", "comment": "Malware payload (Mirai)", "value": "4ad567fad1f1d0988cdfcbb44400dc88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380643, "uuid": "090a943e-54b4-4762-95be-94d61fd5a9b0", "comment": "Malware payload (Mirai)", "value": "26d8d28bf1f6afb5093da1da33fe4f3b6a380ebfa9d52597221da36d0531526c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380643, "uuid": "f06442e5-ce32-40a6-8441-44d89915f387", "comment": "Malware payload (Mirai)", "value": "2f6c1a94db85025f51188e74706bd4af41e96867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380643, "uuid": "32c57b43-0133-4d6b-a6f1-5abe11264684", "comment": "Malware payload (Mirai)", "value": "6bf51573f755246da843ed5286ba20262fd9a5731f1162d356c2c02500bcbe8c4f1a25e2c86dd7e91e8496522d8705cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380643, "uuid": "2f706028-0ae8-423c-8c54-2d77c89347d1", "value": "T19163E74AFD819B15D5D525BAFF0E528D33535BA8E3EA72029E146B2527CA82B0F3B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380643, "uuid": "f5cfe80b-5d1d-44cd-abee-306c8f72c642", "value": "1536:UZnV813q6b8Q+sPPOtHwe6Kov4Ql1W4EdXMUux3MGlM9lLIiOy0Y+z3ju+7RG:I8166f+0eHwe6KoQQlA4EdXMUux3MNCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380643, "uuid": "ac8fdf2e-5e7b-45f4-8001-995a25b0137b", "value": 67944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380643, "uuid": "68601e5f-e866-4ae6-8e1f-46c93a597d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380643, "uuid": "1407c88e-6bd8-4e74-8aae-3655a57c3131", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9dd17c-e7e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767362251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362251, "uuid": "a1e36c5b-56f5-4b2a-ba4a-ee8fe7d1e3e2", "comment": "Malware payload", "value": "1d92d9d66d57468794a6c53ad62d3002", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362251, "uuid": "917332ab-ba8d-498e-afc4-e78d5564ff52", "comment": "Malware payload", "value": "26e6939efb18aeba68c1d94f285c1b2576027faba679d00e1b9c21980a9d156e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362251, "uuid": "38099ec2-9160-405b-9f4c-9d050e345c19", "comment": "Malware payload", "value": "a3667a87a78d28bf6d42f47c445b0041d30bc8b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362251, "uuid": "f4d5f7b0-1fe9-48e8-bd84-4ad5942bc459", "comment": "Malware payload", "value": "ba751e314e369a2146ef32a08de9446e45aaf7c80640d6ee8726872b64aa56fe7f483b8fe9847bed569d4992f1c73c99", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362251, "uuid": "db76ad01-3b94-4e8b-b132-2d4e2d8d7c74", "value": "T19992D16618EB0DF6EC8B4BF1E08524931C3CF448588E2C15247A1888DBF5F7EA88F11B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362251, "uuid": "ea3c7461-c5ce-4c56-9f88-02d76ba116b4", "value": "384:sDLPkWNelmSNvTvLoEc+kd+qX7HIEw1hKhzCt0xaXZpHnl4eYm8:6PsmqTToWmfo4hzC2YXx4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767362251, "uuid": "52b2d0c5-099d-4d33-915c-fc9ad1f2e395", "value": 19373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767362251, "uuid": "951c64a4-8d47-4fde-856a-bd2922ff8012", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362251, "uuid": "a39ee294-0cff-406c-b1bf-9e4d005d511a", "value": "07f07ffc-028d-4092-bc3f-74cb13257159LIRBUYMJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d9bdcd-e7a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334940, "uuid": "0a1f8f6e-f999-48e4-bc58-6dc62e4369fa", "comment": "Malware payload (Mirai)", "value": "cfebf7e1d87fc3f12c2612f32e806f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334940, "uuid": "9ebad64f-d54a-4833-ba77-9a4e27d3385a", "comment": "Malware payload (Mirai)", "value": "281eac190853c90a2548c82d1f5a44becd92adbff4251a92c2fc8b88311e1517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334940, "uuid": "8f07eb0c-7620-45b9-b880-1373ef1ad85b", "comment": "Malware payload (Mirai)", "value": "15001b2440b285d223f866a04737a00239b0f030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334940, "uuid": "51de3606-f6f1-4cea-8c6c-04cfc75df8ac", "comment": "Malware payload (Mirai)", "value": "38330af7200268a8de5d4ec2aaf00ba29fc91c2d81650e904581d8306b3b8b158416ef745558f525a1a43efd42f1a616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334940, "uuid": "daa81ba6-2342-4e75-911f-595a6bc62308", "value": "T168E36EC5E683E0F6ED1505712077BB369B72E53B212EDA42C3BD6932ED52681C90B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334940, "uuid": "bae027e9-b7c0-463f-99c9-ebbebba9a0d7", "value": "3072:wvAgZhY+Fc9xvgz1AOgOnOshKyZphQvezlDea+WMVqDLub3R45g4jCNtgt7W:LgZhY+WvgzaOgAXh5tQvezlDeI/K3i5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334940, "uuid": "968f500f-52a7-4228-a6ca-51a354c0a65a", "value": 150184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334940, "uuid": "c6c307f6-c70d-4118-be7a-1563f7fdb738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334940, "uuid": "fb0a1fa0-e48b-463e-b2d0-2d14aa34012d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e43c376-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386039, "uuid": "26c69e85-5ebd-4795-a778-29cc087219ab", "comment": "Malware payload", "value": "f502e2b0a0db0d742eb7c1416f8c5fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386039, "uuid": "e0725279-96f8-4f96-ac77-03601c73a182", "comment": "Malware payload", "value": "2853a4d24e46d83d40e5fa4ed7f75dcdaed9229695c919feab62b8ce5fd00916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386039, "uuid": "29c801f4-1040-4fb1-a055-d1944d479234", "comment": "Malware payload", "value": "ed2f8be9a2ed18673c166a0c65baf33bae5dcf2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386039, "uuid": "81c7baa2-40ff-43b4-8788-7e4eefda61a0", "comment": "Malware payload", "value": "5c34f3d206899b80281e70917e2e2fc2681dc26088852373ef3c8508e38d9b2e6f36de9fd4b94badc4e67e128d920194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386039, "uuid": "65e315f7-f12b-4a18-b0e1-f457b361fe16", "value": "T1060633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386039, "uuid": "1473b806-ac32-4f40-85d5-1f9f3012e717", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386039, "uuid": "9f32cb2f-cfc9-4800-b2fe-bd56cb6e7c5f", "value": "98304:a2T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:h2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386039, "uuid": "2f854140-426d-45c5-a296-4d31724d7ea9", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386039, "uuid": "6c409657-3044-4ec8-953e-7cf80c6d1941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386039, "uuid": "e01959bb-9c13-4d36-947b-7180e6ed4694", "value": "f502e2b0a0db0d742eb7c1416f8c5fdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903e6e60-e7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767371950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371950, "uuid": "0c6b2038-ef08-48cc-916c-4f26e3812300", "comment": "Malware payload", "value": "eb02d925022154b3629778544fb3b087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371950, "uuid": "9d2ec4cc-7983-46f2-a14b-c111c94316bd", "comment": "Malware payload", "value": "28a3c1554c3025c4a252094e18ad1aed931c71edc992eec9dfc991f893f6b438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371950, "uuid": "3af70acc-34db-429b-976c-9074057a50dc", "comment": "Malware payload", "value": "f7aa4992b4c21b9ce1d75e32186f917085be2d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371950, "uuid": "c33f5156-b931-44f0-a625-e187f337ae7d", "comment": "Malware payload", "value": "db99920d06cb783e02c3ad0201884c3b22e3129ecdd89783d52a16315dd04a3aeec8aa6368694fd45acac6df07d4683f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371950, "uuid": "580635db-6a31-45d8-976f-3f30c618b168", "value": "T176B733F266858873D46A25307D38429A103ECDA14E680FCBB6DC6F7998693D37338767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371950, "uuid": "af807f6e-2313-4966-a67b-e84375ee74dd", "value": "1418e44b536f42ef5db8fd35c961985c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371950, "uuid": "670a3680-3b18-498e-81bc-677e1a839a10", "value": "786432:AhS+EWfgN8mdpz5UFWaZv4RyP+s5KUfYiptllyFPsc2tXQxnqlyjlrfJBXH7Htrq:Ao+HfgNfdgFR4wgiptllyickXQxntxB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767371950, "uuid": "753dcb69-2f3d-47c4-989f-c6bd2040feda", "value": 49161070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767371950, "uuid": "ac4c178a-739a-41d4-b9e2-933e30193333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371950, "uuid": "b8378b90-9425-4546-b7c6-b0db3db6af55", "value": "\u503c\u73ed\u8868.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5159604-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385755, "uuid": "6e5e8eb1-159f-4dcf-ab18-06f484e85359", "comment": "Malware payload (GCleaner)", "value": "96610ce29a4bd44b0ce6974685539f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385755, "uuid": "7a6508fe-4240-4339-95ff-d90c3bfe6f83", "comment": "Malware payload (GCleaner)", "value": "28c309d8996ac945ecd955a6af5e7039149b19d05a380d3b23171887096061c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385755, "uuid": "781b3e8f-ebd6-4ae7-9797-1611935e659d", "comment": "Malware payload (GCleaner)", "value": "ca03e6c372f3f814389f5b88e54c45a02b3ae691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385755, "uuid": "141ecbac-fd8a-458d-89c1-f0cc773279c8", "comment": "Malware payload (GCleaner)", "value": "a43ab787ff3066c17a21a1e45038b86dab09bf178aa256641acc7be8b1956f8ebeb50d892efc67ce70b4633e313381d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385755, "uuid": "0a938650-ca36-42f7-8540-ab882ac67cba", "value": "T11946DF35DAE18E32D6F396BA383F06EC876F5F19C49CD6761760384BADF1A4BA050061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385755, "uuid": "26096eed-307a-4221-bbd0-f15c402739af", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385755, "uuid": "99a85341-3a78-4078-9318-fac95bd62d67", "value": "98304:5S/NFNAtdbldFsvnCNT/VSrmSuw048/LRu/8s4yk:YV8tVljGnqT/UqSuw0K/8sdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385755, "uuid": "7bb82f79-c2c3-4b1b-a9f9-66fb58a1ff9b", "value": 5681424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385755, "uuid": "e76aa8ff-d7e4-4760-95d6-df446cc901ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385755, "uuid": "b6f2aed2-65c3-4947-82c6-f2d2237997b2", "value": "96610ce29a4bd44b0ce6974685539f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ad2403-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386003, "uuid": "d9e64c51-dce2-4aa9-89e0-a3618acde6a7", "comment": "Malware payload (Adware.Neoreklami)", "value": "ea100d822a87418fac44349042a5232e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386003, "uuid": "1032c0f8-b1f3-4e6c-8da3-3c68de0222f5", "comment": "Malware payload (Adware.Neoreklami)", "value": "28d779d83171a15b325d22e909a2baf25de80fb4e90645ec6cc2140b22ddc3ea", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386003, "uuid": "162615cf-0cac-475e-9c8f-9e9a77c9a9de", "comment": "Malware payload (Adware.Neoreklami)", "value": "d28a82ca48625d1d13d6a7597cff246bbf85a5e5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386003, "uuid": "dcfb293f-5a0b-4539-992f-12594e341de3", "comment": "Malware payload (Adware.Neoreklami)", "value": "f5c8c3d95479690a85181aec32206707ef0199af661715042f094265d320544ae5c6841a461b10d6e25164562df11f35", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386003, "uuid": "c86f5cb6-238e-41b0-b53a-82fc4e06b47f", "value": "T1EC76333238E0C3B8F0212575BB935BF5A394A4980F635537731DCF0E79BA82497A6B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386003, "uuid": "2b84b80e-4435-4a9e-b1f7-6e462319caa2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386003, "uuid": "c4c8bd35-b496-42b8-a5ee-c3768bbf6677", "value": "196608:P1OY8HeXT/DKopRUiKK3ko1tTrIh8vEOkZc+0wIb2Eo:tOJ+XTbKYRUihko1tTrIevEOw1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386003, "uuid": "338c4a6c-8249-48a7-a7e9-d00b437a7483", "value": 7584879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386003, "uuid": "bb625ce5-9fdc-4856-b400-b10b975e9a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386003, "uuid": "6ce9dc6e-9f6d-40c8-b887-775a2b9e9e8c", "value": "ea100d822a87418fac44349042a5232e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c864c5dc-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385358, "uuid": "a7a4e5b9-87c7-4f40-9911-8884df3ecc8a", "comment": "Malware payload (Adware.Neoreklami)", "value": "0d62e3d7682de9970b62c76c225c02fe", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385358, "uuid": "9a5fefce-0e0a-4c71-8eb5-3433e82b2a5f", "comment": "Malware payload (Adware.Neoreklami)", "value": "292ff5a335973818c9708e2ebdee7119a3f3ca9b1b5fb6920a3622835467f702", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385358, "uuid": "bf42bb8b-9952-4d17-9a55-2653b82c0444", "comment": "Malware payload (Adware.Neoreklami)", "value": "d46601d31c576b851d1becbc58c16c2b8d859072", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385358, "uuid": "b03a6e78-a78f-4fab-b3e6-e928304a298a", "comment": "Malware payload (Adware.Neoreklami)", "value": "320b705ba7744e8f29bbe50b39d79db07a80fee118ddaa42817fe5533c8e15f71e79e4ec950a58a619d71bbb4a54d41e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385358, "uuid": "42456575-c6a0-4de6-bb4a-5e24cfc36f60", "value": "T153763311FDD1D9B9C1C1427258D42BBA7CFED3710F9918DB1BCC9A3C6ABCA8908615D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385358, "uuid": "c29245ba-3359-4aec-b720-8b3f7f7bdec8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385358, "uuid": "0b322586-f0ad-4812-aee4-75953c0c04c7", "value": "98304:P1OBwb7mvqYUwm14mOVTtIMyayNaL5+WvSDkbA/moEqZsJBmSgVP+Iq9NBgS4iQY:P1O0SvqY7oOVTqRLWvVAuoLWIXiF2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385358, "uuid": "caa8a0c7-b710-4f0a-ab22-7cddba97bd1e", "value": 7553319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385358, "uuid": "86a64d56-98a6-4bd6-9c51-d563abfedaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385358, "uuid": "fedc2be9-93f4-449c-8c22-39a575a5f705", "value": "0d62e3d7682de9970b62c76c225c02fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e047ef-e7cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767353026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767353026, "uuid": "bc26b2e6-8870-489c-ad20-8684f04c4353", "comment": "Malware payload (Mirai)", "value": "fe430a08aadc9e425d8d3033cb8882c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767353026, "uuid": "78918460-3e7c-4f7d-b10d-992d6e8694c1", "comment": "Malware payload (Mirai)", "value": "293e617a1ae8a302975ccba965e00d59fc4fdf152958bafac6092042f9eaf41f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767353026, "uuid": "f489375f-93ec-47f6-b781-86348d72f24c", "comment": "Malware payload (Mirai)", "value": "08e28facbb79cab73057f90a2f7c1024b305d391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767353026, "uuid": "efcb2d2a-f55c-43b3-b4ff-02f7d5b411cc", "comment": "Malware payload (Mirai)", "value": "ebef672a4f7c0caad8eb9265f546d353b4165b140c34877edb8c1d694d26ffe204cac269405a7bfba4de0fd130bb8da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767353026, "uuid": "bd5abcd5-cfc7-450f-87c8-607e4b1240bc", "value": "T195A35C82D692E8B5F8521076173A93628A33F1352431DD87EBB52F31FDB6A10CB157AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767353026, "uuid": "949006ac-cc34-4389-93df-b89661403cf5", "value": "1536:8uoz6UaKe/nYiMRZhUWmLA9Rsrbx83AqsfEYCBr4uQ9yD03jIaDsFAYOiGYUrC1l:+zdMAabPqsaQgD03saDobrbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767353026, "uuid": "68fbe429-d9ce-4f45-8654-cc4d3fdb8d75", "value": 100304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767353026, "uuid": "d056b617-9e6f-47ea-90d8-815edcee303f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767353026, "uuid": "d3d29cc8-c660-406a-8474-f4946c79c2f5", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eab58ef-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386067, "uuid": "10c46735-1e0c-4c2d-b4a8-2c818b2c20f3", "comment": "Malware payload", "value": "ff8dc7f88d594a02f2cc489363e306e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386067, "uuid": "c4dbea8d-ba7a-442c-8653-a2a9e375053e", "comment": "Malware payload", "value": "2a0b4b036debc75882d91e6165f1da738981eb7e34e8d421f3ac393327ba3871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386067, "uuid": "cb7ea1a6-b32e-4694-abc9-47d359d4f064", "comment": "Malware payload", "value": "be20cfceb838408341ca3328277ca3f3b11bb067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386067, "uuid": "9ee9516f-ee76-4575-a9fd-5c1d86b79d7f", "comment": "Malware payload", "value": "0d32753a84a176f5824922bf370813a06babbbd0dadf00f663a56d64e63a08e0ee640c1c2b1c4406865849a2a42864d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386067, "uuid": "f4b2d8b6-6fca-4752-ad87-680eaf437343", "value": "T1080633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386067, "uuid": "eb606630-41ec-436a-b360-3002769dc344", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386067, "uuid": "0e11d54d-22d9-4894-a41d-76981cebea63", "value": "98304:aPT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:s2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386067, "uuid": "d0df0dc6-624b-4d6a-8bc9-916263eaa528", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386067, "uuid": "7975deb7-9926-493b-8b1e-d4b8ee60eed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386067, "uuid": "b5d87505-ca3c-4e79-b85f-5325f46c78c7", "value": "ff8dc7f88d594a02f2cc489363e306e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b055144-e792-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767327676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327676, "uuid": "e509b640-f73f-4ac2-b70f-7d2526e6bebe", "comment": "Malware payload (Mirai)", "value": "3669226aa7d14a05db8b7a5639628341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327676, "uuid": "95d1782f-61d0-449b-9c91-d931e515fd52", "comment": "Malware payload (Mirai)", "value": "2a39e043a395321fe8283258c3dd92a9399796104c5ab5c7bcd218cc146be963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327676, "uuid": "721f1024-df08-47f5-bc95-309365d8d010", "comment": "Malware payload (Mirai)", "value": "410502c1131f9dda80ca5b2964a358e5184a4930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767327676, "uuid": "f0877ce7-3394-4f3d-9c36-ea957d105bad", "comment": "Malware payload (Mirai)", "value": "8278010f3131f795f3f0fec5241138c2af184333b871885fafc13bb9c71fe9c463036341a83d12257e8c6a1afa0be68a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327676, "uuid": "176dec7d-b9a8-45eb-9fa1-d0c9e6346b36", "value": "T1A3141B46F9818E12C5C112B9FB5E418D33137B79D2EE72029D24AF60778A8EF0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327676, "uuid": "9f6ccea3-755c-41a3-baf4-87a5c418c1b7", "value": "6144:rS1Mqoih6uRREHKVAbW58fyeefKNwODuxEHK1g3hLH4XLELLaMwVD5eBIZoSvm:rS1BJ4IREHKVAbW58fyVfKNwODuxEHKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767327676, "uuid": "f195065c-941c-4823-a2e4-b921eaffb9b1", "value": 209228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767327676, "uuid": "7bd4c264-99b2-48ea-9206-70335dd2df0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767327676, "uuid": "b79d0c9d-9d76-48e3-82b6-c9fefcfd96a6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaaf259-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385424, "uuid": "81401998-ba0c-4989-b86b-dea9ec3880e1", "comment": "Malware payload", "value": "258dd32fb2d84a5049acb0d72e0457cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385424, "uuid": "476aaece-3027-49bd-8b2c-030d254f4663", "comment": "Malware payload", "value": "2ab2f0802e7622649cfa526be9277dbbeb5224111d0ea2eb3beef7ac0b2d3360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385424, "uuid": "424746f4-943f-4ada-9f29-86e7a275c87b", "comment": "Malware payload", "value": "4a0e5eb7a316c3ab950ce63432383703c3b11e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385424, "uuid": "cdf844b0-f762-4b45-bf17-593ecf8bf643", "comment": "Malware payload", "value": "be52e866a3eda5ef883ba5f39ae75e6ccf8ca4d831c6cbab112d23c56fb822a0b553ea0dd59764c30c1671b09c2eeb51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385424, "uuid": "8d1fe0c4-b299-4d3e-a688-bf3aaa1a6d2f", "value": "T1570633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385424, "uuid": "40d81a3c-f61e-4801-b3fa-5c7b9780d27d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385424, "uuid": "867a0ed2-3a61-4ec7-a2f3-106e7a46d9e8", "value": "98304:aiT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:x2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385424, "uuid": "92544ad3-537e-401c-a5ef-ee1264e89b4a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385424, "uuid": "c9bacb6b-1dd6-4fcb-8eec-8b7f658eaa49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385424, "uuid": "8af3af13-132f-4330-b14c-516ea77896f7", "value": "258dd32fb2d84a5049acb0d72e0457cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7739f217-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336259, "uuid": "42c10d9b-0d80-4d90-ab0b-9508c046439f", "comment": "Malware payload (Mirai)", "value": "717f0f292154ece401326c5591dcaa4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336259, "uuid": "a10f8b2a-2f69-4148-b3ff-4e88edb656c3", "comment": "Malware payload (Mirai)", "value": "2abb5da9836bd6120717fb3efa6989893a4b630b296ba0c21d9a9956ee2681b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336259, "uuid": "78a12c4a-b22a-4360-bcb7-17ee455213fe", "comment": "Malware payload (Mirai)", "value": "e1bf3c229c098294de6ea13d9bd5507206bcfc7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336259, "uuid": "69157bea-9e6c-487b-b59c-73a433cfce83", "comment": "Malware payload (Mirai)", "value": "73bece56d88fb822201285261dbc4900b05233c217573c8ce316535839e8aec449cc5b4929d47a11b8f37afb4dc2543b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336259, "uuid": "df81650e-b775-48f6-a51e-bd1ae95d01a9", "value": "T1B0F33940F68BC0F6D817893050A7F73FCB32A9364076C65DEF599F32CB279429616299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336259, "uuid": "cdbbb1a1-715d-4192-a167-b8d318ace9b5", "value": "3072:499r40FnMCh0TjlmWibR0k6l9bo/zKj5dJyLKMLP0gAsCC:Z0BMM0TxmWwekW9bo9zPQFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336259, "uuid": "39bfeb08-1674-4bfa-852a-f7eac265ab5c", "value": 160904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336259, "uuid": "87c87fa2-982b-45ed-8f18-4392cda782e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336259, "uuid": "c111be4f-42bc-4868-85b5-5a0e29db3b49", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291c503c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385521, "uuid": "5e5b3c98-a4bf-4ad0-bf94-ee5b04531941", "comment": "Malware payload", "value": "50b9b16ae3037153cbee9c016199f2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385521, "uuid": "fcce1fb9-9ff9-4618-b53e-cdac16c3026a", "comment": "Malware payload", "value": "2b6cbc44328f66b0be4d79a22b90901c98ae77f8e930a18aad615e57a0b08280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385521, "uuid": "14c1b04b-d7fe-4114-b77f-81eb34642e1e", "comment": "Malware payload", "value": "31a0783b359cdd65f48c9351e8a3c06cc1ffc20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385521, "uuid": "16829fab-6064-4781-a230-44c6838b8c7b", "comment": "Malware payload", "value": "dec0bac841a13fa709879719cd38c8bbea22ab9a07142503d3631d09d82166c8d6df7d082f4d72f9dc89d3f0b59d8d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385521, "uuid": "7d8d7534-9c38-4f24-862e-7e5a8105bf3c", "value": "T1810633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385521, "uuid": "1d474e0d-d503-4cdd-9b77-e1b9b204ca15", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385521, "uuid": "3f11802b-94b5-4301-87e5-06ed3cc33b07", "value": "98304:a6T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:d2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385521, "uuid": "f2f9bc7f-5464-4bef-9f0b-89fec69ecd50", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385521, "uuid": "959df05c-1113-417e-8519-f2dd7ef9c51b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385521, "uuid": "63e090f7-1069-4980-8e8d-ed0927d4d5fa", "value": "50b9b16ae3037153cbee9c016199f2b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4c7fe1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385767, "uuid": "b92ed39b-c144-4457-9006-a6c1bf1f7bbe", "comment": "Malware payload", "value": "99670d20fa36414487a35aef7789153b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385767, "uuid": "824f908b-3389-4544-93ce-2ca30fd4cf43", "comment": "Malware payload", "value": "2ba4243f452deaa536f303214d31a05973325a6401bd31c1997a4073fd812567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385767, "uuid": "bcb35de3-461b-43d4-b464-bb26f5d620bb", "comment": "Malware payload", "value": "7940d6a2747bc610a6b5d3dc5139586251e9916d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385767, "uuid": "8c46ec54-59ea-4f51-a4bf-ec6a8e348593", "comment": "Malware payload", "value": "c669d427356e227cb8a4e5ff3d7b5a6dca8bc252a04588c385868240a893987f11368182101259b97a541dfa89d9ceb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385767, "uuid": "5ec752fa-6804-45d9-b750-8664c612b1bd", "value": "T1010633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385767, "uuid": "ea996f13-b8c1-4683-bff7-11f5cdac9070", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385767, "uuid": "3399ae99-8843-45b5-90fc-4c512303c3d7", "value": "98304:acT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:/2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385767, "uuid": "977f8270-03b0-4e92-9f71-f2c40bb160c3", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385767, "uuid": "ea0ed74b-484d-4682-801b-2f832d11a1ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385767, "uuid": "59d635e9-7e90-48f7-9b4f-41ca747752c1", "value": "99670d20fa36414487a35aef7789153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a9e370-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385867, "uuid": "3116b457-9025-4bdf-8f40-7e220eaf3053", "comment": "Malware payload (Adware.Neoreklami)", "value": "bc771f9277bc7b9b082ba561f4da9ad8", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385867, "uuid": "677c5faf-02f4-4f7c-ba82-f483e624e477", "comment": "Malware payload (Adware.Neoreklami)", "value": "2c09e95fdb0291b0f2beeaf84d9510a4db986b5ec3eac29cb5263c781bad8da1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385867, "uuid": "48d6d775-a5ea-4f6b-a0ab-5900c143057e", "comment": "Malware payload (Adware.Neoreklami)", "value": "00239f60285aff3bc4a259a8662bd1647ed14bcc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385867, "uuid": "776798aa-fbc2-49d6-a17f-443815bd5f1b", "comment": "Malware payload (Adware.Neoreklami)", "value": "c7d94182c15ebc582210352c15ce47166cdbbcdadfede7af74c8c1beb955950fb2b743336bfc779b18599345a8e754da", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385867, "uuid": "0e034bb4-0dea-4d84-846a-7de26a3d327b", "value": "T16F76333334F5CABCE69E5A318C9D8EE87EA4C5041F01846733B48A1D697578BC63739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385867, "uuid": "bed1b0eb-0061-4259-9e0c-e67af627781b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385867, "uuid": "4cc5eaee-917a-4cd4-8452-15323ab40359", "value": "196608:P1Ol8Qgd0WgviqrgHbSY9TP+kvqNUmbcyBRzXTf:tOl8B0viqGbPxBmbcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385867, "uuid": "f567bf61-d585-479d-a2ea-9ed3e127f0b1", "value": 7549300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385867, "uuid": "00402433-320d-497b-89e3-f50c8b1d5f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385867, "uuid": "822a9710-22ff-4712-9c2d-c6c71b45bf1c", "value": "bc771f9277bc7b9b082ba561f4da9ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb5fd6-e77b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317675, "uuid": "f1bd59f5-cfda-4f09-bded-264864b9922a", "comment": "Malware payload (Mirai)", "value": "03e3b91c615af54bd90e363714c7627e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317675, "uuid": "113250ce-44d9-4213-8438-7abd7e64e575", "comment": "Malware payload (Mirai)", "value": "2c0f8e1fd3ad43214b128f1f21c280eb2f1bd97292e716dbc511bb834bc1e3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317675, "uuid": "3b382b0a-9cb8-4bfb-aa7f-3be232cdcfa9", "comment": "Malware payload (Mirai)", "value": "79feb1215863ad77a3acd5f185795598be03cf9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317675, "uuid": "c76c9231-2c07-4973-8985-de3ab7aee570", "comment": "Malware payload (Mirai)", "value": "8896b4ef2d48f9268db1967c548ef374f2afe46979a7138e4de6884374a6a7dbad4193430f7375027819198f91b228dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317675, "uuid": "df47761f-2a5c-4b70-809d-f5d849d23ecb", "value": "T1E9234B21BEBA5C1BC5C5643A21E38635B5F5430A21B8CB2B7E320E9CFF54550235BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317675, "uuid": "0860a244-fcd7-4c87-b2eb-749715f37d30", "value": "768:UfUZeFCvMHIi2gopzhpS7HdoGsO+p2ace+ch1x:UfUZefIi2gopW7HdKnce+chH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317675, "uuid": "5e6a0afb-c987-4119-97c3-85efbfbf8e75", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317675, "uuid": "588956f2-eb9e-42c8-b290-b5cb7d9b9aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317675, "uuid": "b45d5bb7-a358-4c9e-a2f2-3eaf76ed84be", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214019da-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385507, "uuid": "2ad3991a-fe53-4db1-8b41-0640f5c02508", "comment": "Malware payload (Adware.Neoreklami)", "value": "4a373836d312b7e2a75b12aae9dbbefd", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385507, "uuid": "924efad2-45c6-4c2f-8fda-80265cd45581", "comment": "Malware payload (Adware.Neoreklami)", "value": "2c1d3190c8d16c98a6fafbccda19ed068bed4097f7b92061edd660439c1a2724", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385507, "uuid": "8caea83f-61c3-46c3-9c82-956a92bd8936", "comment": "Malware payload (Adware.Neoreklami)", "value": "ec46185f2a8b8e036b620fdd6924fc07ce3d600a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385507, "uuid": "ca6d3684-08ba-451a-b319-fa313b310e78", "comment": "Malware payload (Adware.Neoreklami)", "value": "d4f4df52ee2dfb5d93cdfdea8285eef9c14213887117c16809f48ee1f98002ad2c94203c55d1cac15956c5f1bcefa294", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385507, "uuid": "1bfe951a-1267-439e-b236-2991ecd97938", "value": "T14E763336F5E0D6F0EAC60C30E62AF755ADBBDA294D144CEB23C15C062D75246D027BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385507, "uuid": "697dd3b2-5f76-4339-84a4-41d79774552a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385507, "uuid": "0863a6d4-e768-485f-8c36-1ee04c95cd48", "value": "196608:P1OTnjt4LEFyLIubqr3gzqEXrpn9LCHHCMO1Qmh:tOCwfubqrQrpRii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385507, "uuid": "3cbd18d7-cbbc-4f9c-8eee-94ccef9ec7ff", "value": 7503392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385507, "uuid": "08122671-7f7e-43b5-aa9c-7888dae83e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385507, "uuid": "23bb54ed-9cda-4c7b-812e-7ad979fff340", "value": "4a373836d312b7e2a75b12aae9dbbefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a6ba99-e798-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767330435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767330435, "uuid": "a5f9d9ff-1310-42fd-adce-5aa59611398a", "comment": "Malware payload", "value": "74c1def300fa595f88cc57e9849d6206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767330435, "uuid": "330ff3af-36e3-4de0-8f1a-155345deb5b5", "comment": "Malware payload", "value": "2c563563e0a6fa94ec07074d074b6cb630550eacb678ebb2297835b282747a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767330435, "uuid": "263af738-cda3-4abe-bb59-c830a666c606", "comment": "Malware payload", "value": "b92d147a161b7051f67dbe9c53caba0cf9e50102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767330435, "uuid": "b15a02b3-6241-432f-8820-9957e1226847", "comment": "Malware payload", "value": "657b1e53506b22e2c1f4f0430c1733cab475bcfb19b537766bcf1a7a93329455a7e7d20659c34c59c61b9d02bc13b92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767330435, "uuid": "10c7ad6d-4c9d-4536-a07a-5db5e10fe032", "value": "T1CA15F761E8F9A026C5D101771669DA33242D882D0F3423E7D2C0BBBEB4FB5E41A7756E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767330435, "uuid": "97f826e4-bcd3-4237-aa9a-1306b02e9998", "value": "1c4661ad7d3fc8350c55edf0f712d992", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767330435, "uuid": "70ddaa0c-6015-448d-92d1-89b5a9bba716", "value": "12288:Gacp1LPvpmdRi9HWd+OD07TecFVnScX3FW02JhZIdXhVbdAm3z6WOrrvr72/:GF1LCp0hxW02JhZIdOnWOrrvr7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767330435, "uuid": "e3238805-22cc-4b89-ad5d-c78677454161", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767330435, "uuid": "1fe2d6ea-9eff-44b0-955c-f8d16c154c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767330435, "uuid": "91d83f58-e485-4630-93f0-a129971639d0", "value": "FWR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5200a014-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386019, "uuid": "3ef88e5d-07d8-4bff-bdb3-e613fb2180dd", "comment": "Malware payload (Adware.Neoreklami)", "value": "ee52a18d634c18d48a2b576083fdfd5e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386019, "uuid": "e9bbc3f1-cea3-4e1c-b9ff-1cb813666c43", "comment": "Malware payload (Adware.Neoreklami)", "value": "2d017a85acaca0b15cc0f52f34b4390734bcb0017ffe95aaf6870230ccb39881", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386019, "uuid": "d57d7cd0-14d9-4c7f-aa57-5673050ed0ab", "comment": "Malware payload (Adware.Neoreklami)", "value": "2bae1eccae226ec1e15b9c9b91b77095ed6c6017", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386019, "uuid": "7a7f369e-5f2a-428a-aed6-0415ec980825", "comment": "Malware payload (Adware.Neoreklami)", "value": "b0d20584cbf1eff8b15942c31dc43a60d4fc91ff251a15f6f45d73d312ff90a5b9c39915cbfb9d28a2227a194e94c206", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386019, "uuid": "6a0b7544-5a32-4d04-b18a-d2b5ca7dfef2", "value": "T1CE763369BCE4C6B9D2E70030090137AC85B7E66E4FC088577BD49F190B6EDDE8B1E918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386019, "uuid": "facd046d-9b79-434d-aec7-5a94c030b145", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386019, "uuid": "d2f20e8d-700b-484f-807b-88825a98317b", "value": "196608:P1OlMmng2xCoNu2KZbDCozuwvCz2OTapdETpzlkByaOe7qgRS5I:tOq0xFiDFuw6aIap6BBe7qg0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386019, "uuid": "49343e0a-3a4c-4ae9-88ec-8a73b911b3eb", "value": 7541309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386019, "uuid": "d28df1d9-275c-463a-90cb-140469f37f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386019, "uuid": "94390fea-4e55-4661-a237-05408827fbee", "value": "ee52a18d634c18d48a2b576083fdfd5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36d692b-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385404, "uuid": "495244b2-8a79-41f8-8c90-f05b89efd5db", "comment": "Malware payload (GCleaner)", "value": "2172825955c4a01b1c496ce033168bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385404, "uuid": "24d4468d-bcdf-4e4a-b3c3-666d538acd0f", "comment": "Malware payload (GCleaner)", "value": "2d6b9d5772bd17f43d2336c61bdb453656ba55b13250eeb735e719fe3f650c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385404, "uuid": "32eb98b8-46f3-40e3-acf8-c174269b6f4a", "comment": "Malware payload (GCleaner)", "value": "b01b1b3277d79ede6344447e8be8012858b41687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385404, "uuid": "594a527c-111c-4bc7-ad65-7fea84e20fb9", "comment": "Malware payload (GCleaner)", "value": "069718febbca891c3af04691179ae26cd0930b6e8b74c82bdde3fa44f0e826fcace3aaea57e3c05cd71d6c86c420d261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385404, "uuid": "f89236b1-8f8e-48a8-9d82-05ddeea971c4", "value": "T15C16E025EB02D9F0C2C2267B6D4F03D7681B7940D0CF6A3FD7556A7B67A4B8026C07A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385404, "uuid": "75367524-28d2-483a-affe-9a0b0b9cf171", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385404, "uuid": "ddcd7ed6-5d7b-41ed-80ca-e9e97e7f90ed", "value": "98304:6C1N7eSo5forD6i7VWBGiC86TnnGwDornLfzFsdEFW1CFeFEMCj:6gtcfm6ifr4winLf1MCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385404, "uuid": "e38c6aac-4fef-4ad3-a596-010f101206df", "value": 4411152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385404, "uuid": "cd087e32-d931-4b3b-be7d-d81ac47eb3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385404, "uuid": "135616a1-51f0-470e-9046-44f42ea325d2", "value": "2172825955c4a01b1c496ce033168bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649bdbbb-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385620, "uuid": "c882320e-fcda-45dd-9efe-f5adb56dcf4a", "comment": "Malware payload (GCleaner)", "value": "70749938dd0147b54d43123c2fe9106c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385620, "uuid": "10303f4b-123e-41e6-9b7b-1afe8963973f", "comment": "Malware payload (GCleaner)", "value": "2d6bfbf1de05b44dd70b9410e30bdaf5e1bb54445bafc6830afb9bdf39704352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385620, "uuid": "346168e2-e501-40f9-96c6-bcac060856b8", "comment": "Malware payload (GCleaner)", "value": "267d198a923ba01bcef9ffb1c86e964344b83c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385620, "uuid": "852804a7-8e2c-4e2a-ad5f-4abb78f8c465", "comment": "Malware payload (GCleaner)", "value": "8e45035c903d20f86d56d074db543480bb6793558a84fc64908c8a106ea5e83126079d58412dd965ade4bacb0e982ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385620, "uuid": "082b1dcf-ccde-4178-b1a9-fd2561e0421e", "value": "T19216E046D3D09F1AC4B5F4BBC536A9F04D5EF905E8200646A607AA0CFF33988AD2756F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385620, "uuid": "7c0414f6-65b1-406f-9b94-d20d443aafe6", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385620, "uuid": "2fc76576-64b5-4386-beea-14e0f4b8e9f6", "value": "98304:sUzNgP2RiFujp7COSELlsBvKU52xbPDXIgiu++kbA:DWkjpV5LlM52Bvf++p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385620, "uuid": "8204cdaa-d87f-4061-a5da-f754eb23d66d", "value": 4158224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385620, "uuid": "0f14b1fd-18bb-4f72-9698-2418299baeb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385620, "uuid": "732f169c-d907-4f0e-8feb-52c0e9048a09", "value": "70749938dd0147b54d43123c2fe9106c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1005b367-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381613, "uuid": "f597f736-aa16-49e8-a654-39c5c588162d", "comment": "Malware payload (Mirai)", "value": "56aac59450492a1f32f8db58347b75b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381613, "uuid": "c1ceb0ec-31ae-411b-b2c7-54a5919601e0", "comment": "Malware payload (Mirai)", "value": "2d778a89648854007ed69ef2ce89a4e84b6909917ee6ce3262c7de89ca823213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381613, "uuid": "ecef88c2-a9c8-42c0-8087-ccff18279ce1", "comment": "Malware payload (Mirai)", "value": "e9819610e1e7a4c19f0eb9cf18b5a0b0cfa9c209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381613, "uuid": "12c16388-6aaa-4ed3-a224-db752ad328bb", "comment": "Malware payload (Mirai)", "value": "b9ef7485a248a3b3770a10aa43685e27a369cd14c7bae623ba8a598a57f2d04ce72f638c012939b147176ce4018fb8ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381613, "uuid": "11f1db50-588b-4b01-9204-e33fda15557c", "value": "T1373318D6B401AE7CF95BEFBE81224909FA31621151830B3B237BFD936C322A58D52D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381613, "uuid": "71970416-2f6b-401d-bedb-d082f2d88802", "value": "1536:/Klrztlv77ldfSGxo3DRdCHjnm6fiVf5n9T8h:GLlFSzRdAjUf59K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381613, "uuid": "083222a7-8aa9-41fe-8881-5067580ca7ce", "value": 52508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381613, "uuid": "4d2fdb1d-c222-42c7-ac7b-e5d60df0e9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381613, "uuid": "8c141825-9561-400f-b4e7-27f1e0338840", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20035e3f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385505, "uuid": "81b9bf38-2a3e-4b9b-aa11-6c92dad448d4", "comment": "Malware payload (GCleaner)", "value": "49d767098cd49a7a8ab3f776b8899496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385505, "uuid": "bf372b9f-6ff9-4c4f-92ab-432c97eff71c", "comment": "Malware payload (GCleaner)", "value": "2db5538cd3023845395485b268d03a04a8662a47336132c56f835de07ea28d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385505, "uuid": "0ab81fa6-3b16-438c-89db-3307548131aa", "comment": "Malware payload (GCleaner)", "value": "cd7d59f496b45b61e7e65ec2e52cfffee71380b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385505, "uuid": "9c428931-2d1f-47e5-a591-06881fade061", "comment": "Malware payload (GCleaner)", "value": "c670073216aa89b80b22bf5da7a34f08f69d9b3312e0df16a90d3b2f9b5c981121db29106d8a014020d3213f592ffcb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385505, "uuid": "7b116f29-e86f-485a-a05d-5cd94cfc431f", "value": "T1F046D013D4A098EFEEE61E3C282E4D84278275EFF0A70A461F94646CF794F1267855CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385505, "uuid": "410f19e5-3db0-4265-aad8-f63b0369718d", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385505, "uuid": "886edd58-b121-43e6-ab7e-625650126269", "value": "49152:9S/NdnNM3/MUnfbylzmfXSz2HrOgh/y6Y/PBvkeb8tzLgwQisI77zITDFda0Ieyr:9S/NFNAkUnfbmzUiz2HB/FnUFAmDMqGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385505, "uuid": "7b7fdf71-ebb8-4ba5-8f7a-7777b28108e3", "value": 5482256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385505, "uuid": "c95cf201-11f2-4f46-a354-3e1dbeb341ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385505, "uuid": "d4d0cfa4-70e1-4a6e-ba6b-3def0b097279", "value": "49d767098cd49a7a8ab3f776b8899496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6ba1f4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385501, "uuid": "e576b993-2e83-440b-8b78-48798ad61dbc", "comment": "Malware payload (Adware.Neoreklami)", "value": "48f8f25c0a364e07afdb68c93d9cbe0e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385501, "uuid": "ded39d39-1e52-413b-a8c8-964ac8eca393", "comment": "Malware payload (Adware.Neoreklami)", "value": "2df2212d34ed259758116c84388782e752d5b268088aadcfcf2f53e093796daa", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385501, "uuid": "72f84b00-fd6f-41d5-8901-764a2c9de92b", "comment": "Malware payload (Adware.Neoreklami)", "value": "87ed1196d4b17ae7bd51d326d5c4419345228cbe", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385501, "uuid": "29deda97-3458-4362-8724-47c252fda118", "comment": "Malware payload (Adware.Neoreklami)", "value": "fa86a3d25c6aad13c6aa985cd791396602eb331756f7993cb73b8aa8afea3222ac937e1f2da1713e356451ac56b8715f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385501, "uuid": "044aa658-c604-4284-87ae-7ab06c750008", "value": "T15376331038E598B9E2972531D5D8AF61E6F8C3991E208897739E8FF89DF7301D0B4D98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385501, "uuid": "c24aaea2-d1c2-4d6f-9d65-0eaa730f6465", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385501, "uuid": "cd8716e5-bd7c-4bdd-8cc6-9f151ded6c0e", "value": "196608:P1OrZGzcxv2ZtzA9DTPPe0xXISlipo0aZ/qGbA1EYlBJF/jHGD:tOlg827z+fPPe64SQpW1qGb+EYhYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385501, "uuid": "1c174008-f4d1-4b4c-9bea-30849b170f78", "value": 7620919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385501, "uuid": "637801e0-d0e9-41e5-87dd-c264688dd800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385501, "uuid": "22afc3ad-70a1-4f27-b35b-93465fed484c", "value": "48f8f25c0a364e07afdb68c93d9cbe0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cccc37-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386005, "uuid": "fda35c28-e510-4f16-808c-36fe364a1218", "comment": "Malware payload", "value": "eb58bfbed449faf3bf6e9b46c2f07289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386005, "uuid": "6f69a14f-a662-456a-b0bb-098e2abe25dd", "comment": "Malware payload", "value": "2e827a36ae4f8cae762cfe21a9b3eb0b23e1aca85e2832c104e58d186f7e4bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386005, "uuid": "59da419a-0e41-46c2-9fa9-c5ff25b3af51", "comment": "Malware payload", "value": "3c4bf46baf483db205462d7c7de839c8b076d427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386005, "uuid": "be694cdc-b35e-4a1c-974c-2512e3a619cf", "comment": "Malware payload", "value": "f14c078fac611a229b1f778449deb36fc80ed336f054e068434c24e000c089eb832434f4e783c17fa89e36cc756e335c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386005, "uuid": "6d10ab71-a9c1-4861-83a4-f51c0678b691", "value": "T1570633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386005, "uuid": "1104f890-c22d-467e-b679-cf0f17dede4d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386005, "uuid": "596eaf49-614e-45f9-b9d6-772434da1ae8", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:W2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386005, "uuid": "ed1dc9e4-68f2-4f20-837d-2f2b657b7dd1", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386005, "uuid": "613465f2-2cd5-49a5-97ac-1912f719ba27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386005, "uuid": "05efad15-d7fb-4b91-bc8d-5887375a04a7", "value": "eb58bfbed449faf3bf6e9b46c2f07289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67433000-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386054, "uuid": "c666e13a-860d-4142-bd49-9f735b8f540b", "comment": "Malware payload", "value": "fa8735093df7f009c1b390ec0ea98488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386054, "uuid": "11a863f3-9bda-4351-8a1a-7767b1a6a8dd", "comment": "Malware payload", "value": "2ee3a1c6fef5e0d7bcc3fff288d39c2e4948a25a7556ab6d619c87356d012bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386054, "uuid": "0e3290ae-0d6f-497f-ab4d-7feba17ad3a7", "comment": "Malware payload", "value": "0ee7e38775d4afbedff400f3d2a604550de7bc2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386054, "uuid": "3b5417f1-8ee8-4725-b5a1-0231daf6befe", "comment": "Malware payload", "value": "a2993c9b550e53b4bcdc0b68b2c2db96826c1617b5e777e929284c395de47580a3521c07c44ed6bc5abbbb8e93931369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386054, "uuid": "18bffb8f-62ad-45d0-9ad1-d98a311fc1cc", "value": "T1670633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386054, "uuid": "53652494-b2ca-4010-8dbf-4dbc11773b0d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386054, "uuid": "5be3e697-d375-4976-893b-e7e60f1bcd24", "value": "98304:aBT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:C2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386054, "uuid": "ad8c7591-4432-4836-8aff-9cb69f3e902f", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386054, "uuid": "493b4eb3-ba45-4495-b04e-17d23ecadb9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386054, "uuid": "b56c2530-2214-49db-b789-ea55396567a0", "value": "fa8735093df7f009c1b390ec0ea98488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1abb3c-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381873, "uuid": "cba48e35-22e9-40f6-ba23-c2f8a85d624e", "comment": "Malware payload (Mirai)", "value": "5e49138553a71f8b172605c8f269f435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381873, "uuid": "db314a4a-b65f-4ea7-9012-fc7676b9262e", "comment": "Malware payload (Mirai)", "value": "2efd6748acb580bc51293485c846fe768fc82b7a9cf1e050e2fa53c420e64067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381873, "uuid": "8192254b-cfde-4822-8489-381c4006a948", "comment": "Malware payload (Mirai)", "value": "88928d3db60b1600a420b81378316ff090a7789d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381873, "uuid": "596a08ae-d93a-432a-a580-0712bc8725da", "comment": "Malware payload (Mirai)", "value": "e11799f51c67479348dab2afc97b905801ae199840ae165ad9531265dbb92a51d3e016d2e190683fc397f14fe77bf12c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381873, "uuid": "0c79001b-0b54-491c-8faf-8931e2d4891f", "value": "T1B6433A99EA0F2E81CAC7C534ED5A8F623027B4E8624983365F11112DA9FDDDC9CF1C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381873, "uuid": "b08178ab-de0e-4809-aa9e-99760bdbee49", "value": "1536:z+bDunhgRffQUpRI0ADYs4OcjJTpvZ0bk9mUK8ipU4s19z9bZSgOY20hVio8vYS7:zeoqfxRILUsWShsjNX8BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381873, "uuid": "5fba2c3e-8e12-48c3-a5fb-852856685dae", "value": 58688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381873, "uuid": "cc6ca67c-f60b-41fc-a008-2eb5b988b2b0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381873, "uuid": "425d3c93-7ae7-4587-9cce-b5ff9e89189a", "value": "colomaaarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee94aa03-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385422, "uuid": "ba54bc59-b683-4c4d-a04b-a778599b886e", "comment": "Malware payload", "value": "2533c8bbda56edd465900b52807e72d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385422, "uuid": "72469df5-f7ea-4d3f-856f-945052eaebb5", "comment": "Malware payload", "value": "2f37df120900a301e1c086292ee750fd15862cc7fe7f2dd10887cc9950a28292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385422, "uuid": "bb44266b-461e-4388-8651-d58ca45af897", "comment": "Malware payload", "value": "7b6ac99da65721551b4f4ffcae940f968aa4eeea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385422, "uuid": "50fe9c12-2141-4926-9db4-93e0a322f952", "comment": "Malware payload", "value": "97fa205cf9b9563e5943e784d9065b6ea856cd3cc5d2cfc2083856edda5564d5d27e68c955317238a7380717ae603b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385422, "uuid": "687b35e5-b15b-4ada-adc6-896894ab285e", "value": "T1530633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385422, "uuid": "e4fa482a-2dda-49b9-8010-43f2c1b9a8c2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385422, "uuid": "0fac4bac-a95f-4c89-b788-85a1803f4f66", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:J2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385422, "uuid": "8cf772ee-79fd-4056-855b-b0999758769b", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385422, "uuid": "13d59689-2b82-405e-917a-8457f70a673d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385422, "uuid": "0e6fa5c6-a621-4245-8de2-9b48bf71db14", "value": "2533c8bbda56edd465900b52807e72d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f185ed4-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767380350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380350, "uuid": "c1b22dcc-a716-4aff-9547-0b4715116aff", "comment": "Malware payload (Formbook)", "value": "a8fe0f562c3bd099877c0518b9191871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380350, "uuid": "ced6416c-842e-4993-a04a-71cd3fdbc48f", "comment": "Malware payload (Formbook)", "value": "2f5e075b1ebc8f16a3c42125eb67d31cb16dfed8409ea9616a4d92a45be00ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380350, "uuid": "affe98b0-8224-4158-b49d-0037447b1f9a", "comment": "Malware payload (Formbook)", "value": "c6e7e99e5cda8d2fb908fe8726b250feeb7f440d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380350, "uuid": "ae92c24d-f7fe-47b9-bf14-590cd1a0aa60", "comment": "Malware payload (Formbook)", "value": "e6dcb7ceb88dda619818371d3b9547f204767ffbb110f296f2924f8b4169ba5cfeab22a104481e3b7d1790dfa6d1f442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380350, "uuid": "180c26ef-beac-4d36-adf4-f75dd0593ece", "value": "T171E412886219CA03E1E12FF2A831D2742774AEDEF461D6078FD57FDFB4397205964262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380350, "uuid": "d4c5eab2-f188-42f9-a828-6bb90970a19f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380350, "uuid": "d80f534b-c284-4b2c-b7a4-58b9e033eb04", "value": "12288:k8Bc6gDehGrtFFlwp/cew6zkJUp5tmZEh8J:kx6OehQtV2/cp6IJUp5o2GJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380350, "uuid": "57740462-3c33-42c4-9dec-51506fbff871", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380350, "uuid": "89af1c6c-e035-4ffd-8cd5-6561cd8c8cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380350, "uuid": "46ed1e56-c25d-4947-8b55-3d99eabe2303", "value": "MV Aviona Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fb45ca-e7e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767364233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364233, "uuid": "f0b28cb5-0cb4-4647-9a2c-f63a940b86d6", "comment": "Malware payload", "value": "37e88c216ca23172219bd861b1402b18", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364233, "uuid": "ebb10c2c-f26f-441d-96c6-0341f10cce9c", "comment": "Malware payload", "value": "3009c78448fb115e11ce5eaffa2e238a78bbe69c1f4ea01f39584a2fc2636e95", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364233, "uuid": "887d9e40-f9a9-421e-92bc-7f31b8f014b3", "comment": "Malware payload", "value": "6c9f6e1c841fde5f05d69f5a6c704f0a1e136264", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364233, "uuid": "16e0593f-0dfa-4117-a049-3b61acc37d21", "comment": "Malware payload", "value": "50a7b040fe8a75b4fe5e2596551d192aff0989e7e6f8c87f67eaeb270890eee454fc0704688ab372ec0d3547fbf129f3", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364233, "uuid": "e9a212f9-a868-4024-bc0c-4a97ba2a56e2", "value": "T1EA18026B314A604672516AC016ECC9D31C759393082BCF79AEDCD8E64E66B43EB0E73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364233, "uuid": "433ef32e-ea6c-4641-80ee-a2b0b7652fe1", "value": "24576:Sdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd4:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767364233, "uuid": "662838be-96c5-4793-9fc5-024aaa4a8d17", "value": 87335340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767364233, "uuid": "fe372bf0-e590-40bb-a2d1-dc1a9ce965b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364233, "uuid": "42d2c2a2-db1e-43ec-8632-1051102551cc", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f82e33-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385972, "uuid": "c4514aaa-d794-4811-a760-2bf33cd0b493", "comment": "Malware payload", "value": "db0d04e296fd7f47634d1c47ab5f024e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385972, "uuid": "50346c32-772c-4431-98ac-502b86a817b9", "comment": "Malware payload", "value": "3044a688ef5a4e35e7c3fb45372140ee64303d30f0ebc99830b130a7ffa1f999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385972, "uuid": "def5230d-e4f5-4bc8-879c-02626bd6592f", "comment": "Malware payload", "value": "d2101435388ace156ad4b117f67013255076a24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385972, "uuid": "61a858af-caab-438a-86e3-49557b87c207", "comment": "Malware payload", "value": "3c779cb5cf965971716d6922fe3e4f169ce375766906beee45440ca71ea8314629922d7b7b8dcd5ec7221b23ac3f7fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385972, "uuid": "c2688557-5581-4628-a61f-66a31d883505", "value": "T1620633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385972, "uuid": "02e7e580-c909-47cc-8e8c-1de765759347", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385972, "uuid": "ffd28a60-4612-49e8-830d-efd4e7b35c0d", "value": "98304:atT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:K2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385972, "uuid": "ede422a7-06bb-4414-a066-d8af8fa68504", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385972, "uuid": "3e7306eb-f914-4d18-9c89-d710021ed5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385972, "uuid": "321a5a9a-7aa2-4674-a300-858b50219a24", "value": "db0d04e296fd7f47634d1c47ab5f024e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c2508d-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385434, "uuid": "16b4a0a1-150d-4d00-bd14-ae600764c998", "comment": "Malware payload (GCleaner)", "value": "27ff52480f35146bcd2a317a4f324070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385434, "uuid": "7a2d3e4f-077f-471f-a667-5f5b128e0fde", "comment": "Malware payload (GCleaner)", "value": "304505cbcd5f26a458b40e2f88f3066835de242423ac6a990aea1699b0e278c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385434, "uuid": "df68990d-9f70-4395-9573-f09a73e41f02", "comment": "Malware payload (GCleaner)", "value": "a3f2a134a5d82ca98904e42edb39ae667d6f4651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385434, "uuid": "dcc708f1-5ffe-4924-83fe-a670622db37e", "comment": "Malware payload (GCleaner)", "value": "922d9a11bf6fd93e3489a345d8d5d81958fac8bf42b3783961b96e3b15bcf3fc6699a7ea1fd56502b019b52307a2b684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385434, "uuid": "46efd945-b9eb-4a13-9ad8-9f9af73ad54a", "value": "T17036DFADE0917423D055557838763A7E6F1EBCF2F49F54097DE0AF8A690A0AE38342F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385434, "uuid": "8ece8ca2-32ef-4b06-b056-fbfbc5f5b80f", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385434, "uuid": "9a8cf727-8c0b-41da-be38-80e97fa34f67", "value": "98304:AC1NF2lmqa+B0geocgvuvsRFVjyT+mX63D:AguwqaqMgvuIZyamX63D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385434, "uuid": "f2feca78-538e-4b1a-873e-e374b6a02f40", "value": 4975888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385434, "uuid": "a120cee6-d237-4d11-ac30-cd794211adf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385434, "uuid": "1e33af3f-c36f-4ccf-9bbc-612343a951fb", "value": "27ff52480f35146bcd2a317a4f324070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb3cb76-e77e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767319248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319248, "uuid": "75ac35eb-4551-46b4-9a0a-faed3b27d619", "comment": "Malware payload (Mirai)", "value": "83e48641d2e62e3e7f2623aea869920d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319248, "uuid": "eeab28e9-4fe6-4d3a-a714-0b14aa3cc734", "comment": "Malware payload (Mirai)", "value": "3046a730c53d084e825493abb25e7d7ec1e65c5d13f941f62f8e5fef71f8eda7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319248, "uuid": "6d28baa2-9000-4b8d-9bfa-20eec14ff929", "comment": "Malware payload (Mirai)", "value": "55eddd4b2835e51406d753326148948e36057366", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319248, "uuid": "5fb13858-8287-42a3-96bc-7f8cbc306d44", "comment": "Malware payload (Mirai)", "value": "5b55e7d8bc8afd07f8b647f79abf15c51e93df69f8e0d4ffed9878c53a87c23843580b2a908bee4ac7117973705f84e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319248, "uuid": "dd12858e-c037-43e8-96e7-a53cceba5db2", "value": "T13411E4EF70601A7205CC4F4872B2980CF8448AC591F65FAD5EDD04BB5FC6B14B798AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319248, "uuid": "2b1135a5-74a9-4172-834f-cd614a15a678", "value": "24:DRDNAR3hURhNIRRxKuAbKnY/ZLACgLtFA3lsDdKA:l583hI6xqFLejDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767319248, "uuid": "75869095-0f3f-4d88-b45a-02e93eb74fc3", "value": 989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767319248, "uuid": "0aaca477-f85a-48c0-be57-afc57d7d5417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319248, "uuid": "21ca6b36-ddec-4ae9-a5eb-f26584a46e9a", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e56f58c-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393368, "uuid": "e5e396bc-5960-4278-8445-8f98e5ba3443", "comment": "Malware payload (Mirai)", "value": "ebe8fd8e97c8e201f66604b26f1a71d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393368, "uuid": "89e5a093-bde7-4cc4-b258-d939bebd2fd6", "comment": "Malware payload (Mirai)", "value": "306b07bcd0255f43b053b1fe9e114f013371b0087dc1bf3c294c0bf173f4a4f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393368, "uuid": "c2597eb9-5e7c-4584-8602-4424f8a227b9", "comment": "Malware payload (Mirai)", "value": "54ba2234a8b8c57a91064c9ea3f42362bccfd6df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393368, "uuid": "a5ac0eea-5577-4b31-9dd1-cb5f366e4213", "comment": "Malware payload (Mirai)", "value": "48782aa302575e4444c15c68cc2abb5c8d935a033297e98233b2e5fe0e0cf1bfbb582a7e3ba51018fffb3fbaf162d0d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393368, "uuid": "a086e858-9394-42dc-b732-f68b15df63ab", "value": "T14753F1210B97DE11E6740532CDBCCCDF1F509BE3205790EA73EA1CAC568A543BAE95A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393368, "uuid": "a2cf2dcd-9286-415a-8bb9-f3dd93199690", "value": "1536:gAFmQyVYFyC97WzZzzFTPik8xWYCSKxXM56MSJL6:W4Fy5vOk8orxi6L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393368, "uuid": "a134cacc-437f-4abb-8cb3-b27161e0b0fd", "value": 63328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393368, "uuid": "6710f061-eda3-4877-8fd0-474fcd353961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393368, "uuid": "b1ecc78d-06f1-48da-a734-722643eb6bc1", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5400c434-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385592, "uuid": "fbfbc83a-cddb-418d-911f-b88ef0ba6cf2", "comment": "Malware payload (Adware.Neoreklami)", "value": "67052fdf502a77addec232b119068281", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385592, "uuid": "259200d8-1cfe-4e71-af4e-754b99d21225", "comment": "Malware payload (Adware.Neoreklami)", "value": "30ac8037da6de1a08ca1942d066a81d2c61b0ae7fdbfda4b1e612d8268a72981", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385592, "uuid": "a6fedaf8-8676-4038-bce5-aa7d6f09cc0a", "comment": "Malware payload (Adware.Neoreklami)", "value": "1f129ec7f4e1190a4f4312b1327921bd67a7df28", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385592, "uuid": "5771f79b-2bac-4c4b-a876-16d594aae12f", "comment": "Malware payload (Adware.Neoreklami)", "value": "def7cf1c22c05191a4f0a838225268d7df7269936309203e54a94a2ab279b294d9e21bc005d57980ecf7f836e167ac58", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385592, "uuid": "f8f42382-a229-492d-8ffd-fb303d20283a", "value": "T12A763361BEF18438C68532325EB93EC5B0A9B7690F08641357901A2D3F79C55F22DEED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385592, "uuid": "862db7ed-391f-45ab-9c1c-83add0f61839", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385592, "uuid": "ff1ebbef-a800-40aa-90d4-f1da802f161e", "value": "196608:P1OdhYs4U+oSFD4coWmozN9eOpmRr/dJ6zQFXNWKZc:tOv+U+bFDVo7ozNZpmRXFX0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385592, "uuid": "db38bf31-d656-48bf-9769-88d6a2063ec1", "value": 7513789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385592, "uuid": "7f32c595-e82c-4d10-b561-e5604e6959cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385592, "uuid": "0731f684-94bb-45eb-9777-7e3238d359b0", "value": "67052fdf502a77addec232b119068281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f194db6d-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380273, "uuid": "cd7129a0-5a71-42a4-a90e-cfdd66b3817b", "comment": "Malware payload (Mirai)", "value": "67d63518337893e81a119523b3ea47d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380273, "uuid": "8fec7361-ebd5-4f5b-abf8-82130cb36aff", "comment": "Malware payload (Mirai)", "value": "312b8819c1a7e064eeb0189af925a869205ebaad7732a73875b98fbb11a4f8f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380273, "uuid": "831ec198-9c77-4b0f-9ada-c93da42e1a4b", "comment": "Malware payload (Mirai)", "value": "e5030eadbc970527044df2abc7518d9282097cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380273, "uuid": "3e36b553-16d8-49f9-82ec-7a0a78f9f71f", "comment": "Malware payload (Mirai)", "value": "7417580005fb6ed1cbab96f7af2fddc4a7ce7878d6d82e1126a685ee7207f79a9b0e2b8e7a146a6585eb22104aa1da30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380273, "uuid": "ea9927a3-a201-45ff-a660-d62d264b29b6", "value": "T1BE43E64AB991DB15C5D551BAFE0E528D332317B8E3EE73139E14AF246B8B42B0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380273, "uuid": "4189296a-d83e-459d-9b47-f2dd11e3444e", "value": "1536:6hnmciIqoIuUosSUHweimL4N0AL7tSh3WMXig9RAkgpu+7R:pcixoMoBUHweimL4N0AG9RAkgpu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380273, "uuid": "5c9b6996-aedc-4eb3-9009-3f86c16a7f83", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380273, "uuid": "f0661146-7d02-42b3-b142-12dad8901c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380273, "uuid": "65989d21-9869-4848-b447-c9424362f26a", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d8bc92-e77a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317418, "uuid": "012aa02c-52ec-4044-8c44-41c15e84f5c2", "comment": "Malware payload (Mirai)", "value": "74b87e9677b43920288dc1f0e453367b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317418, "uuid": "acb6aa06-a743-4f43-b2fa-837b0b7f110b", "comment": "Malware payload (Mirai)", "value": "3163c78f178aa5cc394efc4a067c4d7296a9800d7480eb58e50d6a450d4b32d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317418, "uuid": "a2782dc7-ec82-479d-8625-4cb70e96161a", "comment": "Malware payload (Mirai)", "value": "86d083baaca737c648fee6b265a2b4280547415e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317418, "uuid": "3e668f87-0937-4006-9a42-0b34b4687951", "comment": "Malware payload (Mirai)", "value": "993082a0dc96c836565a158715f627598698a7d16995964972c29a9ff8526b8dd2f6c706988cf11079f14b1886eaafb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317418, "uuid": "c074763a-1eec-4462-b093-6e7bec657eb3", "value": "T190547C98BB0DEF02C19483BAED6B0723A33D34617B4B97737815612DEC937D85C5628A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317418, "uuid": "c915dacd-17ae-455e-8aec-4102d526de97", "value": "6144:vvL3CzjHU9CMfuRpPK5qpSQWYNLohjE0jXrlTd:HLy/UQaZQWYBoh9rhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317418, "uuid": "3ef593b4-95a6-44c2-9b70-398f348c847a", "value": 297216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317418, "uuid": "deb1d51f-a2cd-4b36-9267-212e4f9659a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317418, "uuid": "32869a6d-6216-4fd5-b983-bc96a7c1c8dc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7f0914-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385934, "uuid": "a5cd5576-38a0-4d2f-a956-590b82bd7a1c", "comment": "Malware payload (Adware.Neoreklami)", "value": "ccb5a002141b62ac11447b04cbda4eb6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385934, "uuid": "56e49bcf-3af7-47f1-99db-20cde7df87cf", "comment": "Malware payload (Adware.Neoreklami)", "value": "31afbfdc6becdd0ad17494c3968e81eb5ef8e71d281d8483142dfa4eab2baa64", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385934, "uuid": "6e628c11-f309-4e03-8df4-de6a313f5193", "comment": "Malware payload (Adware.Neoreklami)", "value": "20f619f96f95dc39a8362cfe2407d813cdf5868f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385934, "uuid": "3142d200-f7ef-453d-80ef-76670907c8b6", "comment": "Malware payload (Adware.Neoreklami)", "value": "959d9296813ad345bb5e0d1bdd8c86ccb8b72c5ba169da50d16fed4e2569855cfd0984e1e12408648feaac28779f6d48", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385934, "uuid": "7b8491da-4dd7-48ff-bd2f-b7d94c57d44b", "value": "T17176336138D889FBD2D6017A9C3DBFC92CF9D6092992C49B574D963C1D7D889C33AA30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385934, "uuid": "b6bf52b8-8dcc-4961-ab5a-7aa38e51b6b2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385934, "uuid": "ca76fc7f-15cd-4b86-b7e6-211b8d075224", "value": "196608:P1OpJWyJKAI905Qqj5KBD7SP/TIJwJtCAfhServ09yJB:tOpJFYAy0r5kD+P2wJtCErIyJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385934, "uuid": "398c1d79-8a22-4697-a7b1-528b04736d0f", "value": 7536624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385934, "uuid": "21bf561b-4c71-4b5b-8d44-6301b19858e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385934, "uuid": "e8865252-7c14-4182-908c-5a742d9e86dd", "value": "ccb5a002141b62ac11447b04cbda4eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e175c453-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385830, "uuid": "869bd5a6-bf70-40cc-bf47-45cb14b95191", "comment": "Malware payload", "value": "ace6f100f54350cb282769c4f8ba088c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385830, "uuid": "da99b9b3-a3b2-4c23-aa23-38b571127875", "comment": "Malware payload", "value": "323c5a173edda6fdd3b17635ce07b559369452eb98521ab7ecdce76449814b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385830, "uuid": "9be8841e-4f57-4908-8802-2c575cab2a64", "comment": "Malware payload", "value": "e6ef22832b4f91bc0271bc733850d12a333f1087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385830, "uuid": "802b0d1c-ce85-4c22-9ebd-d20d9a294e3e", "comment": "Malware payload", "value": "40bba5dc9733b08d47f18561696fb97bd262f78e956ea0173d9288c68800f2ebc10cb834abd861638e7871fb607c92b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385830, "uuid": "62907f98-d342-47f6-b9e0-8d86a945b160", "value": "T1A90633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385830, "uuid": "dbea385b-85ed-4fe6-b56f-6ded3de33ec7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385830, "uuid": "371beec6-9825-4949-9295-c2e44ff25820", "value": "98304:a5T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:y2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385830, "uuid": "5e0c7784-ea02-4a63-a72f-34b32d872600", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385830, "uuid": "a6c7d2a6-890d-452f-8b9d-fff2c1d63c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385830, "uuid": "5ff50d72-1d4c-4381-aca6-e9c2a5a067fa", "value": "ace6f100f54350cb282769c4f8ba088c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c3ef1e-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385426, "uuid": "a82bef50-0fc6-46ac-a853-ca3b9e922c6f", "comment": "Malware payload (Adware.Neoreklami)", "value": "25f2cacf8205de6f0815420ea44200d7", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385426, "uuid": "905fc8f1-b416-4fd9-85bb-032e8ff11d8c", "comment": "Malware payload (Adware.Neoreklami)", "value": "326163811288ca33b0ad1ecf633aefe0c4729f451dd164587735f0c2af858897", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385426, "uuid": "69c7963a-1409-4304-a421-374142d58df2", "comment": "Malware payload (Adware.Neoreklami)", "value": "c1d7c68871027c720ab3766fa457e5ad6304f994", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385426, "uuid": "166720e4-4fe0-49ba-9748-5f26cfae2379", "comment": "Malware payload (Adware.Neoreklami)", "value": "c23176a525d308b5e909921bb2e70df3a0b70304c7e94bf7493e8604c8270ccca44a77353e468ec545bd190d46350563", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385426, "uuid": "8038d6ed-ddef-4004-b305-76c29b3e61dd", "value": "T1C37633807B96863CD68B0832C8B647E87367771A29A16FB77706043C5DB899F81E53CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385426, "uuid": "407b2038-1900-4c5b-a7f9-155c0fa8aac6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385426, "uuid": "55d6cdf2-1c57-4028-95f7-12f56ad606cd", "value": "196608:P1O3SBtJUfbWUw+GKJ0kQQNwi74eMhPhGGqqnwqmrPH:tO3SEz9GQN7gxhAqnwfDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385426, "uuid": "3c903110-2a1c-4cb2-bb14-55d4fca97334", "value": 7536735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385426, "uuid": "545576f7-7ded-4d08-9e06-bfd9ed46e380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385426, "uuid": "226e06d0-93e1-4733-948b-f4c950200bee", "value": "25f2cacf8205de6f0815420ea44200d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b5c2f2-e822-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767389697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767389697, "uuid": "b9f4875d-8a81-4bde-b004-3821626ef10d", "comment": "Malware payload (Mirai)", "value": "06cfa8158fbd6f79e0bb6ee393d799e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767389697, "uuid": "f16df488-91c3-4b9b-bbb3-3a2e12f3040f", "comment": "Malware payload (Mirai)", "value": "32689695c91d84f60ffdedcc81c2fc8b6729b6eea891f9fadfaebfd8c498ad64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767389697, "uuid": "b956eddf-44bd-4755-a4de-a927a9ad825f", "comment": "Malware payload (Mirai)", "value": "4e1d0820acf8242e0cf0b4919f2643bcc9e99cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767389697, "uuid": "08f998b2-7b96-4024-8fb0-2f741bcf43d4", "comment": "Malware payload (Mirai)", "value": "d63a74e2d626c8a4f59384afcd4442e59705e0c0045908a7bcea6acd437bd320b10a06e3a5a4b7d490e44f466763b4f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767389697, "uuid": "9f74df7c-2e53-42d1-9c01-27426896663f", "value": "T12AF36C16F78080FFD889C27C42EEB636E971B82D2235B25E5BD4EF153D98E21362D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767389697, "uuid": "61ef0a3b-77d6-4ff3-a198-5bc361f6cd0a", "value": "1536:VvI9TJe5jq/cJq/KbfARuU/2s2v9zbhhlQLwKijeU14UE3+OqZPb9wDoAo:VvIyjb4RuU/J0RCLwKk14UEOOqNse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767389697, "uuid": "709a1048-d0d4-41e5-9c55-697237401791", "value": 165904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767389697, "uuid": "87324754-6712-48cf-bd88-4c570dd2ed94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767389697, "uuid": "288be61d-5ba7-4bd2-b26e-f4dba41e4782", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dba8a5a-e80e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380831, "uuid": "69a67d4f-8448-4862-a39f-fa8329e427ca", "comment": "Malware payload (Mirai)", "value": "8ea026b8d5cdecad93b755806f167df4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380831, "uuid": "069cfc53-bb23-4d5b-bfb1-31a060ac5228", "comment": "Malware payload (Mirai)", "value": "328e9da20a58e0672f6d63b2694c69848ced57c416ee0e8103d39e54811e5821", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380831, "uuid": "11a0a754-622e-41ce-910a-e85ce8c867f8", "comment": "Malware payload (Mirai)", "value": "4f49a1c368871c8e4e1bfa8c84cd0d2a3259e213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380831, "uuid": "910f79e3-1e3b-4fe0-b12a-34123f94fa9f", "comment": "Malware payload (Mirai)", "value": "46e09fdfa1abe3ea387622cbb77da94be7ba733591ab04a531f7a6251601579bb4c26321310a27ae2ad245b18aed942b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380831, "uuid": "060b49b5-822c-4bee-b4ab-c6c8430d2fa6", "value": "T13A533BC6BA43DCF4EC1905752077FB325A31F5751038FA9FDB94E932A852702B90A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380831, "uuid": "641ad220-cac9-466e-b35c-d836a29ad0f4", "value": "1536:xaaBgJuSXz7cGWsfltpKFVP+ySVolG+Cez/E31FOxR:xaW0uSXncsfltGVGySVog+N/YXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380831, "uuid": "c77ef692-28f4-4c2a-9cf3-e160a32fb2d3", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380831, "uuid": "739f5d41-7a68-43ed-abc9-917cc47c6424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380831, "uuid": "b4c6cc16-a2b4-4c81-b282-7d89765e2286", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c2fb4c-e7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767363960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363960, "uuid": "3149ea2d-2ba9-467e-9f0a-0da702a4496b", "comment": "Malware payload (RustyStealer)", "value": "44299a368000ae1ee9e9e584377b8757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363960, "uuid": "0cc00904-0a0b-4ec4-aca2-f3b31184f97f", "comment": "Malware payload (RustyStealer)", "value": "3296bd88e0a85ebad4f429878bf8bca16ac43e609133b4781f88a339c37bfe9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363960, "uuid": "2c6d8026-ee7d-43f3-b164-1c6aec7caba0", "comment": "Malware payload (RustyStealer)", "value": "895aebe2d281e66f87963c01de570286561a0de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363960, "uuid": "946fa5f3-a251-4624-b54e-c7947a1bb8ec", "comment": "Malware payload (RustyStealer)", "value": "d0202e177990494d785b1ebead43f503cb358bdedb178fccc3b632ab2f4df90c8898371cbd5877c2a8d7048ab8aa4fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363960, "uuid": "78af086d-6504-481b-834b-8f0323e01995", "value": "T10074BE02F6D269B6C68B007152BCA33A993EA5001F25CEE7D7905EE8D9703F1D67472E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363960, "uuid": "8de2b98d-83f7-45bd-b459-bbea8ded3a3a", "value": "74d8d936f11de9575144eb773634a748", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363960, "uuid": "4787bb87-3b3d-4eed-8fd6-3e888ea8e275", "value": "6144:qU8gz9doYYwFl8xlyBmgU3uUOsv70j8NPi5vM9UVFcgyBoo0cMlYbc5n4IHes:q/g/oYlFCxlv7+H3j8NPi5KT/yl2bc9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767363960, "uuid": "52ca6f6d-28eb-46ae-8e95-d248c65933df", "value": 354232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767363960, "uuid": "aa23ef42-3c89-463e-97eb-00da035ca25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363960, "uuid": "dcc14d3d-6b7c-409c-936b-040eca36463d", "value": "Review Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c9201f-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392380, "uuid": "b506383f-1f22-471c-b7fa-83f784f237cf", "comment": "Malware payload (Mirai)", "value": "e0022878e166d8d3ea69b18b04ed267b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392380, "uuid": "d08ef69b-56d6-4a1b-a54d-353460565294", "comment": "Malware payload (Mirai)", "value": "32e21118ba898ea00e2163ff7fde914430d854bbfc161e656db46bb0245d0ef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392380, "uuid": "2b9aa2b4-6a9d-472d-8b44-77776006b6c3", "comment": "Malware payload (Mirai)", "value": "419dc60caafd2481195e0d5e8b0e740a5dbe29cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392380, "uuid": "be51b819-e060-473d-9914-ea908e95958b", "comment": "Malware payload (Mirai)", "value": "364328b2182c2980916b8c35bf512d3b268e1bb887f30e75838a0b8457edb803e17b1e9c5d0f2366483c0e3009cff8bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392380, "uuid": "79388624-faf3-4dcd-a393-8827c9f49e28", "value": "T1A5633942B1A284FEC09AC9B886AFD667F9317C5511113A3E7794BB343E32F311B4D662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392380, "uuid": "3e7426bc-a55b-446f-9630-6bee8a2862b2", "value": "1536:lwesYC8pwfBUjZcfqG6OjfgB73QorB0sw:vsYjA0mJYhZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392380, "uuid": "9e6f0100-ec5e-46d9-ad2a-9021d45da534", "value": 71632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392380, "uuid": "4f0685b6-f1ed-4ec3-87d0-e753bcd7bd3b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392380, "uuid": "998dc10d-785f-45fc-a707-ce20844951d7", "value": "catgirl.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f136e763-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336035, "uuid": "ffc69193-bdf6-4b4a-ac2c-118151c319c4", "comment": "Malware payload (Mirai)", "value": "b78fb7442f0fb83bc61bfad7fae1e500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336035, "uuid": "9b9a67eb-76f4-4ea5-93b2-7f32c5c3c83b", "comment": "Malware payload (Mirai)", "value": "338c1dcfeea1c85757a836213d14d98fc877a2681d97ff13dc8931e9484d4261", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336035, "uuid": "e3f01fb3-4754-4888-bb6d-c4b6e584f518", "comment": "Malware payload (Mirai)", "value": "d9b408c63451534c8e610b846a9d5ff97f8f84da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336035, "uuid": "73d93813-d764-4cac-b1fe-9e149609e65e", "comment": "Malware payload (Mirai)", "value": "04712aa747b9b23c95c962ece9ddc950670d0a11dd17007b2696a136455e4f006b820a94e1ea531d02b9ae0761d26b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336035, "uuid": "87845e2e-d8be-47c4-bcbb-5724c7676fa3", "value": "T169B35B16B18184FDC4C5D1744EBFA256D932F16C2276B66F33D07F2A3E4EE202B5A264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336035, "uuid": "653c9914-c2ff-4aa3-a65d-9995988149cf", "value": "3072:DkMIe1YmX8EjsWtQehx8cw1h7F39ch2giJ:DbISR2L7Noc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336035, "uuid": "bf32c0a4-ce45-4d66-9330-222544043bad", "value": 109472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336035, "uuid": "9432eabb-eafb-4e26-a086-4fc23271574a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336035, "uuid": "fad21a5c-0ba1-48ca-add9-376f16222433", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930ba6cc-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334159, "uuid": "0133b5a5-43ef-46bf-95a3-2471f4f771dc", "comment": "Malware payload (Mirai)", "value": "c64318be92fe5d731a74e5a6ad386d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334159, "uuid": "9355659c-0b9c-4a0a-9a74-3f3d0fe89332", "comment": "Malware payload (Mirai)", "value": "339363205f95fb825dfeb4a39a89f09000dd7399c00d51d7bfd5063e80023935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334159, "uuid": "f05141f6-1488-47c3-937d-47cb16355c27", "comment": "Malware payload (Mirai)", "value": "a0bc9a4810271173ac1c7e34fc053a58b7347b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334159, "uuid": "e3872d8e-8dfa-4226-89b3-ac32e69b597f", "comment": "Malware payload (Mirai)", "value": "0a973c9ede54b62fac7a70faf5986b96985d338a6ce0a17e528033b3a26f5ddea91d841d4aa1bff37b355d5a79acac12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334159, "uuid": "a6614129-4a40-4f4b-9553-7863230a8ad2", "value": "T123B37C12B18894FCC4C5D2784FAFA116D922F16D2271B65F37D47F263E4EE213B6A260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334159, "uuid": "f641a165-0300-40fd-9618-29f4eb537d14", "value": "3072:k9JIsQPYm6kjR1rOVMwA9FSvR1bfWhk/HJoU7UU:kMs6qX7Kqrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334159, "uuid": "677fc338-ea6a-4e00-931b-32a959ad6c02", "value": 112704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334159, "uuid": "685de0fa-52b1-4ca4-89ab-ea22267b611e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334159, "uuid": "06d52c04-cd45-451a-bef6-2debd147244a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccf151b-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385339, "uuid": "fb529ea9-ab8b-4778-8e9b-12efa926bbc5", "comment": "Malware payload (GCleaner)", "value": "05ac2042a522261f881da5db3682fbd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385339, "uuid": "29c434c9-870b-4e75-a7bb-08b1b9d47e29", "comment": "Malware payload (GCleaner)", "value": "33a7d9544016f25308fa9d4dfc4bd910d139b8ddbef04a32636009f0cb280ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385339, "uuid": "a11752a7-8764-4a38-8e68-037a71777c61", "comment": "Malware payload (GCleaner)", "value": "819db182030195a38f0b30805db94d2e452c620f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385339, "uuid": "78512945-2ac0-4749-ab25-ca5a80f9b8cd", "comment": "Malware payload (GCleaner)", "value": "ae3da1707e161582a3a18ee7eba8fac004e3abe5b406b61610d5d8e1ee966604d6adf7af2a29055b40b0aba518cec871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385339, "uuid": "d7cfc155-4dd2-4c02-ac65-b6f4fef7ebc1", "value": "T1BF26F19BE37489F1E3F308703897905849A475A2DBAB98C31E803E4B46AC5CC64FB55F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385339, "uuid": "acb23934-3d4f-4b29-997a-730fa89045ba", "value": "cde078e68994e408985ac985f5f0d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385339, "uuid": "99a09c04-8951-4701-a895-ea4e9d76ca41", "value": "98304:PkDkzTkrz1cQcdoBffpa7hyqE86pIELKkVuMgI:PkwUHqQcdUfha7hyqtZiKQuMgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385339, "uuid": "384e6f0e-e6f8-4a72-95c3-17ce9dd50019", "value": 4691216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385339, "uuid": "2bcfc982-4bd3-4a6d-9825-1cb341804da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385339, "uuid": "5d1e60bf-052b-4cb2-83e9-bcad9f2087f7", "value": "05ac2042a522261f881da5db3682fbd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a631df21-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381865, "uuid": "c63ff529-0c0b-45ff-9b76-f875212fcfc3", "comment": "Malware payload (Mirai)", "value": "0327c87a3c75776fd91f6efd8887e34b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381865, "uuid": "51063015-4511-4290-bb22-ef113a456d26", "comment": "Malware payload (Mirai)", "value": "33fa94fad9a06fcc78c60124964fb530919a4bc7d5d0e223cb7d776fbfd5112d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381865, "uuid": "c87cd70b-5fe9-471e-9ea6-5abe45596c33", "comment": "Malware payload (Mirai)", "value": "4551cdddf2805b104c711954335a586db8791590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381865, "uuid": "04ee5d9d-358e-413c-adff-82572198bb5f", "comment": "Malware payload (Mirai)", "value": "bf294659a5971755c9aeba5181be50130f4d7117a0346baffb1dc24ff30637ef5f0dd7170eab5a3429af9a23d3b002dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381865, "uuid": "88db7754-8f04-4a73-8105-af77b7635f1c", "value": "T1F5430A59F4408B53C6E521B9FA9D554C37235BF8D2DA32028E205F306BEB89B0E3BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381865, "uuid": "85a5af4c-1457-45fb-94af-19e64b67caac", "value": "1536:X4xV+5koAKC7mR93AXbW3AZ7mnZUhnI9TntO4Y0vNgfp3Eu:IxV+rAXmbimO884/S0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381865, "uuid": "171e20e4-7b8f-4c41-b894-ccadc700f10f", "value": 58560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381865, "uuid": "cc653b9b-3da1-462b-84d1-e5bd3d67a531", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381865, "uuid": "ca72e06b-5eb3-440f-80d3-2f20ff3ef3a2", "value": "colomaarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f79c7a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385696, "uuid": "d0d562c0-884f-4830-85e5-0cae92e39f04", "comment": "Malware payload", "value": "86b65c33119a5d6e5352056367c1e79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385696, "uuid": "2e7c889d-fa1b-4416-b028-44e349117346", "comment": "Malware payload", "value": "344ffb52cda3663bf4a45d7a64694b645f90faf22cd6586386d33c8f69039dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385696, "uuid": "8d1dfd20-006c-470f-904e-d3e98b2cdb69", "comment": "Malware payload", "value": "6aad6bb4f076c29fa7254a7c79198fedbdf6d9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385696, "uuid": "df7415d9-1f34-4770-9a38-937fcebc3650", "comment": "Malware payload", "value": "7ad88324febd6f8b576cccc3dbff3484a9d51e1f1f02333e06d616a8c04e00a4013538b847c9ae332844c902b3845c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385696, "uuid": "eb7b2da1-f6e1-449c-8856-18ceb865b6c8", "value": "T1C80633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385696, "uuid": "56706653-c2af-4d80-b637-cdb6d3dc2196", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385696, "uuid": "9dbf0b35-90c5-4fc5-bbcf-8748dbb31414", "value": "98304:a4T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:r2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385696, "uuid": "93d0e535-3cf7-4d5c-9743-fce4fd50133d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385696, "uuid": "b002433e-c7fb-43b4-b16f-38efbd203232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385696, "uuid": "52996578-1b89-4189-8509-1f20b09e3913", "value": "86b65c33119a5d6e5352056367c1e79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15df5ff8-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381623, "uuid": "ad3d0c49-2452-4565-85cc-87326e0de266", "comment": "Malware payload (Mirai)", "value": "56e6ee66370194c3f8c5ccd6c5ca9c9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381623, "uuid": "15ae4482-03fb-49fe-b1cc-eff9884f1e8a", "comment": "Malware payload (Mirai)", "value": "345f4a98fda7d0c66db17629f7bb5c68334e3d8fdd9762fce9792be5bb3dee54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381623, "uuid": "c20300a8-0a6e-4a84-ab5e-7e0e385d487b", "comment": "Malware payload (Mirai)", "value": "7c99f920ae552ca6bcfe751625032a8a90f2f00b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381623, "uuid": "7670c10a-1d53-45b0-baa6-7c1398195345", "comment": "Malware payload (Mirai)", "value": "42cc9d9a2ebe540af5a7880f0a812866e4b2e82580c6475086cb9cc0d371542eb9ed60164f3242b7ac41fea82e5906b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381623, "uuid": "8903b502-51ef-4651-9ee7-c5c4d616510e", "value": "T1B993B419BFA50FFBEC9FCC3749A91B0224CD651621A93B75B934D818F25B24B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381623, "uuid": "b783a8bf-1309-46f2-b1af-f844c6f5b254", "value": "768:30nJDTF+1Q05gQl6SR9KhE3jU1tnzDh5YUeYOezgeR9GAlNYwN36gT3OXilYra7B:3KP+1Q0Gi3EDhV1OygS9hNVhrka7g/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381623, "uuid": "4703d1ec-a859-426d-8728-bde895bdf01e", "value": 96656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381623, "uuid": "07d9f487-5914-477e-865a-59e522819695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381623, "uuid": "f484e736-5d8f-4f6d-bc08-27c4275f79a5", "value": "meerkat.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6371768d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385618, "uuid": "734c7f33-adf9-4678-b7a7-6159749a1279", "comment": "Malware payload", "value": "6fe411db656f4d9d773d24930aa429fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385618, "uuid": "10c7a0c2-bbdf-4d67-81a0-833a50be71df", "comment": "Malware payload", "value": "34d3d0b1ffafab57d7bae4b1fc37dd737499ae398d9f4e8adc6c8da4b4bf1c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385618, "uuid": "1a6a5085-bd03-40ac-9b81-e6fe58153977", "comment": "Malware payload", "value": "238bad82df8c03405ee3378ef2faf5d7e3cccdca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385618, "uuid": "fd13d8b8-2640-41f6-92ab-f0c98bfbbd52", "comment": "Malware payload", "value": "5c6ca8ac3877b3663531611f4b9a7ab1c6e4f62c8772dfb791ec22ef8a23c407bddad08efd0cc1ea54dfa1f84ae94ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385618, "uuid": "3fb754ab-6178-44cc-935a-22abf6ebe1b2", "value": "T1590633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385618, "uuid": "69a0b1e4-5e1a-4448-a3e0-c1142fa1b23d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385618, "uuid": "92e0d84e-bac4-4340-ad1e-be905fb3649e", "value": "98304:atT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:u2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385618, "uuid": "da47e5d9-365f-4a5f-930e-b3dd279efa12", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385618, "uuid": "79b6a90e-75ea-4997-b9a0-224778ec0221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385618, "uuid": "ac7a4c50-9a9d-46d7-be4a-e220349e2952", "value": "6fe411db656f4d9d773d24930aa429fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b73f76-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313249, "uuid": "44812cdb-e722-4e4a-bc23-712c1fad7ef5", "comment": "Malware payload (Mirai)", "value": "5c3ff9810e8f684e34560e47cf1edd18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313249, "uuid": "505789db-605d-455f-8777-965e360d7550", "comment": "Malware payload (Mirai)", "value": "35f112210a6f83d4dccb7a58bfcb38bfb1bce5c765c90d49ece66154a0242227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313249, "uuid": "c649fda5-f30b-4f2d-9304-819c6018b46c", "comment": "Malware payload (Mirai)", "value": "533ce5269097d8bcff8a663baf51ca33dabe77e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313249, "uuid": "22fa389a-effc-4a03-af8f-7c36c3bee609", "comment": "Malware payload (Mirai)", "value": "318c06f2f546b2323812407d419b2b3e82e8b08364e8ab522e297c2e4b6b76ec784b62b46a3237a89aadbb5d6896e74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313249, "uuid": "6128b992-9f33-4425-90e0-b5e868e9e998", "value": "T108437E4372184A57D5E60A74293F1AE083FFAA6021E0B3C5645FEB6A8671F371086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313249, "uuid": "790725cd-407a-4fe1-861e-d74d9b414ede", "value": "768:C4O8kQlYyRCBwD4zsuTCS8nu2vnD4DIFc+Tv64E/Zz4qPC3el00Z1vSn3Xi/lNuc:CckAf7uvUWGvFExz4qDRvSn3S/XuM7Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313249, "uuid": "790fd820-fd33-4f20-ba23-e4351837dd8d", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313249, "uuid": "19a9a483-1726-4bf0-a05a-4ca8b294fe31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313249, "uuid": "44b66224-d44b-446d-9db2-ef9421ce1e8d", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b9a881-e7de-11f0-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1767360208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767360208, "uuid": "ac8ef8d8-977d-41a4-b915-cdeb1f5c2281", "comment": "Malware payload (SSHdKit)", "value": "51521db41b8073835b71795293f23951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767360208, "uuid": "d2e1098b-1f9b-491e-ae04-5639a5ad6d24", "comment": "Malware payload (SSHdKit)", "value": "36555ff60bf19a111e67ae372f11a8730e6593d96813bd16ecff7140234f793d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767360208, "uuid": "97ec0811-566e-4c93-91c8-bb9315e44ac7", "comment": "Malware payload (SSHdKit)", "value": "1cb3430b4de5b06fb6753d03159b6291f7507df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767360208, "uuid": "e9c56cc9-e3de-4bed-9a53-df6c17404308", "comment": "Malware payload (SSHdKit)", "value": "345b7c30a1fa18b9060bb0a20f11312be73cd23571f2f8b02bfd062164c54fa0472c7f82bd04bf7003b703b356acba21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767360208, "uuid": "c01ea518-af2b-411c-bb59-66b4080a70f0", "value": "T1C9356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767360208, "uuid": "2cd59587-0985-402e-ac1a-2e3128bc149f", "value": "12288:E8dASOYRNCAJump208iJftl7zmGSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsOI8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767360208, "uuid": "e0d56a83-808e-476d-af9b-a15b251975e9", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767360208, "uuid": "3594ad66-d356-42fe-9639-51d48dbcfd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767360208, "uuid": "73554333-9981-436c-be71-f3edbb8f6ed0", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63553456-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380464, "uuid": "a83043fa-32ed-4fa2-943b-db1337d33733", "comment": "Malware payload (Mirai)", "value": "c8b1f5012ecb4d98b5c080117028bace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380464, "uuid": "4cdcc04b-8dac-4caa-80dd-3af7e91b8333", "comment": "Malware payload (Mirai)", "value": "36655bae3dfcff716552ffa442b1367cec863eab7303123298f18ad01d0a403f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380464, "uuid": "ae1bd0fd-f755-43dc-b5e8-ef20ef3cb8a6", "comment": "Malware payload (Mirai)", "value": "d75b12666ea9650a49140c1ada53236b9f569a86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380464, "uuid": "7e298152-d460-4ae1-b206-32e555b72970", "comment": "Malware payload (Mirai)", "value": "23e5eca232d7137ef8cd5353be18c3656d8e21a9f744926cb3631e5593327e170c0cd61331a61302081339cedb445ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380464, "uuid": "65a300c4-29ef-49c2-9126-4aeba79da81e", "value": "T12783C5097F654EF7EC5FCC3745B95B0828DC950A22A83B3A7930E818F25B25F59E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380464, "uuid": "2ec7dd74-1ec6-42d0-afb9-07729d626917", "value": "1536:SjpVyRFrbtWp6ILZDochf53XvtXt5UrgNc8L+b4rpzu+7R:Sj7yRxpWpxLScn31Xiczu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380464, "uuid": "0aadef33-9479-4085-9d00-a5a206a708c4", "value": 87016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380464, "uuid": "0bf86a7e-3082-4cff-b4ba-3ac845781bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380464, "uuid": "942722d6-da42-4e75-bafe-9d35dd922fd0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0316fe46-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385457, "uuid": "68b12724-cf90-4bb5-8133-bd853570c999", "comment": "Malware payload (Adware.Neoreklami)", "value": "361e01189edc75fa2f4743ca33a5064e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385457, "uuid": "d4fd3b73-07a2-49ce-8049-20650b8654a2", "comment": "Malware payload (Adware.Neoreklami)", "value": "3702426a685fef17cd017041e08c68e3c6e53125cfa1871eff5ed936d2de68a8", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385457, "uuid": "e9a8e371-a2f4-4939-8d4a-592e3e322db5", "comment": "Malware payload (Adware.Neoreklami)", "value": "0262131c053b264bcd8e0321252af357613a1365", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385457, "uuid": "1d1dcaee-977b-49f2-8533-df28cf244376", "comment": "Malware payload (Adware.Neoreklami)", "value": "0d07c085c44b4e5bfe5aa404b87237b6ff0b605879e9b5748e624ab5c6110b032822c85b32ad49c211e4189c8fe4917b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385457, "uuid": "1ebd65de-4905-47ba-ae2c-a1fe245f7bb7", "value": "T111763322BBC0DAFADB5618B2AB5067E55752C62C49218E63037902FD8FBD9F4D13720D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385457, "uuid": "0e85b85a-0ad8-4a6e-a1cf-49614ebce88c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385457, "uuid": "a5008fd6-effd-43f6-b7c6-c9c378b9b564", "value": "196608:P1OsZcAGpUvAWVCPa33wTjdkEn+OGdySGFjZsc3EMHqkth2S:tOs+AxAWVRnwHx+hKFj1fqktwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385457, "uuid": "73199d30-ba1c-44b8-ab60-12b6c606851b", "value": 7560538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385457, "uuid": "aa501dfa-1e38-4a32-bd4f-dcd2cadf0304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385457, "uuid": "a229222c-661d-4460-a3c9-80f8246eedc8", "value": "361e01189edc75fa2f4743ca33a5064e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a5c43f-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386043, "uuid": "4203b9bb-a9ba-43f2-a0cc-ca4f0cd98136", "comment": "Malware payload (GCleaner)", "value": "f6103898c5b77e75ecc180e1d82f3757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386043, "uuid": "e472f88a-924b-4a1c-b87d-b566306271f7", "comment": "Malware payload (GCleaner)", "value": "37146cb1305a68e635c53dcde5e9e88e9366b35085246571d2c0b80fbc5dcc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386043, "uuid": "cee5cffe-672e-415e-b12e-31cf648b28ee", "comment": "Malware payload (GCleaner)", "value": "73e70bb24979ce18a1b480af31776c6d3217e6ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386043, "uuid": "44580f4e-7b1c-4cc5-8b93-165d09ea322a", "comment": "Malware payload (GCleaner)", "value": "f0e1e5942e9dab336f7e85e84c059cbf2d6f7953d57c92b8d55228977201867deef534de5329469cc164794469fbf820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386043, "uuid": "dd3629d0-3a0c-4dad-9f48-4c49e9f30609", "value": "T14226CE59F39978E0C21B3AF04AD1FC95872DFD32ED80CDA9B4881E5AD41F581EA06B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386043, "uuid": "61cb95b6-332c-43e8-b06f-5984c5ebf79a", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386043, "uuid": "ce19b66f-b1d8-4645-a6f6-31cec5a5f947", "value": "49152:rUzNgPk4tGtSTM4MigbIzmwoPnzejSNFIp51j+5nmNq6T6pTgDdLSgbTIrz8u:rUzNgPk9STM4zcM5l+U0TgZ3nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386043, "uuid": "32d08998-978e-4389-894e-acd831e04bda", "value": 4421904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386043, "uuid": "5da97a5c-40dd-429d-8006-117e1c5585b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386043, "uuid": "93c8a02a-ae84-41e2-957b-6765f261e25c", "value": "f6103898c5b77e75ecc180e1d82f3757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a559cc71-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312714, "uuid": "554f47ec-8e60-4b6b-ba7d-8dfdc924adfd", "comment": "Malware payload (Mirai)", "value": "9ec1609ffc1df17b94b663e718552cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312714, "uuid": "746a8597-9983-43d4-929d-3b310187df7f", "comment": "Malware payload (Mirai)", "value": "371f529f7f05a9c58f1900dc68f4b1f39e700462dcf6ab318c5b5e138c94cabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312714, "uuid": "0cd8e673-995c-4ad1-a062-9db98c4df8ef", "comment": "Malware payload (Mirai)", "value": "d86d467a2c9d90ba83275131bde9e170500411b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312714, "uuid": "04e05c94-740b-410e-be2c-9c9398b58f84", "comment": "Malware payload (Mirai)", "value": "0c8d3f3da6f6501b8bf77b5e777a7ea862ae522efe5e133f9ef1c1fc8ed94e9bf39a1ab1e8605d0777f7fef01cebf3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312714, "uuid": "df064b1e-acdb-4a53-a124-709eeca4ee6a", "value": "T159D3C65E7E315F6DF268C23447B38F21A74827D627E1C681E2ACD5151E6038D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312714, "uuid": "faedf740-f35a-4be2-9c86-3b86203e30da", "value": "3072:i6R/VlcGf8hM9U00VeCqJqDJs0KGhQf/2S9G:juVe5JqBJh8eS9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312714, "uuid": "456b49ff-34a0-48fe-b86e-267d2c417a2c", "value": 133544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312714, "uuid": "b336004f-88ef-4579-862a-2e9ba1f3b117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312714, "uuid": "e271c39a-d117-430d-a7f7-8167897640a3", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396146b4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385548, "uuid": "347bdff1-858f-4e72-823e-3da46ee994f1", "comment": "Malware payload (GCleaner)", "value": "5a88acdff5316dac88dd3922ad043f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385548, "uuid": "48bc53f1-8a81-416d-b494-c6d780adfb20", "comment": "Malware payload (GCleaner)", "value": "372297e9e27a9b95fc86bcf5190a1858603bbea9542d3bfa01552b68c8d73b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385548, "uuid": "d1cf74da-da5f-4ace-b68e-f53eccbbba10", "comment": "Malware payload (GCleaner)", "value": "f8f238c9fa99b3893362c03ccef68b6842443677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385548, "uuid": "c37b4ece-a499-4bd2-819e-3a4d54a6a4a7", "comment": "Malware payload (GCleaner)", "value": "c5ec18e950dd0b805a26b01a92c74735c646d822342ae8247f5fc0266fe32ac2ad05ba4b98dbd9227b999d343dc2c3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385548, "uuid": "404ef138-bd83-46cf-b3bf-f4f2f64562e5", "value": "T1BA16E078D212D11AF40D8633ECBDADBC64AAB95CC87C46CBB1E7DF482B6B2C11545C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385548, "uuid": "fc073a5b-1d40-4d57-8706-158b00b2c1b0", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385548, "uuid": "694df7ec-41fb-4a31-932c-dd9de033ab79", "value": "98304:yyRN9/BL7fX9lSV7eqpdTCZtwQhssqqWOVi:y6/B/v9lq9TCZtDW7qWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385548, "uuid": "02df443f-c5f2-4001-a4bb-394ba6f17c15", "value": 4103440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385548, "uuid": "0149a563-ea33-4659-9f68-c36e9ac4ad40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385548, "uuid": "212d1f93-c0c4-4e19-9114-81e18eddbd8a", "value": "5a88acdff5316dac88dd3922ad043f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b3a22-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385539, "uuid": "0096154a-4933-404c-80f6-52f058e95c5d", "comment": "Malware payload", "value": "56b1a2fe35572ccd57df9af8a9d6eed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385539, "uuid": "1f9d3f84-8835-4a78-93e1-e6cc9651a4ee", "comment": "Malware payload", "value": "3786849e2ebbd802a5c450439954341f3208b56adabd5677b87ae51893dd2fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385539, "uuid": "39aee05c-62b8-448a-b9d6-122135e0a322", "comment": "Malware payload", "value": "a8d16b4b80e98dc259d7e8f12f369f97e3d752ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385539, "uuid": "7970c8c7-4ba4-472f-a1d5-69cbb8e7cccd", "comment": "Malware payload", "value": "3b835a9bfbd1e5b64035e2c3e1dc97d1d8fd6230ec5d3588942c9cd875d10709e026295148104242b9d68d36ff310892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385539, "uuid": "32b6db10-1984-41e7-b958-ca63b267d2f8", "value": "T1160633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385539, "uuid": "b3e13935-a992-40be-bd8a-21b855a14e0c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385539, "uuid": "f6f89b87-1a45-4064-a787-67b34a41ec02", "value": "98304:aMT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:b2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385539, "uuid": "9316590e-521b-4f3a-8c9a-29eae111a479", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385539, "uuid": "66bd06f7-10a6-4c0d-93ad-cddbaa59cf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385539, "uuid": "9a80e94e-2a83-4b83-b1a3-019265d1ec46", "value": "56b1a2fe35572ccd57df9af8a9d6eed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177a58ff-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312906, "uuid": "ae99160a-63aa-4e42-93f8-d13591d77ef8", "comment": "Malware payload (Mirai)", "value": "e2623e21be8c6244603fcddf8620b6d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312906, "uuid": "933d7a0e-ab60-4d64-895c-9f2a47e8024a", "comment": "Malware payload (Mirai)", "value": "37dac2c3b42b42fef8672f893075327f34a9300b51d4d7ae399889d5eea1204a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312906, "uuid": "33be362b-1b21-44bf-848d-97b33b5046f8", "comment": "Malware payload (Mirai)", "value": "1969bc210900b080bc4b4069630a7ff33a2c5103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312906, "uuid": "7dd643c4-2b06-44ce-83d3-231217fe4d4e", "comment": "Malware payload (Mirai)", "value": "e140cd87c547a3b789384882295fb10f1286da3d83e1965ab17ec4afaf4ee23bcba7c7ee0a3fb228a635f6678b750c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312906, "uuid": "b9b0be1d-f657-492c-90ea-2cce46923f57", "value": "T11F83A60A6E219F6EF768C73587778F31D788379226A1C281D16CF9015E6434EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312906, "uuid": "1334d397-5eb8-4b73-83a4-a3f59b1278d9", "value": "1536:cQtYoXdSTQZ0W8CEjEyq6pam2PAlULOPsS3k/39t/33opTXe8S5u+7RiZ:bYsddKaL3C7Let5u+8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312906, "uuid": "64285558-fd7e-47bc-ad3b-05cf38ef629e", "value": 84800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312906, "uuid": "882b3041-ec09-48cc-8030-e9d178630065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312906, "uuid": "f8c22c36-6016-4f1d-ac76-c8ec1317a701", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c956815b-e7e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767363885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363885, "uuid": "84c9b5ac-c5ae-40b4-bc90-a50fee729a1d", "comment": "Malware payload", "value": "07d3ec9ef31762e220715b7f604ee25f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363885, "uuid": "fc6c8443-dc42-4645-9c50-284c391e22ae", "comment": "Malware payload", "value": "384b4c97bd81b3a458cf4419f0d29da332e4aef75cff44aa505dd2522e4de870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363885, "uuid": "972db712-98ab-4106-afff-89aa63be7515", "comment": "Malware payload", "value": "36b7f61712f10305e3d5f703a20963f646a46e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363885, "uuid": "42ddfba5-039e-4053-b482-bf2da85f1926", "comment": "Malware payload", "value": "21c0246a501078fbd24ca0a1a3e2e93c6d100e02f173350de16013b6609c58133bf665abee8af905894e6c7b0b346793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363885, "uuid": "7252b8aa-a992-4cc4-8b3e-865d36015a67", "value": "T1E926DA15E24C943AD3260F1ACF405F8CABBB2F1A0DA519E9F0E1E6CCEE7315782159D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363885, "uuid": "4f192d11-b0ff-4dac-bc1c-cb41b4d6fec3", "value": "384:TLXzyTNp3xLKVZXDWcz0+lP+b1Pezd7ADRrYdy+rIi1y2Bx2Tm2Y4y2Bx/jJgEqz:v5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767363885, "uuid": "33efd359-f0ad-4600-b827-250d9842a4e7", "value": 4748139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767363885, "uuid": "078bcb16-65cd-45fe-a9b9-5103969be290", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363885, "uuid": "67e68d8c-c0cf-42a2-9f4e-68a4e120d961", "value": "New Requirement Manama Contract PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f7cc9-e7ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767365588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365588, "uuid": "472f7e5f-a429-4e41-bd18-c2885c44affc", "comment": "Malware payload", "value": "b1ed16360fb00c3c850045713d6ae8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365588, "uuid": "9813ed09-232e-410a-a41a-659c4e1eea0e", "comment": "Malware payload", "value": "38751bb880a94be4bb62862f57f366b517f6e5d89cf21bbefdde1a841c71d875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365588, "uuid": "7c22386b-38f7-40f8-990e-5534be0e3897", "comment": "Malware payload", "value": "37e4670bd226f7c517f112f33ea0df7c156130e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365588, "uuid": "9a9f001b-5e29-4285-900f-4fc3a73370ff", "comment": "Malware payload", "value": "7f20487cf42fbb1a4549f4d924daf8f17314e191a793bdc3112d675e6b18211dc900b6d7b2c24b5560324eb0f7a6f3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365588, "uuid": "361c9421-ed6b-41b5-8b2d-be57080b62de", "value": "T12F8618A3AE54822DC99BE239EDB5A255B230B445033513C37F674BA08DC7BC4573B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365588, "uuid": "70ef9357-1620-4e40-a044-56afbbd5464e", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365588, "uuid": "18abbf8c-82dd-4e28-9917-243849df6c23", "value": "49152:6fsdXmlrb/T0vO90dL3BmAFd4A64nsfJkY6uRMMFgHpxsDlHruQdAubs6U9BitF1:6fI5G2keOn01m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767365588, "uuid": "7e356bf5-dc15-416c-b648-3e49f31acc49", "value": 8607360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767365588, "uuid": "180e3a97-82a5-4619-a74c-745fc32e2e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365588, "uuid": "d8974f88-3b71-4904-96d1-1ea4f7706e5b", "value": "38751bb880a94be4bb62862f57f366b517f6e5d89cf21bbefdde1a841c71d875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70112b70-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385640, "uuid": "b9d3adcd-20fd-4994-b94b-c5d3bb21b281", "comment": "Malware payload (Adware.Neoreklami)", "value": "7782b21e93670308fa1580bdbbc752a6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385640, "uuid": "8d67be5b-a6ba-4b0f-9dfc-3ddfe62a86a9", "comment": "Malware payload (Adware.Neoreklami)", "value": "387fb59a31fc6f1e2a83f32c6acbdc2cbf00556490e990ac52205e31b540566e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385640, "uuid": "9c833a21-f155-4052-8e2a-af1cdf86f056", "comment": "Malware payload (Adware.Neoreklami)", "value": "612a275deced43a0e653fce20423a3dcf7626535", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385640, "uuid": "1093f32f-55dd-44d7-a4f9-01ae25fda02b", "comment": "Malware payload (Adware.Neoreklami)", "value": "403a3673f16a2afab52d47eb2eb24bcb639dda3bf14bf3bea3dc3970577ad5caf17c38c95d83a99ee1f65a3c7401ff80", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385640, "uuid": "b8fbb9d5-4877-4b13-bc4a-b94d16c94263", "value": "T10D76331475F449B6F7801436D9946F92F7B9E0291B218C273BEF411C7C3EEA82A0F65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385640, "uuid": "736717a9-2274-4a49-b77a-406e79a3cb9f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385640, "uuid": "576e15d3-9a1e-4183-b57f-4343dcbc59dd", "value": "196608:P1O8JrcXOG81RDQwLtcBhxLS+/jpyJalj+QsBk3F5xobGMVK:tO8pzGiRDQwLtAhxuoNualJs2X/ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385640, "uuid": "f8a795bc-454a-4bf9-a20e-765a11773e77", "value": 7585339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385640, "uuid": "92eb9206-82df-41af-a07d-69009e6f71ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385640, "uuid": "d6af2523-bd10-4a97-a1cd-aec790fef540", "value": "7782b21e93670308fa1580bdbbc752a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6a22f3-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385904, "uuid": "e02ef186-d1a0-46d4-b516-7db7811969f2", "comment": "Malware payload (Adware.Neoreklami)", "value": "c619ad2a79dde3a73b831b2409fbd582", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385904, "uuid": "c1b1d1a7-cd7b-467e-b317-029b1a02df43", "comment": "Malware payload (Adware.Neoreklami)", "value": "38af0e2c86813a65925ebafe7afaf7fa78b8acc5d9e5618bd4a164522c3e550b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385904, "uuid": "4477c9cd-dfab-43bb-ba17-9047e7c6fdb4", "comment": "Malware payload (Adware.Neoreklami)", "value": "60cdac24dbf8371dd4e63b5892b648b4e9e28532", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385904, "uuid": "43ab61a0-375e-42fe-8556-c9380181616f", "comment": "Malware payload (Adware.Neoreklami)", "value": "56249892c6c0c119d9a670a8f75ee9bf2080b239593c3f90898ca14b6bb0bcd8ef31e3e115cf09933046342a3c77a305", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385904, "uuid": "fe220ac0-d37e-434e-a3f6-00c64bc5ca06", "value": "T1307633207F95EDB2E00205B1CFD4AAE2B0FBC7A00F644EE733AA461D1F2AD655352567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385904, "uuid": "858d5fa2-7944-4ba3-9ddf-1d0174e17bb7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385904, "uuid": "65112278-0334-472d-a6f9-e1f720cbf7d0", "value": "196608:P1OEYDEPEohgN1IyAdIp88j1zrA2zJnpiZPCTQgS:tOEbPEoW12dIp/drJn0ZPCTQgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385904, "uuid": "7c1510c2-f755-40b3-bee8-576189d58a31", "value": 7516154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385904, "uuid": "06264452-2e77-47dd-88a8-2bf44f238a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385904, "uuid": "dc204ad5-29ca-46a2-935a-56b70ded7411", "value": "c619ad2a79dde3a73b831b2409fbd582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d19bc6b-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386037, "uuid": "11d689fe-cea7-4ef5-9c0f-65f5655142ea", "comment": "Malware payload (GCleaner)", "value": "f4b3201d70767dbedafdf0a27933e955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386037, "uuid": "4515c047-f1e6-4dbc-90d2-9dda97eb7e1b", "comment": "Malware payload (GCleaner)", "value": "394df0c27bbefca727f40a0713a37c4bba7ff0a4ed0696224f8cbabcbe4fd6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386037, "uuid": "85adc0db-e1ce-4761-a193-ff600f57a132", "comment": "Malware payload (GCleaner)", "value": "c0bb465ca00535530b1849e0cbd9f0b9ea9b4169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386037, "uuid": "ee792250-ffbd-410f-996d-d91699aaa71c", "comment": "Malware payload (GCleaner)", "value": "ea760c5a2b5c2246dafa3e2bd0da8748e6268238936b34c4bb5d0caa6ebb08aca022348cffa5af225b9c2a3c9279bb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386037, "uuid": "d131be05-3536-4bb4-8a05-a07503e3246c", "value": "T18426E045E9ADFC22D6F656BCE8EA13793F24E161F0DF8C3297A9048525D3C42249E1B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386037, "uuid": "6a8e3f5e-fef7-4319-8fae-d95b342acbe0", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386037, "uuid": "ae42f001-84a2-4a41-a506-2615ec55f792", "value": "98304:TXAcyvt2lhgSaY5oYqzKwhMjiCoh5TnmrAemhtUCs3n7bLqX:TKv4Pg3Ktqew6jfawmhtUbHLqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386037, "uuid": "2738a2e3-3d64-4192-b059-5aefede44697", "value": 4526352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386037, "uuid": "26250b97-8300-4edf-bf8f-fa249b04625f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386037, "uuid": "0cf8cfd3-d83d-4f0f-bfab-b7b884cbab70", "value": "f4b3201d70767dbedafdf0a27933e955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb83834-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316302, "uuid": "f0fedd36-cf00-4fc5-97de-a19757e51c83", "comment": "Malware payload (Mirai)", "value": "b95668fdec564426d5ff6966d9a08473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316302, "uuid": "8c261c0e-cec4-4d09-8e37-ca04af61f847", "comment": "Malware payload (Mirai)", "value": "398cfbd6f9783c30e6b431aca4b43156415e4856fb2d1b742565113625d4e234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316302, "uuid": "f8947f38-8aa7-468e-af26-99ef9dca36a9", "comment": "Malware payload (Mirai)", "value": "4503fcccfea08108d40e25b05db4065045082b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316302, "uuid": "ffe38c6d-8427-4eed-909b-bf8445d2bd13", "comment": "Malware payload (Mirai)", "value": "c13f333524f416e0f8c850feb90f26804339216ec8dfcf4785b23bce15ac03b5348b28214cab4cede9fc5f3dde9838f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316302, "uuid": "eeb44347-41da-41e9-9ed1-fe9c04c1b7f6", "value": "T1EFB36B82AB5AD2F4F55A41F124379F3B4231D6324004CA41CBB99E32ED65E42DB1B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316302, "uuid": "a7856784-e7af-49c1-a829-3446fd0e60ea", "value": "3072:qQ40BRuC8kD5ebzvoq0NZb3v3fNknot4j:qQ4yueXr3/1knoyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316302, "uuid": "b2dab5dd-cfb1-4afa-932b-5c13d79d0f72", "value": 114180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316302, "uuid": "a1bced6c-63e3-452b-9a2d-04cde6138a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316302, "uuid": "8fb3fa77-776c-4271-b80e-7e63aa198358", "value": "rondo.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96c245c-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377656, "uuid": "cbad6165-90e8-4d57-b610-07d31cc3da90", "comment": "Malware payload (Mirai)", "value": "18b9a09d265cfe39629e4142825b3d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377656, "uuid": "d6fb111e-9bad-48ca-bf20-0b9cabd23249", "comment": "Malware payload (Mirai)", "value": "3a048b1791fe989f6112e1e57f6dda06af7994d58835605b3094f735bc65357c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377656, "uuid": "6918a779-a917-4246-896e-c1efb8302675", "comment": "Malware payload (Mirai)", "value": "abd5c753df6c697aabc4671a6578c9222a934a6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377656, "uuid": "0f3cf8fb-ff61-4a49-8aab-0df936abe6a8", "comment": "Malware payload (Mirai)", "value": "6627a85006cf5465d841865817f9022d7a52e82dccde7f7dace8a819b66683f7ee1697b5488111d856efac67d422f482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377656, "uuid": "b98e6960-135b-4e53-a492-0685d18c0ee5", "value": "T12BF34940F58BC0F5CC1B887050A7F73FCB31A8798076D68DEF999F32DA279429616299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377656, "uuid": "49bd0d8b-8528-4d59-950b-81a6c939ed34", "value": "3072:vBJewiX/I3vOwQaJ4jQHVfyEiHzVdz5AfaR4DlpP+Xgo2qy:iwO/QvOhaJ4+hyEiGT+Bjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377656, "uuid": "e448e594-179f-43eb-8a86-d6e8d31f08a0", "value": 163976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377656, "uuid": "e0c89cdb-f1ef-407a-8fa1-3a61665d5d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377656, "uuid": "91102196-e281-4471-81d1-fefb4195cab4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25e470c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385858, "uuid": "0deaad3a-fb1d-4379-9e9a-aa7218594a65", "comment": "Malware payload", "value": "b9f0f948d329360cbd05bd4bcffe0723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385858, "uuid": "2919bf26-ff2a-4dee-bf8b-b1c3cca392a5", "comment": "Malware payload", "value": "3ad07a6474d4a1408a7f4bc55e8264597c0997a0a78ba5d319a8bd6745a18e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385858, "uuid": "b08d4701-bcae-4daf-b65a-1106ff6b9325", "comment": "Malware payload", "value": "f1d9f0f97e35c19019cf3e6ab0b2af80cd93d161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385858, "uuid": "138f9558-b437-4e3e-aef7-1e032622a4f4", "comment": "Malware payload", "value": "c6d2c707794860d4668fb64b385e6215c4d63fdf3ee53ef390dc298bf5f2bf43529fbe94e251481faa4945e809432a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385858, "uuid": "ced9d083-5eba-426b-839c-a94cfd0867b7", "value": "T1A50633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385858, "uuid": "ff8c9430-f393-4cca-8b63-e8cb2e9e28b1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385858, "uuid": "dda8e01b-5a48-4591-a638-994ad2dda9fe", "value": "98304:aQT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:n2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385858, "uuid": "5c72f34a-39e4-46ea-8789-ee610b553380", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385858, "uuid": "533b6ac9-56e2-472b-bfb8-60730ac9b1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385858, "uuid": "ee47dde2-c740-4ec1-8efd-b577ebf35d94", "value": "b9f0f948d329360cbd05bd4bcffe0723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262ec358-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381650, "uuid": "591cd330-44f0-413d-b9f2-67eccf630c2c", "comment": "Malware payload (Mirai)", "value": "e2c1ff0d0ba787583b37a596e82ab93a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381650, "uuid": "451db174-9b97-4950-afd4-ea1f2f118472", "comment": "Malware payload (Mirai)", "value": "3af38f517f14ee77e63a926f8c5064a27e3bf887bd5ee5b29570860fd232772e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381650, "uuid": "8fe1b1b6-7120-4861-a09d-4d32cf4039a8", "comment": "Malware payload (Mirai)", "value": "caa3c869f3a8f91fff33c2190fbe5b9f006690d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381650, "uuid": "f95090af-247e-44ec-95f8-0dcb561d4277", "comment": "Malware payload (Mirai)", "value": "cd83967ebbe71debdeeca15405c040eeae850fa965bb1f58fbbb31beb12e9baed5482e660a128db64ae876ca1caf834d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381650, "uuid": "244b36c9-0fbc-44d6-8d8c-fb9d62f1ef07", "value": "T1DC338E73C42E7DD4E65982B8B9204B785B63D40296933EF5A64AC6974043FECF5093F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381650, "uuid": "42fe9789-b80e-41b9-824b-d4b92ffe54cd", "value": "768:5aF/Miz/6Ozr+52iMuwtAz+gXVq9DIa3gHDLZ0ID3eZ74e4zSC6goKoyCERE:5aF/Mu6a6XwtAFaIxH3KQ30kSv7yCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381650, "uuid": "856f6195-71db-4370-81de-5e3250a3e4da", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381650, "uuid": "74dee378-05bd-49d3-8b04-d4596a00db07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381650, "uuid": "ddf7bd4e-4347-4f3e-a046-fd0fc07a259c", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2a7bab-e7da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767358546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358546, "uuid": "b1ac7b42-cd88-40d6-84a5-7644aaa5ed60", "comment": "Malware payload (Mirai)", "value": "08321e16a9cf7aff58d84626152a52be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358546, "uuid": "56bf2d48-3359-4f0a-bd8d-f06a8931c813", "comment": "Malware payload (Mirai)", "value": "3c871aba9fde763bd2af432bfcd4d30882acb16befb5a0ce8f2bd0701377a645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358546, "uuid": "34602234-c3ae-423e-bf41-b7bb04945557", "comment": "Malware payload (Mirai)", "value": "af3309d65b7a3e81e77b76b741bf8e2f39e2fb08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358546, "uuid": "5a876e06-4e34-449b-b21a-2c7c1f815f1e", "comment": "Malware payload (Mirai)", "value": "b452b31bd9d580c3d7c45eecfdbfc85ea1f30a635a0b9645c653f197434c510066acd5cae2edbcf9ab5dfa8602cb2e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358546, "uuid": "2f19ecf2-a125-4e0c-b294-a956a9155e48", "value": "T168243A56BD91DF11D5C221BAFA6F808D33135BB8D3FA7102DD206F61638A99B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358546, "uuid": "82fed398-b198-440c-8c5f-57c5c5746909", "value": "6144:5Wd4MQXfiQkF6zlDz8Wgk/amk+5t8hqR41Z77XPtG:sd4MQXfiTFMFgk/ad+5t8hqR4vrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767358546, "uuid": "d7543992-15b6-4ff4-ae27-dca659d545b8", "value": 210068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767358546, "uuid": "b9542651-3602-4f4f-8534-efbe6ed2bebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358546, "uuid": "ffdd1b67-643e-4f7c-8cfa-e178095f647b", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cd12f8-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381384, "uuid": "4e660570-848a-46b8-9d92-a77230314d38", "comment": "Malware payload", "value": "8ccc64ff55f988b5d3aaeedcad8c9e9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381384, "uuid": "f972a37a-889b-425f-bd36-3e136f479a3d", "comment": "Malware payload", "value": "3c957b16916a0dbb3bbbfe0bb8f79bae8c84db78c76d0c447a8fa3d5aff20ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381384, "uuid": "173a8735-3b39-4092-85e9-c5dd308383f0", "comment": "Malware payload", "value": "aa45ec096178ed1c466b109d95a96324f3aa4261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381384, "uuid": "a71799b0-4ef4-4383-b7a5-269ac7bf9e6c", "comment": "Malware payload", "value": "5006ca0699f02e4ed844e3740fa657d3a28b14a4b39b79cf85949f3f9cc963630eae48e3cd3ee9f3bd7395c7c6ad59e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381384, "uuid": "8cca4f3d-6fb2-4d8f-8faa-b666c3191477", "value": "T112A4E05BF20B2F42C4EBD535144AC2459B5DE96733E293497F43A8BB38392768F28385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381384, "uuid": "df654f9c-3055-4a44-9c46-0a58a7c40a0f", "value": "6144:Y/YEpectizHu0pLA61lw92mgA8kXYx1785zJXIYZQoGBuBuJDB8pfZaonAf/B:Y/YoqHJLxmBon78TvQoGBI+t8pfZaog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381384, "uuid": "08e9cca1-3500-43b8-907d-807794bc44e1", "value": 473368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381384, "uuid": "06aea7db-5505-49bd-a253-e3b8ff3ad8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381384, "uuid": "67e1734a-396c-480c-b2f4-764f897d987b", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bad0192-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379915, "uuid": "eb3d8993-63b3-4aa2-ad75-ff5c3b311495", "comment": "Malware payload (Mirai)", "value": "98f290d54496945ea710a966b6b6a502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379915, "uuid": "2d57d9ce-d83e-45b2-a620-987b40e50d0d", "comment": "Malware payload (Mirai)", "value": "3c999fe5e4abaf8e0528dbb0d443aa6156c706b4e5d4fea226a2493239a1ecd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379915, "uuid": "c20a05c7-e097-40b8-8a7a-014c5973a872", "comment": "Malware payload (Mirai)", "value": "29b4a7bb73087e500cb89f47f9648199fd75a059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379915, "uuid": "d2c27220-16a8-4140-8362-10ea6abd4b43", "comment": "Malware payload (Mirai)", "value": "8ecb4254668fe04bfe70abdc2daa970142855c6728f417b8628d1b0b854bc588c5effefe73e1cd904ea7cda74511b8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379915, "uuid": "ff5bc83d-1c3b-4e15-b8fb-74366ef46584", "value": "T16C73E886BD918A15C6D512BBFA2E118D331367B8E3DF73139D105F247B8A82B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379915, "uuid": "f179272f-653d-42c2-9239-3292a121e211", "value": "1536:qRn1ToK7vCV6i3yEhgqDXkms5BHwe33br7fpD9c3M3hM/0itSOtWAHu+7R:Y1vA3yEhJD0mWBHwe3rHfp+SOtWAHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379915, "uuid": "61ac3217-88da-42cb-8025-dd54f542d910", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379915, "uuid": "434b1d6a-8bd8-4f89-b70b-5ce7dacb40dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379915, "uuid": "7286955f-1d6f-4c36-b560-d063873aa801", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f03518b-e77b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317858, "uuid": "60dd5ade-c8be-4a73-8bb7-82c040276114", "comment": "Malware payload (Mirai)", "value": "7d4ad0b61600bc53e19624226f2dc3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317858, "uuid": "b62b5f23-a6a4-4c03-be2b-6767af8883e7", "comment": "Malware payload (Mirai)", "value": "3ca8b2afb0d98ac41d957488161302d34b21d1c2767a7dc94eedcbbee8209e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317858, "uuid": "b374e694-3e12-4ec9-8b60-606eb7528824", "comment": "Malware payload (Mirai)", "value": "f9164caaefa660340f882ae3d984c3061c4a7d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317858, "uuid": "b552a261-1da9-491f-888b-b31fe7fe85f9", "comment": "Malware payload (Mirai)", "value": "e85e75d612ad5468bc5f82d8c4f2cb9bbf65408b565d44ccb234bdc55264bfcc1b1012740ff94b5c89491a9d7f24388b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317858, "uuid": "7eeec994-ef3b-4528-a821-149ae2f3c007", "value": "T1A7A3127BDD3A9B87A5F277F5BA3E27C5A7A21343604240FE31211C024472E75ABD06E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317858, "uuid": "e0f754c1-292d-4279-9ddc-35931476a158", "value": "3072:/hRfVwesQ0/TuV0NT+75ELumQLHYz/+PBP5qpU:uest7E0CL1YzGPB2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317858, "uuid": "6fe7e3c4-f142-4b0b-b7f8-31b7972b6297", "value": 98872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317858, "uuid": "2e7a16e7-58c5-4404-b5c1-92653c0b5116", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317858, "uuid": "7b2b5d39-d225-4ef3-86d2-42d59ed87290", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d389a161-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381941, "uuid": "09aa4e5a-9ef3-4169-aba2-4ebc46e2547a", "comment": "Malware payload (Mirai)", "value": "7f0351b1de84d5267b0e019c85919980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381941, "uuid": "4d3ec2ae-dec2-475c-af85-92ad01ac0971", "comment": "Malware payload (Mirai)", "value": "3cc20088ff03693c8cddc48d795bd933c03a76f3855709761b3f7130e597dbf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381941, "uuid": "a4398bc0-5181-45b8-941b-24f5df9a9cce", "comment": "Malware payload (Mirai)", "value": "605d4d552361a6da8df29947b34ed7fdddad3335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381941, "uuid": "b02ab7cc-c435-4e2b-af82-3905c6788269", "comment": "Malware payload (Mirai)", "value": "547a7786f071ee5006be04470d20c905636ca422b6f279db3fc153601e8a883aebe4c1a1c87a3212be901d2928abcfdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381941, "uuid": "771bbafe-37c3-4325-9d00-4de6cb81188d", "value": "T1DDE37DC5E383D1F9EC5601712076FB369673E13A213BEA86C7B95A32EC52541C91B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381941, "uuid": "2bcbbde5-f3e9-4677-bf16-b6947f0dddd2", "value": "3072:0agHiRhrYwN88O0cLtbau8qOTGtGvkyNOlBp7xqU3B+651XnNIDFRY:0akiRBYwN887obaotGvkyq3bfnCXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381941, "uuid": "bbef9dfd-b473-45c7-b6d5-2b1098db9ce0", "value": 151912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381941, "uuid": "8b226b58-80ee-492e-bfb5-7d62234388ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381941, "uuid": "94926c50-3b21-4814-8b85-2789df78fe73", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d31834-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385570, "uuid": "f349aaa5-5030-43a9-87ac-431396d507ef", "comment": "Malware payload", "value": "63cba0cc5c87b60cff789fc93a44fa68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385570, "uuid": "462681dc-9096-46a2-a453-f0f6b4c48919", "comment": "Malware payload", "value": "3d16f2c633c3192acf3c4141ecc47c7710284caebebec35ede2a4d3c94edd722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385570, "uuid": "cbfbbb5f-1000-4eca-86be-eaf3fdd6f7a2", "comment": "Malware payload", "value": "59889353882dca9f607c9b3ff7e64df5bfb05c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385570, "uuid": "745081aa-6beb-490e-8b98-17bac989eca3", "comment": "Malware payload", "value": "a29b3d760ede200e6cb1b4cfe13762a4ed16a2aec98c9a707357c4bcc730d33e26c1d0b14019ed9b359814c735efb997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385570, "uuid": "29ccdbf1-7b39-4f79-82a6-b7e4ce5df50f", "value": "T1CD0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385570, "uuid": "fb098f80-d8b8-4612-a043-ce391547c775", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385570, "uuid": "377fd177-b1a0-4800-a2ec-b9b698626d46", "value": "98304:aDT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:82w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385570, "uuid": "d028bd49-3aa5-454c-9515-2630444ac004", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385570, "uuid": "db3dd979-3659-48a4-8579-4ebce7e349b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385570, "uuid": "b6d10005-857c-438b-a783-95b9d5956f8b", "value": "63cba0cc5c87b60cff789fc93a44fa68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f59179-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393404, "uuid": "c441fb0a-9e03-4576-ab5b-797527f22ff9", "comment": "Malware payload (Mirai)", "value": "564aa9bfc4596b033810aa86be549509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393404, "uuid": "d6c03d91-07b9-4233-904d-6d902795c09d", "comment": "Malware payload (Mirai)", "value": "3dd5b104b1d65450ba39351ffe32e21947af190f6bc12cbf05240c3078c58830", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393404, "uuid": "cfe4eac1-d696-49a3-bca9-531c96fa0313", "comment": "Malware payload (Mirai)", "value": "fcb1763af05304184ce53861e8ae53294210f1eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393404, "uuid": "ecdacc66-fc41-48c3-95b3-ed2d8d8039a1", "comment": "Malware payload (Mirai)", "value": "7ef5f3b050a206f068a412951a188e209e7744bfe90ee18b2c69631ff7dde3e5f3363962bd62244becac5693cd562ce2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393404, "uuid": "182653b9-3526-4425-b1d7-3661561758a8", "value": "T1D414951E6E329F7DF368C73447B74A34975D23D626E1DA84D1ACC1052F6028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393404, "uuid": "6fd301c5-5135-4eab-9e5d-ac7e2490eee0", "value": "3072:nPHpedDWuJRI9Ku4TVfBLseYqqomZZaeKAOQ8bzOCqiLQe/:nPJedDoX4TVKWq/bf69qiLx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393404, "uuid": "b8cd3dba-ad5b-4a62-9833-29b7879074e6", "value": 203128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393404, "uuid": "e3976e74-3931-48ff-b6d8-d3f6b13187b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393404, "uuid": "fdeeb43b-8b33-4778-8e56-654d9c2a89e3", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b08f26-e812-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382695, "uuid": "b21f6d3c-3a13-4221-8afd-ae8f85113a5d", "comment": "Malware payload (Mirai)", "value": "dea0decfb599eecf46943dcf05987dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382695, "uuid": "421dc262-013a-45eb-bc64-3d3b1f815a7e", "comment": "Malware payload (Mirai)", "value": "3e615487c8ad4243067835a97b96a08b71305428b454d1d83066fe010ad2bfc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382695, "uuid": "5f080006-3966-4076-9bda-2f645e8e4132", "comment": "Malware payload (Mirai)", "value": "70ee1abfb33daf1dbae40f74e7337e9c131b413f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382695, "uuid": "1557d130-0a5d-4ebc-9e34-9c08cc09a4e9", "comment": "Malware payload (Mirai)", "value": "a332e44ba289c02b2bbf690c4482ad1f7fac31445e732ad16fcc9d7995c6407f4f8b92d7bdc7caa98ab75c6bab86a5a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382695, "uuid": "66b3c7a7-3e9d-42c9-9b36-752ce662b52e", "value": "T1CE23E989BC91C956CAC55577FF0E42DC372603A8E1EE73039E19AF65365F83B0A2B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382695, "uuid": "d3d114f1-242b-4c99-8c06-cd876491bc79", "value": "768:VWXhbAOmWELwfEwmNAiJrBL7ZH6lMsEu+7RT5c:sSuELeEWiT10Uu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382695, "uuid": "c50cc7f5-6df2-4e2e-a555-fc0a7499f67d", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382695, "uuid": "32fe5d7b-c2f1-4f88-8562-2bd2d41fbb67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382695, "uuid": "654410f3-c12f-476e-a07e-90b6f24d04d0", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8519181b-e7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767374078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374078, "uuid": "1c5e5b96-3be9-4b19-8bf2-f79d9434d537", "comment": "Malware payload", "value": "4e041e4e914c30adb7493396f2903af6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374078, "uuid": "8355bae6-641c-4ecc-8574-5ffceb2f6a9f", "comment": "Malware payload", "value": "3eaa9777b7b070dc3639b95b316aa0d7949f318527d3a813fc603c612700965e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374078, "uuid": "978e66b3-ed23-425b-ba4a-dd8eb409ab44", "comment": "Malware payload", "value": "f13ceab55b081e3c3b04085db8afbe3641b01724", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374078, "uuid": "be034b44-701c-4edb-891a-314f2d8d0df8", "comment": "Malware payload", "value": "480eac59c5f95824f628ca97df37e1fe39810cb09ee7867343f50b394408b080a2c23d15fc57116507eeb489063a6e4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374078, "uuid": "dec5d4e6-17da-4d34-b4c6-8a1a17a61c0c", "value": "T106051257B3A924FDC0728279C8591A42EB72387567109FDF03A447B62F236D29D3BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374078, "uuid": "6078613d-f00e-45e3-996d-0f6351274f5c", "value": "f73c6a7c47053d807256877f079ae0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374078, "uuid": "77b8b195-9d49-411a-8ea9-0390754255f2", "value": "12288:/IDEwe+QGBLWxvTOJyv2zq8chRjsuPUDYYfeUaTLc2VOsCr/IwsGZB8ilLQibPKq:JJ+QiJyHbWYYfiT3VsrIwsLiJPKbx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767374078, "uuid": "dc5e0b36-85f0-445d-8137-a76d4826e813", "value": 797935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767374078, "uuid": "9c7a12f6-5d90-4f44-b09c-cc7622bb6cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374078, "uuid": "7cac848f-3acb-41d5-8add-717f56a63f95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f74043-e7a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336720, "uuid": "14174978-69d0-42c6-b78b-868e6ff91a92", "comment": "Malware payload (Mirai)", "value": "0d524589fc0ea6505b82ba0aaae10a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336720, "uuid": "8f870f46-28d7-444f-ad4e-83f0a2a84ba0", "comment": "Malware payload (Mirai)", "value": "3f3299a94e5adb00595d73770d268063debeeeba2458eb500b45e4276eea7470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336720, "uuid": "5a939f46-01f3-4d69-8b7c-dcc2db64fe81", "comment": "Malware payload (Mirai)", "value": "ea11648547a6b8fe6506c62aa49567c03f6b7638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336720, "uuid": "42bcb10d-648b-4688-9bf0-940ca6a088cb", "comment": "Malware payload (Mirai)", "value": "dd29fb3d6a3af86ee124a28afc4cb5223680eee3ed73eafd9db2149f27072979f1e9f495807148c69475c0f757328b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336720, "uuid": "7c614ee5-3476-4d66-9ade-7507d89041f3", "value": "T19FC30796BD819F20C6C256BBFE4F428D331357ACE3DE7213DD181B24268B95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336720, "uuid": "18f5b119-49a9-4fda-8dda-4f458c59c24d", "value": "3072:x5irYTVXvatW8EmFfUhQ0orkvQ/TJTmoa5AC/rKD+FZtuIknT1:xMETVXvaY8ZFcV2kvQ/1T/aLW+FuIk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336720, "uuid": "676b6473-a073-4bb7-93eb-34fdc9a0eadd", "value": 128136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336720, "uuid": "bc97592c-d382-4ff6-872a-32f01bf1b2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336720, "uuid": "340400db-05e9-4773-9475-4897c2c4a762", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b241b648-e811-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382315, "uuid": "f246166b-2c2e-459b-addc-fcffc9470652", "comment": "Malware payload (Mirai)", "value": "2c060cabc67b849929eb70b542fb0cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382315, "uuid": "5096a687-9f8a-4657-b363-1125edaa3d4a", "comment": "Malware payload (Mirai)", "value": "3f446f2ef46fe7420330c815c97be50d5e0db910dfe0664a60f9da036a79a564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382315, "uuid": "a9aab745-7394-4961-9755-e88cfa69b32b", "comment": "Malware payload (Mirai)", "value": "66cbb375e7d6bd8ecfa105918c52e2dcd321b881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382315, "uuid": "a0eea578-78ee-4c59-b6a0-666cba84fb56", "comment": "Malware payload (Mirai)", "value": "5952b0e7932080f346bcf438d1324febbb3df4c824887628ece18afbcc51a6daa4e43f59147431f7402537f06bac2707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382315, "uuid": "bd4b1b9e-b73f-42a7-9d0d-2f48c6c5a821", "value": "T1A093084AFC819B15D5E922BEFE1E018D335357A8E3EE72029D105F15778A82B0F7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382315, "uuid": "bc6081df-51d1-40c4-8ef7-28f09503d1a7", "value": "1536:xRnNOB8eoVXETo75IqUrBVsvEe6HweS7PtT4uRLB6XYXcBfqxll8YiFHlVposu+l:8qePTo75xUdVwcHweSztTNpB6XYXcBXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382315, "uuid": "c60ea543-ec50-49bb-9dfe-7b31889de7f2", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382315, "uuid": "5229cbb0-7bc2-4845-bfd6-497ed9e933e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382315, "uuid": "0da82664-62b2-41e7-98cb-82ec737c54c5", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd796df9-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385823, "uuid": "8e4ca77b-9bf9-42ab-b3f6-93cf3a2bd073", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab08d929af73137e5c4708994cdfe1f5", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385823, "uuid": "b53b7b83-6b04-4304-bc99-58a556ed2ab6", "comment": "Malware payload (Adware.Neoreklami)", "value": "4057058864c54ad808bed506fa95ef8ea9fb20f06c9b7f49ae915ee92f099a5e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385823, "uuid": "e26ffe1a-fc31-43e8-8e79-d2743978c2a8", "comment": "Malware payload (Adware.Neoreklami)", "value": "408b45d8eeef50fada48e312cdf4582191b04347", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385823, "uuid": "501550e1-608c-4b21-9d35-ceb72028be76", "comment": "Malware payload (Adware.Neoreklami)", "value": "965a168630110dab227baaa776dd9ecc040f351f3ad4ba3c5cb4dd843ff808c1a3a4e2c739462ec1678ddd181db81613", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385823, "uuid": "c0296c3d-0edc-4327-8c9e-06bb1989f640", "value": "T14676335331E5CCFAD46614394E5A7FD110F1EDB18920D603A3CC0BEAADF95A4C962E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385823, "uuid": "8332c1f4-8d00-406f-b6a0-35cf8ccb85a7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385823, "uuid": "a65132a0-cf68-45d5-bb46-1b7f946f448b", "value": "196608:P1OXvNCbOSrhZ1+0Ao1418rRR0oSgKe/309MHh6JAm3k:tOXVwNr1+0Av8NwOE9fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385823, "uuid": "c29e6920-150a-4d25-adaa-e3217c74cff6", "value": 7513513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385823, "uuid": "521ab504-073f-4b2f-9807-eb6d412171a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385823, "uuid": "97566b48-ad8d-4956-bba8-88985e08e092", "value": "ab08d929af73137e5c4708994cdfe1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f01e241-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393396, "uuid": "cf97b911-bb94-4562-87f0-89b80d9a35da", "comment": "Malware payload (Mirai)", "value": "0d3fb30be4dc681a79f5c7422f3e8783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393396, "uuid": "ada04659-0804-4395-9ec1-28a51b9c789e", "comment": "Malware payload (Mirai)", "value": "40e2855c5d63df422ddbc989f670b344c717dd5b54234e0ba70885375b1316e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393396, "uuid": "59f311a2-dd46-4c8d-b6a6-bd9c8bcf9831", "comment": "Malware payload (Mirai)", "value": "4ed0a8a5006ad4a6a2b3ca1edff8f3280628aa26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393396, "uuid": "78750713-6f6c-4200-aa53-c4be2c3ac3f9", "comment": "Malware payload (Mirai)", "value": "a10f18a310cd510cf52084ebd0a1fe0ae40c3be38aa5329032742853a8801afdf4b1cb08640b19fab4a71c55b29fff4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393396, "uuid": "f9e92366-98d1-4df0-9b0d-b7ba18845d88", "value": "T165E31945FC518B16CAC662BBFB4E428D77271768D2EE31039D256F21378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393396, "uuid": "023aee21-0c06-4f14-902c-1bf678fd9296", "value": "3072:6W6jpYCB/C/cUFcpwir02hEZXnPh70sKe4EDYahyKnpmYLLdl/Q:F6jpYCBicUFcq+3MJgsb4AYaoKsIpl/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393396, "uuid": "6f41c66c-00ad-4e10-bb76-08c0c132439d", "value": 154168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393396, "uuid": "217b4d83-7f9b-425d-af14-a49e5a443b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393396, "uuid": "e8f6e282-1294-4d50-b83b-92e9502c17b0", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b39d9a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385750, "uuid": "bd4ad784-4bad-4256-984a-f129e25c056f", "comment": "Malware payload (Adware.Neoreklami)", "value": "953dbdf405cde9e7cbb6f783b952837e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385750, "uuid": "3b853b47-0c00-42f2-9537-ee6e9ec9f15e", "comment": "Malware payload (Adware.Neoreklami)", "value": "413d75c378a7ca80ab86a57eed19b07266e80711171dfaaf58a71fb8d38d014d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385750, "uuid": "5adf7bad-232a-43f1-9764-d3372dee39c6", "comment": "Malware payload (Adware.Neoreklami)", "value": "dc049c7db69c1f7d46dbc79ddd53ea26cea55180", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385750, "uuid": "91660ee0-73a6-4be1-9a8c-41143b7214a3", "comment": "Malware payload (Adware.Neoreklami)", "value": "b996e6b9274c4bba842deeaa15877ea7c833cbe4dfa4af14043bfe53929d0dae8d3411341a7ba002c91746db82379768", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385750, "uuid": "d7135c9d-6e0e-49b0-b90b-b36bdcae3b47", "value": "T17E76331634D2D5F5D6DF2871CAE05FC473A58BE04A30CCE76362335A9B39929CA1E18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385750, "uuid": "76c04956-1d33-4fe3-86c2-b007560b0893", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385750, "uuid": "b73281fc-45d1-41b1-bed3-6e60cd6f70b7", "value": "196608:P1OVKINahKVALkmCLlK6F0acDuXYnwCasN40r:tOyg5uac203N4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385750, "uuid": "7f703d22-1c78-4d96-a0fb-104766857fc4", "value": 7590489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385750, "uuid": "0952009e-1594-4f83-a301-1853a3667963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385750, "uuid": "8b8c742f-77c8-47e9-8d76-d5edb2778392", "value": "953dbdf405cde9e7cbb6f783b952837e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96c478d-e774-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314869, "uuid": "bac7afa3-4e3b-42b2-b47c-7e25dba3fcc2", "comment": "Malware payload (Mirai)", "value": "2b1a756014379f30434c93c408a0164c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314869, "uuid": "1fe2927d-eb64-4892-bbc4-19d54fcaf3d0", "comment": "Malware payload (Mirai)", "value": "414a67dd0a3dc6921a0fc2ad354c75a2d5234c3ebddbfaa1b4ffa75c9ff22f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314869, "uuid": "8bd6e279-3890-4ff9-b08d-ca8ed485292f", "comment": "Malware payload (Mirai)", "value": "ca7c11eb39ee3328b4be23f6cd4ef60967edcaaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314869, "uuid": "d5d18a95-c063-4a1a-96cc-be679ca2978e", "comment": "Malware payload (Mirai)", "value": "8fed6f37a87f9d218fbc63503c7eb0384b606a05cde95ad805402c71a1c8f45c5a201dce88bdc13384f409c1b0c2f616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314869, "uuid": "eddc0093-3a60-47bc-8a0d-08d109a98165", "value": "T11193084AFC819B15D5D922BEFE1E018D33535BA8E3EE72029D105F15778A82B0F7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314869, "uuid": "adbce0c1-efa9-4f43-95e6-3065b92b30c4", "value": "1536:tRnRaDhYysSscwOE0UoqZbWDs9bulHweOv/smO98tjbuQp+8BJqwllO4iadRBmuU:ED2yGOE0URZyD2OHweO8mO6FbuQp+8BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314869, "uuid": "7c7827fa-064d-4446-9a13-aeede1616d03", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314869, "uuid": "8b11c25d-2782-4019-8ef9-5e12f15c2af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314869, "uuid": "8274a472-b900-4def-8252-daa6aa44af0f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3803805c-e7d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767358058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358058, "uuid": "3612c3ed-6081-4456-a37c-e23eb1eef6e1", "comment": "Malware payload (Mirai)", "value": "06a3bf757c16c51f8eab98a5359643ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358058, "uuid": "bd23ff07-6367-475a-87d3-f7c65144b282", "comment": "Malware payload (Mirai)", "value": "414d350e3083740c9ae4fe6f8802a37b94e6ccaf3e1f7ad6538a42359b5488dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358058, "uuid": "214a7284-2a90-4872-bde8-60173f5b1fb2", "comment": "Malware payload (Mirai)", "value": "05b3d0e1aad20ec60a6a2468fe88bf99edae3724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358058, "uuid": "66d5a22a-5b19-42db-bcde-0345fbaeb7ed", "comment": "Malware payload (Mirai)", "value": "23a20e25bf1dac4951e7a7b1eca133848a7f169f1d024c26eefb731e34138ef44f6de7d33e4e5749eaa822fcb5a72b36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358058, "uuid": "bacda8b6-1aa4-49e1-ad3f-854a3300dbdb", "value": "T16BE36D86E743C1F6F85A05B0607BF7374572FA3D002BDA96EB79A931AC61542D21B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358058, "uuid": "f56e0800-a686-4431-825b-3957912a02f9", "value": "3072:ZN7TcckR0SMpnIKAcY4fCO9gyZj41UNo46PjxHG1DlQ:ZNTtSMpnSZx84Io4lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767358058, "uuid": "8efc9761-f8e0-48df-8954-2a477850f754", "value": 157108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767358058, "uuid": "5eb830f7-b061-41b2-b802-cbf9b5ad8b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358058, "uuid": "1585f079-c8f0-4f10-b048-78f96021f434", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d19341f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385554, "uuid": "e99d18ca-9633-4b51-9077-b568ffbb4925", "comment": "Malware payload (Adware.Neoreklami)", "value": "5d7e65f7ee223cbafbbfef438cbb554d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385554, "uuid": "b9a987c4-4bc5-4df4-96b6-581b5bf4efd0", "comment": "Malware payload (Adware.Neoreklami)", "value": "420e622ed4ecea92a4cecf3d2cda632cbb6591c3186e5405475bab5f0d26819f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385554, "uuid": "a77b21a9-2a47-404e-a390-cfef022d33e1", "comment": "Malware payload (Adware.Neoreklami)", "value": "e655fb07f0689d16c795522392e63ae7135a8df9", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385554, "uuid": "a43c9610-fa44-4a8d-8c76-f4d538a7b5eb", "comment": "Malware payload (Adware.Neoreklami)", "value": "08d85bd73d8ccab2db63b80c0839071d063f041766bec2640f1296bdc3c2a057778f83bdf597981a39b310a2d27070ce", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385554, "uuid": "44643d86-90d4-4220-8edb-af5267d6ad02", "value": "T1957633743DD2E5F5F58340B68B082BAA949FCA225FB0055733DB9A5D08749CEC727AB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385554, "uuid": "22b60426-cd4a-47ee-9424-250d3e353e2c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385554, "uuid": "329ac7d7-f68f-4a97-a61c-95af4f506a62", "value": "196608:P1OSsMqXfUjUs4xUx0FVVqzkdz+dgXxZYUzQ9mgdbXEKUK4Gs:tOS/Yf0o3PgkdSdeQ9bYGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385554, "uuid": "7bcdaa4a-1d81-4c7a-9ba8-784e7639845a", "value": 7529494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385554, "uuid": "92505c52-979d-460b-bd95-cc27eee794d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385554, "uuid": "2990de02-fbfe-476f-98a5-5ed95bd97dca", "value": "5d7e65f7ee223cbafbbfef438cbb554d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ab5f7f-e815-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767384035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384035, "uuid": "e5c43727-9fe4-4075-9de7-d6e45bfe30aa", "comment": "Malware payload (Mirai)", "value": "18b7fcc5916af20df1d31c42d4eb29a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384035, "uuid": "2f731351-4197-4899-96a5-3933d818359c", "comment": "Malware payload (Mirai)", "value": "4210ee026677414d9ee9dee24b22028cfd628dde7cce3a7d515a759d3aceb1b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384035, "uuid": "d417184c-e293-40a1-8ed9-31a9d9949202", "comment": "Malware payload (Mirai)", "value": "3d39c9bdd114b80ac4b92c3412da1396587fe1ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384035, "uuid": "98d72f31-252e-4aa5-949c-74b6ed12a89a", "comment": "Malware payload (Mirai)", "value": "5f403d0b07cb8a7ed8de5b7abd548d8c4a501728588914de9a31ebd98f25d3e26fafb67693c808612063d945fc164e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384035, "uuid": "99c25489-1c22-4e9b-807e-5d79a0842612", "value": "T168533AC5BA03D8F4ED1A09752076F7335B31E5751138FA8FEB94F936A852702B9062AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384035, "uuid": "8a6e73fb-c127-4c21-9615-610eaac07b8d", "value": "1536:uFc4LzRJf5gG+oIeChq8Ef9wQiyvpJaI7SQ7BSnx3XR:uFcKbf5gXoAhq8EwQiyvpgIV7Ax3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384035, "uuid": "65c2ef55-a890-41f5-82e5-340d3b3dc8a9", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384035, "uuid": "30c78b3c-d2eb-497b-ac58-35486c0e8b7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384035, "uuid": "5f22cb4b-1909-42b4-a853-1bff2b320169", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f7e23e-e817-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767384742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384742, "uuid": "c2d621a9-f3e4-41cd-990e-bcb4817d8a3a", "comment": "Malware payload (Mirai)", "value": "15f9e412ae7eb02c5dd2b78e190cf062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384742, "uuid": "cbff8a4a-4f64-482b-8796-6da0b45ec04b", "comment": "Malware payload (Mirai)", "value": "4389328b274b11ace991c6c1f372a508f0772dde4dae9f6c89d22ec274feef58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384742, "uuid": "140c873e-e20b-4d0f-8f24-6217a996d0a1", "comment": "Malware payload (Mirai)", "value": "8a8c4283f095d1161f4b2536c8e802f8be2651b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384742, "uuid": "399db794-e839-41bb-acfb-e8a2993a3c4b", "comment": "Malware payload (Mirai)", "value": "5f7a91e8da617583d0939c35391db2b3522885290dd533fa6a2fa75b8b9f3de82a6d7ae4d2b6e2e1af08628dcc7af209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384742, "uuid": "3e7a76ad-6f15-4b0f-a08d-17bc9fd9ff86", "value": "T1BE633A21BD796D1BC4C4A47B21F34374F2F2670A36A8CA1A7D720E5DFF20660215BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384742, "uuid": "f21c8263-6d23-4a23-8068-1cc7f569ed49", "value": "1536:pnrSl6FKfdu6pBUp4ZeXIrK0Qd5CfjC5lD3re+chr:VOzVumc9UK7e+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384742, "uuid": "a74beeea-2f64-4e5f-bc04-fee369267e7b", "value": 68952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384742, "uuid": "0b0cd803-f54a-4898-a293-b592a0e8c4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384742, "uuid": "13d0256c-61f7-44d2-8de8-b843a83d7fdc", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8883784b-e827-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767391694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767391694, "uuid": "b274809a-ae3a-4dd0-a374-faae29025854", "comment": "Malware payload (Mirai)", "value": "21e51d8d5cf3840d9e846748d3e999ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767391694, "uuid": "dfcf3867-b780-4144-ba39-0c1449bacd20", "comment": "Malware payload (Mirai)", "value": "43de885421455e33557ad66f540a44d9697d9ff5b55d463c2dcc2621c40761ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767391694, "uuid": "c65ec346-8760-43c2-bf7c-e0c0baea49df", "comment": "Malware payload (Mirai)", "value": "8080e75d8b09ff7786a836cfdd8d5b850c78b6fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767391694, "uuid": "7c1f935d-8368-40cd-809f-5fc5a57d411d", "comment": "Malware payload (Mirai)", "value": "8ba960fbd843088a94f914919a866fbe8f69451bd4fb340cc60df7b24ed878342f8ef37bc665db760022af1619110a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767391694, "uuid": "80994df7-2ca8-4cf5-8b7e-3e483c89da25", "value": "T14C342C46B8918F12C5C112BAFE6E418D33136BB8D2EE7102DD245F64778A8EF0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767391694, "uuid": "866dcd4a-724c-4955-b053-9c5abc96d8e7", "value": "6144:NyLtHMCJNt0rGlMOVd/p/qHlffCLXWq/ap6W1R+TrMawX:YLZJNt0rGlMOVd/pCH1gXZ/at1g8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767391694, "uuid": "a0988748-be2a-4326-a2b8-0171a539f7ed", "value": 237524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767391694, "uuid": "110225b2-9034-4dee-93c6-f191d36126a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767391694, "uuid": "dec019f8-9c7c-4a54-8b55-ddba4045bafa", "value": ".7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d34e73-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380272, "uuid": "12b039f2-0102-4acf-9fb1-68dd97619526", "comment": "Malware payload (Mirai)", "value": "b36a44e4bce4f434d711ba2ed628b4e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380272, "uuid": "db3c7048-7b92-448a-a065-b284983b1d0d", "comment": "Malware payload (Mirai)", "value": "43e69474bf63ff6c96a78e736ab03e460ae8267a591c083a171a1c28724a7e8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380272, "uuid": "8a505a12-b4a7-4f7e-ba80-3f9225cc9aee", "comment": "Malware payload (Mirai)", "value": "b1d40c29b77809e050da44f702d6ef65301ccf85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380272, "uuid": "431144ee-5898-4fd2-b5c4-de5e74b6e15e", "comment": "Malware payload (Mirai)", "value": "9bb8ee6a6245b0c914524e6652f8265b21a952a4009ccab14986c8be0ad355f9b9dd657274f091a96c2c24a818835c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380272, "uuid": "1500b49e-79fc-44fd-a249-d5438c165a4b", "value": "T1EF23E88ABC91C956CAC55577FF0E42DC372603A8E1EE73039E19AF65365F83B0A2B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380272, "uuid": "797ce84d-5f8c-488b-9ff5-aefd74f160f0", "value": "768:zWXibAOmWQLwfEwmNAiJrBL7ZH6lMsEu+7RT5c:ORuQLeEWiT10Uu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380272, "uuid": "80924d16-a182-4bbf-913b-81a88613fcd1", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380272, "uuid": "a52e61fc-98e4-4f0e-ad3d-add2c27e1158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380272, "uuid": "6bdd5f27-1664-4e61-b4f7-213182a1908b", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7be922-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385415, "uuid": "22f733f2-e121-4e05-b1df-5f5c5ab77298", "comment": "Malware payload (GCleaner)", "value": "23cf4cd3a051635511369a12cb46a1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385415, "uuid": "680bc438-7e8b-4efb-8631-3f08a7388860", "comment": "Malware payload (GCleaner)", "value": "4417b0bbf5945972edbfbb3d5306597b6f978ce86b325016d743fec067ddd3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385415, "uuid": "7e18150e-9c5c-4bca-bd2a-82933ced86e9", "comment": "Malware payload (GCleaner)", "value": "6e640e8f5ffc5e9b5bd24294bebf82a9f09bfb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385415, "uuid": "477eb7a7-f4f8-4f07-bc78-c0199ab1d2bc", "comment": "Malware payload (GCleaner)", "value": "9658fc7ba62a1be47582694fe1789e58730534ce1d49d956724880308cb695979ea7dab11b6dc093a6fca283debcd211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385415, "uuid": "164cd94a-d3c7-4554-a1cd-679ad4a37a35", "value": "T1D116D001D7D8072BD0BB4272C75ABF86BD1DED05D8341C89EA81DDC96705BC1E28BAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385415, "uuid": "d8482704-eff6-468c-ad7e-7e8fd5333572", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385415, "uuid": "2fcff667-dc9c-4e40-850a-c82d3c1ce263", "value": "98304:qrSWTX0FZqEqcpXZUnZc37AQfCVPx9ATMsHdCSPa:6BX0FZ5qiXZUZc37AQfCNXATMsH4Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385415, "uuid": "131c76f7-835e-4b97-a984-32c3963ba2c5", "value": 4184336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385415, "uuid": "5fc9504c-58db-4f1b-a7c8-169b3d041c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385415, "uuid": "af7bd7b0-7f30-4e79-a7d6-548eb5beb73e", "value": "23cf4cd3a051635511369a12cb46a1bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d52f735-e812-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382494, "uuid": "3a5cea90-8608-4ece-8d85-23e17432d251", "comment": "Malware payload (Mirai)", "value": "e3fb4b2c6aa53d057bb2cdd739a47243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382494, "uuid": "98a43d25-874e-43c5-b239-80b040a27a58", "comment": "Malware payload (Mirai)", "value": "441a1f4b00832efd1ccc1ec8128415ac748801eb2db626033a4b92b488b565d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382494, "uuid": "b6c0c0ac-b512-4178-927a-2a56fe98d035", "comment": "Malware payload (Mirai)", "value": "48eef89647ac9de440ead555de45e632de9afff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382494, "uuid": "a6c0bebb-7723-40da-acfa-d9135660d84c", "comment": "Malware payload (Mirai)", "value": "214482a38f591946093ffc72604661e58167d4b8ef8f32740a200012d86d1cfd25ed4b3db3360b7613ef6ac525992a43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382494, "uuid": "7d6315c1-5217-48c6-bb55-1e49cd61d1f8", "value": "T19B233A21BDBA6C1BC4C5643A21E38235B5B5470A21B8CB3B7E324EACFF54550235B9BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382494, "uuid": "6fa4ab13-0d32-495e-b389-7b84551a6779", "value": "768:hsZe9uKHIclOXEpDgIb5+9GO+6daje+ched:hsZeLIclOXExA9ETje+chC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382494, "uuid": "42cf616c-4edb-419f-be6d-e2e3aef28df6", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382494, "uuid": "40db5b69-0f13-4a02-9f38-2514a169eb4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382494, "uuid": "ff6771cc-71cc-44c5-adfb-9bd6dcf7c5f0", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722b1db2-e7b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767340975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340975, "uuid": "1fc073dc-4edf-4da8-9e95-d2d8564af4cd", "comment": "Malware payload", "value": "4d1082d2571c38fef1f2d2641ad5db36", "object_relation": "md5", "Tag": [ { "name": "clipboard changer crypto stealer", "colour": "#4BB200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340975, "uuid": "cb1111f9-70c8-4cec-a456-568105a2648b", "comment": "Malware payload", "value": "445cc9f102d19b8b91a875b0c5a5c0804e98d9303393bcbb2f47006762a3e51a", "object_relation": "sha256", "Tag": [ { "name": "clipboard changer crypto stealer", "colour": "#4BB200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340975, "uuid": "b8204c5b-9eee-4d8c-85bc-bde8d5c7973c", "comment": "Malware payload", "value": "67699aa3d57de470009416fd30428812995c845c", "object_relation": "sha1", "Tag": [ { "name": "clipboard changer crypto stealer", "colour": "#4BB200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340975, "uuid": "281e04fa-c9be-4e03-812f-213bd6fdd360", "comment": "Malware payload", "value": "ae8489b1d206e9d4f7d1c27632536c9993445074c42047a4aa2cbc5ab745f7d70424c8bb42128cdb0d66dccea4fdfc4c", "object_relation": "sha3-384", "Tag": [ { "name": "clipboard changer crypto stealer", "colour": "#4BB200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340975, "uuid": "5c97f39b-5365-41e4-a030-51eeb86f8715", "value": "T11D551847B88010B6D0AED2328AA652527B707C955F3113D73B61B3F82F727E85D7A368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340975, "uuid": "295c09f3-0c48-41f9-87f4-38514ca4ed2a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340975, "uuid": "66d90ef0-7e06-477a-9264-84edf4065218", "value": "12288:r/hsGtYRVt1p6znqsw8Ew1rlxbfmeRTa/BMIa1aUQ9SEghKgd8dlh1P:jjYRyznqsw8EwVlxjme4/F5gEYydD1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340975, "uuid": "ff66c4e3-5ecb-4b5c-81d7-e61b4a5d6880", "value": 1384960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340975, "uuid": "761184eb-7fb1-4556-beea-9fdcafb64191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340975, "uuid": "050301c7-6134-4604-91c4-bfaa65391f7c", "value": "ntlhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e233984-e775-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315226, "uuid": "e69750e5-ffb6-4497-a62a-61c9a5d06b44", "comment": "Malware payload (Mirai)", "value": "b962ef1f5b353c61c6983d1f631fcf4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315226, "uuid": "13e97e33-7454-44d7-be10-d4987e7f8252", "comment": "Malware payload (Mirai)", "value": "44cfcb10866fb4039b9170da80585ef3c958ce041c81da3b0a48d4f21489ec03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315226, "uuid": "ae953c1a-b104-462a-b308-109a9cfdab7e", "comment": "Malware payload (Mirai)", "value": "ae1728f98e8dfd72c3f5827274a91f2bfe235ac8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315226, "uuid": "f5078c6b-92f7-4207-8c31-017ead03eab1", "comment": "Malware payload (Mirai)", "value": "ef9de6af3e18514b9ccd5dcdedd441636f4c577ea9ca744982964bbbd81c7a1b163cee4850f9d542c1aaf2e189427e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315226, "uuid": "bcd56fd5-8e67-46b4-8ce7-f5a9d22681f5", "value": "T170D32A56B9919F11D4C731FAFA5E414933136FB8D3FA71019D206FA123CA99B0FBA212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315226, "uuid": "47079c65-6c84-4240-9eaa-e03751451abe", "value": "3072:EK7fEExiea1G7VqavS9i3IC77svvei45z7svrBVb:EK7f7s1KYavS9i3ICHsvMzovrXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315226, "uuid": "597fcff8-d2ab-449c-83cf-038e35ee3636", "value": 133360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315226, "uuid": "d179ccdb-52cb-4eb4-b1b5-071b7d6c78c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315226, "uuid": "562dd5f5-3d29-4ac9-9097-57136d5c3e8d", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b3bd7-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379911, "uuid": "a0398602-6b5b-4f5a-abd3-7e7cc8294296", "comment": "Malware payload (Mirai)", "value": "70a736072e89f569e35f2564e70fe690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379911, "uuid": "de128fc7-bae5-4c36-8008-c218039b701c", "comment": "Malware payload (Mirai)", "value": "44d19d784d11cbafeefa6355d7a0ea476a64aea8aa952fb7abf65220f7f1041c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379911, "uuid": "5bddff52-9178-44a8-a66b-b5b4b62f2c33", "comment": "Malware payload (Mirai)", "value": "a0edd721c7c55d42ca6f4d8a44d360b485443643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379911, "uuid": "b3a2c518-2a3d-4e39-8822-3b394d2fcbf1", "comment": "Malware payload (Mirai)", "value": "d543f8bc3f1073feb8272e4a1d5f954ad94f1101f7e7b37937ffd1b6678ea49698f6e7115734a56de1ac797ac7b4c72a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379911, "uuid": "e29ccb8f-dce1-4a9d-b5d0-a2c40fc7d333", "value": "T1B983B60A3E269F6DF76C873687778F309798339226E0D641D16CE9015E6034EA45FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379911, "uuid": "38ccd2fb-1dab-408b-90ef-2e90324b5b23", "value": "1536:zxTB4udE62d0ONwDEiasjR7LXCFn6BGZIijE3jJJ3jj++NQLl8u+7R0:xB9douRfXuxsNQx8u+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379911, "uuid": "b92f6d9f-dbeb-4ed1-8eb9-a30027251443", "value": 85144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379911, "uuid": "e8fd43f3-c476-4340-a857-22ca51113c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379911, "uuid": "5c776dba-cd03-461a-a7b1-fa2ded16f5ba", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baeb031-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385686, "uuid": "8c91aea8-0c84-4139-812f-6dc9f3c46f20", "comment": "Malware payload (GCleaner)", "value": "8587799688ccdbbb31311feeb7ac6b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385686, "uuid": "f0382d4e-f6a4-4059-b438-bec872f2766d", "comment": "Malware payload (GCleaner)", "value": "44e956e20e767066f5f27479436996b2f91c131c19bacd6623a72ce1ba7a6358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385686, "uuid": "9e60c359-da01-44e2-bacb-1bfdfc7a90f8", "comment": "Malware payload (GCleaner)", "value": "f550428b5b01517f50861c6625f568a4531c99c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385686, "uuid": "dec420e7-256d-47ef-973a-431b4e83ed3f", "comment": "Malware payload (GCleaner)", "value": "d0de6cb70037334cf36823d571e17d1b39b971e8f8a22099a2d580a8af1a7160cfacb8b41af54b61518f2008fdc3114e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385686, "uuid": "9b93f030-fa7b-4fc2-98e7-0c7e9f0f463c", "value": "T18606E069C3EE4FF5E14235F53E09B091BB1EB691AADEC00406B11C373F9129C1A96F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385686, "uuid": "52e04ef2-6334-40f3-80d4-3aed7d1709f7", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385686, "uuid": "fd80235a-d76b-49ec-b951-abbb8231b689", "value": "98304:EUzNgPFeyblC/ku8+6yjTeSzq4FDM753zla:bWXpxuN6y1q4Fu5jla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385686, "uuid": "0bf37266-85bc-4819-8157-cb43bee81759", "value": 3777808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385686, "uuid": "a6981eb6-63b5-44f0-a1cf-d3be4bc7197b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385686, "uuid": "468c9bc7-f2fd-41c6-b3cf-d3e3d9cab2d8", "value": "8587799688ccdbbb31311feeb7ac6b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6d8b7a-e828-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767392078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392078, "uuid": "05a0e181-59d8-4dea-842b-ba46fb3ccd9a", "comment": "Malware payload", "value": "d8db576b2e79c007df16cdd7bd296d6f", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392078, "uuid": "7ef15d04-df07-41f1-8732-f5ecf6da66b5", "comment": "Malware payload", "value": "451fe418159b0826d1b007d8bba9b8374760b9eee8a99bcad38bb62375a049e7", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392078, "uuid": "194d20c1-df1d-40f8-9728-f857edf3f768", "comment": "Malware payload", "value": "cf271ec72564a4537bd14e69b95a82be4366e69e", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392078, "uuid": "1cb8ee1c-4c9e-4edd-a717-710f25501199", "comment": "Malware payload", "value": "616194e32462190257a8445bd578102cdb56ab6ee1d497d2efe73be764116c999ade814b06895a895cd0251c0d0cd180", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false }, { "name": "Worm:Win32/AutoRun!atmn", "colour": "#27F539", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392078, "uuid": "84c8bd0b-457b-469c-82f8-3c50c5c42732", "value": "T1A2A5E112FAD18077C1611A34CC5B73799D3ABF111E28AA8B77F4ED0C6E3624169352EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392078, "uuid": "4c3398c5-6078-4b63-b273-a0a72ffb72c1", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392078, "uuid": "4184a3dd-0206-4af9-9d53-6376dd30ea0e", "value": "49152:YnsHyjtk2MYC5GDX1D9p2R4xJvBsvD/DX+y4onCYDoDe45EW:Ynsmtk2aKDv2R4x3svD/D+donCYU64WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392078, "uuid": "dd1f06cb-fa46-40d3-9fb3-96e4a4fd94c8", "value": 2209280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392078, "uuid": "6e4914d8-58ce-4da0-bfd7-47dc6c110d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392078, "uuid": "71030689-613c-4ffe-a060-e056a55502cf", "value": "QQ1666213767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526671f1-e80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379577, "uuid": "7b8e1985-8b22-4fa6-9ef0-41db9d16be57", "comment": "Malware payload (Mirai)", "value": "a0ff7120d67bbfe5123696816d52a7c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379577, "uuid": "9952bcb4-f513-41bb-9db5-27fe6f80ceb0", "comment": "Malware payload (Mirai)", "value": "452b7b4cf32f4577fffeca43cd8b3cb189a675f019fdec655ffa8f7f7df67585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379577, "uuid": "54b4b50f-033f-475a-a9ae-0eb3c6cd01ca", "comment": "Malware payload (Mirai)", "value": "6a5c24ec7fd124deb98a7e673c46f18fef262c0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379577, "uuid": "518e55e0-595d-4e59-9e77-1f1d47a9f507", "comment": "Malware payload (Mirai)", "value": "40e3fce3fe54f45e100abe1d37da5994643824ac7428ac73fdd6d2c82686ec8fb5d043558dda7fb60cf2674527cef414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379577, "uuid": "1e5425db-71ea-49ec-a29e-cb2d2df6c79e", "value": "T13A144A07B5C090FEC499C1744BFFB13AD976B05E123CB29B6B84AF262E49E701B2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379577, "uuid": "5db7a271-9778-415a-8197-aa8e3eed82f4", "value": "6144:wLAcdWf91xBfxEs8A/CBF8T7tENdpQQYYAY:w0RI8v+N0YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379577, "uuid": "9e87266e-2dc3-4683-8b74-433442e821ce", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379577, "uuid": "bcbfa786-0c80-46f6-8204-8881661b5438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379577, "uuid": "b8ee8b22-dd7b-4014-8f49-4b942b18717d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d3acc5-e7a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336869, "uuid": "3d458697-b4a1-48a4-9844-9a62105eae3f", "comment": "Malware payload (Mirai)", "value": "d97e20bec56a752283dd57eaa04bb485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336869, "uuid": "163f5db8-4769-49ef-8c52-82b8ff902f6c", "comment": "Malware payload (Mirai)", "value": "4551cba6ba89ec74986ce53b1a3f065232e5ad0832318af5a946a711b8735820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336869, "uuid": "f3c4f10c-df9f-4704-95bc-bc60b80afb80", "comment": "Malware payload (Mirai)", "value": "f13e03d5bd35f29ac944eba604dc975b5d45abe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336869, "uuid": "399a91b6-46f2-432d-8658-4fe6e4604d55", "comment": "Malware payload (Mirai)", "value": "e268ae8a569aff086f9f968ea3729f4990dea5fbfb99d0cfbfd213b5695ab11b327c74e7580f194edad0953dd496e560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336869, "uuid": "e0a3ccbc-f187-4823-a939-bb3484226a7d", "value": "T1E5C33953F400CD7FF88AD7764283CA31B63173A59BB34662B252A63779383E05D16E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336869, "uuid": "6bd319ea-ad06-4cdf-9f88-bd6b4e1cbff0", "value": "3072:QKb3R1/Y2b8kaGGOnk5dOYOcnYcgJALtkN8E6yK72V/ZleL:R//Y1kfGOOofALtcoy+khIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336869, "uuid": "95355bc5-595f-4ce0-a797-9e7dec36cf6b", "value": 120852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336869, "uuid": "cc4981f5-1a59-4b65-97cc-130a8e32b5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336869, "uuid": "d4330830-5fe1-4cda-b561-b28fa8eca110", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dcb4bf-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381629, "uuid": "a9b8fdc6-47d8-4772-864f-4130d536cef7", "comment": "Malware payload (Mirai)", "value": "e50d2d1979903455b1d66ef76bbef126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381629, "uuid": "c1dc8123-3e15-4c40-ae63-c435fdb16abe", "comment": "Malware payload (Mirai)", "value": "4558ab82dfd9126f4a7427946726d810e2a375fa00c19e61e913601f6ded3abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381629, "uuid": "bac74ebe-578e-476a-8137-71380d9aa0b1", "comment": "Malware payload (Mirai)", "value": "5d353a07c8927e6dcf6a9d80f1bb6383b7532602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381629, "uuid": "b1b14651-b85f-4934-84bb-383c6d2c6601", "comment": "Malware payload (Mirai)", "value": "f28e2fb6f5fc189eb15417c765e4e684f4174d21d7a53eb1967056d7c190c540ba12893897737a77fbe7d502c476bec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381629, "uuid": "b03e30a9-dc70-4c8a-a3f2-9f0eeb0897c3", "value": "T1C1230756ACC1992AC6E0237AB67E408E332177E9D1CF7657CD120F10778A82F4D67B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381629, "uuid": "94483d2f-030d-4edd-a312-847338d537d1", "value": "768:PI1lxj6ZEziok/dNiMFIEdRZpcVGo5JQjTOJkWaB51VKd6kmr/lR7bMHOBNhc/:iYZEY/jiMDbZpcMo5MTOaWaBzVKwkmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381629, "uuid": "9909312f-f611-4008-b0d6-2f7c12fff1ae", "value": 46308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381629, "uuid": "a25e7c44-fa48-4f8a-a571-4c43c18c46ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381629, "uuid": "370f39f5-335a-444a-b64d-8a260ce9e199", "value": "meerkat.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aede1ad-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381631, "uuid": "5f7b01d1-d11a-440b-8c35-4a9c864f9d4a", "comment": "Malware payload (Mirai)", "value": "8597f25edcbfcb853ca02b09be1421d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381631, "uuid": "431ea134-e264-41b7-ab66-eb200e791249", "comment": "Malware payload (Mirai)", "value": "4560f546663b8205437d16c632ba3253f3f976f187b61a2a8c6e3d8c832a8524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381631, "uuid": "01a966aa-9737-4632-9783-88539f6d9d50", "comment": "Malware payload (Mirai)", "value": "d863665b8496b09f380fefcd22a07a4206440da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381631, "uuid": "07c3f36e-16c9-4b6b-9c38-3554e8c20be5", "comment": "Malware payload (Mirai)", "value": "9c426dc63214466864441fa086f23b157bfcb67f8dbd9478f3f49417a5e60bb361139d46faf46505f8c6a9f587b9ecca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381631, "uuid": "5afbc067-4985-4938-9eca-eda0ba419f76", "value": "T1D853BEB3C8191D58D65A41B4B1284E3A2F23F01462D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381631, "uuid": "6a6e14a6-e5df-4a06-af0a-de634f74d1e0", "value": "1536:RyaC/P/aU1OIgxlK2NVQ8id1c/kKe1Thb6+/CQI2M5:gDX/z1OlK2NVKs/LeH6IVM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381631, "uuid": "7c15a367-90e7-4a0a-895d-c4c8a8d91bd4", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381631, "uuid": "0ac9f55b-a21a-4c2e-ba2f-b1fb1a168a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381631, "uuid": "2dbaa7a2-9f09-4b5b-87d7-7c3e755cd01b", "value": "meerkat.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191ad7d0-e7ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767338249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338249, "uuid": "93765097-367c-40a8-9678-a23adb00bc9e", "comment": "Malware payload", "value": "806320c9d08e36b6d41350a94c0eedb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338249, "uuid": "6555f184-c96a-4a47-9006-980a0a7c2042", "comment": "Malware payload", "value": "45cba221dba92a96f119d025bba73513282557bfc9e4483830990ae27098868a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338249, "uuid": "75486948-3233-4904-995d-a8a6ccb0dade", "comment": "Malware payload", "value": "91bee1263a9c4d510de14a6fa5196c86ca1a5ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338249, "uuid": "33a0d79d-04fe-4c1f-9b91-319a467fb71c", "comment": "Malware payload", "value": "8b3b0d86c7e4d593c5f7183d2625fae4f97216e861a93654cf7142dc19e496be986c100024885b1918dadd32d2cc5aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338249, "uuid": "f54016d4-2a3b-4134-8714-7b4f01d970d5", "value": "T188F3390773A911F8D1BBE23999A24906F7B63826473197CF2350427A0F777E0AE79721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338249, "uuid": "95fe2092-f588-40a0-8367-88ce9beed5b0", "value": "a8308de57fce070f4cb88c7f43bf4b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338249, "uuid": "57786bc8-f153-417e-88e4-ae84ec886e6c", "value": "3072:05vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCWods096hxpfSo:0BKjK2LFzZNfIULLD0chbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338249, "uuid": "24acada0-ad91-45ba-acb3-19828e4dbe15", "value": 164720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338249, "uuid": "c3cd3b84-5c25-42d9-a36b-77afb412580c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338249, "uuid": "3713a3c2-2750-4975-8225-d2e0854c6388", "value": "susano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdd41ef-e774-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314901, "uuid": "5aa418a1-df4f-4859-bcad-0b2e61e34e9e", "comment": "Malware payload (Mirai)", "value": "0f94ad165ac0ce4d0bd49ad932ab3919", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314901, "uuid": "41bd9890-bac5-43d9-9c5d-34c8d12f0c85", "comment": "Malware payload (Mirai)", "value": "45dadf697894626cc1219c5e6e89db5a8831333b96c8aca0541e83388628ea80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314901, "uuid": "9bb97b79-9a3d-4ac6-9f89-42460ff6d6ed", "comment": "Malware payload (Mirai)", "value": "5bab6a230fbc666a85042b082179177bbf19611f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314901, "uuid": "bf0da3d4-fbed-4ea1-921f-1afcdbb107be", "comment": "Malware payload (Mirai)", "value": "1f2044e50bb963f0554461e94d94d0b45fe6e024c83c29a10f5c8c41bf0e23c223c3910d5ebe79dfbdb19ce73ed03655", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314901, "uuid": "f54b6ffc-4f0b-44bf-988d-b61f91ff8113", "value": "T1D324F85DE4508B3BC7C1227AF799028D33735F68EBEA730589256B343BD66259E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314901, "uuid": "faa177de-163c-4c5c-8a14-e9c0d2e2542d", "value": "6144:x97Y4xmP7acPz6qzz/UlLvRqbI5tF7eb:nPmP751z8KM5b7eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314901, "uuid": "d8294b2e-2e3b-439a-99de-0520e48afdcb", "value": 209820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314901, "uuid": "fbe0ea37-d7fa-4ce2-a2b2-3c317fc4eb8e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314901, "uuid": "47872eb5-be19-44b0-b51d-96c88f381c90", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d374275b-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385377, "uuid": "5136f290-c80f-4450-b8b1-4a75136f012b", "comment": "Malware payload", "value": "1608c305360059b235b3257cd08f2110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385377, "uuid": "9b8846cb-2a5a-4f46-b7b2-9c750e32160a", "comment": "Malware payload", "value": "469f2177e6782da2fa71b5bab032057ebabdd2c52de8f693078e8dcd9a6ed644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385377, "uuid": "ed137d9c-7908-45d1-8d26-fbedec3f8784", "comment": "Malware payload", "value": "bab1dccb9dc1bb8c340dcc9c48acfe90016e8198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385377, "uuid": "92bb74a3-237a-447f-8c86-0cef40f37df9", "comment": "Malware payload", "value": "b653cc7f103763040101e9ba46f983ebe852eea06d58ec427447e335564e9139ac0950e7aff9f4a03cd994447d0d3262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385377, "uuid": "caa05824-3c52-471b-9c38-351bf24f3886", "value": "T1150633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385377, "uuid": "a7c1f64c-2553-4a4b-97cb-e2c9a25e61d6", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385377, "uuid": "50274091-7467-443d-9263-cd070ced2506", "value": "98304:a0T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:32w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385377, "uuid": "229d0367-a72e-40cc-b360-3bf2a9624d24", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385377, "uuid": "8f6e2502-cd90-4426-b9ff-d5e069e6507a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385377, "uuid": "ccbf4b5c-af40-4ac0-84c2-7dbb3d658d1f", "value": "1608c305360059b235b3257cd08f2110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e331cc-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385326, "uuid": "22559a60-adf5-4350-8d73-0ab7db185ad8", "comment": "Malware payload (Adware.Neoreklami)", "value": "008fa09c9e45e174c4243a1a897aad3a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385326, "uuid": "93cbee79-41ed-4f0d-be7c-97816de55d9b", "comment": "Malware payload (Adware.Neoreklami)", "value": "46ab9fecfe6e235c694b8f47d17e35270113131be69b21ff7c6baa0f53b44303", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385326, "uuid": "c8edf4f3-3a51-4877-8d5f-cabe9d3450cc", "comment": "Malware payload (Adware.Neoreklami)", "value": "dd52923cfb1118629391ea1391cad19e8e9f65df", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385326, "uuid": "07d348ac-a50e-4be9-9509-7b88ce0cccb1", "comment": "Malware payload (Adware.Neoreklami)", "value": "f50a7c35bd0d54e0e1708f8e37a3ed7ccc7328f34bd16b8afa72df3393b3ffe289fc0333af4e4e81cb6e213a0dfe6073", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385326, "uuid": "c6c5957a-36b7-4a09-af8c-9b4200577b74", "value": "T13F7633A978E1CDFEF3041271A6901ED861E9E22D5E25C9B3E3C8D198373D9C1EF22915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385326, "uuid": "605a644a-38c5-428c-a572-849fbc3d48cd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385326, "uuid": "5fa4a49b-c1fe-4d13-bd7c-0bd415fda212", "value": "196608:P1OVJX+9bIuLEvqBGEtEqFGQDVDA/0pEhsJR7SOwc:tOVRoUVvqBGyE83DS0BR7SOwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385326, "uuid": "41107454-4c6b-4527-ad60-8aab25bc0fd6", "value": 7506540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385326, "uuid": "2c1a21c2-17ee-4bbe-9b84-db7d796c4e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385326, "uuid": "c8b8d408-03ac-4167-905b-03f69d2b8849", "value": "008fa09c9e45e174c4243a1a897aad3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe587818-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334339, "uuid": "7b66d733-223d-482c-a266-d6662f83e062", "comment": "Malware payload (Mirai)", "value": "d2e297746b312617f56243919157f070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334339, "uuid": "165da18c-a91d-486e-8998-bdb1dedb20f3", "comment": "Malware payload (Mirai)", "value": "46c352fbd5875972d5eb9764a8a88f0db7e9d0676330b6173329f7c6ed6d1eb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334339, "uuid": "33cd68e9-1c83-4964-90b9-47e561af7b3b", "comment": "Malware payload (Mirai)", "value": "dc11d63a12679e9f0ba5303abdec6026cfd6339a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334339, "uuid": "74197529-7a10-4c60-9eb9-75d644ea0e91", "comment": "Malware payload (Mirai)", "value": "d26d73a2070696999cf1960fb26976422bc1bd92e939f9671d367a68cec256a11bdc661ebd9dc8c98370ef16902e2f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334339, "uuid": "d7e7fa93-2730-473b-a171-2f660f498a70", "value": "T19E930781BCC2DA1ACAD423B9B66E228D3362B7A9C2CE7217DC505F1537C661F0D37A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334339, "uuid": "52e53505-8e7a-45fc-a4c4-bd9cc11df8f4", "value": "1536:kSTUj3pPQ6BI2obmezVWeXPRjt8/ty5uymk1rzAl+YJLj1YWVCwWzRO:kSgDNQ6BITbRzV8ae3JLNI1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334339, "uuid": "3b217660-1504-4dc4-9a95-328a71fe92d2", "value": 92544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334339, "uuid": "6392e6d9-82a7-414e-8f8e-1afc21a3d6d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334339, "uuid": "16d976ea-114d-45a8-b9cc-cbfcfb1cd399", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46213ff-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385405, "uuid": "6b9cd138-3734-43c4-a29a-4deef7e2188b", "comment": "Malware payload", "value": "2177e8d10355513ee5323582d86ee83c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385405, "uuid": "99cab04d-8820-4309-bad1-65c7f140a8cf", "comment": "Malware payload", "value": "471bfc94922e8f6e1ac63c58b5a31e81e278e6550dfb4fb0314f4d29db0ef1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385405, "uuid": "a76ef229-00f7-4d8f-a4d8-c976e5232c14", "comment": "Malware payload", "value": "ca4d363c3cff31bd50d5cece0895ffeaeb55cca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385405, "uuid": "b62fbeed-4a55-4fbb-80c6-eedb1e51712c", "comment": "Malware payload", "value": "4d45974952a669b2c7ebecd4d1536e6b703c8ca477a3dbead2c7c1813ecae3825b876e15037688b3c04fa3fd08cefed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385405, "uuid": "d9c8456c-343f-4384-8cb5-1ca94180cca0", "value": "T1BF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385405, "uuid": "8652570b-7c3f-4e2f-ac46-2e7a3018012b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385405, "uuid": "b4b8e2d5-7d56-48cb-910a-04c9494af445", "value": "98304:asT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:32w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385405, "uuid": "b95cb768-2a69-495d-b7e2-82af240b6386", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385405, "uuid": "86406eef-4dbb-4280-a50d-4194f514e3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385405, "uuid": "fb11dc86-65ff-4202-99c7-67118cd8047e", "value": "2177e8d10355513ee5323582d86ee83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1063effc-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385479, "uuid": "adabd4f7-44d7-45f4-93ed-a509987d21c1", "comment": "Malware payload (GCleaner)", "value": "43c38d84870779aed806c48468c88722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385479, "uuid": "517f74cc-b9f2-4478-a395-02fff218df0f", "comment": "Malware payload (GCleaner)", "value": "481e9f20f429f44de3c46a559418afbc10dfebeabe155fca30cc3e0240b9113d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385479, "uuid": "9854fc29-1977-4e8c-86aa-9c3f8cae232c", "comment": "Malware payload (GCleaner)", "value": "500f559c475cb48ae2ba699dcf4e6fe548f5ee2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385479, "uuid": "b014f062-396c-4f58-8e42-c96c61db0c87", "comment": "Malware payload (GCleaner)", "value": "ffcd91122dc5f76824d7d55e2793e239d9efd24779921ffef4f0850ec6320349648e8bb4c67412af8794dd93ce2a42e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385479, "uuid": "b36ded90-2fb3-432c-bc25-ee83f94018ca", "value": "T19F16D070D9908C36D1AA39FB79778FAC142E6B03F86918552E843F5712FA1C36B4B487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385479, "uuid": "8c8b9e74-9269-448e-8772-768f309a1dad", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385479, "uuid": "50632c8c-bda0-4149-a925-27146aa7eca7", "value": "98304:mUzNgPi1sbO88Fs8RBSv9dHEFdQVbij+mUmpNJA:ZWYgTqs8RBSvSuYb9bJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385479, "uuid": "c58a34a0-aa8e-4e1c-b9f0-8bf9789a53fa", "value": 4069136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385479, "uuid": "dc25790c-0761-4629-9a57-271ef5151c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385479, "uuid": "41ffe17b-9f2a-46ea-a54c-393961be4520", "value": "43c38d84870779aed806c48468c88722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50bc042-e77d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767318807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767318807, "uuid": "918031c2-f39c-49d8-9b0b-6d31b6aaa137", "comment": "Malware payload (Mirai)", "value": "68a2096d47943b1708e1931d33c96da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767318807, "uuid": "cbdad6d6-e58b-4f7c-b0f3-6195f05f6f05", "comment": "Malware payload (Mirai)", "value": "486727c0b06833a51e5ef7a7ff15734be8dbe443098683fcc8b05a1f5ecb51ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767318807, "uuid": "f1e9900e-0a3b-4fca-bd33-5f7ccf4889d1", "comment": "Malware payload (Mirai)", "value": "e1fba93b83ba1abfe570266889907271723e3a2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767318807, "uuid": "a2120401-b16b-458c-b8e7-2fe68aaf398f", "comment": "Malware payload (Mirai)", "value": "12021e963509cf761ecd0262ee53d46555ec4aa73ccb2e2493e753006177d6e6fc9f6763aadcaac9e479eea768432e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767318807, "uuid": "0072b9c4-99b0-4f3d-9ed9-3df9c9a323ca", "value": "T1A663F64AFD819F15D5D525BAFF0E528D33535BA8E3FA72029E146F2527CA82B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767318807, "uuid": "82e659e9-485c-40c2-b17b-45f5f2c4e770", "value": "1536:iBnOQvTq43bqQsJIu1Hwe8+6ydQXhK0Mm73sglF9lLoicLNt5HXBu+7RL:NQvW42QW7Hwe8+6y+xK0Mm73s4Kt53BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767318807, "uuid": "f7de9335-301c-499d-abd3-c160822ddc6f", "value": 67696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767318807, "uuid": "32c82866-95f1-481f-bf99-cecf576e0762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767318807, "uuid": "f387f966-3c68-43b6-a5e2-03fe3d21ec1c", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29c841f-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385429, "uuid": "563a6c87-5478-45bf-8b1e-4bb68e129eae", "comment": "Malware payload", "value": "267efda1dca1016d9a03062a33993daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385429, "uuid": "dd7308af-b30b-48d0-af57-a634665c45a1", "comment": "Malware payload", "value": "489e138d27c1acf4a62f1d9cfada948b7bf18c2122e41625994daeb25c840877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385429, "uuid": "008ca036-a656-4004-8fdd-e2d87b4581a8", "comment": "Malware payload", "value": "19b88c6eaa70f59d2f8ac26510c5f4853d23bd02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385429, "uuid": "2ec1218a-f50a-4341-888e-762a424a2c81", "comment": "Malware payload", "value": "70e0e4e1d11fea0a2582139f1839c2384ac0e26ac0b848eee30e3022fa2484fb90f40dc7fe9468fa6f6718d25cabac1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385429, "uuid": "cc046fdf-60c4-409b-81e4-2a5e3145d7c4", "value": "T1F50633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385429, "uuid": "5f827ea5-04ca-4906-8ca1-b43b89e89cd2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385429, "uuid": "236c087c-aeda-4ad2-9ddb-e25e96968c65", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:i2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385429, "uuid": "8b0dbb41-75da-49a8-a5f0-e6bc59164a1d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385429, "uuid": "bbbbe4f5-5740-4648-9647-d2161f210e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385429, "uuid": "f00b4be9-7a68-4dbd-835f-cb2b2c1fe7f6", "value": "267efda1dca1016d9a03062a33993daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b65ea2-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385671, "uuid": "d7ace4ef-a7ae-43f3-8682-2f2b7f217490", "comment": "Malware payload (GCleaner)", "value": "8010fec1769e77ebe9cb5064b2e58f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385671, "uuid": "b078f511-aa5c-4b86-8afc-7b3b83187847", "comment": "Malware payload (GCleaner)", "value": "48a6bc4b29b75e76ce48053dd95ba810cb2b056082f0868fcf927a5e3663f5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385671, "uuid": "8beb4f5d-60bf-4b64-b2de-f4c1a272941f", "comment": "Malware payload (GCleaner)", "value": "218968bb4cb033518ae05335fbc6c43ef2540f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385671, "uuid": "ca472539-4798-4fd8-b2a8-af5e5eb362b3", "comment": "Malware payload (GCleaner)", "value": "87658c6302ed62125b7808db40956138d153da6e0be49b330503104cca201abc4d8e44eac2463b118e39c8d7bf25e4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385671, "uuid": "05d9708d-37fc-4f83-a704-6925c46ab0c9", "value": "T15506DF15C8E10CE4EE36CA3EC472C15610D8A5B8543C5C5A77A4EEB819BE7E0ED392DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385671, "uuid": "4f8e295b-44ba-4aaf-b725-4ec227751e93", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385671, "uuid": "24da84f2-a4c0-48b3-957d-37c618802d78", "value": "98304:qXAcrZjUqwh6EtUAHM20sW9lXjhDsWQdIYn++++/+uPO+++j+++q6++/++S++++a:q5fwEsA28vhDsHdFSxbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385671, "uuid": "50bddb22-18cc-49cd-81e1-d51c5844d15a", "value": 3832080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385671, "uuid": "c3581ddc-2209-43ca-be81-dd02e3ee9567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385671, "uuid": "6738c1db-2681-4abc-a112-b510352f2d13", "value": "8010fec1769e77ebe9cb5064b2e58f08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4021c0f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385780, "uuid": "9b62c9f8-ec41-48d0-9a48-c19903c3fe1e", "comment": "Malware payload", "value": "9d955859fa5c1f288ff8a3fd5c4b426a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385780, "uuid": "b4519559-b470-4670-bb32-013f61ce7efb", "comment": "Malware payload", "value": "48ce24e46efcf40ae868b6e95b134718b07c57005afb2248c6a3d999a6191650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385780, "uuid": "ba4575a3-25ca-44c4-b2c3-a76b20495b21", "comment": "Malware payload", "value": "4785371527f4b749922f72f28888f7200aa8aec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385780, "uuid": "3963a8cb-86bc-469a-8346-74b2f67bc747", "comment": "Malware payload", "value": "75316a4e6400aca7378a552e19abd7efb0838b4f28ef7d94363aa6da0240ebe2a849603876f17317efbf2ffa28ba07d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385780, "uuid": "4f3fe5d1-2824-4986-b6c3-00b0e3c1a491", "value": "T1C70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385780, "uuid": "2b5d456b-ff34-48b5-af7c-631330e34d50", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385780, "uuid": "fecb2763-3759-4427-8bd3-1a62c3d97a5a", "value": "98304:awT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:j2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385780, "uuid": "c7064004-6ada-45c5-a6fb-c9e23aec2951", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385780, "uuid": "fdc7dd49-2faa-49a2-9a21-50e80179375b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385780, "uuid": "b0ef1d6c-3b74-4102-bce9-d266a9af908c", "value": "9d955859fa5c1f288ff8a3fd5c4b426a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663830ce-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393354, "uuid": "e18b55dc-dd15-4fd5-b1a9-5803632173cf", "comment": "Malware payload (Mirai)", "value": "8d26f6dfb96beb664770d6a6c5d1c0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393354, "uuid": "0ff56663-9aea-43dd-8ff9-db8bc217c8fc", "comment": "Malware payload (Mirai)", "value": "49628d6dfab99a870e797a49fb4a616206c6f8810de43e03d2b704b9c46c9b23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393354, "uuid": "ff7cdc4a-4f79-4470-af89-911d81ea6b03", "comment": "Malware payload (Mirai)", "value": "4aa412d46dfe2503c5a9320caced88838e97ba66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393354, "uuid": "fd6b4d7c-e772-4d8f-8e36-d4f6cfcdfbbd", "comment": "Malware payload (Mirai)", "value": "6b388676549e79edc0f4e1dc9012e06298cc3902c530806cb104b69dfa8f275ac74bbe8265db268de0813d4e26177ed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393354, "uuid": "a6e90364-b13a-47f0-bf10-fb947c047d2d", "value": "T1E9D35AB6CC262F58D965E5B5B030CF791B939954804B1FBE14ABC2748083D8DFA1A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393354, "uuid": "76e5b52d-f2df-4295-ad0b-797d7d7248c1", "value": "3072:LGAnHhEODAsWLGtW/pBoRc1QW8PmHRHm:6AnXCLGY/z558PQHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393354, "uuid": "322700df-7249-49f6-a2e6-a2e86e8ed5af", "value": 137916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393354, "uuid": "cee5d60d-79d3-40a9-b756-0f8b8d48b1e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393354, "uuid": "1d8490f5-1bc5-488f-ad4c-ac2775e7039a", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7fbf5f-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385370, "uuid": "6e348fe4-1493-47e3-b31d-d731c00d4ef9", "comment": "Malware payload (GCleaner)", "value": "123910eca8a6e0aba2f5a49ed2881790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385370, "uuid": "b9d8521d-c916-4b52-8656-ba213f6e0dfb", "comment": "Malware payload (GCleaner)", "value": "497a6d9a13a4fd2a406310095baf31eb4f241a5c367864422db7dd01816ffacf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385370, "uuid": "f0d91db8-2575-41f6-b969-88da0b18d676", "comment": "Malware payload (GCleaner)", "value": "a8479b047109f8747b4bd54765eb1af149fa927a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385370, "uuid": "77004d2d-a1b4-41ff-86eb-aca856b5a0c3", "comment": "Malware payload (GCleaner)", "value": "dec1bf697750ccf51b62ae973cd4cd36929bf6f9df2dd712db7cd7782398bd7c0e835775db478461d8b3c9ad85313551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385370, "uuid": "489bb25e-d085-451d-a65e-a8fe5be95172", "value": "T16F26CF36D899053FD2B750BB8D72D93E761E1C32E2153E3A2AD3090E5A2D903D63B917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385370, "uuid": "dea6b032-f60d-4d36-86c2-7b16c713cf2d", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385370, "uuid": "2b9aed2a-623f-4550-8847-a89a77b60ea3", "value": "98304:0rSWkX7CEPnOZEhuiO/w+Xk85XodqHKSL:MuL1OauJfgxSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385370, "uuid": "b459d315-a693-4192-a9f5-0a3b241b0298", "value": 4592400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385370, "uuid": "703545ae-4e07-4a1c-ac23-a4c7bd9eae3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385370, "uuid": "9dfa2190-df40-4f0f-a10d-1ad47ebf8639", "value": "123910eca8a6e0aba2f5a49ed2881790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b047273-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385604, "uuid": "2d274769-7055-4660-a04a-eb4b7abe5817", "comment": "Malware payload (Adware.Neoreklami)", "value": "6c96c51cc19dd03af7b2b25c13125491", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385604, "uuid": "8c6a8fef-a1ed-4136-ae5b-96d17cb33fcc", "comment": "Malware payload (Adware.Neoreklami)", "value": "497bd26835d83f50193ae937e859bb908a54fefa5c5c888e77801e0d4f9ceb00", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385604, "uuid": "f3d3c9c3-22c1-4394-9c44-750321683029", "comment": "Malware payload (Adware.Neoreklami)", "value": "74782ad024a2cbad55f6e159d35d9744f8c97efe", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385604, "uuid": "d6b9946d-ee41-408a-94a7-5b9bab885ae4", "comment": "Malware payload (Adware.Neoreklami)", "value": "6b86049b762b0f8ae425329bf47085abb4a47986342d608e9b3e66c470c02361abe618a707805df7d9a9527691a4ec27", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385604, "uuid": "0c4a357f-ab64-4c80-be80-6b3ffe52d373", "value": "T1EB7633303ED14071C2DA6D3B4DA0CDD5D49AEEE8272E5DDB53284A1C1D3DCAAF60D68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385604, "uuid": "0294fd2f-da2e-4134-bffb-fc3c618e225e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385604, "uuid": "78e464bc-46aa-49bc-b8db-f5db261093d5", "value": "196608:P1OsMhQq+4G73iU+ypbGrgdD4ow9mrwowNXME2PqcNvdhnWw:tOsWQqbbnAdElMwoi83PqGdhnWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385604, "uuid": "2d2e83f3-c166-4189-afdb-4f3bfedb375b", "value": 7503260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385604, "uuid": "90f91ef7-763a-4916-9b58-1bc2ba3ce1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385604, "uuid": "4011ebda-e5e5-4298-9cc3-ffcf0953a859", "value": "6c96c51cc19dd03af7b2b25c13125491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17470f1-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385373, "uuid": "c8bd3f0c-93e0-4f00-9b41-3310ab1d3a51", "comment": "Malware payload", "value": "13e52b47abf9dc882896d45f6080ae8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385373, "uuid": "2c88c479-2258-48a4-a52b-5de647eacc53", "comment": "Malware payload", "value": "499d508d103c188d5a14c93e0a3a40598a8e8321f21c454481a2eea530057ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385373, "uuid": "a8fbdf04-93cc-48ee-a6ee-b7bae426d4c1", "comment": "Malware payload", "value": "2d6c723497932f0caa7f2b4f01cb55933c9d9557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385373, "uuid": "b546a60a-9007-45ce-98a1-2080824ad851", "comment": "Malware payload", "value": "9af7dd2e6578d5c3c309399cbb54d12a11114f006d7ecb4c641aa7cf79582ea0bba69c3fe1ca132d9f61c989a87a6674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385373, "uuid": "ba55273f-1bfa-43df-8a09-902f235e39db", "value": "T1B70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385373, "uuid": "94f302ed-d51a-40a9-9b1b-93f691a2e591", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385373, "uuid": "fe2351db-62a0-4726-8f71-338904793418", "value": "98304:awT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:r2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385373, "uuid": "c074f4e0-f82c-4793-afe0-9acedf96dd27", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385373, "uuid": "cbc412a4-2ee8-4b3d-aafd-4868f4b667f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385373, "uuid": "375fc919-d2bc-4071-9448-67293cf48191", "value": "13e52b47abf9dc882896d45f6080ae8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c028c6cf-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377613, "uuid": "1fc08ca1-dac6-4b7d-a413-5686fdf22caa", "comment": "Malware payload (Mirai)", "value": "074cd75f42d84ac94f892d78537f918b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377613, "uuid": "532d3fce-69c4-44ce-b88a-e82b7cc43f55", "comment": "Malware payload (Mirai)", "value": "49cbe5c8b4d9436561d01e804ff8db63af0f9750f9a15bc2142551d2e865cbe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377613, "uuid": "02d62559-8ad5-412f-ad28-a14c21d8c806", "comment": "Malware payload (Mirai)", "value": "06e218271e96159a77a9809cc802be5130de884d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377613, "uuid": "55dee60b-bafc-47c1-8ae2-34e768dd59ac", "comment": "Malware payload (Mirai)", "value": "6e1b66ab38a60916773a7025bca91a43e15ae90fe4e6bf37a6aed4f8ecd4c90d961492bc843704da81d80c88ad977bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377613, "uuid": "e82130dd-4bab-431e-bca7-6f306c51fe1b", "value": "T10C836B22657D2B1AD1F0B47612778363B1E52A4D0194DB9FBE764E4FFF212801E2B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377613, "uuid": "6ee608b4-512d-4ce7-bd7c-6905fb2302f2", "value": "1536:Bwg/lO4AMOpEQF1NuCLN9j+CnAeRxsQA9EvIOfMZFOvv4xp2T0TWme3rkNsaabvW:OgtO9/EtxRZEB1i3fmSai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377613, "uuid": "c87f615e-ceee-49ae-bceb-11cff226a477", "value": 88692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377613, "uuid": "0cfe50e6-215e-4b28-aa8d-3f3cf93c8d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377613, "uuid": "54ebf367-5e4e-41fd-8b8d-cd654461f53d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37211ddb-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312530, "uuid": "58e88136-a34a-4f8b-b672-44bd96bd9320", "comment": "Malware payload (Mirai)", "value": "cb687bd8bd2f744507b6b43f91e6e8b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312530, "uuid": "223b1f34-667a-4078-b459-73d465640ee6", "comment": "Malware payload (Mirai)", "value": "49de83b748fda1930baa7548982cf4f682dc7b21b2b7050eea1af3f0cd9eb8d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312530, "uuid": "c4223474-d59d-4c18-b02d-be566a7bfd36", "comment": "Malware payload (Mirai)", "value": "d9fb05b26053f8f80e3f505689a25d6687c88d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312530, "uuid": "c7a7ae7d-588a-4a2e-ade4-a52a8bc2d1f8", "comment": "Malware payload (Mirai)", "value": "331f216f8608cce5a86a613c86cf69cd7725b56e5ea3bcc4a7067c41faf03adb8724ae95c6f60eda5260621bfe0b46bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312530, "uuid": "175ee9a4-0ad9-4ecc-a9d0-7e663e82e325", "value": "T1E863E846B9818A26C5D512BFFA2E51CD33276778E3DF73129D106F147B8A82B0E3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312530, "uuid": "4e9801d3-0d64-47e6-b0e4-b10f762ceee5", "value": "1536:aRnoLB6viUByuPqgHhSsoEeHweGL6nRiVhEmPyIAiOTpd/LK6uM7RI:FoimSuhSjEeHweGenRiVATpd/LK6uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312530, "uuid": "bf6d3f98-c06b-4e96-90fe-1b018a4d9623", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312530, "uuid": "53ede52c-da20-44fa-a016-fd7d9e5d08b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312530, "uuid": "4adba31e-f27c-43b1-9dab-f6fa663a02a4", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204e658a-e7ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338261, "uuid": "e92aa4c3-b64d-4e90-9685-b4ac3aa3b40f", "comment": "Malware payload (Mirai)", "value": "480bb94d49d00ad55766032137f91e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338261, "uuid": "9bb7785c-69e1-4643-8bbd-437705c3177c", "comment": "Malware payload (Mirai)", "value": "4a4a358d1f5ff70f1c07f272ee414b9cb27df53bad3e0d3a9f5958b466d2cc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338261, "uuid": "a7669994-c49f-481a-886b-8664b2e9df08", "comment": "Malware payload (Mirai)", "value": "1e5edac4bb20b617247ad1159cda6afd508a4acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338261, "uuid": "087756df-8822-4f7d-8f57-2b59f85f32d1", "comment": "Malware payload (Mirai)", "value": "22bd4e8c4d48ef88c7aa077c90e0ed292ba5f91a33a41f20ebfc57fa60c4f4ecab61da2b04c721b1029f4758714647fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338261, "uuid": "f5453bf0-818a-483a-8580-a53afafbb1b9", "value": "T13393E71BB9829F01D4C631BAFB9F41493353AFB9E3F931119D24AF9023C69DB0A76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338261, "uuid": "3f5a0912-95bb-4711-b95a-1a39499350be", "value": "1536:jvnMJTNA/TWpeQzHNlja9ePHDUvmRUzgllv2iE6FUvjuYkunSW:gTC/apeQrNda4PHDUvmD86FUvqYnSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338261, "uuid": "8c2c9bfc-6b03-4f18-8ab5-82f6d8e9a682", "value": 91580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338261, "uuid": "3ce36dff-18d2-4c73-ad89-7512d276e6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338261, "uuid": "f7993c58-cf6d-4d71-8f5c-d38c19ea5a98", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d256f117-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385804, "uuid": "0eeec0fc-84e7-49b0-8402-b81bde28865b", "comment": "Malware payload (GCleaner)", "value": "a2da2ce3850163d5adce5642414b2683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385804, "uuid": "d8d0e44d-a1db-4776-aadf-bdefc5e3a0af", "comment": "Malware payload (GCleaner)", "value": "4aad1271875e321592f7c1912637d4437e74e53bcc0060fde430dda063d0da16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385804, "uuid": "14578b6d-f290-472e-8a9d-2d476a06f608", "comment": "Malware payload (GCleaner)", "value": "6f144a88619379267508b5785b453adfd4ca29bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385804, "uuid": "db39c415-372c-4aab-ad2e-9b5bef01a1b2", "comment": "Malware payload (GCleaner)", "value": "5069c226502638254053f8718d38e29cc4338aefec976d6b33ade4eaf66a038066f19a4126551d16da621fa9dd2b2c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385804, "uuid": "6256d989-ab33-4fb6-bff4-ba032e0f6848", "value": "T1F916CF63F9D58B36E3B676763A011C44483AAC49EE1CEF457E744E4B2B2D58320726F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385804, "uuid": "3a0a4894-ef82-47c9-a804-8c79bfd5f241", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385804, "uuid": "9f6f7a43-de98-47ca-af7c-d9bc0679762f", "value": "98304:BXAcuCk/XEbJRK59c6OOodddC5XR0ea0i:BWCk/U9AfcvdddCN/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385804, "uuid": "3251246c-eb8e-42c2-815f-58dcb33f7b15", "value": 4231440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385804, "uuid": "4cfa81d8-63c7-4687-bcfa-7f9848f9882d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385804, "uuid": "043292e1-d999-4760-8614-7862c69613dd", "value": "a2da2ce3850163d5adce5642414b2683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c7108b-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385775, "uuid": "2a033a80-173e-4c67-b33c-79f6a80525d5", "comment": "Malware payload (GCleaner)", "value": "9c946a17f2a3a7bb3a6038ca4d17a7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385775, "uuid": "5e16fb31-8843-44fc-9c1c-6076a8f54800", "comment": "Malware payload (GCleaner)", "value": "4ab057c4ad4198bb73ffe285e23f4e9a38e12aba4ab478af75376351821e2008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385775, "uuid": "7a033b45-8f66-498c-be8c-839b26975350", "comment": "Malware payload (GCleaner)", "value": "7aa5b350732764a09d66d1874835684197a3fb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385775, "uuid": "a6cca76a-6df2-42d6-ab0f-236681bf5cf1", "comment": "Malware payload (GCleaner)", "value": "9731493668d12b7b84e5fc1ef97870d5218ed7a9f2f8bd74c1a37aaea9779a00314967a1a821c7702ee9e99665bdd5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385775, "uuid": "68e3b9ba-7848-400f-b1e2-d6ad065afdb8", "value": "T18B36E0C3E7E6A8FAC03F1E3A591623D56D6CB9B2F8240731DE691B7A5E38151D429033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385775, "uuid": "52dd4baf-16ea-4b2b-8de6-01bc7144f4af", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385775, "uuid": "2d9b8b8c-6e84-4106-a7ca-90f5b590e2de", "value": "49152:PnZJCU1CzdQt/3kURhTt+do6S2TsAlz4OzxaMH1ldRdEUOwCmYH/lwOvj7yEd82:PnXCU1CzgNYDtDZpL5DAlwOvM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385775, "uuid": "bc4bf340-b54a-492d-adf0-0a58831b5b44", "value": 5249296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385775, "uuid": "68576c68-c5a2-47f9-ba9e-38f0f52a6434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385775, "uuid": "552fdb9b-b5f4-4502-b022-7c74dd36fb98", "value": "9c946a17f2a3a7bb3a6038ca4d17a7e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5656a7-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385611, "uuid": "c579953d-5e78-4edf-8769-4f4d10e52b73", "comment": "Malware payload", "value": "6f07cfcb9c571a7800113a70cbc0a0ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385611, "uuid": "e5c0e2a1-1b3f-4759-bddc-e2380a082807", "comment": "Malware payload", "value": "4b479ded11ce8e1464e8553edf295a2fe36f0c88b8cf1487de3b941a0e4e5457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385611, "uuid": "d422d0b0-f2ee-498f-84aa-8ceb7dbe1188", "comment": "Malware payload", "value": "846da758a54683b6f5c2db3bc09d57866f0f2bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385611, "uuid": "3c4bb85d-4883-40bf-98b4-2dc9a7935567", "comment": "Malware payload", "value": "9217f132e5b6d71177776e7ff9fc70ccf44afdf6797367839c5349544c1009e375f0c8978d054242c4dcd1d622125683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385611, "uuid": "0dc410ef-8f75-4096-830f-c1da547a44b7", "value": "T1010633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385611, "uuid": "50b1bd60-acbe-4d51-b778-667106bfe9f4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385611, "uuid": "2d7f5f3e-981f-47f1-b292-0ea5489784be", "value": "98304:a+T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385611, "uuid": "c2614df5-cf14-4d0f-9af1-82452dc3eef0", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385611, "uuid": "9b11e114-a4b4-461f-bc37-5dbbf41aeab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385611, "uuid": "de61400b-52df-40fa-bdb3-1753aa99b779", "value": "6f07cfcb9c571a7800113a70cbc0a0ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d23d5f-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385409, "uuid": "1574577d-10a9-4ada-be96-302222113029", "comment": "Malware payload (Adware.Neoreklami)", "value": "21ed78a866bc543552e6cd6ff08a08f5", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385409, "uuid": "99c068fb-408e-42e6-bd02-6b841d133602", "comment": "Malware payload (Adware.Neoreklami)", "value": "4b6360f78c4ee03c9aad0e6ceaee11372806e2844f11076f60d45123673efb86", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385409, "uuid": "b8011dd3-dfdb-4375-b61d-b2896ff28f76", "comment": "Malware payload (Adware.Neoreklami)", "value": "78c7c7d4af6f8b0b2b6c08fd0ec2639205351c8e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385409, "uuid": "e7be3b50-99d5-4c98-a085-c3b353cca224", "comment": "Malware payload (Adware.Neoreklami)", "value": "137bec35f6ce488f1c6bf05405365b572662a21ef22f95be8b48e7b85f9cdf12e0b64ca871435bb56b984b27ff1cc7bc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385409, "uuid": "874334cb-47f1-476a-a299-b196f9a56772", "value": "T10D76332A31E2D47AC25317B6EC6017EE2596D28D0E31998373610C8C697EF9BD11F2F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385409, "uuid": "71fd3a66-d8d8-448b-8b7d-5fa6181642fa", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385409, "uuid": "d75c19a9-0ed8-4eb9-b79a-a730a60166ed", "value": "196608:P1Oo3elgVoYwf29lJAdHdvsauHizLIEPBjuniLJI1rIJhk:tOo3eu3hvuGHckjiLMrIJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385409, "uuid": "d8984fce-c764-42dd-96ad-790d1edb3f59", "value": 7570461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385409, "uuid": "d8886f15-4ff2-4405-b5f5-70ecd37abf52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385409, "uuid": "1d5ef80a-72e8-4573-9a77-5cee63ca43b6", "value": "21ed78a866bc543552e6cd6ff08a08f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bbc587-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392385, "uuid": "b54eddde-5edc-44d8-9f5c-1a8df2752cc8", "comment": "Malware payload (Mirai)", "value": "992b4ea04a07223fe7e8f7633ba1cf65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392385, "uuid": "8b51c33d-7944-401e-a658-a833f0831d35", "comment": "Malware payload (Mirai)", "value": "4be112635bd07a1a6a0ad20aaac628f2d0814eb4f31f70a2b2028521f61b8457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392385, "uuid": "b4aeefb4-10d7-4234-ab20-dad162da171a", "comment": "Malware payload (Mirai)", "value": "5396e95ff5e7e21820c2203345c8f19bf4cd231d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392385, "uuid": "f852e34f-b919-40ff-90af-a6be5b0c7b84", "comment": "Malware payload (Mirai)", "value": "a22e42e96f487471cf7132f5400df60e02e9194b14d50d6de6649673736d09f3f08603a4ebd8cb0d74fef36724a7eee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392385, "uuid": "f2a0dc22-e541-44eb-a172-246abccc64bc", "value": "T170C309567711DF72C26DC1300AB3C75667EA2AE626D18509F36CEA0C2E71349681FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392385, "uuid": "b8705d7e-c0d8-4392-9ff9-1cd728788d31", "value": "3072:sYG/46PQqL6PHrHYtd2N/Q9/FzB/lAjPA:NtPHEf9/vNWPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392385, "uuid": "d5583452-adbc-454e-a675-373f1e0afc50", "value": 118792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392385, "uuid": "7eaaf167-a43d-4e01-a4c4-c43387566466", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392385, "uuid": "3564d584-0099-483f-8f45-8080285ddd7d", "value": "catgirl.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47eef7a0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385572, "uuid": "128c5f45-0071-4087-a02f-d0c5342bf3bc", "comment": "Malware payload", "value": "63ed0ec506915fe3344888ee450f0717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385572, "uuid": "c5334ef3-4c54-4ee3-a567-6360de599aa9", "comment": "Malware payload", "value": "4c761a40c0127f2d2cb54886089f05b5d5cdef82e04b255d5ddaba3406479cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385572, "uuid": "f968f1ff-e2df-402e-ace7-2917bfa7b74d", "comment": "Malware payload", "value": "8bc55bd20a0328231f4796bc8c5ba0e31df98630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385572, "uuid": "28ff904b-bcd5-4057-a0da-5fc5464140dd", "comment": "Malware payload", "value": "224bd624fee402de2c2903cb118016774cc02680432d9bede108dc7ab2979a8bedb62cc0539c1cd694ebe860c7f1c4b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385572, "uuid": "2ed0d8d3-36e4-439f-9011-a10f75e3b951", "value": "T14F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385572, "uuid": "160ddc16-880c-4dba-bd9d-0aae315e501e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385572, "uuid": "f925caae-9705-42cb-9be5-9bacc89d5fa8", "value": "98304:a2T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:J2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385572, "uuid": "0ae6893b-71a5-463c-867d-82fa7bf614be", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385572, "uuid": "920651f9-8d2d-43a5-9d62-bf2289839cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385572, "uuid": "0416ebea-337e-44fd-ab6f-c032e5327480", "value": "63ed0ec506915fe3344888ee450f0717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f86a8aa-e7a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336569, "uuid": "3fb5352d-1176-42be-af00-38afd4da041f", "comment": "Malware payload (Mirai)", "value": "8bc8df0506422fca2e6cd9b9693f908a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336569, "uuid": "c2cc99c7-2a8a-4147-b0dc-079887df9435", "comment": "Malware payload (Mirai)", "value": "4c8d0e913ea4e9a964d247f5710568172d8086f5644bda67afcceb7caa4ea07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336569, "uuid": "516f266c-0035-497c-baee-5d5f6d3c39ef", "comment": "Malware payload (Mirai)", "value": "ff2357dfeb21d573d01d5da638f1eaeaab9c52f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336569, "uuid": "668a5ccb-5f90-4bd3-9e94-96fea5672e12", "comment": "Malware payload (Mirai)", "value": "fa9957ad422a206b4a8fa446a331bc739fcbf56cfe4eb59005e6b6ab263b18fae4611eda61584249e7d53543a488a984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336569, "uuid": "00c2fffe-5b24-4261-a341-60c5ef537012", "value": "T144D31995BD81AF20C6C625BBFE4F428D331357A8D3EE3213DD185B2426CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336569, "uuid": "2e6a11f1-9966-476c-bbcf-c05703fcb555", "value": "3072:GZvvP7z0wumQBhgrAlmZ+DikaIYT5z1yrCMLPHRYXDAFfnTE:GZ3PH0wfQBIAlmZ2ikaIYT5z1y+MjRod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336569, "uuid": "f5729e6b-7342-4635-ad47-af32c827d0e4", "value": 140848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336569, "uuid": "9ebb3001-9f18-46bf-93a2-86585a1dc2cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336569, "uuid": "61db4400-12d9-4d11-a875-be2c823cd32e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152d978-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385400, "uuid": "393ff3e6-75a7-47a0-8b1c-3890acdf1e62", "comment": "Malware payload (Adware.Neoreklami)", "value": "212351e59f29f0152569e212345aa2ad", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385400, "uuid": "2b2118a1-db30-4828-a982-76aed4edac95", "comment": "Malware payload (Adware.Neoreklami)", "value": "4d449194629539f5acf6f8991c7203292d3afadff12436155ee41846d0546cf9", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385400, "uuid": "d73aea68-0d8f-46b6-9cd5-b0c231d47be1", "comment": "Malware payload (Adware.Neoreklami)", "value": "e8fbe3ab2d6d01e76ab0e95dedfd214bb2826285", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385400, "uuid": "107093b1-5dc7-4a0a-b4e9-8501ecc1e9bb", "comment": "Malware payload (Adware.Neoreklami)", "value": "f568cd5da4ab3204c0fd1cc2b33aa04c1ee61d8fcd55ce0a1ca9143b2ad470370bed767a310df7760f010fa45db7baca", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385400, "uuid": "14080413-a591-4cd2-923f-222c4540115c", "value": "T152763311BCCA96B7D9D64130C0BC5B82B2E8D0A04F315D1767EB25694FBE5C6B2EDC22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385400, "uuid": "1fbcefee-349b-49c4-94a8-4a2bb72737d0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385400, "uuid": "802dee1c-99f5-4364-bb72-54c24a9ad420", "value": "196608:P1OgOCV9XZS9K25ccMPEkITcXT2iWOVfYl6YnfRdJ3MuNht65:tOqV9SKoEEkCDiNNYlFZYAhtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385400, "uuid": "37b1e583-f4c2-4ae4-aa59-2866ed601865", "value": 7553115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385400, "uuid": "70e1cee6-2ea3-4311-80f0-40bee7c8e23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385400, "uuid": "91d80c1c-8334-4c9d-9681-3079ec0a8959", "value": "212351e59f29f0152569e212345aa2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e3ec3a-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767386072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386072, "uuid": "3949f8cd-f96b-4e78-898e-356c81c422d2", "comment": "Malware payload (Formbook)", "value": "454c0f50b56df85436d75f071927bd36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386072, "uuid": "f66f3583-9743-4fc5-9c61-348b3c5c7174", "comment": "Malware payload (Formbook)", "value": "4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386072, "uuid": "188f6cbe-40c3-4b7b-92c0-715720a8656f", "comment": "Malware payload (Formbook)", "value": "b20c81f00fa0f6f80b345e28317d79672b89d989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386072, "uuid": "1364f171-054b-4e76-a5cf-ad90f303d85f", "comment": "Malware payload (Formbook)", "value": "978b5cb55e7f369216b4ae3cc5b89aa9c613a5c56f2ee838614b8d67666046b2073ef642fd9c5a8b1ec3501f8d36afd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386072, "uuid": "d734bcfd-d7b5-4aa2-bb8f-08fa55ba517c", "value": "T1ACE401D13E396712DDB046319629DDBD82640E683015BED36AED7BDB3BD8310AA0CF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386072, "uuid": "ba44330e-cb78-4530-b20b-ab7b4de868b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386072, "uuid": "8e0be3a7-1c20-4917-9feb-d10e897fec04", "value": "12288:T64LAlkI42tAHOPe8hfxQyH+NlJy05KoZKZ4M7Fv7uUipa5ud2lrWsN/aPhO:CWw555HQJh5zMFz3iNcKQaPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386072, "uuid": "08156374-bcab-4638-bc53-b2c8bf3eac31", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386072, "uuid": "52de73ff-6af0-4adb-bc14-ab9d5123686a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386072, "uuid": "3ec6dacc-0d24-453e-abeb-630ffef6c548", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a86b952-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386060, "uuid": "66455072-9ec9-41d0-a484-99b647b7257e", "comment": "Malware payload (Adware.Neoreklami)", "value": "fd2a333abea1a434170ecdb24ca54733", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386060, "uuid": "9b816034-d87b-4384-b21e-49a499e07b97", "comment": "Malware payload (Adware.Neoreklami)", "value": "4e0843a733d5262e6029180bd74b4b7fdfa65db6ea7ea23daa25fff01ddb3c21", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386060, "uuid": "b232866d-35fd-4bff-88b8-fe4e3295d15f", "comment": "Malware payload (Adware.Neoreklami)", "value": "f8765e6f4c68e1c331a90a003e6c27b7c5b764f0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386060, "uuid": "fd8195a9-bd4e-4d0a-b062-b0376bb9038d", "comment": "Malware payload (Adware.Neoreklami)", "value": "c6dbc8c7f60fb606b80911b325fe5bbb6f9c760b8a6ef8ce4f6d4b9d9dd63e2757b589c3fcc486d7a7daad336578cfe3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386060, "uuid": "5657d771-46a4-4e6e-b5c6-6aeecdb0e421", "value": "T10F76333130DCC8BCD2C71339A258275BF1EAE26E296200579346172A1F77759F762A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386060, "uuid": "4c160964-b679-4a43-9faa-9b3f3c9bf0b4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386060, "uuid": "1c367964-9e5c-4e4c-8968-56d66df4517e", "value": "196608:P1OwhSKgbnAgHq7xBcNDuSGdSCSgSUwOxnzeWpPE5/hLUB:tOwhSjV2jQuSG1lSUwkauPCLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386060, "uuid": "d7f2527f-eb4e-4002-aa10-c5415c577807", "value": 7538379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386060, "uuid": "811968aa-c916-440c-a0d7-97db3a061f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386060, "uuid": "2d3c640a-22f5-4d84-8695-f123910019c9", "value": "fd2a333abea1a434170ecdb24ca54733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b3bd79-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385887, "uuid": "97ceb448-a2a7-48f5-ac25-e367f837bad2", "comment": "Malware payload (Adware.Neoreklami)", "value": "c3a87842a71918b4a252be30f122b5b6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385887, "uuid": "a8f99c01-9100-4ced-8d0b-a697097adee9", "comment": "Malware payload (Adware.Neoreklami)", "value": "4e2ddc3ac7ad655928452d63bca1d987482debcad77ab748a0a865fbfdea85c7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385887, "uuid": "3212705c-3e78-4497-9925-e27133cfcbcb", "comment": "Malware payload (Adware.Neoreklami)", "value": "253e9496df318cc9e2ce89504eb4789888713bdb", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385887, "uuid": "74bb5add-bf98-4121-af10-37ac132641ed", "comment": "Malware payload (Adware.Neoreklami)", "value": "4a458db401b683a072f495db09a3697176762cbacc6ee5847be92129c5550e3078d4460d606d310b65019293e0cb8003", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385887, "uuid": "d4a5fb85-daf7-49f1-82ff-dc76030113e3", "value": "T17F763386B2FCC2B9F55500F2CBB516D4E4BCF7048A629417AF2BCD680FBD651431A1AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385887, "uuid": "aacfaf2c-f099-430f-aae0-1dfd6c5ec26f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385887, "uuid": "2dd2a8ab-9a36-4522-9480-73f738813ed0", "value": "196608:P1O6d25Yk1q6Qh4gSEtHi8/5WS1nJwB6ccJ9tHX5RxD:tO6cTq6qtn8GiX49JX5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385887, "uuid": "59062aba-d2e1-4650-836e-233beb1c5d79", "value": 7554158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385887, "uuid": "11522b56-2f47-4f33-a702-d5b46d0c624e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385887, "uuid": "9eb428b7-fa9b-4dfd-8198-768c5e02e620", "value": "c3a87842a71918b4a252be30f122b5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814e15a4-e7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767366771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366771, "uuid": "52c4199c-9f65-4446-94fa-9917a2209a7f", "comment": "Malware payload (Mirai)", "value": "eb44978f22335fdb75c640b41dcbeaa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366771, "uuid": "ae7bdcb1-d4c2-46cd-9252-1c3f13a06e0c", "comment": "Malware payload (Mirai)", "value": "4e646e589875e569e541564a585f24947150736fd127ac0cb624b2a714749345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366771, "uuid": "ab1e20e1-9202-4eba-97f0-e993beb5245b", "comment": "Malware payload (Mirai)", "value": "54a28a891fd8b9da13d1f97fca9e5d255927b43f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366771, "uuid": "baebcdd1-4bcb-48c6-82fc-800fffaf3ab4", "comment": "Malware payload (Mirai)", "value": "a776f7da26f8141e99a44b00cb1d1ed5159ae23b7d2bf17314b818ff4d1a78a362f7633276f55e6a97af3e8f4d93983f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366771, "uuid": "cae2ee5a-5289-4fcd-b544-7d43fb889691", "value": "T1F57302849668CCE0C7B766F898D09A68120EC5B6C7EC3D67074D400E5BAFC1BDF15957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366771, "uuid": "0ba7e367-8c49-4770-9c30-ed4a4f3e1845", "value": "1536:WnNn4WHZsD7gdc/y0DWRyM9B+Hiz8uJHonU5B69XtKHRr/4PRLQ:WnVTsD7go9M9UizXH/Bk9KHRrWLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767366771, "uuid": "88cf87ac-6855-4db8-bfb4-10d2ff52b6f7", "value": 77336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767366771, "uuid": "4afa226e-6e41-44a8-8d8a-285ddafb190b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366771, "uuid": "53226c2c-f55d-4b26-bdd3-7f9e5868ccfd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72536875-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385643, "uuid": "22d2062b-00ba-4ba7-976c-22377ba402e7", "comment": "Malware payload", "value": "78e987babe268ed601de737086c62817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385643, "uuid": "22d29f97-b807-4852-bdd4-719937a07cf5", "comment": "Malware payload", "value": "4e7d06875bc4a722f342e3a6b1d171efc213e46c92f6a90ec21bddc19c2d5c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385643, "uuid": "cfb7946f-7a79-4af5-a86a-35bd89ce7824", "comment": "Malware payload", "value": "b27b4a2b13826b774a2bed55c44a5c13c9a58714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385643, "uuid": "a73a0872-a638-4453-8404-e6224fbad58f", "comment": "Malware payload", "value": "5df9dc8222de8886f1778cfdac3f7f648ffedb8baa6cb25deb6aa748ff8ef09f9f588f22d27ce7e76f44c53bbcb6fc34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385643, "uuid": "2334b28e-2d2c-478c-a7ed-215aa93139ce", "value": "T19E0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385643, "uuid": "9f9d87db-3d1b-48f6-bed8-3228242e0d32", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385643, "uuid": "e4eac6ec-9f1f-4d5c-bb1c-4a2faba1ce19", "value": "98304:auT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:12w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385643, "uuid": "6b85c1d0-fdcb-4ed1-b0a6-1a9b66389937", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385643, "uuid": "916e5d32-159b-461b-b75e-e8316f7d73e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385643, "uuid": "469678f7-804f-4af8-920d-c6dcb8cfa343", "value": "78e987babe268ed601de737086c62817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec819445-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385848, "uuid": "b5489ee7-a5cc-415f-9ae2-901357783d2b", "comment": "Malware payload (GCleaner)", "value": "b3c2c49f97eb56c63a40ba8db0e37b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385848, "uuid": "5b318c0b-439e-45b3-83e8-a3dcea90d3ad", "comment": "Malware payload (GCleaner)", "value": "4e7e1e4da49b782da39dd19ee348821c27f2cf1aa698e6933fbd278e8ba6ac6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385848, "uuid": "7e86098f-62c3-48d6-8d99-ac728deb6a33", "comment": "Malware payload (GCleaner)", "value": "da7f4f2709b34d53dedd2083a57df0fe6d5fdf46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385848, "uuid": "af0f77f9-9838-4875-9b07-51c738f3dac1", "comment": "Malware payload (GCleaner)", "value": "59a998c2fc50a16df239ff993260f84d791ecb84256402e33e05949290cb9878cb9686009c551c410c24d3ff676431ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385848, "uuid": "15e765d5-ec45-4c88-bf3d-b106e17fdebc", "value": "T15246CF20EAE2D06DC431C97FD9F21AD27C662989F408B4C322FC98D92FE9575B46D163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385848, "uuid": "24eef883-e8c2-41d7-8bd5-5e84c9e557a3", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385848, "uuid": "02df9068-2808-4017-a144-e46d11a5c59c", "value": "49152:WXAcOTM/OjEk9gtEUmdjvev9vSWYX5uJdx3ExdccYxNVQvjgBm7rl4yrQsmY3Bv:WXAcz/oKm6aXEddExdvwkrd7hx3Bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385848, "uuid": "879b9a11-a82f-4823-82a9-5c68c9abc4a9", "value": 5781776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385848, "uuid": "9df0a86f-e5de-4715-8bfe-68c6543ef735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385848, "uuid": "a84f94ff-8014-46e1-a4da-3644ca33d3cc", "value": "b3c2c49f97eb56c63a40ba8db0e37b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb71e434-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385363, "uuid": "96603064-be8f-49e4-bf41-d378a3282473", "comment": "Malware payload (GCleaner)", "value": "0fb70723da5ac662821c4b138efd7321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385363, "uuid": "036ff7b2-f3e2-41c8-9548-433e47d329b1", "comment": "Malware payload (GCleaner)", "value": "4e7e8c25e64ac4c534d252fb48eaa9a16bb2b5fc4d53ee421f84023e234b6110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385363, "uuid": "628a4e46-e1ce-40ce-8cc7-1c3767fa2654", "comment": "Malware payload (GCleaner)", "value": "4696d0e736aae7776488c3bb917ed1c7bc9ead6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385363, "uuid": "257ff5f4-4ae6-4a3e-8d08-cef7b20066c6", "comment": "Malware payload (GCleaner)", "value": "1bc335cf095972bffe6ec3a45fe68be61ebff94b424d510f6a212c0265a58c8517678a3057d19f4e2e3ad0131c508997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385363, "uuid": "6a73cedd-b5f8-4e2c-bb41-4648bc44564e", "value": "T15B36DF92F19030A4D81A8F3AD336D1BC73B42D0CFC1ACA986549FF99BF336826554796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385363, "uuid": "ea3878b4-a9e7-46b9-8d97-8afc85f17d45", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385363, "uuid": "3a35faaf-3ee4-4f55-87fc-93c949685f89", "value": "98304:mrSW2rOD1H9UeophzvWKgvG94JgyisKyFy:22OD5JophxCFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385363, "uuid": "bf0c8422-75ce-4680-9683-f82268d92151", "value": 5094672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385363, "uuid": "e687be22-b355-4ea3-bad6-2eb9f353e4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385363, "uuid": "9d5f6b60-f845-4150-99b4-04d4541e43a5", "value": "0fb70723da5ac662821c4b138efd7321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4cadfa-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385875, "uuid": "0eb67011-fd61-4e12-b0e4-f77008907ee3", "comment": "Malware payload (Adware.Neoreklami)", "value": "becaf6b28b6de9662640b920fbf188a6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385875, "uuid": "622f8b8e-9127-418a-bbcb-d65d1ba49c0d", "comment": "Malware payload (Adware.Neoreklami)", "value": "4ef374cdfba7766305f4d3bd78f362c964e8440c40edf8c16998cf0a1f544dff", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385875, "uuid": "7f140b5b-d62b-4dc1-93c5-207f7a4d14fe", "comment": "Malware payload (Adware.Neoreklami)", "value": "f056ce69920062a3ee7c9de371430f3678d01b45", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385875, "uuid": "0bf3f5b5-7606-4cb1-bac2-5198eee958bf", "comment": "Malware payload (Adware.Neoreklami)", "value": "1686035f8cf129b5798ac252e0a8b98ebd179fffcee3d7285afd0c505a04452159a83223fc3fa6ecf7298095b262ed2c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385875, "uuid": "7f46ce66-c128-498b-bbdf-65e71d48f0a1", "value": "T12A76331132CD90B9D549383590954FF0A4EEDBE40A33ECB773A66C6C6C1DADA8629733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385875, "uuid": "a2314586-8157-4cd0-92c9-068a1465f712", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385875, "uuid": "e31bb3a0-de2b-4a8e-a3b3-e3ae3644c0e5", "value": "196608:P1OYqy61s62mhs0vnFH9ovEYsvSKUKLuO8TOaty1F:tOu6520siH6TsqxAubTA1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385875, "uuid": "702c8f80-8f57-40b6-92a6-d3baad1e85e0", "value": 7571557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385875, "uuid": "9c9caf23-9440-4d67-8598-f4f1c9ffe4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385875, "uuid": "f8e6180e-dbcb-4a69-8b9b-ba23c700298c", "value": "becaf6b28b6de9662640b920fbf188a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf996300-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335549, "uuid": "db73f3d5-422e-4f7e-bddb-98f9899aae77", "comment": "Malware payload (Mirai)", "value": "ab4a5f4a46e156a01cab862575d1484c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335549, "uuid": "21d422b1-d363-46d9-a607-e85450356c41", "comment": "Malware payload (Mirai)", "value": "4ef8d3838f23d0147efbbfc2965b04bf7a42c9944601020735bd0c25a7a59c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335549, "uuid": "6bd269e1-0b4a-4212-b265-6f38ecc65a86", "comment": "Malware payload (Mirai)", "value": "3fa2d1e2feca817b3256eaaf1a33c35b291addac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335549, "uuid": "e3f7b7fa-e04f-41c9-b9ac-7d9a338ccb5b", "comment": "Malware payload (Mirai)", "value": "da7f759a19fe94088ff57f269e48a63928a3899fa28ee372d5271481bec3894368bd4cf7472d903e7fb7cb5b6f9d2f0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335549, "uuid": "187a0319-b257-405d-b23b-8c71bbc92ae2", "value": "T1E6B33967F9919B11D5C215BBFA1E418E33130BB8D3EF72169E146F31238B96B0E7A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335549, "uuid": "0c638828-19eb-49c3-93fd-c371e449fc48", "value": "1536:cJnEwxg1r5nfsHXGFFeA+COBH07ti57XMar1VCTCC5doimLfef778SYWmS:exa9scHlZihXMarZLfef7YSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335549, "uuid": "dd92d52c-9c6e-4074-99f7-5730bcc6ab3d", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335549, "uuid": "7b7f6adf-3de4-4867-a417-9c34dd4379ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335549, "uuid": "d36db3b2-00e7-4443-a349-74edaa4bb93d", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28024c86-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385519, "uuid": "26bb94a8-8b08-40ae-86d2-27cd62f113b0", "comment": "Malware payload (GCleaner)", "value": "5066d375c289ca1f981be1fd5f1ba0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385519, "uuid": "6e67205c-0601-4156-9657-12ec38babcab", "comment": "Malware payload (GCleaner)", "value": "4f0bd002db2d2bf293c0c9da5311017489b64a9ffd4c4c47e79518bac4cdb871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385519, "uuid": "a90c7ec0-717c-4196-a6b6-bf480f24a1a8", "comment": "Malware payload (GCleaner)", "value": "58068c3e2af785543b21fe8b3dbe7c2249cb2dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385519, "uuid": "7f2c098b-eee3-4cdf-b0ef-def3612b0743", "comment": "Malware payload (GCleaner)", "value": "ed09a9a67bb1b4c3b062c81acbaccef5a3d3d3c5414636a744f01b014ea08d2389530ea73f42f725b1271b9016488932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385519, "uuid": "0eacdab9-6eca-4671-a818-57a3d314cd5a", "value": "T1EC06DF11E251899EFBED14F1A50743A423AE3943F9482F203397DC78F79EEB67189291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385519, "uuid": "709a625d-0959-40c8-9d53-23276f391a51", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385519, "uuid": "277507c4-be29-4e4d-93d0-2136294cfe6c", "value": "49152:tyrwExW5utcbqqvcAad3mebq7NZDVPMFCn7ru6ay81NUxAI6ZziB6pNeIl6Fh90c:tyrwTXva7QHD1MFC7faN3Uaxiz/Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385519, "uuid": "ba0f3525-318c-46bb-ae56-f32ca316fa33", "value": 3884304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385519, "uuid": "15251879-3513-42e8-acaf-7e732f45435c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385519, "uuid": "85c8e46b-fdc6-47de-99fa-1391c0a8be03", "value": "5066d375c289ca1f981be1fd5f1ba0e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4069d30c-e80b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379547, "uuid": "0fd790df-34bb-423e-845c-5a31d2d0ef36", "comment": "Malware payload (Mirai)", "value": "b2c86e1768952e37e78e59272cde2c93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379547, "uuid": "7d1c893b-daf4-4978-8f98-2cb83b7d416c", "comment": "Malware payload (Mirai)", "value": "4f384fb83d4d8c006e4862b9e1051701293ba3f2eb8b78560cb59a9667acfb29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379547, "uuid": "d2d7e908-5614-4102-9073-38ead63d773b", "comment": "Malware payload (Mirai)", "value": "11bebc83a2d859126a19fde4e1fc88a2d62d1c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379547, "uuid": "5bc91ba2-756d-48db-a7fe-af22d187c687", "comment": "Malware payload (Mirai)", "value": "c153299f206ff260897ad458211f761542ca5b51ccd28a23058843071acd456bcdbe3440ee06f032b4b3a6fba3d7bdf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379547, "uuid": "68897ec6-4db0-4a6e-9eda-84481b7ac8d1", "value": "T1E473028612F8F673D06F1EB089848A96BDDE08876AC1D73847DAE798D87DD116681EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379547, "uuid": "69e26432-169a-47f8-b514-50fdbd8b263c", "value": "1536:kPZ/xMg6YpdqPT0verQ0fRbf8a5gM1YUWEsO0tDMUmWSLaDi:M959dqPT0GrrZQa5ggFv0tDMUmWS2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379547, "uuid": "0f9655e4-ea1d-4b8d-b059-64efd876ff2e", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379547, "uuid": "d2852a6f-84f8-422c-9f4c-dc40f9a58130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379547, "uuid": "7d79bcf1-d81d-4071-8f43-8e9a7963fdc1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d99cb8-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385762, "uuid": "286eaae0-178f-41ee-9da5-ca6559453fcf", "comment": "Malware payload (GCleaner)", "value": "975b2b4e347a5e9f52f98b8b8b5d414b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385762, "uuid": "3f267546-fbaf-4160-88f8-dd2f294b298a", "comment": "Malware payload (GCleaner)", "value": "4f43a343277a31f9c477d5b47adda8ae55ae8f00c42c5e2b1b769fc559722747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385762, "uuid": "a8b1a280-ee69-4fc8-9a54-870357617e59", "comment": "Malware payload (GCleaner)", "value": "68a9bc35ffcbffbaadca98736f27f8cab2e29123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385762, "uuid": "fe46a9b9-adbd-499d-8d55-398dc2b27779", "comment": "Malware payload (GCleaner)", "value": "d0e6b29b95f4601961f9c97886f058564a9b0276a92e8b522bab2968bdae4dd05ab42ea5e3f07509bbffec466a3d90b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385762, "uuid": "dc6b2a8c-8b86-465f-af07-23dec1a1aaee", "value": "T10A46D01DDD77C166ECE210B8F942363A1F18BC5CE5A8FEA1138209342E76695F6316B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385762, "uuid": "ac832642-01a0-4928-9d92-1315e8993377", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385762, "uuid": "271b18a9-d468-46d4-9e1e-16c23d63b379", "value": "98304:drSWCOnWy0upd9fHBKw0J4ajOwy8AmgqPvGWrWjMyLyrTpid:RhWyXrg/J4aZy8Dx3GW6Opid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385762, "uuid": "a16678fc-3133-4b8a-a9dd-dd5796a3dc98", "value": 5731600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385762, "uuid": "be682386-b2c2-473f-a525-a74b774915e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385762, "uuid": "8cd23593-362a-416a-85e9-0e614df0bfdf", "value": "975b2b4e347a5e9f52f98b8b8b5d414b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8efe13-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380079, "uuid": "3de3f08a-9567-41f9-84d5-02e4da681d79", "comment": "Malware payload (Mirai)", "value": "e2fce55787710ee98ab92ee7a3bf4f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380079, "uuid": "3309e60f-b3b3-4d16-bee6-a11307ba67d7", "comment": "Malware payload (Mirai)", "value": "4f80e922400955ac6b74132e7f9ec15a68f5d08a1d2ce2938933fb0b8124d2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380079, "uuid": "4c0cf349-a991-4f69-afdd-c71d876838c1", "comment": "Malware payload (Mirai)", "value": "68b9c99ffd3ee0d7ca40be7a36644800dafa4d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380079, "uuid": "89fb9693-d4be-4f7c-96b3-0f4cfbd3ba4e", "comment": "Malware payload (Mirai)", "value": "b290c2e187fe0865a230183c182b955d35f19a14af755b2760f34703a2adf8b8b23ec5533d56248e6041a9a47d9fc23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380079, "uuid": "13c5045a-12ae-4c47-b2fb-419bfd77fba5", "value": "T1ED049C72C875AE98C6609174F0B19F391B63A12499072FFB65A7CAB54087ECCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380079, "uuid": "fa8957f6-6ead-4c89-af62-3c5fe9d8a1f2", "value": "3072:kyzx/iHBTr057AXuPFS9pfrwPTEVvWtBxnVRkb:kyzsBc1QutS9tEI+tzVRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380079, "uuid": "0ee0bbfc-157b-469a-a454-36ed87b7bda8", "value": 175520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380079, "uuid": "dfe49083-8a27-4fc7-af38-9b5bc8f63777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380079, "uuid": "edc07538-aeba-40ec-b121-107c3be7cd1e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b83232-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385673, "uuid": "e5f0c0f1-05b2-467e-928a-1605a5d9e3f7", "comment": "Malware payload", "value": "80a9c4aaabd086384513420d5c24ba39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385673, "uuid": "d58b688f-5e64-4af2-8d12-dd49af793f8a", "comment": "Malware payload", "value": "5040f533a8ea8d00a4a1b5234eb870dd9f8dfbaeb76e96619e4938333ccf7ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385673, "uuid": "648a5045-d864-4265-ac0f-40096c4915fc", "comment": "Malware payload", "value": "7bffc5820e56a1d8ccf6e673550c2fd081bf4c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385673, "uuid": "73f741d7-e8bb-48f2-86c0-d113f4680480", "comment": "Malware payload", "value": "94abee44efa1b5f0271d71021bbfe3f611416eefad65ead7b6ee93caf8ea4ab4a883ab9b1bec15e9400e7122568fd638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385673, "uuid": "ca197e13-1e70-439b-880e-5b1439dd8875", "value": "T13D0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385673, "uuid": "836d7453-eff6-4d92-8711-5003de773890", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385673, "uuid": "e1f5720f-ed2d-456d-ad93-8f59d61598b5", "value": "98304:abT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:02w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385673, "uuid": "42b9826d-f794-4e69-a4ff-ee539fe8bf27", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385673, "uuid": "e56b5572-c269-4d6a-a917-beda28890b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385673, "uuid": "32efbf31-f5d2-46ef-8928-843b95b6468a", "value": "80a9c4aaabd086384513420d5c24ba39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5f2159-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380080, "uuid": "bf66019e-8a01-4b37-8f62-c4c859ac8492", "comment": "Malware payload (Mirai)", "value": "93cd127157381f7a017b193a043704a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380080, "uuid": "d83fe404-d415-4370-bb75-093074719e04", "comment": "Malware payload (Mirai)", "value": "506cd59c93ffaf7e1d60f46aa39feba484b0af81069a2e0a753048923c07dba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380080, "uuid": "d4fbb4fa-13c9-4c04-9f96-80d5f1f24a43", "comment": "Malware payload (Mirai)", "value": "134165027485c1fdf5e3d052ea3f18914ebe63ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380080, "uuid": "85f5e9f2-19fe-4848-aa1f-1afd0e6dfd6a", "comment": "Malware payload (Mirai)", "value": "b42feea0c7d51edd1f1923066ae521ba28f59cf12b4a3c53a929d453a65656b844241a187b962fffe6b1f897d5059e27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380080, "uuid": "ca2205ef-4375-48c8-8821-4455cfc4dab1", "value": "T1E4531845BC91CA26C6D462BBFA1E42CC332653E8E1DE7207DD11AF157B8A83B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380080, "uuid": "bf7e0292-eccc-4f73-bc36-6bfa286978c2", "value": "768:uj2rrmtecnR39Tz+cWCCOOvkyvsdQi9dUh0zNirmNAscABLYbgjSS4u+7R:drqticWzO67vsdQiQh+oLsZn0u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380080, "uuid": "d6a4be4b-1bd8-4cf7-ae2e-a1b43658dd4d", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380080, "uuid": "482fcc2f-9842-4147-8458-b701b535b74d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380080, "uuid": "71a26f54-d2a6-44ad-85bd-bd3e28821cea", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a980d52-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381604, "uuid": "490ff1ca-ae23-43ac-803f-7a0917d6648d", "comment": "Malware payload (Mirai)", "value": "2a4948af14775951b1d7937e050fde8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381604, "uuid": "aeee2fed-761b-4936-8541-6097f4a250a8", "comment": "Malware payload (Mirai)", "value": "50cf561a9d187624c1732b2f95f842be7966c3109de355ee6f317b26fcd42831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381604, "uuid": "162f9b71-ffc5-432f-a4fa-5bb0a745bef8", "comment": "Malware payload (Mirai)", "value": "68fd8904ef1d98f99bab3260aca0ccb819aed62e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381604, "uuid": "10a149d9-4fee-4e65-86d5-63119960f57f", "comment": "Malware payload (Mirai)", "value": "9bc6056c8a5cb6855ab91adfa52515a394dbab72409524e7acd50ee57e413b58c850603646fd73ce3a0038f0b7479f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381604, "uuid": "7d0f81c4-e34c-459c-bba1-980f6dee6db0", "value": "T118635C01B75C0E47E2A31DF4253F27E193FEE99020E5BA89250FCB865235E33458AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381604, "uuid": "0413c85b-312d-4129-8fdf-1f9267a528b7", "value": "768:IonEVMh+d6vlF5g6Py1F61oko4ZAkRayOn94XeW47DqSD3fB9m54PSnkC25HqG9S:jnh+dSlK611wQ49myKU5KGOZZGZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381604, "uuid": "1bd87b85-c618-455c-a2aa-09792f977c01", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381604, "uuid": "9323a410-48b5-46f3-92ca-d4d5842416f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381604, "uuid": "7146effc-2f96-49a4-b09d-9660d1f23232", "value": "meerkat.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7a581b-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385932, "uuid": "495951e9-cd0f-41dc-9915-9e175bfdd92f", "comment": "Malware payload (Adware.Neoreklami)", "value": "cc4b905d32e90401cc713070996cfd73", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385932, "uuid": "04955445-1c38-4b96-836f-9b35bba9d2ef", "comment": "Malware payload (Adware.Neoreklami)", "value": "50fd9ad14e0d22923223012ca269a0a37396b6092036af09623ecffb35c346aa", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385932, "uuid": "87f54232-59ee-47be-b81d-5137d618a063", "comment": "Malware payload (Adware.Neoreklami)", "value": "eb8d639254578a576cb5cd536f89f11f804301a0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385932, "uuid": "f5fc9ca2-83a4-4dda-bedc-ba738074e7f1", "comment": "Malware payload (Adware.Neoreklami)", "value": "5f64ad0a4353bd5d573e993bd5f1d69e559a46607a8d8ad0c8598def413614865cea7b49203015bfb3d30cf6be01d833", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385932, "uuid": "4c764105-b8fa-4a6a-bafd-94c38bac8136", "value": "T19B7633267AC4D0F4E0925135CE806FB479EDC9246E20A8EB738E851E5FBF570C52B64E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385932, "uuid": "a3a55d17-9c1a-4a37-934b-48b119a91688", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385932, "uuid": "dbb69c99-7019-4797-98c0-d7a3ef91bb0a", "value": "196608:P1Oahqnw3Rx3/Wfw95D/WaHfTDz09sHhLV4H:tOvnw3z/Wf2/vfTE9YH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385932, "uuid": "de96c203-a6aa-4a0a-b9bc-db106be2a1bc", "value": 7540339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385932, "uuid": "eeed9cd7-161a-41d2-8a97-4c9a0d8444b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385932, "uuid": "643d951a-dec7-4d1d-896f-09fc2b8c274d", "value": "cc4b905d32e90401cc713070996cfd73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920babb0-e7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767366799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366799, "uuid": "eeb45d75-3dd2-4406-ab4a-7e4f07cce6b0", "comment": "Malware payload (Mirai)", "value": "dcb52f5852b569d956545fe7cff514c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366799, "uuid": "4871d02b-a945-461a-ae59-4825d068c794", "comment": "Malware payload (Mirai)", "value": "5158bcf5ca8f5545190fbf958d3837d0c4f72c0185bf2a1456ff5fa0a9af7ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366799, "uuid": "967737e7-2962-4194-9eec-06573db3964d", "comment": "Malware payload (Mirai)", "value": "8311cc2ca42c6b58485f11c6391bbe3c7a6ab583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767366799, "uuid": "16137e35-37cf-4f63-8cf8-bb6dd9b35ee8", "comment": "Malware payload (Mirai)", "value": "f34663d2f12972e1aa8950af235b54d1628d127a8adf4d344eb17709b26be91dcccd4aded56de099732eb2a697264f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366799, "uuid": "2fd2fde1-2683-4432-95c7-3420ae0c0eee", "value": "T1D6241B42F9818E12C5C112B9FA6E518D33137BB9D2DE7202DD24AF6077868EF0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366799, "uuid": "7baff090-f8c5-4055-985d-f04a373e498b", "value": "6144:uEle5NiqQvREHKVAbW58fyeefKNwODuxEHK1gIVDf2XwFI0axq00B3m8OpmP:uE4uq8REHKVAbW58fyVfKNwODuxEHK18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767366799, "uuid": "a5acd7c7-ba05-418f-bb5c-97a2b3ee320e", "value": 213148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767366799, "uuid": "4c085315-b2a0-44e7-b779-2fc061866082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767366799, "uuid": "a4d7b544-e710-4814-85db-ae516ab4e1e2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28727e92-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381654, "uuid": "9f67ea6c-e032-4726-9fa4-4c909b45e790", "comment": "Malware payload (Mirai)", "value": "c4fc1def3cde08d725bae569bdbaea0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381654, "uuid": "6e69a47a-4002-4da8-b655-f1960a36629a", "comment": "Malware payload (Mirai)", "value": "52a9e3a2a1c5bb06743aa8b6d9d982b55b8e56815c6e84fad9ce254d14c31121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381654, "uuid": "f541935d-c6d8-48c9-965e-c4598859320d", "comment": "Malware payload (Mirai)", "value": "09926618111da9e9e35a2b19dfe09ddb931f2fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381654, "uuid": "d7732782-05f5-4138-9db0-e65173621e23", "comment": "Malware payload (Mirai)", "value": "3ac38a9c872e00d17cd16519e4ec827eab1e8c68d42d501100d3d5713d09ffc10c5e1875142cbd0d7a772a21a0507d20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381654, "uuid": "24e56619-b0a2-4fe3-8a17-294a2580a14e", "value": "T14E234B42365C0E47D1A65BF4293F27E083FEE9A020F4F588260E8B868575F77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381654, "uuid": "b31f7fcb-399f-4ef0-89e4-8985f65f41f1", "value": "768:EK4YZ3fcca/hDZrOERoFkVEEwPC12n+SG6cCBqO0qKmttABU0sJW7OER:WcUZrDzEEwPC1Y7GpQM3vsk7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381654, "uuid": "180a8787-9518-44b0-967e-b0475e8db08a", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381654, "uuid": "5713b251-36e6-49b1-bb56-e3101ef5903e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381654, "uuid": "a5df51d4-422f-4e8a-a9c3-438c59a93d6c", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d6b18f-e7e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767361277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361277, "uuid": "a54fa50c-81f9-47a0-b288-878b1e0ff3ae", "comment": "Malware payload (Mirai)", "value": "f3f16e6de4fa029308b21409beaef8ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361277, "uuid": "ee65260c-330a-40f8-9dbb-debb22215597", "comment": "Malware payload (Mirai)", "value": "52af3b59a6acd36f9a15730950a9358eed6d89cd0915df8e6966c0f6ee24dd24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361277, "uuid": "1776f46e-ee80-4fcf-a7bd-2a8c45764cd9", "comment": "Malware payload (Mirai)", "value": "7ce300eefaee290984882464c9181304a0e56a33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361277, "uuid": "fa62d0db-a0ef-4658-8b03-12034dc42c31", "comment": "Malware payload (Mirai)", "value": "1b127807762a7967b9dc012be413d0ada93471557f6cf746857418db8597f35be304aa13af00bee3a60044b4ab77fe3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361277, "uuid": "feb11157-580a-4077-9b88-ebd527bb0b28", "value": "T1FC44B60E6E228F3DF7A8877447B79E20975933D626E1D985D1ACD2001E6029E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361277, "uuid": "8d9c8cbb-b2c2-4d11-9613-b4344310bc9a", "value": "6144:bNByzSHTBnA5VghwyDBFqhSMTnklDDPbWF9pE/zv:BszSHGbkd3t/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767361277, "uuid": "47ec4d95-91f8-43cf-9e44-006f9bb98eff", "value": 256420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767361277, "uuid": "f7417e07-d805-4527-8717-4bfc389ac740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361277, "uuid": "14aeb7c4-bdf8-4d23-add9-27ef12c1e5e9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6bce73-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385471, "uuid": "10ee7a4c-85bc-405d-9b88-21292b2540e2", "comment": "Malware payload (Adware.Neoreklami)", "value": "3efe81130e90a432908f7c09b1081481", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385471, "uuid": "c8ebab0a-9be3-4570-9ad4-a42dc5878582", "comment": "Malware payload (Adware.Neoreklami)", "value": "52ec31705e026114f6dd395c7f5c93289a9cd6347b47eea72c44913adbee3607", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385471, "uuid": "2fde7268-7ef3-49aa-9fc8-73a4fd80e520", "comment": "Malware payload (Adware.Neoreklami)", "value": "a41e3d8aacfab78dc985564e579b79bfd426bd40", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385471, "uuid": "1aeddac5-bd5e-4862-a968-c39ec4e5265b", "comment": "Malware payload (Adware.Neoreklami)", "value": "fcd59b03780ca84a086ba89fb0d09a00e58dcd379f22dadaa2dcfbd3b3b543968f7e6fa0fc0aafb3b433c61d7fcd4ec2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385471, "uuid": "b6b3c796-c57d-4726-a00b-9f3b888dff28", "value": "T11E76331236D284B6C095D633EA177EF4B0E0E9055FB5852B739D081D3F3FA82ED69A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385471, "uuid": "38a72ff9-b5cd-4b4b-8cb6-3e3c67048828", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385471, "uuid": "599932cb-7148-4c08-b84f-50cb6ac2f511", "value": "196608:P1OXsrHGlvhOblnoM4haBL04wIDwg4CWRc4NJbPb3fwga:tOXszGlUoELtrf4CwPbvpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385471, "uuid": "0e3a4756-102c-49f9-a4b7-1c7993bf03d6", "value": 7525659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385471, "uuid": "03650c55-3e5d-442c-8778-5bc3a4ea63cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385471, "uuid": "06ac79ad-c79d-4d00-ae4a-dd5a4a42ddf1", "value": "3efe81130e90a432908f7c09b1081481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8090988a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385667, "uuid": "365c2426-7a0b-4d96-b163-7a0567c59599", "comment": "Malware payload (Adware.Neoreklami)", "value": "7ecdc4687fee4635f6c821464ddc841b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385667, "uuid": "6a669d9c-f4f2-40a1-b403-55957acec951", "comment": "Malware payload (Adware.Neoreklami)", "value": "52f3538dd1d2049cea3b31a549c97178e909aa8d784972cc8bac7e446e49e71e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385667, "uuid": "3dd73b90-c5d1-4b2f-b926-58cc42a92ff4", "comment": "Malware payload (Adware.Neoreklami)", "value": "3a7e90d40840b8c2e7b13b27b768df1434ecd656", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385667, "uuid": "179655bb-3536-4261-9b4a-a4b46d9571e1", "comment": "Malware payload (Adware.Neoreklami)", "value": "e819c2a700814c7ff9eef66a49f0d6570e5373cebcbb30cb27bcfebf62bd8b0d967f7208c31d6ebfebc0c596005159c0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385667, "uuid": "0f8ed541-fafb-4bff-8902-8d1d1cf02e29", "value": "T1567633117BD05AB9CB4A15319EA15F94FADED117AA758DB38788481E3FBDBC9C030A0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385667, "uuid": "aae67688-0573-4fa3-b8f4-537b52849423", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385667, "uuid": "419a3f4c-340d-48d2-a6f1-e2e4eb6c3c10", "value": "196608:P1O+apioW/3FPNGUucYlA1ClrxWa99bziGWvXV2mCjaqgbSnIoLmQZq:tO+a2tNEJT/ziGWvl2mOTgbSIamQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385667, "uuid": "94326fb2-fc4a-4128-b4c2-a2929a44cac2", "value": 7552417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385667, "uuid": "94a98598-ce59-4cf0-b7f5-85e5002500f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385667, "uuid": "bbffe5bc-d145-400e-9142-913326f6456c", "value": "7ecdc4687fee4635f6c821464ddc841b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e39582-e778-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316663, "uuid": "d78fa956-a2d1-4bd6-bb5e-b32d7d38f978", "comment": "Malware payload (Mirai)", "value": "4afbe63199c0c33cf53c5eac4f3d8ef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316663, "uuid": "9a287e54-5520-4895-a977-be7ea9b182bc", "comment": "Malware payload (Mirai)", "value": "535102a731facdb49f92d34a45e8a6fa23e852da00e256081d96237af49ae5d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316663, "uuid": "66d80dec-f3d0-400c-b6e8-1f1c360e6cb8", "comment": "Malware payload (Mirai)", "value": "103b58129ff999a0fec2a16e96eeb9a6cf8a7ee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316663, "uuid": "54c045c2-eff4-435e-9fa7-b6ac8eba312d", "comment": "Malware payload (Mirai)", "value": "da241e5806219d404f4153df4dc73def3264d0af00589e780b77be342768fad0b50546542c43d4b46d0f314a6b918679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316663, "uuid": "21dbaec9-c2b6-4a7c-8b79-91c66a0bce38", "value": "T164536E4233184A57D1A60AB02D3F1BF193BE96A021F4B3C9B54FAB698575E331086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316663, "uuid": "14fce785-0db2-486e-ae99-8b0d3662f421", "value": "1536:4bFWUG6/mRupO25i80jEqIqkKfezHTFHlu+7Rkn:MWTL2I8Xq0HTFFu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316663, "uuid": "98559065-fbc4-4ea6-abff-fdab314f2c74", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316663, "uuid": "e1417413-9538-4523-ab54-408679233ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316663, "uuid": "b2d7b2b3-2ecd-42df-8af3-57bdf81b34fd", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b637d28-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385981, "uuid": "5c5815b1-ad74-43f5-b3c5-767117fef9f4", "comment": "Malware payload", "value": "df35e5357495a09a15ae8233db0650df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385981, "uuid": "3bba9b2b-2962-41ff-8644-56d62aa50756", "comment": "Malware payload", "value": "5415b9dbf1a4a665cebe584ba3a02b34e9275f820759096731348f070748c20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385981, "uuid": "8b5141e7-b4ac-4649-b626-4ac413ffd52a", "comment": "Malware payload", "value": "c58b6965742e00d50b3bc07d3fa30f06cfe05785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385981, "uuid": "74e703f1-49f1-4601-9ab3-d286d3e990dc", "comment": "Malware payload", "value": "16b436a76e6bc2125c02607ae77c45fcc658c58b5cf346937c77a5992a1f8381977b54b5bf85f47f5b6e5d52a135657f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385981, "uuid": "0ad099af-8108-49a1-8bc9-ed06c13b05a3", "value": "T15D0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385981, "uuid": "8dcaecc4-57de-4a20-9c4f-8b89994beaf0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385981, "uuid": "3659876b-8ccd-41e9-b027-15889d58bd77", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:e2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385981, "uuid": "215100ec-c544-40c4-93e7-c0e4f29af8e7", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385981, "uuid": "5e5a103e-e0a7-4e24-86ea-b51bfe38c68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385981, "uuid": "d4c94e25-cfb6-4a68-915a-3185fad695fb", "value": "df35e5357495a09a15ae8233db0650df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37362907-e7c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767351184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351184, "uuid": "e78e0919-82e2-41f5-abf2-5a1210950812", "comment": "Malware payload", "value": "28dcd9d818b0278114bc3f45d0db6d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351184, "uuid": "524761ea-a32c-4a28-a27e-7135f531ba25", "comment": "Malware payload", "value": "549098ab636733211c92e23b3865444c03a2289263677c514e96aa50b7ab42ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351184, "uuid": "8b3ae755-6541-405d-ba26-b8f645ed0f2f", "comment": "Malware payload", "value": "5298cd84af2bfa2c60808d246b2743bd5165fa00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351184, "uuid": "deb98cbb-8605-40fc-a86d-68674f562078", "comment": "Malware payload", "value": "2cf8e3988510225e4563b40bc6445619cfd7e34b0b35469f7ee611b6353c463ae5b59e78345c2cf1c761b90b80e9c73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351184, "uuid": "b144f596-afd9-45ad-8778-bccfe88a542f", "value": "T1B7086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351184, "uuid": "44c71354-7526-4797-b49c-bc815df07404", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351184, "uuid": "a2879073-6f93-45f2-86d9-047faaade96d", "value": "393216:Ds/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+2:DEYGD7sJYgNukUB4S5rs3wbpLLNN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767351184, "uuid": "4d7fee7b-e7f6-452a-9fe8-fac56b1fa893", "value": 82079860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767351184, "uuid": "6fc7037d-80fc-4f7c-8b04-8f3fe1c87f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351184, "uuid": "76e18133-9230-4463-9f3c-7f918e330f96", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393befde-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385977, "uuid": "2728de54-36ce-4010-855f-3b485571062e", "comment": "Malware payload", "value": "ddaa5c46e6e9b5d2088fb0e2d608085f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385977, "uuid": "ac4a2faf-81b6-4895-aa6b-d64818d0a62a", "comment": "Malware payload", "value": "54cf9920f058bb99d09f3005588746c12df0d07ae71b2503c48e95de1b07906a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385977, "uuid": "cb500b84-9d15-4f7b-bd15-8f03f49c6391", "comment": "Malware payload", "value": "83e847b1b823e799f68a6ad4a3775b0a3466a73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385977, "uuid": "2d2c847c-4dc3-4b7f-82a9-40046650579f", "comment": "Malware payload", "value": "bf81c2d160b44ca6cf145e8e15361bc68dd7009f67cc3d317cbb790cb50c2a9b597a4789fd907cb3eeba5b6efc37e12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385977, "uuid": "80958e0a-af9f-4895-94d5-141fd3130577", "value": "T1910633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385977, "uuid": "bbc339e5-d830-4222-897a-4f3a9e472e39", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385977, "uuid": "82d4b520-bc8c-4339-8db2-2772c963857d", "value": "98304:aOT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385977, "uuid": "5920f32d-1e5c-4df4-b20f-b1e9ed4ea68d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385977, "uuid": "74106e87-d54b-4178-8e9b-961a233653fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385977, "uuid": "f08c426f-da21-4c18-8e55-93cf8e7145ba", "value": "ddaa5c46e6e9b5d2088fb0e2d608085f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9ee206-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385984, "uuid": "2ba4387c-8c07-483f-8234-9237445ea460", "comment": "Malware payload", "value": "e1d309fd3e31614371bf75d92353c4fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385984, "uuid": "01429d35-bea5-46b3-b940-59a10a981e15", "comment": "Malware payload", "value": "55211700caa20b099db31b313bb7fb58cea14cfad6b7eebca69b05e6d3c98de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385984, "uuid": "3607d5b3-0898-4f24-84a3-ffff4d45d384", "comment": "Malware payload", "value": "e7ec18d3316ed6164c71b7a3bb9d57be9ee00a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385984, "uuid": "ee93ab8d-81a6-4c03-a13d-ccced9c9c096", "comment": "Malware payload", "value": "476f2eabb63ddd70e051f547045e97fc957e6cd23c62d23c24c971a1f4ced98c844733755d5c1d420950c5829a432701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385984, "uuid": "3cfc3688-ae69-47c2-9c1f-611fa70b162d", "value": "T15F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385984, "uuid": "bb1d0f9c-c4da-418d-805d-641c6362a469", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385984, "uuid": "cb788360-e103-413a-8195-0932c2ba9c0c", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:+2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385984, "uuid": "a4c975a8-3682-4471-ad7f-0eec145e164e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385984, "uuid": "bb1111be-a224-4902-9fd4-7630524bc186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385984, "uuid": "46dc090f-d66d-451f-b391-77fee96c2e9a", "value": "e1d309fd3e31614371bf75d92353c4fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298b7b52-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315943, "uuid": "5cb41d03-23ea-43d2-a982-6ad1e161ea7e", "comment": "Malware payload (Mirai)", "value": "7aa1e4dbc75af5247fa6390b59933c8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315943, "uuid": "359762f7-86dc-48df-9f8f-02b65301f16a", "comment": "Malware payload (Mirai)", "value": "55ba4a30131c7ba3459230c5d6ffcffc45c0b54c4387c8297b792c915d3cde79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315943, "uuid": "2ecf090e-54bd-48b7-b107-07ddb7046d83", "comment": "Malware payload (Mirai)", "value": "5fceb9c3bc525087fac77f942f5e8aba8ae5e22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315943, "uuid": "a412b3ca-fe7e-403d-9cc0-bc1116eede90", "comment": "Malware payload (Mirai)", "value": "3087693dab28d84a0276c00fb2d88e7b3bc3cdc40c27008d44644bf2be75b29097770d80caf14a800fe12479c5a8805a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315943, "uuid": "6b87c4e7-e437-4a94-84c2-9dcf55a71f41", "value": "T1CF5302468274A9E9FB5DB0F268BD56CEB498D14DDCC0157BC3811A2FEC6137A3C2921B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315943, "uuid": "407981b2-846b-4805-b287-cfb5bae5328a", "value": "1536:Jsg9QUTRz7EPqXPOAS2WdhIlqGtU0Ow6L1ExE/nouy8GyB:Kg9QUNEPqXvSLAwdL1EGvoutt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315943, "uuid": "c7a00c97-0f0d-49c2-97d0-9d69c5be2316", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315943, "uuid": "8702e4fc-0d6c-415c-aa48-a854ba113ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315943, "uuid": "80ab6f99-0c89-4287-ab4f-8b0749ac5fe7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15e4cb-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336211, "uuid": "e6c7a4e0-ca90-4df1-8399-47dcfe5dd1c2", "comment": "Malware payload (Mirai)", "value": "9889192fdce134c678bea99ef331561b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336211, "uuid": "98b60b85-9c6d-4f2a-9880-117f2f2d4415", "comment": "Malware payload (Mirai)", "value": "55dac707c01c48dbd36e1e6288cd5a631f0eb512c0e766e96343bb541f63733b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336211, "uuid": "be091565-0e4d-40bf-ac25-d3cfa8e692d1", "comment": "Malware payload (Mirai)", "value": "0fcdb1b7843530bd73ff903ed259541079825e30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336211, "uuid": "45a1a89e-63fd-4218-812c-33b336517d5b", "comment": "Malware payload (Mirai)", "value": "96e9d4f86ce6bbba21751ad3f96e1efc22fee71811acdc3498cf2e1dac41c7c8d2eb1ce2673f8a64b135d04250805520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336211, "uuid": "7f702d05-c2ba-4832-8d9e-6c7c1d0722f7", "value": "T175530263C4997B77CE7270FD8CDAB24B2C148168FCA9C2890FC62D2D477186A1E0A357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336211, "uuid": "5e365c8e-7a60-4bff-9556-13f53758f80d", "value": "1536:k4ul8TGcY3tgCkKyVG4ZgeCKdSIhSeXJyz1Up2/nouy8GyN:NxGzdgJVddxcGyzW2vouth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336211, "uuid": "59b51c7b-046d-438c-9000-136e2404b546", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336211, "uuid": "a473cdab-ab96-4cfb-95d1-6e1d61e9c077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336211, "uuid": "f71619d0-5ddc-497d-8d08-fe091f152f27", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a731d6-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385587, "uuid": "76a3d7dd-caf5-457c-84c8-6f71b1a53380", "comment": "Malware payload (GCleaner)", "value": "656fa2af6b00973770ff30d6f5252576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385587, "uuid": "c0c91ced-7a14-4f67-a011-54f5da8f0673", "comment": "Malware payload (GCleaner)", "value": "55f5d71ac0be41023003f347aa91e206c7dc10ede3670fb3ccc26a1355f9cb72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385587, "uuid": "f9634c2d-2f0b-418e-b057-3b639bb2eff6", "comment": "Malware payload (GCleaner)", "value": "e99e544ba3918f1db1b6ceaffbb0660ebadba7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385587, "uuid": "80d03a6c-b3f9-487b-90e9-966a9f39015c", "comment": "Malware payload (GCleaner)", "value": "473424151afd2cc191e40a8aa9973546cfe44c1409cb6abe9becb6c69c12195a87257629ba9dfa985b2550bdd09fd7e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385587, "uuid": "33254b57-a466-4a5e-b9c1-db97d74ecdc2", "value": "T18506E073DDE9C0E2C0F222394ABA59964D613C0DE548792153D4BF683AB72805E5FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385587, "uuid": "7b8c79f3-0b3d-4656-aaad-e3ac3bc9f12e", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385587, "uuid": "d03d1f40-2a69-46a2-aa3a-89aab6c2628d", "value": "49152:MrSW1uMHB5VZ0xZiekeJajHv8ODBQ7dCHpp1ow3z3CVRWjhIYZCiyWpI:MrSW1Lh5X0TzajwZCHphjyXOgWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385587, "uuid": "dca44d50-7bb8-4da9-87c2-393163435f9a", "value": 3948304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385587, "uuid": "bfc14bb0-34b3-41e1-9de1-31f34b0df490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385587, "uuid": "71c7cd90-f45b-47b4-ba34-c3b6f0ef9d8e", "value": "656fa2af6b00973770ff30d6f5252576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cd48e7-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385939, "uuid": "22f9d992-5573-406f-b013-f73c84eb8cc3", "comment": "Malware payload (GCleaner)", "value": "cdd0604511f0ec1c971297e12d159076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385939, "uuid": "d0c8392e-c2b7-4ebf-93fd-84b7e1e820c6", "comment": "Malware payload (GCleaner)", "value": "567d1a564db223a6872bc06a2bae09cc35d203359491eba63ee700683bb02708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385939, "uuid": "8abf0108-b349-4e76-b9c8-6f2cd1f00ddb", "comment": "Malware payload (GCleaner)", "value": "38834b60d329ccdfdcced971a3b8718e805d8574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385939, "uuid": "9460a059-9a08-400b-9e56-874b0a1f8f06", "comment": "Malware payload (GCleaner)", "value": "653a88dfd84ce188abfacfab0a2f95fa62742d2fde70a040232f4acd7fb3b02a01a8b29cebec118ac7c22a02412bac5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385939, "uuid": "991f9050-824a-4708-b8db-345f16079db8", "value": "T15C56CF42E352EE15C19DD97B8A438BFCE3A4F240CA277211DCA7EB01AD510DE6DDA5C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385939, "uuid": "40d2df78-ed38-43dd-9e6d-92c875ab09f8", "value": "cde078e68994e408985ac985f5f0d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385939, "uuid": "02eee026-fe49-4d39-8f4c-e03d68b48c4f", "value": "49152:akDkDGcJ04+B7aGmrQiVAYDILDFTg8n7BKtClUwiBue3BGLqWH8G6wH8IqE5pHvN:akDk4BR2TcLiaWCl6FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385939, "uuid": "38f24531-68d1-460e-a001-b9b5a39a5805", "value": 6315792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385939, "uuid": "a7195fed-e999-4467-b513-d02cf073ba11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385939, "uuid": "338f67a4-cf9d-4d75-aa59-5d378487c15b", "value": "cdd0604511f0ec1c971297e12d159076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a6dcc8-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381869, "uuid": "865e1dcd-a8a3-4a99-969e-e25bdf5c718b", "comment": "Malware payload (Mirai)", "value": "a3e6a8d8f2224b45ee7b6d94abbb57f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381869, "uuid": "ea798d6b-b9d0-4474-8b03-c8ef9c60abb5", "comment": "Malware payload (Mirai)", "value": "5684acaa680ad10592a9fdc5b97d399afc0a2d50ec637b5d3a002a163a850d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381869, "uuid": "8c956143-98aa-4536-ad0e-bb7ef21eba88", "comment": "Malware payload (Mirai)", "value": "27600e2a6b57b56b43db74bc9f6977d512a680c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381869, "uuid": "a173d48e-6d84-439c-bd19-01d83ce7e2eb", "comment": "Malware payload (Mirai)", "value": "1b2accf1fc1a107c92cc91ad6018eb0bc333bfd7163bc5b4b88f85abf69d3f70d6f9309e6330f6129f9ba9bb555e5881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381869, "uuid": "f4e8f3fa-aed7-46d0-b259-8c9d0ba08ed5", "value": "T1AED35A00F7090AA3D0931E74133F0B769778A9C266F5F1055A06BBA52B31EB36587FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381869, "uuid": "9064e506-fbbb-4d50-8fd4-caec43894e4e", "value": "1536:x+3WcKr9te7hpW4KLjg3Pyzly2jStUuR70LY5ZYI/IiIfy5:59UzPPy5y26UuR70L0Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381869, "uuid": "e1649829-ac2e-48e1-9925-5da2fe5b3288", "value": 132108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381869, "uuid": "34a825e1-00f2-4dee-a00e-d85c797f2cc3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381869, "uuid": "f4425d54-d8a3-4e61-a72b-4865c609c62b", "value": "colomappc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75d119b-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385759, "uuid": "f3647ce1-e32a-475f-995b-64c80e2f880a", "comment": "Malware payload (GCleaner)", "value": "97087bb1c9d91743f57bd9cb57c737fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385759, "uuid": "062b5428-5a45-45d2-a3db-4ab3b09a0be7", "comment": "Malware payload (GCleaner)", "value": "570ba496415659fb08667a6e4796147a3ae64ad743d5274096f7bfefd1c3ff86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385759, "uuid": "62fab51b-8771-41c4-93af-3c9a7aa8086d", "comment": "Malware payload (GCleaner)", "value": "676be75f8f321292d4f2a75f96fd2cdf4cbbe991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385759, "uuid": "f42564ce-72ed-401d-a563-ab0b3a1ed12c", "comment": "Malware payload (GCleaner)", "value": "43ac0583e4fcf0f507a06b39246e32a8ea103850422be9ce813246ea9b9d3ef0d48302f17f015838589bceb6b287da15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385759, "uuid": "e0370052-a631-4f8c-8ae6-165f7f245975", "value": "T15B26E17BDE63526EFADF15B7445F59014DCBAA02FA34F142F5A10A28773C440BC2A29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385759, "uuid": "285c5e5d-7e4c-4eca-9ca1-9d07cf31f3e3", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385759, "uuid": "d61caccb-b5ec-4f61-889f-4f7ca1151013", "value": "98304:/S/NFNAE4i6k+NaDG9Qer5M7sK+5JAoxGOS:aV8E4NN6W3ugK+5J5TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385759, "uuid": "6b348696-f9b3-4f2c-98c1-c5d06c1b00b3", "value": 4679440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385759, "uuid": "6f7c3097-067e-482f-9227-28bc4e76d987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385759, "uuid": "c7418f0b-4d73-42ce-82e4-4c3fbcadbdef", "value": "97087bb1c9d91743f57bd9cb57c737fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc59945-e808-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378440, "uuid": "999c376e-f9dd-430a-8cd1-ec7876029b67", "comment": "Malware payload (Mirai)", "value": "c37bff0e506a1d60b4bb49e370fc33cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378440, "uuid": "12c95d5f-405b-4d06-8822-c65019c1cbc9", "comment": "Malware payload (Mirai)", "value": "571e6f714d749d809fd91648f6d83beef88aeaebf71452e2c6646d772fa5eef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378440, "uuid": "de5c158b-adf2-4cce-a38e-7440974d5a3e", "comment": "Malware payload (Mirai)", "value": "3e912c65358ba5c249f411bab962cfabd5f583ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378440, "uuid": "0d7111b1-80e8-4448-9d8c-acaf28a30a32", "comment": "Malware payload (Mirai)", "value": "e27e1105d67fbcd4d9590d624d067f5c079766e7a9537401ac6ae8d6baa5476673bdd818c1e2f5b46e3eb06fd285c100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378440, "uuid": "d08d86ef-1f66-4d01-b669-f0ec6bea9338", "value": "T137630288D2489027E4FFDC211EDFBAE5BFA05FD423065E72F04AD7227A9059D7718506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378440, "uuid": "6b57f66c-1ea9-4ae0-9cad-7da89843d5ba", "value": "1536:SwBGhe0PZ2J+AwEiotYvVpAHNRmo0zQDZd0z7gxuu8th2cbiMmD64u+qgw096:Dch++AwEiotYv/oNRb0Z7gxd8rhem4uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378440, "uuid": "d32ca95f-7dd1-4571-802e-133a5e6b3f7f", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378440, "uuid": "c6ed3fc3-d15f-45e5-a5ae-fabbf24037bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378440, "uuid": "6f746b7f-650a-4d3a-914e-e9d574f6e65f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a46b52-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385483, "uuid": "334550f7-3f41-4f14-9979-cca62b07e8c3", "comment": "Malware payload (Adware.Neoreklami)", "value": "43db9c531a4cb0613fb0b2b4eaef2e9e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385483, "uuid": "2badcbd7-1b4b-42fc-bc8b-9346b78372a9", "comment": "Malware payload (Adware.Neoreklami)", "value": "578846c9d965f6c5ac4ec946bc7872183e2f248cb356fed48968f0c662751453", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385483, "uuid": "aa8bbcd0-1081-4a64-9973-77d03b18a133", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cc881c12e1986d98c3ce83af49d299e3dd45c8c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385483, "uuid": "09985f04-b87d-49be-b400-30475492a8ed", "comment": "Malware payload (Adware.Neoreklami)", "value": "7c651519c9821dd0779257456e4b37ba86238d25cf2ece280fbd2dbf4f779ff536b1c368d8206921497e20a65e8c9e2e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385483, "uuid": "ce7aac76-c314-46b8-8d5b-ddf5f6b375d0", "value": "T18E7633613FFB82F5E32E46318B749E8883C1D38E0FE616170B9915169DAD8CAC634E4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385483, "uuid": "545acc6e-fbd3-4ee7-bd5f-4aae5c34966f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385483, "uuid": "dbb5fe25-f704-4680-a2b7-60412f8bcd41", "value": "196608:P1OigTm/iHWU21Tu3rpDGmHAWR2GOlt3zsa7N5ra15:tOisMiHG1MpSmXR2GOL3y15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385483, "uuid": "698f561a-d2d5-4147-a28a-5dbbc2b6ea4c", "value": 7600103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385483, "uuid": "8d8e4fd1-dd35-4b4b-87a3-94c5ed88d8aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385483, "uuid": "a434d5da-094d-4a8d-b615-816bf529813c", "value": "43db9c531a4cb0613fb0b2b4eaef2e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d3e59d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385674, "uuid": "f3b97cc2-7e1d-4b0b-b10c-ff7bdc45421f", "comment": "Malware payload (GCleaner)", "value": "80dfcd9e9cc8d15b2b5f541fc0bc52b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385674, "uuid": "ea74da3b-259b-45e8-b58e-786e4f618ac5", "comment": "Malware payload (GCleaner)", "value": "578c654db249cb447ed05a7262f11a9f33bc5a9d4a1362bec8f92302e03af7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385674, "uuid": "5c5d75d4-ffe0-42bf-b952-3f5969b71655", "comment": "Malware payload (GCleaner)", "value": "cb789c78851614f61940bb87b82b8c46e9ef2c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385674, "uuid": "c36e7bcd-f07d-4a99-b1bd-174c4f4bb6fc", "comment": "Malware payload (GCleaner)", "value": "9f459ba1b2c061a879a8408500f38c04f189d7bfe9cfc673b14f3fe8a5800a0c4e774adb44c0d01001624db419ef338d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385674, "uuid": "96315f0f-4729-4737-99ba-eb9e6a4b230a", "value": "T10E46DF19D342D07FDDA52B7CB2CA5D24DCB0A86AF8426873CB94D806FE24911B5F26F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385674, "uuid": "87c34913-84fd-4f4c-9ed2-1253f22055cc", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385674, "uuid": "2c26cdc9-98d7-46a7-95c4-c0bf6dc65e16", "value": "98304:sUzNgPNRkL+HdiEVS80w1bzm6PZcsRMjP:DWLk4k8VZcsRMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385674, "uuid": "75ed2b10-a3e7-4c71-b378-aa499e113b20", "value": 5475600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385674, "uuid": "6f91437d-fe9a-49e8-bc47-9c5c48d2b93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385674, "uuid": "2a76b933-74bf-483b-8a3d-340e99616dfd", "value": "80dfcd9e9cc8d15b2b5f541fc0bc52b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b692c9-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385991, "uuid": "200152fc-7cf8-4f84-984b-388523d67236", "comment": "Malware payload (Adware.Neoreklami)", "value": "e56d0ae6f61e34221fe7893b70bfda3b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385991, "uuid": "e6f0ed36-f707-4fad-90db-5bf0ac831e71", "comment": "Malware payload (Adware.Neoreklami)", "value": "5793426d3847f4a3ea451ef2a6a7acb2c5e09f0a7d94e98e911da09e0aa2d3f4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385991, "uuid": "39991834-727e-4342-b8e2-5912b104f74f", "comment": "Malware payload (Adware.Neoreklami)", "value": "0da280890550b7f6df55ace1144dffe8d7f4ad97", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385991, "uuid": "81ea801e-01a9-4812-bfe9-a970caf84ab6", "comment": "Malware payload (Adware.Neoreklami)", "value": "0e447eff01ce2b3ac11e6515ddecd773cf5a50461f638dc3291ee582bcf2dc589bf4ef4f976f554a2c92871f8ad48e56", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385991, "uuid": "68cf1622-773d-4757-98fa-4f942b6d066f", "value": "T1C27633623BF7DCA6C9BA0476049E8FD9D1E5F5680E3289BB1790418CB87DE94C113E6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385991, "uuid": "7c805c15-fbf8-4b53-8b5d-c023362d2440", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385991, "uuid": "ca6205f9-3b33-45b6-9422-7f54a661f47c", "value": "196608:P1O9CRdU4mtiC/ijuCIGFuJ70XS+IQ2QezvQn:tOoRdbCiiCgr+IQ2Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385991, "uuid": "7abc7f3f-2dbd-49d2-bf08-497e40ecc438", "value": 7587594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385991, "uuid": "9d7d82bb-7b87-4520-8e21-2de54d8b3bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385991, "uuid": "b00e2e54-6099-4d59-a358-02bc0d50820a", "value": "e56d0ae6f61e34221fe7893b70bfda3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ddf9bc-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767356501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356501, "uuid": "66eba30d-ca47-4ede-bf72-15efdcd8e4bd", "comment": "Malware payload (Mirai)", "value": "4957eb8e6519c70ee111523d38ecf5dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356501, "uuid": "7ae8d99d-edc1-423b-b313-cd908a2eefff", "comment": "Malware payload (Mirai)", "value": "57dfa02cb53dbc86974edd1c8e6ea335dd83e18b5fdd49d3b975449c9718c9bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356501, "uuid": "2e255efa-04c0-4b56-b33e-0b1009a7d988", "comment": "Malware payload (Mirai)", "value": "adc14bc38de2b78687be79d3e7ba2f44c1214ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356501, "uuid": "fbb8daeb-f209-45f7-ae28-4d108396c720", "comment": "Malware payload (Mirai)", "value": "a69b5facd0fc97f89e7aa25ff10837ea7769b81ab175f66286bc8da549963be2636fc61643c793af18c57c3f433ed98b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356501, "uuid": "7153e4c3-c75b-4cd1-9d39-96523cd3f27b", "value": "T15FF36C16F78080FFD889C27C42EEB636E971B82D2235B25E5BD4EF153D98E21362D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356501, "uuid": "7940a471-f841-467f-86ec-0c580f7d6c9a", "value": "1536:VvI9TJe5jq/cJq/KbfARr/2s2v9zbhhlQLwKijeU14UE3+OqZPb9wDoAo:VvIyjb4Rr/J0RCLwKk14UEOOqNse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356501, "uuid": "2e0e7cee-548f-4447-b665-abe552f15f81", "value": 165904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356501, "uuid": "5d0aedeb-e45f-43de-93f7-3d9116e73afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356501, "uuid": "5598ae8e-36ab-4faa-8862-aa80e74a450a", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a065c19b-e81d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767387439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387439, "uuid": "eec43800-1c36-4edc-a075-687b6b903e8b", "comment": "Malware payload", "value": "45f0449655bc644d19b7dfa9c131567d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387439, "uuid": "036c1870-4e60-4698-a083-d37963135500", "comment": "Malware payload", "value": "57f0b64f490e4d0b0fec5037ff0ce0c5e0773c137e4bb6d8f4717e2d66be5499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387439, "uuid": "a82b09f2-f5c7-4a89-8553-2d1ea8768611", "comment": "Malware payload", "value": "e1d530748da00563b63dcaef67c36ffc93164c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767387439, "uuid": "6ac09a61-c5e6-46ce-ae4b-81ca7cdae9ac", "comment": "Malware payload", "value": "59c4127a31eb273c6a8d6de45f92c9ce4411ef72ccd4d0e252b24118bf8d02c1fe42b434eaa7be50e42e7c47753d7209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387439, "uuid": "ea9b7fa5-397d-4a88-9af3-b65046c794d6", "value": "T1A4C35C5AB30D0A43E38609F0263B17D683EA6AD170E5EA49260DFF0992B1D3B5185FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387439, "uuid": "18123b2e-ce08-42ca-b187-a14b6b2f5473", "value": "3072:0NVBKrzNWUmb92H82mBpE8+y+0rH7TCrRl:01KFWrYH82mBpEdy+CHfCr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767387439, "uuid": "dabed463-d457-47dd-9b9f-cabe66e30dad", "value": 126940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767387439, "uuid": "191ced0d-2d18-4d2f-8fbf-564c2e5ed747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767387439, "uuid": "84c172d0-0076-4441-a36b-4a9a83ecc696", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d081f9-e7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767371957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371957, "uuid": "21073272-9841-4ca2-ada2-21c8d7daab1f", "comment": "Malware payload", "value": "f6c81b75f567f5a7816fcac0e22df699", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371957, "uuid": "64d94c28-4782-4a4e-963e-e54a64e244e8", "comment": "Malware payload", "value": "5819ab7b3a42990a28b535bb2b058dd59d1e4cd45f7f6777a5c9ad79317fbd6b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371957, "uuid": "6e392b2b-b54e-4f80-8632-f1238aa7d2b2", "comment": "Malware payload", "value": "ffeff8ba12498431e8cef16dbb0a8c829160a7de", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767371957, "uuid": "eec4fb40-baf5-49a8-a28f-d4e1be214cdc", "comment": "Malware payload", "value": "b6b8f595542289a0ee052d0ca149ea8aa9f86321775d867dc69ad982ca003e76d1f7cf304f47051d21386d32657f8e59", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371957, "uuid": "1d1c4863-a425-4464-8f84-90df0373af92", "value": "T1B77312443B77EE6BE3452F3F444081265F193BDA9EA31A70949839B19C41CBDD687C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371957, "uuid": "931f59aa-452e-4169-a215-29fda5816345", "value": "1536:UvDPrDH0wfGgp2uZXEeyZxN7ixZFNSb411JBYyUIyv1rpYbh3k1:E3H0Q5CxN7ixZXSCKw8rWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767371957, "uuid": "61384ec7-f47e-4dfb-a492-1a60eb18287b", "value": 76189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767371957, "uuid": "a086d3aa-2ebb-41ac-9077-7b91e5debdb6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767371957, "uuid": "46eb184f-82e3-4a3f-8a07-cdaa32491675", "value": "13474f4e82b8fa13c6e43009433720e07e0485971293afdc5867849b9fac8f09.dll.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a272f003-e80e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381000, "uuid": "d54146e2-b8a0-4163-aa7a-871580a9152f", "comment": "Malware payload (Mirai)", "value": "e8f896c227b91ed1798ac9b6b1bc41de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381000, "uuid": "5a477ae0-75a6-41db-ab22-2fea2f4e45eb", "comment": "Malware payload (Mirai)", "value": "5861ffd25b23838c06cd3e9c6f2035e4853b8f4abdf4a29c53e66b7b5719904e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381000, "uuid": "66c41fb6-0ca1-4c80-a75a-3f93e1876eb1", "comment": "Malware payload (Mirai)", "value": "4862ebf5910e06f3787ca6852e8fbae7038ff9bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381000, "uuid": "4720882e-4c62-4fe2-832f-e882ee730ca8", "comment": "Malware payload (Mirai)", "value": "72684181437c94300648c1d562681179ea7c8d56399c3eb81a011b8b51a234e3cccaf57920794c16b04f2195339ab3c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381000, "uuid": "ea3b6a71-dedf-438e-9957-8c29ee3e41f1", "value": "T125535DC7B500DF7CFC4AE67BC5160E05F624334196930F2BA6BAFD935DB21988916E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381000, "uuid": "edb99d9d-7b09-4ce5-929f-f9a9b462e553", "value": "1536:zSKjoB1gJ5YlcMfEAlvPaTqPu8t7QQkSRTgpbDPh:zSKj/AcQEAJaUt79RkRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381000, "uuid": "da62f93b-4c00-4c7a-ac85-17ebcaae858e", "value": 64296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381000, "uuid": "8e369211-9087-40fd-accc-ac9028dd166f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381000, "uuid": "e432726b-cbbe-480e-9dc3-86ce72a2a886", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced234b4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385799, "uuid": "10408775-8711-4875-a495-2ac333cb3058", "comment": "Malware payload", "value": "a1de5dc547bb80d1398a75ea23f26745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385799, "uuid": "a9d935b6-96f3-4588-a0c8-58a221ae3a75", "comment": "Malware payload", "value": "586cda30b271f1d3880473ead5f50502ee9d885f55ad4d7431aa17b5da7e1d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385799, "uuid": "2699b827-210a-4149-ab44-146c59e3754d", "comment": "Malware payload", "value": "9668d2c21d72bf96535e2220f5fab8e9f27de06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385799, "uuid": "6dd067d4-7aba-49d2-9b24-75c380c9b5bd", "comment": "Malware payload", "value": "42ffbe9d47ab18b01ec6b5f9ebbaf2dadb9af7967ad9ed4aba614203488c363a62043e5d2338a81fc15fa6b936673334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385799, "uuid": "df0b04f5-6f21-4bef-9eed-d939ce070787", "value": "T1F70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385799, "uuid": "d56936af-bff9-48e1-96db-d044caa17d37", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385799, "uuid": "d44858e3-9e3d-446a-a9b4-ba764a9fe18a", "value": "98304:aiT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:N2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385799, "uuid": "120a5cab-2a96-434e-9a6b-5c8f3e156b4a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385799, "uuid": "d37fc331-a0c0-431c-9d3a-975fe02fd72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385799, "uuid": "bf494f6f-e612-4445-8da3-8c0cd1b03d65", "value": "a1de5dc547bb80d1398a75ea23f26745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f4728f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385544, "uuid": "2317243b-d9d2-4d97-95b8-adad2b3e5f80", "comment": "Malware payload (Adware.Neoreklami)", "value": "59988e11fa479fd2ec4dd799858b85f0", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385544, "uuid": "ebe91ffa-be6c-4f78-908f-9e9c351a019c", "comment": "Malware payload (Adware.Neoreklami)", "value": "589925eabfa79ab4c76fac20760c532c7f903eb8ee956ffd2972b2eb4cbb596b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385544, "uuid": "43043de5-52b7-4baa-b982-6c5f09615c51", "comment": "Malware payload (Adware.Neoreklami)", "value": "f07aa928b73cdaa8bbca8506b21252470746347b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385544, "uuid": "f74eabd1-5143-4446-9c15-be3714db7e0e", "comment": "Malware payload (Adware.Neoreklami)", "value": "c00b342e4c1c92f6f7a80ff59500183d5e6e9ea1a138fdbb73e1d214bcb9a9b55bb3e39fcf1f511b6c83d5d6fef3bb4e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385544, "uuid": "96e8195b-fdcf-4989-b426-9fd8eb81424d", "value": "T1C3763350B1E0DDBACA8604735F545AF2D9AEDA185E30C95327E907483CDD3B288B673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385544, "uuid": "6d761d2b-4105-4d64-a37f-497d3b817d69", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385544, "uuid": "eada2ca2-32b9-485e-a9f6-1bedf102d2be", "value": "196608:P1OD7ajWVm2iY7wg35KnCw5puxWKF3U1w1bnjh9ONBi9qN+wjDs9tEF:tOD+jWwKYFnuxLsKnjhEz9+w/sTEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385544, "uuid": "13277a4d-5a26-4028-907d-36facb586787", "value": 7529589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385544, "uuid": "b6e0bba6-3488-486f-ac9f-79516429f867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385544, "uuid": "14b2eb33-b01a-41e5-b60c-e106047926ca", "value": "59988e11fa479fd2ec4dd799858b85f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aa2c62-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385433, "uuid": "92824f7a-52fb-4ce0-ab5f-f9fd4ab0df90", "comment": "Malware payload", "value": "26d086bd49f71978e25d0c227c193d8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385433, "uuid": "c720070a-6f8d-4c4e-9f4a-40bc76093d7a", "comment": "Malware payload", "value": "5918926cd48b891b545939611d8f56e8991363f4b251b10bdb66104f3f09205d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385433, "uuid": "bbe0d294-04c5-415b-adbd-4eb73e962bc4", "comment": "Malware payload", "value": "b5d09827e96ea25b49b2826b47d8a2707a4f634c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385433, "uuid": "c84df5cc-2a35-4edf-9979-e1e3799b6ce2", "comment": "Malware payload", "value": "1e095691818a9f181c475ea6d93577a5f50cee9bbb4b56be1cb5e88e2548af457c667ea9a426f61c443cce5f717afbae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385433, "uuid": "2795ffb1-5b27-47c9-848d-49de3aea6e71", "value": "T17B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385433, "uuid": "35e9fab8-515a-4c3e-80ac-a0224f0fa783", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385433, "uuid": "7c7ac860-68ee-45b7-9b2c-cff76af38d88", "value": "98304:aET3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:L2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385433, "uuid": "808329df-7dd7-4536-85fc-0da9ba9e5d26", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385433, "uuid": "d7087aca-a215-435d-befb-6fcf3a49ffcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385433, "uuid": "50226cf3-fd35-4abf-b8aa-45bac6b382ba", "value": "26d086bd49f71978e25d0c227c193d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cc60e4-e7a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334913, "uuid": "cb503124-38cf-49c6-b46e-5b543eb71696", "comment": "Malware payload (Mirai)", "value": "0c352b326e9a6a3c8ccf1c958fef8df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334913, "uuid": "aa06c337-70d6-4b6a-bcec-860d5957d1e8", "comment": "Malware payload (Mirai)", "value": "5957cce9cbd6278d4b49fb7b77eb7c9c95f1f1214937b56b32cea1fdaf7256a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334913, "uuid": "229f8db5-1284-4607-a0e8-c00db58ada87", "comment": "Malware payload (Mirai)", "value": "ef8a424d81ef67d84cb345f3c16e83cc9dd11210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334913, "uuid": "66264e3b-088f-4984-a9e8-82d4fdeb95df", "comment": "Malware payload (Mirai)", "value": "54f981d2f893616382830534cf9386c87c03313d6f94615a9c897f248826e7fc3f580c0f1e09c779737ff48401731746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334913, "uuid": "485f566c-9f7e-42c1-9426-de3bcc1b9891", "value": "T15E5302078B59D723E9EF413C80BEF70D7407AA0D2301C567B6E094BAE199854EB75663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334913, "uuid": "832c13d7-5f04-4d54-8e9e-d8dd35b9a1c3", "value": "1536:eJ3S5uPP7TpYyrLADyCuriXAje/AfejhXsHEBenouy8Hyp:E3S5uHHp1LAiiKe4ghXkzoutO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334913, "uuid": "301eeeac-40d5-4257-be70-6b4ab5e2462a", "value": 61248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334913, "uuid": "7017b12b-4005-4013-a4aa-490cc2688bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334913, "uuid": "e7097a9f-f7ba-4881-8540-ff142856ba1c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e7adcc-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767385891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385891, "uuid": "da5c4893-c948-4c41-8c9d-01d13a928d2c", "comment": "Malware payload (Vidar)", "value": "c3cad5c673e2b190e7cda997377965f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385891, "uuid": "eb3549cb-eed7-4df7-8509-9abffd9a3c89", "comment": "Malware payload (Vidar)", "value": "59d896c37abda71d5321d121ec682bc058ce590a049418118d81f68235a54628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385891, "uuid": "bbfe357c-cfed-4910-94b2-dbc75abe607c", "comment": "Malware payload (Vidar)", "value": "c5882a192f298d1f69ca2bc637452daba692e1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385891, "uuid": "f3cacbbe-40d8-4f55-8d54-504583f8b84d", "comment": "Malware payload (Vidar)", "value": "dc06d254bc1872d4319b80d16f32b475f7aa1940242aa51b030d1ce99665fe5d2399a94d28628730f3210ce337601b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385891, "uuid": "dc3ec045-0c08-498a-9e00-c528c9914847", "value": "T145F322772864891ACFF34CB841103C74317BAE6019E91AD2BD990D66367CE0BA36A774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385891, "uuid": "6c2cace8-aed8-4334-8180-db59c1eacd4a", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385891, "uuid": "01eb4cf3-3b1e-40c2-b4e4-4f17a71f0cae", "value": "3072:hevrlbT9xCfsYukcxQZbMCAyNY9/ZLAGNjumunkH+JC7V5R8/W1EQWB9M3skrX:Mrl/9x97xeJAym9aGNumunkeJi1EhBid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385891, "uuid": "431a1b9d-8984-454c-8fe3-f9694b894e84", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385891, "uuid": "5c8fad7e-b2e2-4898-8e63-66aedb511ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385891, "uuid": "734a94f1-2d46-4a31-a545-25ba7a2d1b96", "value": "c3cad5c673e2b190e7cda997377965f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf992c34-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385773, "uuid": "e5cd2505-40fc-4669-9a30-f0a09865e9e1", "comment": "Malware payload (Adware.Neoreklami)", "value": "9be55541f29140da1a7551e1d6310aa1", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385773, "uuid": "875f7ee2-c509-48cf-b0ae-1cc86933a7e9", "comment": "Malware payload (Adware.Neoreklami)", "value": "5a380a76fb24825e344c40669ae957d1acedd9858ad019623933110894ffe52e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385773, "uuid": "0e5adaa7-5e0d-447c-8532-16b7df2f91a5", "comment": "Malware payload (Adware.Neoreklami)", "value": "0b2e309263e60130c338ea151e7577ae777ef199", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385773, "uuid": "4c6fab06-86b8-4350-87ac-e062b8cc2546", "comment": "Malware payload (Adware.Neoreklami)", "value": "8f4c1600e8cd8d81954920238c7b78922d68f5f433e1f7badd2ae5b0a84ce16f1a623db176b0fabc143de6eda4c57732", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385773, "uuid": "4f8a8f22-8f10-4eaf-b661-db7c35cb28ab", "value": "T1417633213DD1E8BAD264A57983742FA1F4BDD2A13C309C5F57E02A69EF7430598A0A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385773, "uuid": "56cefae4-c978-4656-8336-73d9ff244b40", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385773, "uuid": "a6cc5b1a-444b-4171-866c-8966f48898c3", "value": "196608:P1OlnBOLjK4JRPzCuKWF7yFYCdGJo98qxmWvPzUS:tOFBb0RGTFYCxiW3zUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385773, "uuid": "8286a9c8-f311-4735-9a7b-77a9a63d9e02", "value": 7541688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385773, "uuid": "3baca121-738a-4188-992e-c7e6487fbcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385773, "uuid": "bdc0f2bc-a196-4558-abcd-31acb47f9e20", "value": "9be55541f29140da1a7551e1d6310aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ccdaa1-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385327, "uuid": "954a18ee-a03e-4ac7-92d0-eb16ae2d4cf6", "comment": "Malware payload", "value": "00f10c0ed33345974714426548351e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385327, "uuid": "658be79e-eed3-4777-ab11-36c64cd76f1d", "comment": "Malware payload", "value": "5a5dc202268826cbdf38e700412950b0ba5422ac7e4e65e66156ac19ac95dc86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385327, "uuid": "440501d4-cee5-426c-ada6-016c0ba5279d", "comment": "Malware payload", "value": "64f345101feb84719e4ccc33bd4c8ec8cdc3086c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385327, "uuid": "c92318b2-05d3-421e-983f-427fe0754054", "comment": "Malware payload", "value": "02b1bdbbb011f39e94a57cf93fd0d98e4770a789149165a74390a7f126a27b51116e9e6a80cf28cdd3bb4f880aa01404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385327, "uuid": "4d9b674e-3025-42f5-88b0-4f2a896261a8", "value": "T1890633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385327, "uuid": "029f3d00-9968-4ea8-925e-88f78d919874", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385327, "uuid": "0fdd3e9c-f8ce-4adf-9f05-4ccaa3d2b217", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Y2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385327, "uuid": "10b0f82b-39e9-4950-8e0c-7cfff2bdb700", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385327, "uuid": "cbdfa1ac-653d-4b8d-bddc-51eafba14ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385327, "uuid": "540b6601-f289-4d92-a934-6c73c819c6f9", "value": "00f10c0ed33345974714426548351e3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448c3653-e81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386855, "uuid": "fa6ebc92-89f7-4fc2-a4d4-531746d55042", "comment": "Malware payload", "value": "2f4a36dbb67f415a3938cf9d5638deb8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386855, "uuid": "82adadd9-7512-42e7-aeee-81e71397aa54", "comment": "Malware payload", "value": "5a880725884283493526b5f9875054ea1decaea278272ee5ab6f89bbd71304fa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386855, "uuid": "079e06da-9805-41a7-aeb8-acb8e9dacffd", "comment": "Malware payload", "value": "fa56ed4a7b246f11b2f41a6a9c27cfb197bae967", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386855, "uuid": "32ddb298-f4cd-40f4-a430-2c6dd7c695b7", "comment": "Malware payload", "value": "92c54a9f4159b11670113b511a08f2f2b24aafdcc608bffc8852b9d91991f8ee5016c56e1e0576f14ec2e5724492244a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386855, "uuid": "6c6641ec-ad44-414c-b772-85ccb4ece593", "value": "T1C8E633C193FC39E0F1F6698AA2A63274DB3075DCB499C218C74B31383E896FA3601759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386855, "uuid": "6ab7dda7-d7f4-4daf-8691-44a2b14e98e1", "value": "393216:K6B2HHJchWqza1U+4unsWnHCJg0sv13bfm60pfx:vB2JchWI+uWiPE3bCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386855, "uuid": "8d1cc11f-7f48-46eb-ae50-b38b83ffabd1", "value": 13922880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386855, "uuid": "02771f4a-0f59-49b3-90c3-2e14008105c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386855, "uuid": "02680660-a79a-4a36-944c-5d3efd6fa785", "value": "NibblrAI_268581.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c81042c-e812-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382493, "uuid": "0fecc812-330f-4db4-84e0-6cd1066b8880", "comment": "Malware payload (Mirai)", "value": "aaa0e350e89daba6f9d86111ed60155b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382493, "uuid": "8cf79749-1782-4b93-bd2d-a2c9cee90eda", "comment": "Malware payload (Mirai)", "value": "5a90d745919c76e9e5fae0fb27155f5a8ba41587d756ac1f1ddba31d0dbb35b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382493, "uuid": "d138d5a2-8191-4137-ad93-9c83aea43c0d", "comment": "Malware payload (Mirai)", "value": "ed246be43b62dc104ec432d06229ffc7563d4acc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382493, "uuid": "45426223-d9ed-4570-86f2-546646317bc5", "comment": "Malware payload (Mirai)", "value": "318e8cade40960adeb46b42ad73328f2481fdc777780012a8c60f331667a6f3dfe03cc4d88d6fc4ae89b626108aa2992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382493, "uuid": "7bb2a037-181f-44f0-baff-770f88005d85", "value": "T18843974A3E229FADF72C873697774B21D79423D627E08284D26CF8055E7034DA45FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382493, "uuid": "e20e04de-4002-4886-a051-92c53988a302", "value": "1536:4nBsk+HfvPoIKYzMH8ZnHPfWyuGtjZm7jsLj6ZLjjuCJyXdVu+7RT:HVdMHmH5sJyNVu+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382493, "uuid": "e4214673-f365-49b2-888e-94f3ba784764", "value": 58552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382493, "uuid": "fe41c018-5889-426b-a92d-38f32d931051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382493, "uuid": "b5c2c2b8-3d0c-49dd-a302-be36281c31e6", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dfbffe-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386032, "uuid": "14e3021e-5761-4ce3-ae37-630f3e0423d3", "comment": "Malware payload (Adware.Neoreklami)", "value": "f11cd613a5c9495aa1c36806472dc2e1", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386032, "uuid": "0c8aa50e-a1a0-489a-bc6f-e1414b6202ef", "comment": "Malware payload (Adware.Neoreklami)", "value": "5abf8b114fe63c0e9fd4ef39b59ef1d7b4ff37394d3b0e41cc05d87bae537b07", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386032, "uuid": "327321d8-444d-49f6-9ccd-48cc4f5a7966", "comment": "Malware payload (Adware.Neoreklami)", "value": "521a645ac83c730e012513b1a4e92c7bc916b178", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386032, "uuid": "a4a705c6-7787-4bb5-a958-da4110f93efa", "comment": "Malware payload (Adware.Neoreklami)", "value": "50b66f4c15ff0abd25b58ef259586a40a957e005762144c33d2b26d127020060fd18f063488f874a0c9c7979eda77fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386032, "uuid": "8742d250-f374-4492-b9ae-06ea30828aff", "value": "T17776332235D4B6FCD6420530C65433E590DFB9B8CE53816793DF8A5E38EC8D2A51EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386032, "uuid": "cb10c522-62ae-4d34-8342-b376cdaa3beb", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386032, "uuid": "c00b283c-5275-48b2-b092-1b116ef97dc4", "value": "98304:P1O0ES9sViMDG/Z7da31pgReICFrcvQRRpYJy2Plme3Q8wjlZd2aGxVkn5wZQk4O:P1O0bGy/ZBaldZRY+u7l5WxSsoWX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386032, "uuid": "f21e732e-46cc-45b0-93c0-bf36ebfc3fe5", "value": 7497611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386032, "uuid": "be95ccca-86d6-454c-addd-731cf5d2f786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386032, "uuid": "a05760af-e562-4ca0-b548-9f1514ef03df", "value": "f11cd613a5c9495aa1c36806472dc2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548c040e-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386023, "uuid": "04c7b5bc-dc17-4782-a7ee-c9b70b142e2d", "comment": "Malware payload (Adware.Neoreklami)", "value": "ee713ee05119f55c460b1fbba1da92c0", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386023, "uuid": "58a1da14-9189-4c88-9e07-1e0fe18db105", "comment": "Malware payload (Adware.Neoreklami)", "value": "5b75606267f02892ab32882438b6a134a4424bb482be3bde5250dda3e2a36a8a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386023, "uuid": "d0ffca6f-09b4-4890-8684-cc8b4e524415", "comment": "Malware payload (Adware.Neoreklami)", "value": "13b69de3c211527dab334d1fbc313e77867e7b17", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386023, "uuid": "6aac9971-7a5d-43d6-8082-6f1445df03cf", "comment": "Malware payload (Adware.Neoreklami)", "value": "f40fd92f6c4bb5fa467a4e476fd646340b58f060722fb05db1a920d880bebaf514828e3f3bb3e15e2e7efe80247f00ac", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386023, "uuid": "1efe183e-4665-47a5-8f9e-9c4ed1b472c5", "value": "T1D5763311FAA090F3DEE760328E4257DE9DB8D3C10A1141FB578C261C2AFEA95C367979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386023, "uuid": "7208ae0b-b09b-4093-8077-a264c88a7026", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386023, "uuid": "be61bc53-8ac2-4360-ab39-2c0f373fc5c5", "value": "196608:P1Od344qcj5Y7W8NNvQ/PeRroOjRrMXYI6iYlUcaOiD:tOm+Y7W8TvQ+uOjZMXKic9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386023, "uuid": "dfe5c66f-dd48-4ab4-aa5b-57f697cf0133", "value": 7586947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386023, "uuid": "e160132d-5b29-42a2-bbd3-a83d4780ea10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386023, "uuid": "8458d14b-41bd-476b-962d-f342c0d3fae8", "value": "ee713ee05119f55c460b1fbba1da92c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc4dac4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385528, "uuid": "35051578-e43f-4dfa-8d2c-e6eeff64f79a", "comment": "Malware payload (Adware.Neoreklami)", "value": "54120715730913d87366c3053cfc5053", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385528, "uuid": "b596f9e0-d8f2-4a4f-87a3-df75a73805fc", "comment": "Malware payload (Adware.Neoreklami)", "value": "5ba23d69e08728adfc62cb08ef68e65c6e9c943abedc4f794cff50961ba70e86", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385528, "uuid": "a23a48df-9166-43ac-9ce4-097399f9c4f6", "comment": "Malware payload (Adware.Neoreklami)", "value": "348844b6b026cde075c365622267eb9569f89f65", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385528, "uuid": "61d21508-df57-4196-902f-ad1c01c20865", "comment": "Malware payload (Adware.Neoreklami)", "value": "cfa962b62610305e04722205ee81981f5a2cd9e305f029d6275733235c591055aa243c4f52c1826018e2b1f4b80b0630", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385528, "uuid": "b8e4a3ee-fef9-48a7-956c-6622f10b45a9", "value": "T1A6763352B9FC48BCDD654B32BDA1AE41C6F5EF105E7490F32780184F1EB96CB0507AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385528, "uuid": "4a0b3e5e-9bb3-4fd6-abea-14702f4c3d3e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385528, "uuid": "8c8b5bf5-7642-4cd7-ba9a-ce2ce1f05468", "value": "196608:P1OHzwyLPiZKECqC9vxXjaoILHDvSNu4F4Vpm7puQIT:tOTZ+2l7aVHDvSNuVY7QFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385528, "uuid": "1b1a3401-556d-4ec1-89f9-0e3194bfb977", "value": 7512116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385528, "uuid": "aa2fcb61-e579-4dda-a95c-49de0edff0f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385528, "uuid": "433281d3-a022-4e15-9b43-d410130628bb", "value": "54120715730913d87366c3053cfc5053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b870be-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385624, "uuid": "9818a860-9006-4106-ad10-1d968e972b2d", "comment": "Malware payload (GCleaner)", "value": "70ddcadb450649cf01a38c053a24f83b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385624, "uuid": "58e45fd5-5467-49d4-9695-a7f043a6169e", "comment": "Malware payload (GCleaner)", "value": "5c2430ddb6b84f5ee7c5905fd0c4fee770fd60346f0959655060dd907aa377e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385624, "uuid": "7707e78d-f18d-401f-8d3c-5785a7e13240", "comment": "Malware payload (GCleaner)", "value": "6fca7f0609cf9f54d4b56c6f24a7e5305d7dd1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385624, "uuid": "ffd78eb2-849e-4d1a-bd4d-fbe60e84fa40", "comment": "Malware payload (GCleaner)", "value": "629e238a9f61570b27cc1b4d4a605f713bc9b2e68f1df13421886090d8756f0ea5b3ab9b076efac4c1d6fc15437e9738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385624, "uuid": "78053bb2-1647-41a9-a46d-a64ab5922c53", "value": "T10126E011D090F7AEF0725FB6AC15205BECA52832FB7585C5BEA7285B781D8F82434E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385624, "uuid": "8ca2bfad-8ec4-40f4-8d2e-1c21aea4b173", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385624, "uuid": "634a8d6d-190b-47dd-b681-90d6250d526b", "value": "98304:QrSW5aQtiGd0k8b1pqTrLI0SLZjQWcj1ecKzAjk+Es:InawvCXqTrLKL9QWctKzAjkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385624, "uuid": "e6aef027-8298-4ad2-b692-0e3563fc28b4", "value": 4610832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385624, "uuid": "36d85f26-0c27-41d5-953e-00a9afe50a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385624, "uuid": "df8ca993-aa6d-40e5-bf8d-f8afa3cc9c3c", "value": "70ddcadb450649cf01a38c053a24f83b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83afb7d1-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381377, "uuid": "6c58ca5d-b1ae-454a-9d9c-ebe5c09ec995", "comment": "Malware payload", "value": "8cda0b7a3e8bdbe0fbcc5ce1859a5d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381377, "uuid": "4cfd3995-2f5b-4773-833b-6f1bf9663561", "comment": "Malware payload", "value": "5c7bf5638d74973a6b0d552ac45cac24a6318fad45f5fa1a32a46e54240b4f5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381377, "uuid": "5c1b25a5-943d-4c77-beff-b62b636ce13f", "comment": "Malware payload", "value": "84dcad000b523a49bde1e1b0e1edf5432621cde2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381377, "uuid": "280b93fd-7a3e-4824-908d-c3f38e468668", "comment": "Malware payload", "value": "5d7ab082b677b196c3ce407716ebaf46df36bd7aaaa4fbe618c3b7ff7a6d96b9e25dbd7b08ae16a9657feef3a7d83c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381377, "uuid": "423718b6-1b5b-498d-a6af-0e4c0b0959ef", "value": "T16E054A82FF1C0563C9531DB1297E83D5F3217A9240F8C229331EAB572631E769ACB796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381377, "uuid": "36d478bc-14be-457e-b939-39a45d458182", "value": "12288:OOPU7Mj32yRji7+ciE86KVMZJ3f1w92dAYjG2rjm59yYyfWqJVPPjuvGepOOdV+S:OOOa2yRji7+cKqJP1wQmv22WYy5PPodf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381377, "uuid": "f490cef1-5ff5-47ee-b7c2-1dba7f5fd269", "value": 858004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381377, "uuid": "16d9a67d-f2c4-474c-899c-2f46d2716d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381377, "uuid": "e229b46f-db33-4f25-9142-b1e7889dfcea", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268dbc9a-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335695, "uuid": "649b18a0-5118-40e3-8ed6-e710d33788fa", "comment": "Malware payload (Mirai)", "value": "837d100a9389b459ee92aa1898c1d677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335695, "uuid": "0764be44-41bf-4425-a28c-456330844474", "comment": "Malware payload (Mirai)", "value": "5c8de3a946e7e61cf33eff430e1ccdd0e3181498eb523d114f2e215a5c90b9db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335695, "uuid": "b27c7b9c-dc88-4df9-aa6c-34f63e559b7f", "comment": "Malware payload (Mirai)", "value": "53e9b2bc60f5a91f7854acf15def43ee87c0bad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335695, "uuid": "3ce5c3b7-f417-4d71-baf1-e247ab7c3de2", "comment": "Malware payload (Mirai)", "value": "38823fd2ab4e3cf83c3ad2530d4e34985656884883b209879d973ed135e4ad9e717c8aef39b6a81cd49b8a7cbf912487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335695, "uuid": "f3c9a2c8-5e00-47b2-9fa2-1a085b798506", "value": "T19E936D02B71C0A43E1636DB47F3F2BC1D3DAAA9112F4E689350EBB499071A326547EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335695, "uuid": "38f2b4bb-b178-426f-881d-cabe5e11ec75", "value": "1536:NCXfqTJF8HMVZF60aSwhLWAS6REeybZIqx6I0Lj:Nq8F8HMVZF60avrRzyVoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335695, "uuid": "277211fb-57de-4b0e-b974-449d668f376c", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335695, "uuid": "48d47add-b762-4d59-b05f-ecf05067788f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335695, "uuid": "3ef68a13-2567-4368-8e2f-3bf9cd970402", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfb78a0-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767356323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356323, "uuid": "dec804c6-aa73-4aaa-9ed9-e4f56d81b624", "comment": "Malware payload (Mirai)", "value": "cf76ecb5f7237fc817d53f8649a902f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356323, "uuid": "e881d9d5-dc8c-40f8-a110-e3d996e52b68", "comment": "Malware payload (Mirai)", "value": "5c969233a0eaa72b4418bef4deca679970c3f4080d8556ec8e83c721a31a7dfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356323, "uuid": "c85a9073-6b25-4038-a772-6b0aca35b632", "comment": "Malware payload (Mirai)", "value": "c801aeed3a98d93fdb9eb36de5ef455bba2a43bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356323, "uuid": "ee27d8db-c67b-490f-888c-4260d9de523c", "comment": "Malware payload (Mirai)", "value": "ca6ebcbef563f3f677df11aa2b122f1eba4fd2d4e6678eaae6c1698f962235355c13e0a21cac7dcd703657384ec22bfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356323, "uuid": "149583d3-3025-484e-abf9-db9ea18cae99", "value": "T157044A66BD92DE26C6C62177FB2E818C372713B8C3E73106CD255F21678A46B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356323, "uuid": "f6d14898-3b83-478c-bf21-c63f60bba787", "value": "3072:+zd5CRAOWlVSTvTockS8rJmUUDsG1Tw2t8HMhWVYJql9s5A0a:+dIu9P3ckS8MUNG1TPyHMhWVyql9wAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356323, "uuid": "9d79334e-9bc4-4cc2-af3f-1dfa69b11f65", "value": 179600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356323, "uuid": "ed5dacb6-5eba-4b9e-92c2-80a5df418461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356323, "uuid": "57ea7d71-9fd5-4494-9676-a3221d9a0494", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67479618-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393356, "uuid": "8ac5655a-2b45-4ea4-b572-5eea256d23f4", "comment": "Malware payload (Mirai)", "value": "fe991cfeb2b68246f86037dc2a45bcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393356, "uuid": "8a4f659c-73f7-47c9-a16a-e49437db76d0", "comment": "Malware payload (Mirai)", "value": "5c975a5c1e9983dd8e204fe207d44c1bd2389b6825d6bdbe44f635eb90bba318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393356, "uuid": "3086db18-1860-47d6-af02-fda1a586e5a5", "comment": "Malware payload (Mirai)", "value": "185ad55a5d18b85253c53a31344348714f9557c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393356, "uuid": "452e455d-60b2-41aa-86ea-8b99b2ff8a7b", "comment": "Malware payload (Mirai)", "value": "34485406e1e5de7031fd32c6fc2381430135ec7aa2d2ba35d79ebb146e1711f815a29c55eb5643d58b0dbe860b0c08b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393356, "uuid": "1eea77f8-6ae1-4b58-9892-e7a96bfbc501", "value": "T14743F120266A8E61D66099BFC5B483C3530B637752CAF4605C74D4F4CBC7B2A27D8F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393356, "uuid": "687c4651-2d4c-4d62-8791-686114c93e9d", "value": "1536:tOtVuhMsYfD6utYj3wHH77xjtbonHleoT7zx:toXsYfm87ptboHsoPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393356, "uuid": "945bf41e-9a8d-4090-9817-6c68c563603f", "value": 59156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393356, "uuid": "3cf3f344-0098-4189-8432-ab53bf85d3ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393356, "uuid": "fecd5ec2-8a67-4054-bb36-a6cc78c9b98b", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff06832f-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316301, "uuid": "a5e3a116-2bfb-48d4-b6c9-ce0af31abceb", "comment": "Malware payload (Mirai)", "value": "e6a6a1e40d85bfc1850a8aefe8d9f1ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316301, "uuid": "ad4ddddc-5c15-4549-8abb-b7b975b272ed", "comment": "Malware payload (Mirai)", "value": "5cbe442598f8f4e473daadfa88518ad5ede7c24a59ede1af42e9ea63b7c03ad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316301, "uuid": "4f7d847a-11ef-408f-bf4f-84b83c005b9c", "comment": "Malware payload (Mirai)", "value": "8c7eeda98fe12a42d3f37950102e1b2f05b18739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316301, "uuid": "ed90d58f-1066-456f-8806-7e3aa035f838", "comment": "Malware payload (Mirai)", "value": "35c5578a88e17ad69cc003616427beccae231f62cff583dcd181fb8d7091b2488b55335375a5f61ffed4d3ff0b5a3fee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316301, "uuid": "d1b4ced4-f4b6-4ef7-8ad7-3d64d9eb0670", "value": "T1FC04AEA3B70F24D1CC6102F80BCB5B9D6A232502AD67D6E76C2F353A6E760DE59123D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316301, "uuid": "d8616383-e007-4e1d-ab62-b434a6406cf1", "value": "3072:24JVtfgqMjjq6Gap3fNv8n+anNsmo2nF8plOmqYkqGgQCRjIHSAlvq:rXfD6GaLE9qaFkMNY3QCFIHZvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316301, "uuid": "63632f0b-3a1a-4025-8f41-9a79d105a0aa", "value": 182180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316301, "uuid": "a91fa052-3403-4bd9-9d4a-06d0bea1aaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316301, "uuid": "81351a87-4b6f-4544-bb2b-0cc40b902d86", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbb6c8f-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336032, "uuid": "724df7ad-e172-43c7-ac88-a3416678f5bf", "comment": "Malware payload (Mirai)", "value": "865217e0e09b4c0175bc60870a9b419b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336032, "uuid": "402fc3be-a92e-41b3-8e75-99b31b211a8d", "comment": "Malware payload (Mirai)", "value": "5cd26e6f734b0bf7b91fb70d9e1a7a5c9827ff4c74412a987ec83c4c1cbeccb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336032, "uuid": "cdc3fe22-7724-41d0-abcd-854ad2d78963", "comment": "Malware payload (Mirai)", "value": "6e8f2c7741a2852e73a1a3d91982acd41b44f921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336032, "uuid": "239d6821-d41f-467e-943c-0b6ea16b4f3f", "comment": "Malware payload (Mirai)", "value": "cafb558ca1603979758152341b1474bb59cd1e85f2f1d0bff6aebc1b993e15356fcdae4c495a592f15682bca12a37eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336032, "uuid": "4e3e952d-d4b6-41dc-b5eb-0de799e03828", "value": "T11C53018410F3D634D1A9B03E4D67B15D5F611B63E70C8BFA6A81E2649EB4AFD102D3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336032, "uuid": "f14053f2-86b6-42bb-a0bc-71b4d783508d", "value": "1536:tzwXH6hUu0G0WdI3W4fHWmMRO2Rqnouy8Gy+:GXtun0GAfHWX42RyoutC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336032, "uuid": "0b36456f-534f-403a-a009-f5c537281686", "value": 63992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336032, "uuid": "9d7fc1fa-c76c-4f3f-93c5-07a97467c73f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336032, "uuid": "a4eb9dfe-85d9-4ff2-afc2-b0671da867a1", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b4aa21-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385560, "uuid": "696b0ed6-462d-4ac2-a1a0-79df6dd2d377", "comment": "Malware payload", "value": "619951b90b2f8afd45b947c86f1c551c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385560, "uuid": "c9192d8e-3529-41e4-89de-e7665b827d36", "comment": "Malware payload", "value": "5ce8febffadf9ed103f48325eef1f1a039dfb7cd1d8cea9a48c9e4c9c175a3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385560, "uuid": "a3ccf457-0014-4463-a53e-197ddccfd375", "comment": "Malware payload", "value": "fc913770f5d8fc24dd4e7e651733229fa01b8022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385560, "uuid": "6175f1f0-b6c1-47ef-bbfd-73b13a73b5b5", "comment": "Malware payload", "value": "4611cb77ff99fecc62508adaaf4bfd081ae0a4d8a7fe4f57c151d86a3ab0e5c527d04062515e72c0717e61ec769fa854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385560, "uuid": "193c48d9-e865-44b5-9e42-302aa4a51781", "value": "T1F90633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385560, "uuid": "eb155223-4ee9-4fff-a66a-89dfd0334c60", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385560, "uuid": "53460b26-89da-405f-8848-6a9eaf3ab70b", "value": "98304:aDT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:o2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385560, "uuid": "4d343db4-be08-4410-8c77-5d3662e2333b", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385560, "uuid": "b7f9e598-0f6d-4f78-ab99-9491aad2a47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385560, "uuid": "fc6b56ba-1a3b-4e27-aa5f-6febcf3fecad", "value": "619951b90b2f8afd45b947c86f1c551c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234669c5-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392383, "uuid": "02484dd4-6a94-4aed-8e8a-68fae24e8f61", "comment": "Malware payload (Mirai)", "value": "a5cdd5acdb562b2bb301d212a041b49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392383, "uuid": "59e54246-3b00-44e4-a036-521dd3ccef27", "comment": "Malware payload (Mirai)", "value": "5dbc8f6e41f6dd93e5c2dce90c7b2c3887e9762952e16212162864c4e6efe51c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392383, "uuid": "0e6753a8-0b32-4efa-8e4b-acb3f6e85755", "comment": "Malware payload (Mirai)", "value": "00b1bc0eb504d0b98ada962fe185aa7fb3279768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392383, "uuid": "6b0ee550-9ccc-4998-814e-ee5a90798428", "comment": "Malware payload (Mirai)", "value": "deec01a6e1009ff16d4d13ea1b780d13cfe68c5b51595edcbac22f7c5afc02470c3e25f8e0c5bec65af65a6f21cfd683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392383, "uuid": "0c048de7-32e0-44c4-b939-b6fb03d37610", "value": "T1B9732B94F890DA61C6E4257AFA5D528C33530B78D2DE7202DD24BB3537FB95A0F3A842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392383, "uuid": "3b7999b5-56f0-486c-91dc-2abf238161e2", "value": "1536:1yDU3/f0zKnIfQ94iRovjX9aCFOqKATwlhFDV64ijLD2GFOD9M1Ir:1ygosIf/wovoqKSiFDch3WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392383, "uuid": "61fb4a92-a422-4e6c-81c7-a48e9b6658e3", "value": 75040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392383, "uuid": "db56e99e-3742-4109-ba01-bfd5e3c52f99", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392383, "uuid": "cbdb161b-4a68-4cb7-8aaa-f9278fe653f5", "value": "catgirl.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f26b53-e77f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767319725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319725, "uuid": "c0282ae3-f236-4575-8988-c3e333f17efa", "comment": "Malware payload (Mirai)", "value": "06e723621f56449c3365e0376fb9b53b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319725, "uuid": "bcbbf5b5-1e74-4716-a923-f88e390252cb", "comment": "Malware payload (Mirai)", "value": "5e641b530f5511ad8607c97b1815c393b7e6cd691ce3b99bf49fd862ab1d494d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319725, "uuid": "39a66708-3e4e-43ca-a9c3-13eaff05b867", "comment": "Malware payload (Mirai)", "value": "98a9153be85c8e0936f26ddc3a1b2e3e56fa7841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319725, "uuid": "7de46dcb-ed48-46f2-b7bd-0439b1e0426a", "comment": "Malware payload (Mirai)", "value": "407e49ab79c6206de1d31406ebd47e814c198dbdfc67cfd701a231eaa655dd266f86072735970a87ab61207c437f2879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319725, "uuid": "46adbb12-ae28-4af4-9734-775b17339193", "value": "T11F436D0760C180FCC49AD1B487DFAA36EE33F8A942A5719D67D4FB226E8ED204F4D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319725, "uuid": "acf2c143-95c1-48c1-9c2c-6a430384d865", "value": "1536:7g+CdwIPcky6aiVeLIEM1jks/oDcbqIOUwf:7gxdZPTlaEeL61jks/Jb6Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767319725, "uuid": "efbbaac5-59b5-4e4d-9023-ddbdf8c4440a", "value": 59968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767319725, "uuid": "fe465423-70a5-469d-a14b-14aea0d1fccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319725, "uuid": "1d1a25cf-084b-443b-a0e0-feb580223aa5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa168f6d-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385442, "uuid": "d10fd21b-b4d2-411d-8619-5f0780fae3ef", "comment": "Malware payload (Adware.Neoreklami)", "value": "2e328b914a7fd58534c810eb038ae61f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385442, "uuid": "342ca6b6-3127-4390-a5ab-1c551a9f844e", "comment": "Malware payload (Adware.Neoreklami)", "value": "5e861b535202085358fa145212d22db5d2bc06aa7e0516ea16e0c8915490300e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385442, "uuid": "1ea57418-9341-4640-9165-f2fa80772299", "comment": "Malware payload (Adware.Neoreklami)", "value": "9ea3d5a0016dbe5d44755be1016604e38fdae06d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385442, "uuid": "544fba32-55fe-41da-8aca-286f57e21b3b", "comment": "Malware payload (Adware.Neoreklami)", "value": "d27defc066cf0dead00d36d4063e22085ec8d6efdb2ffab4f85cf098eeb6fe7f3b4333501f7a949d4340fa743becb670", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385442, "uuid": "a781b1c9-1d7b-430c-b140-748bb66cbc69", "value": "T174763323B1905937E2219F34EBD85FD4F1F0E6880F7886B35699A9796A3C616810733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385442, "uuid": "7b30758b-40e2-4b92-a22a-2df8700c1050", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385442, "uuid": "82fc45c9-5df5-4b6f-8ee0-2eea827f0e64", "value": "196608:P1OTjCReEGQ28SbKrXzPG6EFdu+uCAo/+nmP:tOTjCReDQH4KrXz+6Ei1y+nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385442, "uuid": "52923e3b-8391-4c79-92cc-c2a4f4dcaa91", "value": 7543468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385442, "uuid": "9dbc2ce3-22d9-40e8-a205-162b3f9da050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385442, "uuid": "79e388fa-5312-46e5-aa00-96b78077a061", "value": "2e328b914a7fd58534c810eb038ae61f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c929b20-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385983, "uuid": "9e721045-0766-42ac-bee8-7807f6fc0afa", "comment": "Malware payload (Adware.Neoreklami)", "value": "e1d1a68cb4da9ee135eb2d64ebae7f0f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385983, "uuid": "d1a56dc0-3d55-43d4-8414-46473a29bfbd", "comment": "Malware payload (Adware.Neoreklami)", "value": "5e9ead30ecb8a2df014dae07fea2fdd0ce81309b5f5ad6ca3e6e1652961eba05", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385983, "uuid": "5b50e99b-f830-4b97-a49b-a7e3d3ad7aea", "comment": "Malware payload (Adware.Neoreklami)", "value": "5f801946163eb2faf6effbf93813052d69538033", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385983, "uuid": "9ed5a191-77ab-4e01-a014-0b8268df8825", "comment": "Malware payload (Adware.Neoreklami)", "value": "8b064cb92a22fc3799947acc76a0acad30b495a1673cb1e8cbaa799bc5b1c1b43af35f7ff5fe028c272ee9701eb3eab0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385983, "uuid": "ce38ccf6-24cf-45b2-80f9-863791c23de1", "value": "T1E176333736E080BAE841493246D52FA7E2B3AA7066321D137356DB2C9F7D294D80B71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385983, "uuid": "b5ee9de1-d63c-4e93-b0aa-3aa6e558f609", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385983, "uuid": "985a7858-6d26-4c51-8f07-4ef8b3b83130", "value": "196608:P1OfT3rmaCL+qIfiCRZrY+vvrsvnFyLLT:tOTrJCL+qIftLB3wY/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385983, "uuid": "d65f804c-119d-4de9-9a93-304075ffed83", "value": 7506511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385983, "uuid": "316ca141-8788-4ce5-8752-d5c0f2d28e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385983, "uuid": "4236cadf-f791-4355-beb2-6f9bab132d75", "value": "e1d1a68cb4da9ee135eb2d64ebae7f0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0056ec-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386198, "uuid": "e621d03c-1a25-4cbf-87ad-fcfef10ce644", "comment": "Malware payload", "value": "1c12ba45cbb737ea3e1605c8ab103694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386198, "uuid": "352e73b5-987c-402f-928e-88e457313980", "comment": "Malware payload", "value": "5eaa39d838a594913866eeee0599419bc1a8aaddfb6c819e60f72980a0e95802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386198, "uuid": "7a3b6101-2ebd-466c-8c81-0dac7b5752e4", "comment": "Malware payload", "value": "4d3356514707f4061045a9d0fe36b0086dfdd5c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386198, "uuid": "4d33e684-2c2b-4c06-84ba-b9eb889a6e0e", "comment": "Malware payload", "value": "ae7672e81022b6668eb8869e51515767ba4b1a493941e6183a4e7f389866ff863b1ff86d9fdc6eb3989ec63e7fc31d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386198, "uuid": "4b57c85f-db9b-4861-a657-f08fb176826e", "value": "T1A6A43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386198, "uuid": "e309a65c-003a-4814-9959-df31ac1680d8", "value": "dc3120d7b4090566a887530f3c294893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386198, "uuid": "6265f47a-5cd3-4109-bfa5-4b202dd6e228", "value": "6144:NAKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:KKZPBhxVLCV2RcG+/CZ7VZBx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386198, "uuid": "1f8e95dc-410a-4408-ac82-e7fab35d2c68", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386198, "uuid": "704f6ad0-a097-43ac-be23-b2b1f8435efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386198, "uuid": "fd4a2024-81fd-452f-bbf6-2fbc9f969658", "value": "7443ad113735ee5f21b3bc742fd4497e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c281d22-e7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767372292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372292, "uuid": "512d2e23-c51d-41d5-909f-00e8ebc10f5f", "comment": "Malware payload", "value": "1e8958c95d30456b12539ba4ae90f3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372292, "uuid": "d4b79503-e23b-49d8-8aff-0e622af7b3a2", "comment": "Malware payload", "value": "5eb2299706493e2a6a3c30c2253ffbf0f644515745035b7f858e5b90d29c5662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372292, "uuid": "37f2cfe1-4663-4cb4-ae6d-a048cf78e44a", "comment": "Malware payload", "value": "f36aa43580222a3373a5bcd4c926869456116ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372292, "uuid": "173da6f5-8f5e-4c21-9b81-9143e13446cf", "comment": "Malware payload", "value": "6160cc54ee6979dafb4dcd4214f81c34263554bc0e0d01eb2f1c10a18dde0d14fb3f0bdf7896d99b4ff05a77f00753cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372292, "uuid": "15ac5ec6-864a-4344-ad01-3a452525f048", "value": "T17C0833960932D312C59778F8C7AE4BA82B435C373EE9F50F5AC0B41DBB314727A59A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372292, "uuid": "751985a8-d076-41f8-a546-12a296897263", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372292, "uuid": "ddbcea78-cd40-4983-8a7a-423b91b3f300", "value": "1572864:CkcszpioQ6MrZws2K2kC8CjswNQze950nmf/7XPg3F4:C1/oPMiORQNQiLI3F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767372292, "uuid": "59f88fc6-4da3-402f-8458-611044c86167", "value": 77394071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767372292, "uuid": "5b19171a-d347-4856-8fd2-ef24ea546650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372292, "uuid": "31d17c68-2c35-47c9-abbb-338f8b1c11a3", "value": "D..e.e.p.L_X64.1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9493b3-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385367, "uuid": "cccf109b-9246-45eb-9f1c-45d7dccbfb83", "comment": "Malware payload", "value": "11070c01310205cb75aeb7938435f228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385367, "uuid": "9b21126f-7818-44c6-88d6-58f9e2db338f", "comment": "Malware payload", "value": "5ecd3b4272cf8345034b097b929f755a94c346cd89e2a6d453d8cd6332c5f14d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385367, "uuid": "c7e38db4-a4e3-40e6-b699-92717fb69613", "comment": "Malware payload", "value": "381c20a405d9ecd974c5121ccf2f451bc80fc197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385367, "uuid": "f2972cc8-31b0-46d2-aad6-da9412872d34", "comment": "Malware payload", "value": "601e1ecced732b6838cdde61095988d3f78a1241378282baaa8be5f4df9b52b8a3a0e360338a7ba6e776abe32bce0740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385367, "uuid": "dcc8fb32-7b6b-47c4-a538-258e55bda8d4", "value": "T1B50633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385367, "uuid": "5b07e5ed-2e66-4024-a1ad-b196c6e51b38", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385367, "uuid": "08b7991c-034f-4c25-81ed-881dbe0eac9c", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385367, "uuid": "2605d7dc-ead8-465c-8a7a-38812acfa175", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385367, "uuid": "5db0edea-2741-42cd-8ac3-d68d62ce339a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385367, "uuid": "32a23148-37a5-4273-844b-384be50ec7c8", "value": "11070c01310205cb75aeb7938435f228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c514b391-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385782, "uuid": "1a6a9fb4-4271-40bc-a943-dd2d194535bb", "comment": "Malware payload", "value": "9da68317dcd6284eecc37686200ba2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385782, "uuid": "dafffd10-921f-4eb5-9406-de6f76c1e18c", "comment": "Malware payload", "value": "5f18d1d2bb6766e08d89f145c36ec1c435ff958189df8653c0d45f8dd5dafd2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385782, "uuid": "11691a0f-9429-46bd-8d73-43a2d0841078", "comment": "Malware payload", "value": "2aaf1ea1b0e9b96dccb3746f35c8754c83462017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385782, "uuid": "9ee4386c-3e78-49af-a8e1-28dd1f651cf4", "comment": "Malware payload", "value": "6a9b9d4c45f71476e8673010f956216f3b787fafed2aab355d789c9723a0ab5fcd7c7228a465d8b7f6360411adec5157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385782, "uuid": "5cf4f53d-5931-445a-bd3d-888f7c563a0c", "value": "T18C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385782, "uuid": "2e9807b8-cc98-4e2f-a6c7-ed49ee5e0b8c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385782, "uuid": "c7bc880a-9585-4a10-9f4a-93f9d2fb2f40", "value": "98304:aST3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:h2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385782, "uuid": "492a5bc3-fff2-4bc9-aaab-fc6da3ec606a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385782, "uuid": "66fe62cc-f92b-43b8-aa22-603f881358f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385782, "uuid": "6fa4f367-2405-477c-af73-272fbac30f31", "value": "9da68317dcd6284eecc37686200ba2b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873296de-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393409, "uuid": "7b30d61b-d15f-496c-8bf4-d8936a5bafa6", "comment": "Malware payload (Mirai)", "value": "987fc071df7c250fea0cc0acb9c0c737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393409, "uuid": "ce692152-07b4-4106-8b9e-d66fa280aad5", "comment": "Malware payload (Mirai)", "value": "5f84f93fd9d945620d28ac37491313c41e7c9f1177e3e90e3c08ba997702b64a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393409, "uuid": "d43106b1-9650-4dbb-938e-8c69c899e6f9", "comment": "Malware payload (Mirai)", "value": "089f3c9ead05e6f6f8af7225fbe184c020b2f39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393409, "uuid": "49fa99e4-4cf9-490d-a9c0-f79519996203", "comment": "Malware payload (Mirai)", "value": "52316a82163ba281d00ebe190d34708ecd0ee8e2a95c67eb5bbddc9d0d2469a6c4279d79d9f232f9b6ffe1d09f113e0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393409, "uuid": "7e4a45bd-98a9-4b1e-a33c-8108809674d6", "value": "T1F4F31956ED819B11C5C156BAFE0E528E33131B7CE2EE72129D246F34778A8BF0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393409, "uuid": "fb8ec8e0-064a-44db-8477-0d950cb448ef", "value": "3072:j6PBhV8F6wiqmsrtEO8hQ57Q3XGFt8aSwlvfYX1phoCxnZboLOX:ePBH8F8qmsrty+8XGF6aRlXyphoCHboe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393409, "uuid": "663a8ea2-9afd-4dcd-abbf-de9eca9bb01d", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393409, "uuid": "7396634f-a600-4b68-b0d8-3c0d215ea577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393409, "uuid": "15d9b44f-a46c-4693-bebb-6739b98ea2aa", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10289457-e7b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767343817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767343817, "uuid": "cf36a56f-a29f-4a76-b144-d46017816cd2", "comment": "Malware payload", "value": "eeb4b8f05310cdeec97c2d3441abb674", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767343817, "uuid": "8a6606ce-d47b-42e7-8140-39af41d12c69", "comment": "Malware payload", "value": "5f9c4af7ac12197fb8df152d27f9aa6cc1add0613eb3ecfd7699807b0d35e577", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767343817, "uuid": "4a9cdc3e-1410-4958-943f-048102055340", "comment": "Malware payload", "value": "21bd497817774236e5aba10171508fda337a71a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767343817, "uuid": "3fbd3809-d506-45ef-98dd-f051379441cb", "comment": "Malware payload", "value": "aea8f382c928fdb57130b11bbe5f110ae5742c00494cf49492fa2e1f0e28c40a2b1abeac3f7ceab5391dd9850950a3ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767343817, "uuid": "bce09942-ec0f-4811-9787-c409174e579d", "value": "T10275FE232380AFA6DC3B9B62F739FDE4EA1C6B783151049BC4456C0456A572897E3B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767343817, "uuid": "8c66d52f-b751-4d66-8e63-38900a51ce0b", "value": "24576:4EPs4h786rFpiIQo5PCnXWbnogW0rXd+I4bw3UMIVn:4Shh/WgV42y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767343817, "uuid": "287258ee-bf93-4d7c-8c78-2ab19817066f", "value": 1588317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767343817, "uuid": "57dea419-ac6e-42fa-8678-952674c599db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767343817, "uuid": "33378635-050c-4388-9e34-891c75b6004f", "value": "encoded-1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb3b0c0-e812-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382492, "uuid": "670bb9e6-99f1-4556-b12d-cc507348e577", "comment": "Malware payload (Mirai)", "value": "cddfaba1ae6c3c9f3401eadd3c9b93b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382492, "uuid": "c49bbc7b-781b-4f23-ba3e-b1a53d07f10c", "comment": "Malware payload (Mirai)", "value": "5fea4aa7b5c13a8c293b532d9875656b55bc80f1356dac92be63a28212b83cd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382492, "uuid": "314c04b0-b34e-4b89-8cc7-ae1bbc319b5e", "comment": "Malware payload (Mirai)", "value": "c9261ac2d88293e5dc99200ad737440f30d11e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382492, "uuid": "e3638812-650f-4f94-889e-c24be1f86b03", "comment": "Malware payload (Mirai)", "value": "c77b89b458dc0fc380b2d73160bcaa8ab93d5ace5c82bbaddacebfb7e776290c46101aa12300352d6b87324ad71200b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382492, "uuid": "ea3d0b68-dc02-4289-9033-fcf8c4d5ee4c", "value": "T150531945BC91CA26C6D462BBFA1E42CC332653E8E1DE7207DD11AF157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382492, "uuid": "422736f5-fadd-4895-881c-e93127ed2bad", "value": "768:SYRXR8CaTWaqBL1ilr6t2ri62DkipRI1kiyJek7YezmNdktJBi/E69yoDXu+7R:7XR0Tat2W6urpRImZeWFOkMXrXu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382492, "uuid": "5e75886f-4f43-47dd-8f6c-e87f735c49fc", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382492, "uuid": "4c28a811-e29d-4c7b-8240-ddf8ba1715e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382492, "uuid": "8024c543-4d8d-4350-82df-ff5e13e23d50", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1373111-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385856, "uuid": "8b5f08db-1b37-4899-b0f0-6fa227cf05c4", "comment": "Malware payload", "value": "b7fe781e765b263ab72768950ba488df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385856, "uuid": "b8b05d58-7949-421f-b0da-3a18f3425987", "comment": "Malware payload", "value": "60133ba64039a15a8fa736887d4f7fa046279d25f8427b07aea8fb355bedc4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385856, "uuid": "8fa3e2d8-1c2a-4ff5-bb7d-a395a0375bc7", "comment": "Malware payload", "value": "3095a930b85a0315620bf5c4d3944a828eb71353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385856, "uuid": "c261e9ac-5539-4777-8e0e-e4686f755772", "comment": "Malware payload", "value": "d75e559bb9c750bffcb24150d934979467bfb6e85a7df4a0ffd6f4ec6c85454c312b4f29936d61659ad2e9d9ff40831e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385856, "uuid": "a2fdf883-e83e-4c39-8414-f9d88089f14a", "value": "T1530633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385856, "uuid": "66de8e98-8cbe-4845-b4e3-ded1726f8610", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385856, "uuid": "e3dd7bf3-b3a0-447f-bb80-f5b53f72b318", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:g2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385856, "uuid": "a2b41444-a0f5-4710-a221-c3d5f948703f", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385856, "uuid": "aea52328-5c07-4be7-9adb-2b2da53c0cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385856, "uuid": "b5bdab35-9fe8-4ddc-9683-f0b87c5129da", "value": "b7fe781e765b263ab72768950ba488df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6245d18-e807-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378080, "uuid": "584f8370-90f0-4195-b6d8-9da46f9cd280", "comment": "Malware payload (Mirai)", "value": "855675f8e8992954a37c6f4c4674bb1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378080, "uuid": "b14aa06f-0c78-41c3-a612-51feafc64e01", "comment": "Malware payload (Mirai)", "value": "605dd76776492b5542f1617eea797863c15b05964a3d15cfdd99304b95ffc9d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378080, "uuid": "c945d776-526e-4860-b84a-29da4ffa9f8f", "comment": "Malware payload (Mirai)", "value": "3bde308d94ce874024e4b5f966fd0b96aa325ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378080, "uuid": "d1b9af9e-357c-4849-865f-53d7f2e8cf0d", "comment": "Malware payload (Mirai)", "value": "f01194a447cb141117d0754fa9f36e1b326dbea8404d420d8e1e2717fea1af4209b9906ca744ed151921b917cdfc8386", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378080, "uuid": "d07c2241-0056-47c4-a190-c1e0a3b6c736", "value": "T142040845AD419F11C5D622FAFA9E418D3353ABB9E3FA7102DD205F6023CA98F0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378080, "uuid": "c0553b53-1bf0-4a44-98fa-d711b9357866", "value": "3072:072f9FELxUBntrREHKVAbW58fyit9fKNwODuxEHK1gWaycsAryfLYCDaC4V6qfB+:fFEVUBtrREHKVAbW58fye9fKNwODuxEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378080, "uuid": "3df75428-36f2-480f-8cf7-2b0cffc5bae4", "value": 178884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378080, "uuid": "ad3efa46-a5b3-4c1b-9548-4c756518e04e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378080, "uuid": "a6519651-c212-4941-ba9e-e1f00766e604", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e369855-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315977, "uuid": "e7107774-2c46-458b-9bec-c539b4c41797", "comment": "Malware payload (Mirai)", "value": "b816627e552dee7927f5d0c856c69ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315977, "uuid": "18319b2d-e8c6-4b23-9616-8950893f4822", "comment": "Malware payload (Mirai)", "value": "60a1c0ecffa9d628e2fd29042326c1acc8ddd9b49135ec66e8d9113acfbff10b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315977, "uuid": "eaa08dfe-3456-43eb-b3cd-a8129a268445", "comment": "Malware payload (Mirai)", "value": "955103a721e344411ceb772a2ac7553af968bf66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315977, "uuid": "664f8d90-a13b-4d53-ad1c-3ffadf1551eb", "comment": "Malware payload (Mirai)", "value": "7c0b729fa0f803ce0023b793d881eab03fec25e86802752a9404a8972adb690f2f0a2e244e4a0edfb0309cac8b956d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315977, "uuid": "b2f74ee5-195d-4fc8-b528-4295a2611a7b", "value": "T13D141A42BD918F13C6D622FAFBAE018C37167BA9D1EA7103DD21AF6037865DB0D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315977, "uuid": "10980c72-063b-4bd4-b8de-1d1079dc4c22", "value": "3072:AB2aKaifhsTWJQHEeKEY5VG4hKSHxvSedTuWbjqj:AB2aKaifYWJ1eKbHG4hVv1dKWbjqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315977, "uuid": "04bf05de-0df7-41e9-b431-03946abbe360", "value": 199548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315977, "uuid": "f2dc033d-bb68-4cb7-9f64-7297501eda2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315977, "uuid": "408a6c12-d29a-4510-9b5f-eab19064fc36", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12de5e59-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385913, "uuid": "384edfe6-7583-4bba-bb57-6bde20f2984c", "comment": "Malware payload", "value": "c7b06cbc45f350f3fcb018b08d04b9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385913, "uuid": "1ef817ea-fe06-4c5d-905b-628a06650645", "comment": "Malware payload", "value": "61cfdb599d69e76c1a767e6fae5cc53c9e4bc697a16b37b99748a072706c3274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385913, "uuid": "77f21c44-c8bc-4756-94d8-60f744c0cb7e", "comment": "Malware payload", "value": "636e1e7631f006b6c44e176c5e1a1b29351dff3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385913, "uuid": "bd2b0713-45a8-4791-a007-dc68257ec2eb", "comment": "Malware payload", "value": "f6ddbd27c5e50092baccf033217e1b40bf40aa6bdf9b0a13eaa6e454fe80752c8bcec307ac6dbf85671e425a8a7e5cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385913, "uuid": "127c12ac-4161-4d10-a07a-9ecd83c19adc", "value": "T1B00633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385913, "uuid": "79f398ca-44ad-4a2b-a0f3-25e621a1c1c4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385913, "uuid": "5133f510-bc2b-4553-a14e-b16c5abdbf8f", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Q2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385913, "uuid": "34ab2084-e231-46cf-8384-7ca923ba28dc", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385913, "uuid": "59e615e5-4e63-4bb4-b0ec-e48be659bc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385913, "uuid": "c11a2bc7-4c3b-4993-aeba-1f4f74e2a848", "value": "c7b06cbc45f350f3fcb018b08d04b9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55d3bff-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385353, "uuid": "8038a043-a5dd-4fa7-a4fd-03caf9b6c21b", "comment": "Malware payload (Adware.Neoreklami)", "value": "086cbbefe70ce09614fa08ee3699bd0a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385353, "uuid": "06033639-a406-4039-b71b-df5bd9f84f7a", "comment": "Malware payload (Adware.Neoreklami)", "value": "61d8e6f6208c83dabb0a204a7174bbe05f11088bdab434d318b1ed9edb5fdbc2", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385353, "uuid": "762e127d-0870-4617-ba49-2ca2822b603f", "comment": "Malware payload (Adware.Neoreklami)", "value": "cde4f2d1f44e419600f8f52ec4a92511020c8247", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385353, "uuid": "7ab282d2-90e4-4215-9d23-4cee105161f7", "comment": "Malware payload (Adware.Neoreklami)", "value": "ba936deee18b6a790f5b6d8b3fb3b22347c75369d62fccdcd0a9809afeaf3499cf225633ba5b235c0616dca418910c54", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385353, "uuid": "b81ed21c-4071-4c55-9852-b54664585039", "value": "T10076336A75E344BAFBC08432CEA4BF9670F6E12C1EB15E93136A478E1F3CE91D521185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385353, "uuid": "3f730720-9c35-468d-bb34-63b520f78ddb", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385353, "uuid": "51c211c2-1118-432a-8be1-fde699dfd0d5", "value": "196608:P1OOZRw2lVSuSf8re8HdIt/FajxcNmxoVGcfh+k:tOOvw2/rWmH8/axcNQAfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385353, "uuid": "4f06c9b0-061b-46d2-bf20-dde5272ce949", "value": 7543285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385353, "uuid": "2ac94d7f-8a15-4a2f-8539-d82d60874acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385353, "uuid": "2af18479-dd50-4b4e-952f-ccf8dacbaa10", "value": "086cbbefe70ce09614fa08ee3699bd0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0538ee57-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385460, "uuid": "633a318d-5f8d-4aa2-904f-e14477bc20d3", "comment": "Malware payload", "value": "39043f4350f5a8c97f3f6fa03cce4c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385460, "uuid": "c36b4683-d74c-4dda-b705-f0e6a69da776", "comment": "Malware payload", "value": "6220e5fefd18e141769b053f8bceb76588e938be4aee5af1a986e2ff7aa13b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385460, "uuid": "2c540943-01fd-4f74-a809-65d95989f5c2", "comment": "Malware payload", "value": "ecd1e688c54af328123005029724ea88137a30ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385460, "uuid": "b768bcdd-3d47-4ac4-b621-1a8fbeb95473", "comment": "Malware payload", "value": "e20534541b22c652687b14853ba9675084a4c8cedf5244f92ae3300670a089ce0d928f8a9d14aeaf390327aadef257a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385460, "uuid": "a9a52c4f-2c00-4a87-b4c8-8edb9d3321eb", "value": "T1400633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385460, "uuid": "abcf12d8-0a32-4e5a-8041-109d0cefc235", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385460, "uuid": "048b7416-8aea-4008-98c9-dd7df4f818bc", "value": "98304:afT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:42w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385460, "uuid": "f416b34a-6d21-4ee7-be2c-67de95369a70", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385460, "uuid": "7c1448ff-dce5-46b3-b579-7a0b8cafacf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385460, "uuid": "330ac9f3-72c5-4185-a01f-903c9487668b", "value": "39043f4350f5a8c97f3f6fa03cce4c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4a7892-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385474, "uuid": "3698fede-800a-4cbd-9696-3299ce3df737", "comment": "Malware payload", "value": "40de6736198345251877e29fe97a036d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385474, "uuid": "acf95898-d123-4542-bf3f-9775a7ae2804", "comment": "Malware payload", "value": "62e8ef82d15c63bb0ecb8b56c2f51eb27895bf76bc6155486ccd19fe4a302169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385474, "uuid": "36797c50-d924-429a-b94c-7d9b181e7516", "comment": "Malware payload", "value": "25f7078f6b3f4b969f05a87f4ac2998d8ae3f26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385474, "uuid": "1cc1a40d-f6e6-4d5c-af02-6c8a7a071084", "comment": "Malware payload", "value": "154f3e1d1edf22c3e74299aad7f5c3b459c6c473e8e13de0dc2b10a55f0234eb2aa5e03ff516196c01e91e215c555cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385474, "uuid": "071e57d9-87b6-4be2-b64b-d75cf3aa7af7", "value": "T1E40633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385474, "uuid": "5af4e072-77b7-4ad5-a00e-1773f89c7b33", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385474, "uuid": "8a4a2252-ba85-437a-aae6-a453296394f0", "value": "98304:aPT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385474, "uuid": "614be38f-be84-4b68-866a-d530de6771b3", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385474, "uuid": "42e62326-b03b-4086-9202-194ab0fa0fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385474, "uuid": "b316642f-d2fc-40a8-bf81-5a003a079e77", "value": "40de6736198345251877e29fe97a036d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1867e55d-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381627, "uuid": "7fce24bf-dfea-493c-a1bf-48f4e76e2140", "comment": "Malware payload (Mirai)", "value": "2fdc752e298f61a93d283602cfce6646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381627, "uuid": "6a6da074-0120-4e27-b5bf-e6a453c2c009", "comment": "Malware payload (Mirai)", "value": "637d84e52ad45e7a3d96a94fbaa4b0380e8e13ecabe3ab3ee9527dc4ca68deeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381627, "uuid": "da58e203-69dc-451e-b531-91ea455893ba", "comment": "Malware payload (Mirai)", "value": "32cf1ecec43dd8e0a0dc9987fcbbe2eb9fb80c8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381627, "uuid": "94a06e9f-7621-4dca-9870-24366e57706d", "comment": "Malware payload (Mirai)", "value": "80f09dd3d4d6eefb7c7a7c058310bbaf762accbe6620a530012854b096cd7ff32a115712b194430ece92a84cddac3d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381627, "uuid": "5c7f156c-73af-4fcd-84c3-e092ad844a69", "value": "T1DF230852BC828A56C6D42376FA6E118D3322B3E9D1DF7267CC205B013AC991F4D77B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381627, "uuid": "131ecbe2-f342-4e5e-8b1a-e62f4da8c752", "value": "768:dbfVCAITb1lI4z8g8IgrgEVm9YrLOHsXBuepi0eRqh1V+6ogqMkCBNSEdI:B4AITvBbHgJLOWB9pi0eRuP+3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381627, "uuid": "02a5fb1c-73c6-45a9-bd93-5f0f63c0db8b", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381627, "uuid": "252dc250-c49f-4429-920f-487871b04a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381627, "uuid": "fb0a3f55-cf45-4485-825a-e0a7fc133dfb", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b81bee6-e7ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338441, "uuid": "fe9f2808-a65e-4952-b44f-849eabd1f2b3", "comment": "Malware payload (Mirai)", "value": "005b2bdf75d6dc6ce3fe0a40ab53cc8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338441, "uuid": "5ceb5a2a-e17a-42e1-882e-eef375a160c6", "comment": "Malware payload (Mirai)", "value": "6389e9b4f74f82ae07e96e08e94658d707eaf6e2ce83820a2932c38bed98d901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338441, "uuid": "891280c3-8ac7-468a-a754-b206bfb9104d", "comment": "Malware payload (Mirai)", "value": "9b0adf12d048caf746483bd04f7ca5eba977eaee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338441, "uuid": "71f7b6c3-6050-4dcc-8272-65e675c7b6fe", "comment": "Malware payload (Mirai)", "value": "004c944b4ca5695bff7929c2294f8c8c6bd68df74b7ae8d9d13e881d2733dbd94b49d33d9d68242ef93f4869dbd895ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338441, "uuid": "7f6064c5-a7dc-47be-9bf1-f322400f07b2", "value": "T13EF39E73DC656E98CA64D478B0F19E391B93A114910B1FFB59A7C6B2408BDC8F40A3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338441, "uuid": "de97745c-6d0c-435a-a1cc-1afe666b5bb7", "value": "3072:RmW3ltLwPdJKUmHOVU01V6KoJ0C+8PWjmG1m4l:Rm8Nwi3uVUGV6KgBejFm4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338441, "uuid": "78b861ed-05f2-49d2-88b8-6aebde3988c9", "value": 171616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338441, "uuid": "8c66ee99-a215-452d-9412-a60379daecb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338441, "uuid": "c7662a26-6004-412a-bc6e-850651417c03", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8852bb9f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385680, "uuid": "598ee07e-781b-4bdf-9c00-05827640b059", "comment": "Malware payload", "value": "845ae1436119778fea80d6355fc03a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385680, "uuid": "80ea1965-6520-4a1a-9eb2-11ff1fb4f876", "comment": "Malware payload", "value": "63e74cff695a0c82030c9d0b96417d654c757ab26c6c2d983b17fe792b2555a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385680, "uuid": "f56aeb90-e8da-4b7f-bb3a-04822dc7747f", "comment": "Malware payload", "value": "d856c26306bcf28b34f6b37ac985c59696807637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385680, "uuid": "46ce4878-74ec-4fb3-894e-70e1e6967806", "comment": "Malware payload", "value": "8fe7cc7f3b4c3ec2578edf111b616a2f337946eae1016a597cc5d4f314e137fb5832f12c6ceadcdf53b9844effc45e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385680, "uuid": "e878dc68-b2ae-4f41-ae20-788c645f8ead", "value": "T1BA0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385680, "uuid": "6a09e0a7-180e-4a63-adfd-041e0fc7b937", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385680, "uuid": "27be3f6d-2c25-4ee0-9b55-d3ff59a79584", "value": "98304:arT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385680, "uuid": "c7395b43-1fa7-4033-8516-1a8ee5fca3ac", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385680, "uuid": "110a72f0-9174-4a73-8366-5dc74337a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385680, "uuid": "d4a7ba90-96cd-47b4-8c10-7d50167b16ab", "value": "845ae1436119778fea80d6355fc03a06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afce41e7-e811-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382311, "uuid": "b72bbe47-fbca-4b72-bac1-ca64b72da5e0", "comment": "Malware payload (Mirai)", "value": "e2179d581ce1db120bc8ba129df50ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382311, "uuid": "0f9e2525-aec1-4f04-b74c-438fbf4b1a4b", "comment": "Malware payload (Mirai)", "value": "63f58b63d4ffdf0c440438b890b0b82d2919bdddddfe64f65be9ff86be80f006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382311, "uuid": "16f616dc-aebb-4514-b931-9de156663383", "comment": "Malware payload (Mirai)", "value": "65464c1439e7cdc6dc164f68ff41273fdbe2b74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382311, "uuid": "035a1f13-e2e6-44e0-8d29-e98f98e47a84", "comment": "Malware payload (Mirai)", "value": "a8abdc608dd116d7c2e2c85ba05cda238704bb4b3418b7315880b4f1d967b2f93524dd2acd8c51e1a3e5cda373ebd826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382311, "uuid": "3b5ad4bb-0405-4e50-a39c-bec9cac27c10", "value": "T14B530945BC91DA17C6D462BBFA1E42CC332653E8E1DE7203DD21AF157B8A82B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382311, "uuid": "83fec293-c46c-491a-b91a-db8a0c051964", "value": "768:s4lvWRMxgN0CalBwrUzVasCNe2/Tgiole+92NRmN7ElJBwgQY+xwcpu+7R:Vv8MMrUBtb27gjemYqEGgsvu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382311, "uuid": "16b40dbe-bdb5-492c-ad2e-64cfb389dd81", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382311, "uuid": "2f8c17e0-c534-45e0-9970-e99238aed328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382311, "uuid": "f2de5b7e-fa9f-40eb-9899-c500ea66bc33", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af596949-e810-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381880, "uuid": "c00cec89-d13f-480a-94f9-3634df02b6a4", "comment": "Malware payload", "value": "3d7150e15f0218b34174aa7a4de18ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381880, "uuid": "41e7bd90-7146-4d1c-92dd-30928b2c243b", "comment": "Malware payload", "value": "63ff928fcfdd67e70fdcbc2c45f3314d5de8c1c58d62606bc70d072b5307440b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381880, "uuid": "d4ac1d8e-4899-4c51-8a9d-58fcd411b3ed", "comment": "Malware payload", "value": "4ae2c864a7c0e19f2f85def4be9a002911f448e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381880, "uuid": "498ff837-2f0f-4aec-90d7-b50e5aba225d", "comment": "Malware payload", "value": "df44d719116c135c0ffba6eb762baa2da0eb2a2ad1b9b36e797c8c5113d5441c4aee96aa040c5d5baca209b62f8c1e0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381880, "uuid": "1710c84f-bbc9-4bff-bc61-d9743c845a2c", "value": "T188C6390A77C74EEADCC72BB4B49B233D8711ED329FA9196FA648812450933C59D1EBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381880, "uuid": "7b0560c2-2c0b-45e0-973c-87d4a631cfb3", "value": "80f770b992dac485bbf00760852ea3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381880, "uuid": "75aadabf-d863-42ab-bb42-6f5d827f1d71", "value": "196608:gQQFRQeURyHHopcIMzuQjONPU++9v7HsQ7uLz1MwPLIR4:TqRQe9opclzuQdHsQ7uLz1MRR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381880, "uuid": "0c7c7f67-68de-4866-9244-3a2478c40683", "value": 12181877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381880, "uuid": "fa69c9ad-20cb-4871-89bc-5a4b1426b90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381880, "uuid": "f793eb8f-b526-42fc-a31d-375327fa927a", "value": "bot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07167fb-e808-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378500, "uuid": "67be99cb-6ca3-44df-b2a4-aefea149e74f", "comment": "Malware payload (Mirai)", "value": "b99ece94b1f0d2bbc9d0037dd09b5dd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378500, "uuid": "34f727ce-6de8-4245-bb8c-f8728bab266d", "comment": "Malware payload (Mirai)", "value": "645e916de2e269f14fa478777b61ba6ed0a6e84efe645a463568849fe27bbc1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378500, "uuid": "8158a273-2f1b-490d-8d83-057bc35ab121", "comment": "Malware payload (Mirai)", "value": "31179957e3f53ea9ae48632476b6763734d61d16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378500, "uuid": "bc0c1554-6552-410e-963d-8e9352953eea", "comment": "Malware payload (Mirai)", "value": "132aca578498d7dc12be01571b8d34e6e4ad092ffc2c02ec4f425b677d6191967bba349f3e67916bfb09b6aa554a9048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378500, "uuid": "c50e6aab-d7ad-44a7-b9bd-8f83a6ea996a", "value": "T139144B02771C0943D2572EF4263F27E183EFDAA124F4F645690F9A4A42B1E73598AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378500, "uuid": "bf0ae612-90f6-44df-8977-4b990f1ae144", "value": "1536:hjzkrAI5C0i3uq9SfLZSXyF+iUkbJkbGAiIxqlWmYFiz+06ceDAFGiaIBkevAHpt:xLbuISzZSXG5IxdTMQc9FVkXH+Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378500, "uuid": "767bd89a-980b-46c0-8e07-c7c097b48cd2", "value": 195712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378500, "uuid": "80ebe0d5-b232-47c9-a0fb-490e7087d143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378500, "uuid": "0ce66fd7-07a5-47f1-a078-e2b8ae49950e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aef333e-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386007, "uuid": "a338633d-3b9e-4ebc-b9a5-07167d8bc7d7", "comment": "Malware payload (Adware.Neoreklami)", "value": "ebec796f4421c2598514c7bb35945d4d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386007, "uuid": "ac2e6372-ed98-4be6-949b-16f038f84980", "comment": "Malware payload (Adware.Neoreklami)", "value": "6475d0adb50eba010c053c7c543171dc6a976f9ed9fce916cbeaf6095e1daf2c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386007, "uuid": "3f3a4f85-e029-443c-916e-89d9100f1ad3", "comment": "Malware payload (Adware.Neoreklami)", "value": "dd07110a83f0788da61cee8deb1a143c3b406433", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386007, "uuid": "babe3fd9-55e2-45a4-9df9-f40f68ccd4aa", "comment": "Malware payload (Adware.Neoreklami)", "value": "1ddfa63e1c78f2c2db91a6fac9ce3328869b761030e09d90ef90468e8c6ed1c8b91629fe3cedecacb2f61d410377da65", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386007, "uuid": "b25233b6-0a6c-4973-a3e3-9c25cddb6d52", "value": "T12276331130F0CCB9E35960B50EA54F0AF3EAD92D4A71A0D723D5149A9F3DFD520BABA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386007, "uuid": "1cb04701-94bc-4b94-ad85-29ec9cd0d9ef", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386007, "uuid": "a036ef63-62d9-4067-a47e-c751b6e7e3a5", "value": "196608:P1OO7QnDj3/0irru7rxIYzNzvgjEB1RQUNL5J:tOu8H3/VjuvgjEB1f7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386007, "uuid": "54997ef6-199a-4018-8894-dec81248e173", "value": 7511734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386007, "uuid": "82cf67ac-ce45-4b0f-85d8-e3fff1cf986a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386007, "uuid": "16b7c6bf-d043-4ea5-b789-1e6169fa8ed5", "value": "ebec796f4421c2598514c7bb35945d4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0565de-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385742, "uuid": "b86a252b-b40a-4320-a4f0-a4b8ceeef6b6", "comment": "Malware payload (GCleaner)", "value": "94c2ec7957d4cf571baf0caa5593f74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385742, "uuid": "c7167f5a-f457-4cbd-89e8-bc94363d6d41", "comment": "Malware payload (GCleaner)", "value": "655feaa9bab4dcf0d3340c2bd996e2c7393c985541c482862cedfc99651e722a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385742, "uuid": "1b6f1c48-fc5d-4fca-a039-5228e202c394", "comment": "Malware payload (GCleaner)", "value": "dbd0fa1bd52d5caa15a6adfb51038077348f788f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385742, "uuid": "70c54131-8365-4159-92e5-774e9961e106", "comment": "Malware payload (GCleaner)", "value": "f2e6b31b73ada2a587c714078bc34117976194643e9af6b38f9b67a2e04a2e6f64e3a99697e0c7e240e248cfa01a3795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385742, "uuid": "28bc9ff5-1f21-443c-812e-f2022c906c1e", "value": "T1A816D031FE6E1BCBF5338D7D3B59FA55780619D9EA5820962BF3084193BBE08D4E9180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385742, "uuid": "a7a9e359-76cc-4cd3-9927-9c3d60142906", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385742, "uuid": "c85b063d-702d-4c51-8872-8bcbd0c9b4fc", "value": "49152:uXAcAe5aRiWd83BQLzY0fuUuXPzToX9uwtB3jEcsYDyAoreZ0TSrgGHSBwf:uXAcAbd83gcEuUu/gNuwPElGrISf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385742, "uuid": "debeb1e8-b4f1-4811-abd7-019f520a37a1", "value": 4216592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385742, "uuid": "e08d97c8-8a7f-4789-9ec0-bd001674b29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385742, "uuid": "e814809a-297f-47ac-a4f7-26da1e3969e9", "value": "94c2ec7957d4cf571baf0caa5593f74d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73854750-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385645, "uuid": "d30abed6-9610-45b2-91e5-73463f54efa8", "comment": "Malware payload", "value": "792d3d9fb8a215691d92f8d6614b1f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385645, "uuid": "1df1aaca-6a28-4de1-b6eb-90fed6e40db1", "comment": "Malware payload", "value": "65ec01f3f5fb1436db781a3c40a793d5e5f0fe00270d8ce9639673697ca54d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385645, "uuid": "566523be-ad2e-471c-a3d5-fd443e021b55", "comment": "Malware payload", "value": "db8d860c0eec0c0c257e7b6d0968e59834a2183e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385645, "uuid": "b848fc75-6185-40df-a6e3-6df6961e11b4", "comment": "Malware payload", "value": "edad4d15eab023fe2e63d7ae708a053e53e6a62180bd1c86b50e852d1f242512e50bdb1bfefdb6c3f16b737516d5f96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385645, "uuid": "869bfa6c-9ecc-426e-ba4d-1da223c28272", "value": "T1310633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385645, "uuid": "27610df5-dd7b-48f6-af97-244f4a1584bf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385645, "uuid": "a5a638ae-b406-402c-8d30-52ac21a407b4", "value": "98304:anT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385645, "uuid": "a304cd59-2e23-45dd-b748-4d6f4c3210f6", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385645, "uuid": "f83874fb-a01b-4710-99f2-ed8a58bc7405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385645, "uuid": "d01e9d3e-b445-4422-a921-5d120dbc8a4b", "value": "792d3d9fb8a215691d92f8d6614b1f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07baacf-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385372, "uuid": "598814bc-3b96-41cf-ae82-450486c7f7c6", "comment": "Malware payload", "value": "129b9aa1fdbd6a527d1d2d6d7d0d0659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385372, "uuid": "7c92a0af-55ba-47a6-a197-2ba73413c59a", "comment": "Malware payload", "value": "67213b2bf612d48edc1ea6d030d85dbd915779c61682b369ae42bfe5822f0fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385372, "uuid": "929f7dc0-46fb-4db2-a236-afc7da7c294b", "comment": "Malware payload", "value": "d2b7695e065adc26d16693016b99936423092a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385372, "uuid": "a3f4943e-d150-4634-83e6-49f396495c1f", "comment": "Malware payload", "value": "737fa4dc1b70487c921be82bfaff88990362afee60933b31a2e59838dc7c999945bc2c947c5deb87cde7b0e25d1638d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385372, "uuid": "9729c48a-11cb-48e4-a649-85ae207e76a7", "value": "T1FE0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385372, "uuid": "69aa7939-ab4e-480a-8529-7917ec5a7979", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385372, "uuid": "b0647986-1828-4686-bb70-35f143e1c506", "value": "98304:avT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385372, "uuid": "09070568-737c-4b39-aff4-cf4d472b551d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385372, "uuid": "5f2e366e-d4f3-4364-ade4-ce8298110424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385372, "uuid": "23496f40-ec85-46dd-91d6-e751c2669fea", "value": "129b9aa1fdbd6a527d1d2d6d7d0d0659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37b67df-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338132, "uuid": "159c7744-e2ab-4b14-92d9-41c232b232cf", "comment": "Malware payload (Mirai)", "value": "191a62b6bcff8091accb02c5596c4ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338132, "uuid": "5363fdea-d5c6-4f61-b3f8-18f7f105b189", "comment": "Malware payload (Mirai)", "value": "67d268410263c3a827ab9034ed9c2668adac8c68e491c4f2c7af42e157103f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338132, "uuid": "71ff1a84-6c71-41a7-9566-1b4bddb3aee4", "comment": "Malware payload (Mirai)", "value": "9898568d0e1b5ca8c5f6a7703261bded54ed0a0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338132, "uuid": "de3525ec-e85f-4d05-917a-7919d452c68c", "comment": "Malware payload (Mirai)", "value": "8d51a3cf710dd1f3b33bc4d7352ab76584216d150c40118e45497418ecabaaa473b2a155f92331a97baa75721c9e6683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338132, "uuid": "d345967c-055a-4272-af09-7a84a72d99fc", "value": "T123457C2BB2B2E66CD047C03497DBC6A14521F0756A323D7B33C4DB352EA6DE45369B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338132, "uuid": "f8e9fc80-b63f-4cfe-9dde-57c29e5fd71a", "value": "24576:v8pWhGNglkEvv/dTF3k2QJHczUuWbFvt+UO3R6/0:v8shGNg/X42QJGpicUOA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338132, "uuid": "d9b5de8b-5f5d-49f6-acb9-cb155aed777a", "value": 1275656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338132, "uuid": "344f5ad7-9799-4935-b4dc-e264e17037ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338132, "uuid": "4526c2e9-44b6-4f25-b385-72f7f2bab672", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6caed82c-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393365, "uuid": "151ec0aa-3d14-41ee-b012-29099cfd3644", "comment": "Malware payload (Mirai)", "value": "4549fe26af6199faee9fd70e04b92be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393365, "uuid": "66e386f1-22ee-4cf1-8f26-b4a11514885f", "comment": "Malware payload (Mirai)", "value": "68933950ddc262bae652482756255d9e566f62304589a16807e1b2740413514f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393365, "uuid": "ded3346f-e686-4971-8bbe-e5e0ca939f67", "comment": "Malware payload (Mirai)", "value": "023e5a3f149194fdd5678a30e582beaa01381139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393365, "uuid": "78b5198c-632c-49ef-af4d-b7a225ac3e4a", "comment": "Malware payload (Mirai)", "value": "dea5206264ea32f60822adceb081fb55c2f8a0d2c971d22a9482b6995fb0ce1ada430acc9b057deb4d341d9169a0663f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393365, "uuid": "0d702189-02b3-4372-b389-b74db242dbcd", "value": "T12953F142545168E5CDADA0B047647B222CEB47CDF101A95860D94FAFBBC92FB6E83DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393365, "uuid": "323382a2-176b-4578-9605-9bc35dbe88ff", "value": "1536:u6lNODAsqYvz+MKIVj8xPIw5KEJiqwUVJuG:u6lNOvz+uVj1w4qVVQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393365, "uuid": "5163e60a-d1fc-41be-a6f6-bacd2cd0b9ed", "value": 64272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393365, "uuid": "f9e35cc1-482b-4ad5-a1fb-892e787eb806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393365, "uuid": "16fbffbc-746c-4781-9738-2366ec729890", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f425c28-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385585, "uuid": "2a7ffd83-bcc6-4a4c-bb7e-07ee7a09ef0e", "comment": "Malware payload", "value": "65116b3f9388ce7f41c40d5c05d58275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385585, "uuid": "6643e674-87a8-49e6-8db7-131bd0bcf180", "comment": "Malware payload", "value": "68bbeebcca0bad564530229ab96ebc38a85ee6fe813f816f370782f1c4538a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385585, "uuid": "2daf8128-c12c-4edd-9764-8cf8172e7659", "comment": "Malware payload", "value": "60e70ef7b942af786af433b9ff0904954181b730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385585, "uuid": "0f9b679f-9229-4aa1-a416-5b5b653367a9", "comment": "Malware payload", "value": "9ce0b0d9897bb57b44444a29def8fba5d651bb84fdddf343383b33def28ea5509a18a89c7e96091609e1329ad0fb7796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385585, "uuid": "e62703fe-effd-4deb-af9a-f85fe5eedc83", "value": "T1FB0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385585, "uuid": "627c4258-3d3d-4948-9573-aec74a34494b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385585, "uuid": "a9191269-4e28-4993-9b0c-01ecc743427d", "value": "98304:acT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:f2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385585, "uuid": "69d3b27c-ca5f-40b2-9712-fbd86355d678", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385585, "uuid": "4c134661-dac0-4ab5-8e86-c33128b2f598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385585, "uuid": "0960b4ba-2f0d-43c2-931c-9692fea70d0b", "value": "65116b3f9388ce7f41c40d5c05d58275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a50e95-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767356663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356663, "uuid": "1cf327b6-f113-4268-9eb6-b442963f3c00", "comment": "Malware payload (LummaStealer)", "value": "4f897c04acaaf3eaf7c5b9702c53573d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356663, "uuid": "a6abbf79-06e7-4d06-a8bf-80cca33c6f97", "comment": "Malware payload (LummaStealer)", "value": "691193d95f10d944285de55b3dc68c1999051c0f7a936f5862b08daaea30195f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356663, "uuid": "f161907e-ca12-4a6e-ba1a-270227b108dc", "comment": "Malware payload (LummaStealer)", "value": "6d2cb4e06b253adaba744697b9f645d49a5a752a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356663, "uuid": "8f0e9507-aa3f-4519-8d2c-0adab1bc5fd2", "comment": "Malware payload (LummaStealer)", "value": "f7f80630c0a5d69185afdb0d6419276647c59f3b93ccb1a66492a09ad68c39101e31c41e9a1a43fadec63685cf62a330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356663, "uuid": "06ed18b6-7092-4b57-bf29-19b50003db04", "value": "T159F42A2157B9CDE0E4630B7EEB6CC622ADE42D57C6E1902D31B53926AF7081E472CB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356663, "uuid": "9b76cd3c-9f7c-4c6d-8616-c0fceda804b8", "value": "12288:ZAf0oeqwK5TJfrTR0W+OMJL0opIFpwA/ursu/S+D:ZAf0k5TpCW+OML08IR/ursuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356663, "uuid": "f4ea41e8-f31d-42ad-9309-b1acc7c20ffd", "value": 761848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356663, "uuid": "b5345074-2511-433c-bee5-5d595f60b2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356663, "uuid": "80c50983-7cb3-4724-95a8-5ad9eca63ae6", "value": "Host9271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167f4b02-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385919, "uuid": "17da9816-0abc-482f-b3d6-a7bad3dc892e", "comment": "Malware payload (Adware.Neoreklami)", "value": "ca7812375077811ea648db750f4b680e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385919, "uuid": "11bb523b-fe39-4d52-8769-e59b24a01afe", "comment": "Malware payload (Adware.Neoreklami)", "value": "69aeeb824ca44751dc39c98948b0f9b42179cf6a53c6c1e920ad07222f7ba966", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385919, "uuid": "6c16979e-d691-4205-896f-d911d122a6da", "comment": "Malware payload (Adware.Neoreklami)", "value": "29f353afe012092506394162fa8877ab0f7ae675", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385919, "uuid": "1d3f5a13-85dd-46c7-82c3-7225cacc099f", "comment": "Malware payload (Adware.Neoreklami)", "value": "23bdf3054dd392d9753b3706738caa1ef03609e0889cea6524b703e2256eea93ac1cbb63ad4d31568871b94a9581c107", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385919, "uuid": "25a0211c-d298-49aa-a51a-0149ce21dde0", "value": "T1DE76333278E6ACB3E1551AB284D93E41E0BCD27D8B01896BB7B4535E3D7AC86D431C9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385919, "uuid": "e16a6330-e90b-4dda-845f-8cfcfaad25fa", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385919, "uuid": "6374f501-6bc7-4fb3-a8a9-e5fe30765083", "value": "196608:P1ODVsyKi52asuGkXKkyAR/0LZ8IabEl0RgyCn12:tOBBKknZFsZ8ZwlpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385919, "uuid": "759b7971-58c9-457d-b18f-58dd93d5369d", "value": 7500172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385919, "uuid": "1d5325c6-fb21-4751-844d-3e7d7b408de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385919, "uuid": "1a5ece2d-732d-460c-8cb6-4a8886a2ed12", "value": "ca7812375077811ea648db750f4b680e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6462e575-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393351, "uuid": "7b65e4c8-cc75-41b8-b262-abb1cf2ec427", "comment": "Malware payload (Mirai)", "value": "25365f68c6279bccc50131d32aea7abb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393351, "uuid": "19dfe052-6439-4f74-886d-11dc178b6cab", "comment": "Malware payload (Mirai)", "value": "69b78f0858a4e9ee03cb81dd5a3f99e079bc9c42b24e7219e8303042130da24b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393351, "uuid": "218a9193-1ea6-4ff5-9f6c-cb6f43df495b", "comment": "Malware payload (Mirai)", "value": "7b2336eac695558b9aaa4e6a242daaa10e5fe4ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393351, "uuid": "053b9e35-e19b-4326-81be-0d9cac4334e8", "comment": "Malware payload (Mirai)", "value": "34c3c78f82e882d9f317b5601679c83a73351bbc4d96c06141d7563fd1771ec2457dd43e2d9ba14d06c9ce2d26e6a82e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393351, "uuid": "61f76610-91f1-4924-a3c2-f19fc24dd901", "value": "T1D353016AF3C42056CD3DD86551E913ABCCF434C671DBAE9AB6120C8791A4CA7FC09EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393351, "uuid": "609c6995-bf37-4e55-911f-a50d50e5d68f", "value": "1536:pPLc1KoAO20rPhO6MqOlFZHIz95JLFrtyHEMmzJ:e1KPxyk6MqapIzT5F0HEM2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393351, "uuid": "7247a262-0a7d-41ca-b0ca-f2c838e6d557", "value": 66204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393351, "uuid": "e420a3b6-ff46-4165-9ac8-f0907968b8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393351, "uuid": "2defff09-0524-41e1-8934-85d4fb9b5c8f", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57856681-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385598, "uuid": "7bc4d82a-a318-4afb-9a96-8a2b43e12721", "comment": "Malware payload (Adware.Neoreklami)", "value": "6a614c825de135f26a824beae7016cc2", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385598, "uuid": "b1ecd0f5-9952-4141-82c6-c0dde6ad9d6f", "comment": "Malware payload (Adware.Neoreklami)", "value": "6aeb99da62523b6f4d3f3d57baa1d68d1afe91d6257078d47e2c60498bd404ea", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385598, "uuid": "e1bda342-7f6e-44f7-8bea-1ba7b3aee027", "comment": "Malware payload (Adware.Neoreklami)", "value": "5e09a0b90e0be8bdf6ae4224e7f4b335c200edcd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385598, "uuid": "eed33d0c-aded-42ef-b689-59c98e5cee49", "comment": "Malware payload (Adware.Neoreklami)", "value": "ef2431a3db20056e9feb03983e7a2c1112fa198b133c412c683a5d45816330eb3e8b30de97b74630bd359cbe4b89efa1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385598, "uuid": "cf2c15aa-63ce-458b-a66e-c197339333bd", "value": "T16576333875C2C9F3D3C82536A9982FC979E80A3D2A8195A343D8074C9E7E18EDD5735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385598, "uuid": "d6237b73-016b-4f25-8fe8-e4805589a606", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385598, "uuid": "fad09970-78e6-41de-ac25-7baae9b282a9", "value": "196608:P1OuCXK5ZmK4Z3RduIt5wW2v2WGInM1SuYSU:tOuCnK2R/wJvvGIMQuYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385598, "uuid": "cf0cafc9-12d8-453a-9462-9e65b0916fe8", "value": 7569500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385598, "uuid": "282b119e-f8f9-4ba7-adaf-aeb0de5faea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385598, "uuid": "00f3e400-efbe-41fb-ab0b-3ba4207e91df", "value": "6a614c825de135f26a824beae7016cc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544c1492-e776-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315585, "uuid": "8c7029ee-1099-42b1-b591-a28d5011b6f3", "comment": "Malware payload (Mirai)", "value": "9df1095df221db3b59acf5e0e18924da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315585, "uuid": "facb879b-d360-4f9f-92d2-9dba43f0c2e2", "comment": "Malware payload (Mirai)", "value": "6b0cbec2202c0afb2a8347a4c9933d217433cba0206f2ba0990617ee52fefe48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315585, "uuid": "d43f9beb-027c-497e-a227-acf7f622dbf3", "comment": "Malware payload (Mirai)", "value": "0ca9563427cccc4aeb45058b58338c7be8b8dce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315585, "uuid": "141bfd53-168b-42a7-bd2d-ae979b2e0e5d", "comment": "Malware payload (Mirai)", "value": "761016de8939346b12cc74a576a28ff4676b50ade04c1a581cfe3e94cd4f4404497f0fd7009803bde186dc8ccd57c6cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315585, "uuid": "1a227cb4-9874-4367-b5fc-478c210f74db", "value": "T17673E986B8918A56C6D512BBFE2E118D331357B8E3DF73139D105F247B8A82B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315585, "uuid": "4fc9fe7d-c080-4a28-804f-32affb21281a", "value": "1536:aRnxaf8a/aUoqweM+bAqKIvosmaHweuGWeXW7zQ9L38Mtiz4AAWhHu+7R:Jf7/geM+bpK0oVaHweuPeXWh4AAWhHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315585, "uuid": "37a9a2e6-39f4-40b2-bc4a-0eefad6c4508", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315585, "uuid": "e16a6919-80aa-4e5b-b4c2-ac13ffe9d27c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315585, "uuid": "2effacbf-a618-42f9-afee-4c0ae3947e9e", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1dcb65-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385765, "uuid": "ccd527df-85f8-47b2-9ea7-2826d8ca25eb", "comment": "Malware payload (Adware.Neoreklami)", "value": "9939904a9fe1af825b52557d6ea4fcf1", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385765, "uuid": "c23198f4-c915-4212-8034-b3dfe93e507e", "comment": "Malware payload (Adware.Neoreklami)", "value": "6b8871c26ef745f363a37dac313d8bee9afca79f6a4f592025fb926db0875dd4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385765, "uuid": "99538efd-b225-4790-a773-6bd66eb09eb1", "comment": "Malware payload (Adware.Neoreklami)", "value": "08f0a74d7e4721656d91f8f24f82771808dc29a4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385765, "uuid": "cd550c98-19b7-490c-859e-8c9a3c404506", "comment": "Malware payload (Adware.Neoreklami)", "value": "94aa4a3b77ea5488e92f0426b0978a358048585439b3624e19139e595bf36ec885f7aa516809c688bf357cd08abdc7be", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385765, "uuid": "f498d2de-3b7d-40d8-b563-779d3c7453a3", "value": "T12C7633073C4BC530E2524CB2EDE6AD8ED5E8DA790ECAD663B7C8851E6F38494D0B41C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385765, "uuid": "5bcbdb5c-9ff2-43df-a5df-be174f135471", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385765, "uuid": "f3f58046-ffee-4165-9402-c503efcc9f35", "value": "196608:P1OrqGnIT3x+KIf1XxF6EZyWELpzBTZKeG/5Lep5O:tO38EKe1BIEIWELXWs5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385765, "uuid": "1469c20e-1b70-4aac-b7fd-09a3c9754b7f", "value": 7523646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385765, "uuid": "3cfb239c-c5e2-47ba-96d9-03c8f3da4bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385765, "uuid": "f89052e8-1ebe-4da6-a6a0-d72d806a25c8", "value": "9939904a9fe1af825b52557d6ea4fcf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea03bb8f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385844, "uuid": "24777d2d-6758-4c7c-83a0-b1f0f04b4a6f", "comment": "Malware payload (Adware.Neoreklami)", "value": "b278adffcfd5de1b768ea338084ea635", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385844, "uuid": "c9434951-2c3c-47ab-b7b1-b7c96824ee64", "comment": "Malware payload (Adware.Neoreklami)", "value": "6befe40caac265a64e648e5f9c635888764ac294f930a090343e0fbd3f76718c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385844, "uuid": "7ef3be44-9bc7-42e9-b9b6-722660f362b0", "comment": "Malware payload (Adware.Neoreklami)", "value": "624139fea87e5a6b394d2478493c22d3a029fd4e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385844, "uuid": "2dcef00c-9513-4ed6-b67e-e835c6029f17", "comment": "Malware payload (Adware.Neoreklami)", "value": "44b9e9f174e86b3c34145a216dce947ee172488afe449afc2a5a7afa43f3857e93810bf8a77833b9020aeb64daa9ce08", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385844, "uuid": "dd483140-af3c-4522-af4e-db74fc3c9edf", "value": "T1AF76335831FF8DF2E3084D734DA71A4795F85A680F2D8CB763480D1E5A781CD9A682BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385844, "uuid": "2456ba0f-98bd-4307-bffd-233203abca21", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385844, "uuid": "79c24020-aee6-4b21-95dd-591b5de2de70", "value": "196608:P1Ohn5ab9Kb6PmDBBe/mjCSbjlQVCciog0DbU2yqFtTCATtA:tOdsBKb6OFBekbjlYCQgAUgTRTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385844, "uuid": "2499696a-785c-470b-b2e7-53fd9ccb1571", "value": 7548437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385844, "uuid": "6854ca87-af94-4419-930b-38db5bc0803c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385844, "uuid": "029489e4-a801-47b2-b972-da5616655c7e", "value": "b278adffcfd5de1b768ea338084ea635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e599c178-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385407, "uuid": "03b98db0-b724-43e7-86a9-a2183465823d", "comment": "Malware payload (Adware.Neoreklami)", "value": "2184be84fa6cf7d8e9c2bbdf85c7e456", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385407, "uuid": "7a5d218d-db92-40ca-ba13-c733ddc87e90", "comment": "Malware payload (Adware.Neoreklami)", "value": "6bf0da35501ded76467ff6bd648432a322eb80cf9b4e7498b2eca263cbd031a0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385407, "uuid": "cdf2769f-ae14-471a-8b2c-26822acef3cf", "comment": "Malware payload (Adware.Neoreklami)", "value": "7395f9f30ae24b2338697882d54a4d63aa3632e6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385407, "uuid": "b219e346-4254-4284-a311-0e78ec79cad4", "comment": "Malware payload (Adware.Neoreklami)", "value": "351d37c305138b582451f1dc246b725e748ab389c7e19d4b1e3e3adb5db412557845b69c6903c8e85c3f839ae0a959b6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385407, "uuid": "d6c52789-e423-4c79-a580-c96c7e82df51", "value": "T12976331274E8E7FEC5497872A4800FE6F3E5C75E4352A85323839E9C4F7DAA1C52A274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385407, "uuid": "b0b0925f-d6ef-43db-b4d6-69295e96463f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385407, "uuid": "4a0da608-154f-4f5d-abd7-ab1a58fcdd56", "value": "196608:P1Otm2qtiCqJuw+/fC8cqthUvyUtxdnFazHD4:tO31yfC8NItbcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385407, "uuid": "a7a3c97d-2e6c-4c6a-948e-29fe2b71c84f", "value": 7561445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385407, "uuid": "49a005d0-471e-4875-8b09-0b476dfaa520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385407, "uuid": "c46f87a8-7ee3-4ca2-a81a-1a87f921e61c", "value": "2184be84fa6cf7d8e9c2bbdf85c7e456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc32b59-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385740, "uuid": "094c5bc8-a879-4b8b-9f38-232e36e70667", "comment": "Malware payload", "value": "94be685fbfed1b4f56ae402ea0b2f370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385740, "uuid": "0b0538c2-6e0f-46dc-a860-370e29a61551", "comment": "Malware payload", "value": "6c0474d7cf20a8a8ced7f9a5a59609ee58245a9a413e73d1738dad13f85d7f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385740, "uuid": "557aca07-533e-492a-9f6c-36c4074165e8", "comment": "Malware payload", "value": "ee200ff936d30b7bf8f42d10d213f32b98862843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385740, "uuid": "5a567b4d-b794-4da5-b92b-e221bcbe9a72", "comment": "Malware payload", "value": "d38c9da5d8105c3da3460f2a2cc3767d217f95248b549c88a03d1ed72128206e1ece6a5e40f6a2cdc4e1cfe958966124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385740, "uuid": "27a39ee5-9265-4439-8d1d-29fc9e133bf2", "value": "T13F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385740, "uuid": "c4b86b4e-e81a-4986-b1e4-8a76b8426d39", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385740, "uuid": "24c149f5-533f-4864-9fc4-a82e69afc01e", "value": "98304:aDT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:o2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385740, "uuid": "c6b731c8-6011-4e75-91e7-10de4466ec72", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385740, "uuid": "33595c75-2851-4683-9580-331535c19716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385740, "uuid": "c4f8f791-2662-4d3c-b63d-5dfe89dfdffe", "value": "94be685fbfed1b4f56ae402ea0b2f370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6076b13a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385613, "uuid": "87a54a9b-92b0-45b8-b043-a5d0d6660f1d", "comment": "Malware payload (Adware.Neoreklami)", "value": "6f0c4745f99c80d0c5cd199f1cc50a98", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385613, "uuid": "1019b9bd-15f8-4bc0-8793-5d648cacdb90", "comment": "Malware payload (Adware.Neoreklami)", "value": "6cb42eb345f199f5eef35b5414452eb6e3ca074f2aee1a881bec63ef9f5feeac", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385613, "uuid": "b7027bae-e1f8-4737-87c8-2a3f49270b33", "comment": "Malware payload (Adware.Neoreklami)", "value": "6f6a1da62dedbeb287f69278fe87cc491aca9e0b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385613, "uuid": "c1368a92-04c8-43b3-9f0f-c0daae74876c", "comment": "Malware payload (Adware.Neoreklami)", "value": "0cc3de7d7bbe804437393d7124e6adca8420274232908db6b3b2feaa9565bdb2b0677af5de4478a1a895f0421cb8c222", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385613, "uuid": "5a651872-8765-4274-9e51-53fdd9dcf712", "value": "T1BC76331137B3C972D80144F04BD95E98EA7FE2C416351CB3A3DB2B6CBE79244AD29789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385613, "uuid": "995f6bbc-6f0f-41b7-b91a-bb0bdee88ba6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385613, "uuid": "9ae9cc4e-8f3e-4ad1-9643-509f412259a3", "value": "196608:P1OOAT2fGaqs6OTBh65AQTG/Fun2UOxM8+DmVZxQc9:tOOHGtsPEJVn0xFOkxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385613, "uuid": "55b3cfeb-0e65-4466-bcd4-68420c13c5bf", "value": 7561992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385613, "uuid": "21be55ce-8c52-4956-8b2c-23c749cc757b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385613, "uuid": "4431a6ad-7abc-4082-9e86-5e2ba47849da", "value": "6f0c4745f99c80d0c5cd199f1cc50a98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0966bdcf-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385467, "uuid": "9106ee96-b43a-48f7-8fe6-c0cc6e491538", "comment": "Malware payload (GCleaner)", "value": "3d09a7669a455151ae43a800ffa639e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385467, "uuid": "a202c5ee-1722-4936-85c4-bed16e76f03c", "comment": "Malware payload (GCleaner)", "value": "6d0c3bdd07801b794cfca0ed3fc32255d072600937720d4274addd5c0b8d524a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385467, "uuid": "ac85ec6d-ef1e-4397-ac78-8b2c6f66cbca", "comment": "Malware payload (GCleaner)", "value": "e4a504846f32c79ee14d57d3ec802e83a64ffc71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385467, "uuid": "cdf08ef5-015a-46b6-8c92-874642d32040", "comment": "Malware payload (GCleaner)", "value": "74d19c16e1e74c8b658766f94a91149a82421de52948f76cfc4de9146da869be272d2ce421b03226f0f72d940ad52838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385467, "uuid": "0b885a36-c389-494b-811d-2b24ae718e9a", "value": "T19906CF43F9B25435E3A5273C84A7C981B476EA042824D80B15B1394BE9BBB73743EDDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385467, "uuid": "e7cee082-3688-4ff3-8413-ccbbcc4368f3", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385467, "uuid": "e2e5bd56-3e19-464a-aed6-2f1030caeda7", "value": "49152:crSW95YMHHt6qKge3vEqMq+5U362qzFLt4qJpahxVxdnOM1thHGirGflokiJ6v6:crSW95Vov8q+G3Jqh54HlhqKk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385467, "uuid": "d43c9ea8-1f36-4374-aff1-19b6f1cc1f1d", "value": 3807504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385467, "uuid": "f25f1f43-c771-4932-8fad-b7e712e54456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385467, "uuid": "b6d4303a-eb2a-44f5-a828-6e3da137ab74", "value": "3d09a7669a455151ae43a800ffa639e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38a7b0d-e7a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334616, "uuid": "00d326e3-2cba-4b35-84a5-59533f8c990a", "comment": "Malware payload (Mirai)", "value": "d12311b74605ceee9371e9fdf80fb61f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334616, "uuid": "fc9ce12d-8419-42a8-b3fd-e2039c126df7", "comment": "Malware payload (Mirai)", "value": "6d14ce5cf7357f8a1e612c260bdc26a10bfcf7089c763368ef66c4650d0c4b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334616, "uuid": "a5e2e107-b7c7-41c7-95a8-f59c8cc0e5df", "comment": "Malware payload (Mirai)", "value": "9d33604cc7655693272be9ca48f20bb71b9aa581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334616, "uuid": "51aead72-555b-4b1e-b1c7-e28319c04695", "comment": "Malware payload (Mirai)", "value": "1a7efb4970e9fb8673fcb5d03fe397db99b3a8bd61d7e846a1c70aa20c9c3c3380f1d45021b8795375a50691f71cc322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334616, "uuid": "0a83200c-6dd6-4b57-929f-285b3877a2f5", "value": "T14EC31A11F982C1F5DC0B48B5E4AAB33F8B30E63593219A44EF680F66CB27A52571739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334616, "uuid": "24012ec8-ae28-4690-b984-b1aed9fdd2a1", "value": "3072:BXTV2YSHTQoFoHfnjbbtC5tm2kU8q5hmTF//sk4j:BXTV2pjFig5tJ4FXspj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334616, "uuid": "a928c141-c4ac-44da-8f51-348790e7c7ca", "value": 120132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334616, "uuid": "870e3291-548d-47d5-b145-27e94db3a833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334616, "uuid": "1879d261-22f7-4b48-bed5-7565b79a3fe1", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f3926-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767338089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338089, "uuid": "b4c006a4-3bd5-4633-9b54-d437d175abff", "comment": "Malware payload", "value": "52dba5162aee7b80e4c1161c8916b415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338089, "uuid": "21ef1491-a93e-441a-abce-55cb3eff6aa0", "comment": "Malware payload", "value": "6d2629c63b6653cf8907af1556b54362cead634c459014e982b8c3f037a5cbd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338089, "uuid": "ab7d08f5-23b8-4a3b-a237-7c78fb035920", "comment": "Malware payload", "value": "554ac30f0555adff14e508750ce9351e9c932da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338089, "uuid": "2ed8adb7-8429-426b-b8fb-46dc7deb986a", "comment": "Malware payload", "value": "206813f036b3a3fc3ff70d818ab11a5a979fdb670fdbf9b08fccdd7183a2d03fd8ec7e8184668fe72ddfe86b025f7cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338089, "uuid": "62851073-7964-4ce5-8a9b-ddd815126e7a", "value": "T171B3121931202A79D3B44BFA00ECDAC9BEF5AD28D41C1CF3C9B1C4FA13D954E1A17A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338089, "uuid": "d887021b-1dd3-459f-a155-3af4dff76c34", "value": "3072:Qk2XkJZMtgy7w2+qYyDWveexVD7y8W/afU:4Fq3qYcWvV7ljfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338089, "uuid": "2cc06c27-3822-46e2-be6b-4e3373fa3043", "value": 114428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338089, "uuid": "4a3c061b-239c-46dd-b215-98748a36a719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338089, "uuid": "5577d838-d71a-44e6-91ba-826fbef23970", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d26d9c-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381376, "uuid": "2fa0768f-88ad-4a78-a359-0e9d19712cde", "comment": "Malware payload (Mirai)", "value": "a0ca538dca33ab06a1a31b1d85c410f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381376, "uuid": "93ff0d88-63df-4867-bb1f-774b08b05bc5", "comment": "Malware payload (Mirai)", "value": "6d2c14599d60c6aae0f754c01878d1d02041cf96b78a84dc4e0f9b08f40b5236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381376, "uuid": "2cd44863-c062-4a96-a591-3988f70e932a", "comment": "Malware payload (Mirai)", "value": "f07b1e93e4bbe48bfc41bac8f349f287e11d9e71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381376, "uuid": "fd5ecdd9-1372-4338-869d-d6e346a3487e", "comment": "Malware payload (Mirai)", "value": "cdbdbb8ee917d3312d90ae9bf948a229abacedb8a0c458bf24d0efaa60e7a92e9ad57423872ef2c3f7d392d10cd9cc24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381376, "uuid": "b9e1e6e5-4cbc-457c-a390-d5a1a7b0e938", "value": "T1C5536E4232184A57D1A60AB02D3F1BF193BFAAA021F0B3C9754FAB598575E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381376, "uuid": "df0608be-7adb-425c-8e08-8cee1b5baa77", "value": "1536:5euJg1aop1RJ877/C1ySVEh9HaFpru+7RX:jyX8H/CmHaFhu+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381376, "uuid": "1b29dcf0-959b-4f2f-bfdd-6583ff9fcb84", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381376, "uuid": "8a7dfc8a-10a5-44b3-87be-e8cd933963ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381376, "uuid": "0b99834c-83ad-4f1e-b09b-c665385fa325", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88b3fa0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385734, "uuid": "862153e9-e7fb-408f-90b8-11a0bff2361a", "comment": "Malware payload", "value": "93cecf2aebac90b7dbc3ac6ea3b7f4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385734, "uuid": "27421df0-0c26-4d25-8eb5-190a8f31245c", "comment": "Malware payload", "value": "6d6b0a6ba1ba6e041ab71ea07a199036a02c82fe48fac2041d63831ac81a51bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385734, "uuid": "a5540994-baa4-447a-91d4-7692408636be", "comment": "Malware payload", "value": "0760b6a905596b118c2b04b786df4ba158353ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385734, "uuid": "cf6d0560-93b3-42c5-af67-e859c6ef7979", "comment": "Malware payload", "value": "d93686958b183e638bff9c27f2e2c0cfb2f34e68c72b6a0e8d651aff7341f1cd31d9c62e5655913e4238782872846b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385734, "uuid": "00db8417-de5b-44b8-91b5-44ff96b757bb", "value": "T1E40633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385734, "uuid": "04a25035-62ce-4903-a0de-ca18f0263ad5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385734, "uuid": "62501f4d-a0af-4d01-9a4d-c22382d9d182", "value": "98304:aPT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:c2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385734, "uuid": "83c8bb11-c9e3-46e5-b1f1-43aa85c20b1d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385734, "uuid": "f285fb98-06d0-43a4-b2c9-c10205356ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385734, "uuid": "3ab76866-2487-438c-aa61-5c2bb704193b", "value": "93cecf2aebac90b7dbc3ac6ea3b7f4c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a95a3c7-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385550, "uuid": "b771d63d-e667-4221-8833-2956ebd584b3", "comment": "Malware payload (Adware.Neoreklami)", "value": "5bfdd4dbcb3ba6b98e9d1863279cec3e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385550, "uuid": "6f02a5cb-15f0-4274-b455-c37995920c22", "comment": "Malware payload (Adware.Neoreklami)", "value": "6daed2b85f0f56ba58683d0ce74bafae2abea31d33bb6fb135fdf8daff59824c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385550, "uuid": "a9002500-26ae-46e0-9a25-bc8085aca021", "comment": "Malware payload (Adware.Neoreklami)", "value": "45b55c96ea79141a5c6f976ae073993de0aad8be", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385550, "uuid": "3891193f-40fc-4f08-a92a-fa7119dab5df", "comment": "Malware payload (Adware.Neoreklami)", "value": "9bf50620e38a849dc9a6847f4730dfce9231c12a6f88df8865182f342b7eb8c029601c464f71bcea72d20a3f6f281ce3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385550, "uuid": "7b96a866-4ad0-492e-8992-024ad83ad8e5", "value": "T1D77633A4B4FA9C73C443403291747FD182AAC7540AA378F72F66072C7A3D9F5A552B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385550, "uuid": "0e27d10f-c7b3-4215-b750-f1f4be7c3ac9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385550, "uuid": "75432b6b-cfac-4b89-a295-d36494a647e2", "value": "196608:P1OjPwxIAdckH05PwtMvVH6OeAVCd5WUIqhsAtWfDYHm66ptU:tObGBHWH85AM3s00+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385550, "uuid": "23c8d4e3-7644-4847-8c77-e3709f5e59ae", "value": 7500306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385550, "uuid": "f538609c-dd39-4054-a3df-e691d34b6110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385550, "uuid": "1256aa78-21b5-4554-a8d5-0b2848cc9af8", "value": "5bfdd4dbcb3ba6b98e9d1863279cec3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabd7bf5-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385792, "uuid": "6d3fd887-b119-46a4-bac4-28bf0e197e46", "comment": "Malware payload (Adware.Neoreklami)", "value": "9f9bd123f25a051ba117684c99e7c879", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385792, "uuid": "0ae9d6e4-6414-4c67-82df-67f1b43cea57", "comment": "Malware payload (Adware.Neoreklami)", "value": "6e8df6f01fef6066e4b69a49044c91ff0b49990e73342c09022ed0a8d3d8876d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385792, "uuid": "4b053139-f718-4515-aef8-9404c02f26ad", "comment": "Malware payload (Adware.Neoreklami)", "value": "fbf6b0ba3ccc470f0e5f5d683779249764daa769", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385792, "uuid": "c25d2512-7ff2-4154-8cc3-9e4d64c21555", "comment": "Malware payload (Adware.Neoreklami)", "value": "d791275c2b2eb6fff00a2c2b3c1343fa2d8e9ddf0ecfc6200dd924757b3299c880642b090e243401692463ab9bc3481f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385792, "uuid": "864c69af-64dc-4a6a-ab53-170810597cb1", "value": "T1D87633823798C9BAF63508B39DEF6C85CAEBF1480939D4F723405E496F398B1C616497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385792, "uuid": "24a3835e-3b0b-45ac-8371-69b1ea195b08", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385792, "uuid": "32a9eb38-2d8a-4186-8c1a-a4beb0cbeecf", "value": "196608:P1O7C1yeQUHe5mHeByVhY0UXINx9VGt19rDbe9/XJHQrPrLF48g:tO3edHeAHeOY6xzC15+/XJez5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385792, "uuid": "070ed712-92ed-44e8-a1b8-d846e67bcce2", "value": 7496999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385792, "uuid": "7de61f2f-e997-4e54-8708-898101d6e557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385792, "uuid": "69a86ffc-9b49-4e0c-a01b-ab32e15f4233", "value": "9f9bd123f25a051ba117684c99e7c879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f65b9-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385929, "uuid": "c5eeab37-e0fb-47b5-991c-58722d0b4a7a", "comment": "Malware payload", "value": "cc2a13cfff13e22b8e6b2b77fd338838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385929, "uuid": "3f2748e0-3c10-4235-a60c-24f21d0ab6ef", "comment": "Malware payload", "value": "6ea268f9b6301ff4531f57c6e1eba99401f3907956579edd25c3c98dd4ea4a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385929, "uuid": "f0417384-f450-47fb-b840-46e5ae8230c4", "comment": "Malware payload", "value": "8dd675822486dc6222d7411f267e48e86290d335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385929, "uuid": "ae48e570-df20-4780-bde6-3fd640a399ef", "comment": "Malware payload", "value": "abe80a5d677b7a668ebb79c68013529581ae5b80315533968c7c65fbbb94bdeb352c18eae854c6fa15968f27724ddcb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385929, "uuid": "d22a4cc0-a5cc-4886-8e1c-d946f96429a6", "value": "T1FC0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385929, "uuid": "3918b9db-601c-461a-9efc-0b09a87524aa", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385929, "uuid": "7fe5bf2e-83b4-4e46-b5c7-423b169bf7fa", "value": "98304:aWT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:t2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385929, "uuid": "ab7b5ac4-f6c0-4b39-ba73-7e7f00458ede", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385929, "uuid": "ae926d12-9d4f-4fbc-86bb-acd2d7e49f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385929, "uuid": "d09a67d6-382e-4f07-8079-55d3fc6197f5", "value": "cc2a13cfff13e22b8e6b2b77fd338838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938865e1-e7b2-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1767341461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341461, "uuid": "a5f3052d-6f93-45da-a75f-23b819afbb74", "comment": "Malware payload (NanoCore)", "value": "f68378c480ab1dc9053618384ef0a9e7", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341461, "uuid": "e91c2ce7-fd7a-479a-97d2-868f4357a8b8", "comment": "Malware payload (NanoCore)", "value": "6f52c5174cc69ef806ba3f312be44c077c73773bcbb2d18e6cd9bc6a7415718a", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341461, "uuid": "4dcc8649-3b0f-47d2-827d-43d116fc32dd", "comment": "Malware payload (NanoCore)", "value": "e8451f369d5828f769872f5185e5d91371f1aeb6", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341461, "uuid": "8c18857c-722a-48a8-aa7e-d9b3a815c5df", "comment": "Malware payload (NanoCore)", "value": "4350731055baab96b4ef475157567da9ec97b96418f24f64c7c4be81b753ee211efc76d2582d6bceb07bd42aa90d8fc5", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341461, "uuid": "de1dc9d4-e9df-49e9-a4db-468ab09ceca0", "value": "T12414CF6537E4493EE3DE8678702242029379C2E398D3F3EE28D461B69F667E44A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341461, "uuid": "2029226e-7da5-4c6d-8185-d5854d1bc252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341461, "uuid": "a2a1baf6-fcb5-4980-af25-6e0e7e37d52d", "value": "6144:MLV6Bta6dtJmakIM5X6fA+eXcTTacsRy3Cj+tn:MLV6BtpmkquA+eXsaDCUUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767341461, "uuid": "1bcc168f-112d-4620-864e-43902581247a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767341461, "uuid": "ed9640c3-29e1-4997-8739-c9176fab6d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341461, "uuid": "6df08234-4490-4b1e-b0df-e6fa900dd48f", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fef7e46-e7a3-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767334798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334798, "uuid": "3f821679-fb75-41b6-9247-7aa22713e24e", "comment": "Malware payload (SalatStealer)", "value": "4e42aa56434c5c4a3d149b554659b456", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334798, "uuid": "7e7305da-8a23-44dd-bf99-ea1db367abd5", "comment": "Malware payload (SalatStealer)", "value": "6f59aeffb1a9e83966116493c8d010a1c5bf990bccc686a3eb0f2f6ee3095902", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334798, "uuid": "7cc110a8-e3ed-41ea-89e2-f9e5445154ac", "comment": "Malware payload (SalatStealer)", "value": "0f9916cc380375374b46f17de466383083580ff0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334798, "uuid": "17893f5d-902b-474b-9e14-2e261876edfc", "comment": "Malware payload (SalatStealer)", "value": "ddac23a2b05d1d2cb68b27dab6dd0fa72d1e0ac8c482142c4d9f409f9e8aca6d26cb9d081c45fedfe4c9aa6f2381de2a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334798, "uuid": "fd464910-b800-43be-885a-f07b955290ce", "value": "T188E5337402204E37E693653881A16F5A265FCF0F14FF6BE67221BA534D3251FA4A12FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334798, "uuid": "8fb9f916-60de-4863-889f-7f6a1beb50b9", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334798, "uuid": "cc15bd6e-c383-4273-8e58-f6e7a96c628b", "value": "98304:MSSA4CDOYBRE0xSwgPkqAA2NEeZw71IKNJSm:MjWXx3xRyeZw71V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334798, "uuid": "ff99298a-4e30-4aec-9498-9ef21bfb1bde", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334798, "uuid": "76e0a8c1-f4e9-44bc-ba1a-d673d7e7d492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334798, "uuid": "18a4561e-eee2-4889-9f68-13198bff6b59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a39dc3-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336393, "uuid": "7d8c5eaa-88b5-4688-a150-dcadbf16cce9", "comment": "Malware payload (Mirai)", "value": "46b2f76c33a7ea6010625a8b7c4650ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336393, "uuid": "328de064-09de-46f2-b0b6-73f75986c285", "comment": "Malware payload (Mirai)", "value": "6f628f0cd5aadc7b4fda1ea076c3db8f199a352aed05d88e7e9640ff2c445b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336393, "uuid": "eb14d2c2-d568-4f76-a175-2feb8f5dcb85", "comment": "Malware payload (Mirai)", "value": "64d28c7eb826d63b759fb6c6367453a9f63066c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336393, "uuid": "cfab4da9-b3e7-4348-9a1b-74f607c24f18", "comment": "Malware payload (Mirai)", "value": "ba2e747703981f72d5f7ce8de42eaeecd7985d0d18508679102394c60f5c7cb83d4503fc7fd015e594305ba22af7f5b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336393, "uuid": "85b0e7df-a683-4e44-94ef-77b8a72e8041", "value": "T1D6936CC2A793D4F5FD6611B8213BF3764672E939002ADB4ACB25B8369C16902F71B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336393, "uuid": "b303b52d-7281-4ba0-9eaf-9bf3b70d85d4", "value": "1536:OP2UFsL02QTB6cj33GEHxOt32+t7tvqrb25Yel+0jcJD8hmNLE:492L02Qfj33GEROt32mAntQlgJRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336393, "uuid": "32f3b74d-67b1-497f-b7f2-7a870d66c024", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336393, "uuid": "2eebccad-3952-490f-a1e0-bfb79f2e4326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336393, "uuid": "e97a5106-c94c-4cd7-8f15-3a2fd9c8ece0", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626ea58d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385617, "uuid": "cf1b7b16-437e-48f8-bf15-1e1acc804d78", "comment": "Malware payload (Adware.Neoreklami)", "value": "6f71428c8c8fa1e777641e614df7aa5f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385617, "uuid": "cd8eb661-4410-496d-824f-63986f323b03", "comment": "Malware payload (Adware.Neoreklami)", "value": "7008bc2adcbb98c9d7c5e4489b8a781a4936470ac25eb1fadeb59a4e38b5041c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385617, "uuid": "dfe43215-7030-4b4e-85a2-be33d30f3979", "comment": "Malware payload (Adware.Neoreklami)", "value": "31e6473b09428947d837dde871f99845f18a1552", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385617, "uuid": "c61d26f9-8e6d-4e65-b1d6-97ee053e0ce0", "comment": "Malware payload (Adware.Neoreklami)", "value": "ba20b797f6fe4a30336719025ed26313c8310fe8b88b1131c06818aa8e4a76360aaf9e57c489e25408ef6959d8bbc400", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385617, "uuid": "193c25fc-09f9-4726-8746-740ba61df22b", "value": "T11276332030D7C0B9C54145718CB6AEA6E7C7AAA0153B801357F26A2DEC7F7858B7E376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385617, "uuid": "8fe2fa04-93dc-4cd8-b06c-1e1337daeb88", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385617, "uuid": "15983d3e-0f6f-4ce7-815a-e2af7ad924ff", "value": "196608:P1OLMize2HHtTkghnOsPyHT5pLW+aCUKogmacuJOpbdEx:tOLMueMtTkN1T5pK8OpbdEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385617, "uuid": "d8c99c1c-95bd-428a-9cf8-5c5646df1ac3", "value": 7528069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385617, "uuid": "bebb74c6-33e8-433e-ad82-5220b9f8dff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385617, "uuid": "ae105525-beda-4f7d-98d0-118755e6398f", "value": "6f71428c8c8fa1e777641e614df7aa5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5ff5bc-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385469, "uuid": "e8e57553-6995-4f1f-99a3-2764bbb7cdec", "comment": "Malware payload", "value": "3dfe05b9cb7eadbd04282487e93de6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385469, "uuid": "9561cbd4-ae7e-4433-b2a9-8aa6e47bd9bc", "comment": "Malware payload", "value": "7037bda3d808f8e5f509e85ca73a0566e4029ca76b5b9b27adcb51ed09ef3ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385469, "uuid": "545dd425-e21b-41a1-bde8-48e4dd7ccf14", "comment": "Malware payload", "value": "813d3e5639613fc6217747798534a5c8a95100df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385469, "uuid": "dbc5ed5a-f048-4fe2-a759-846ccdb7fbaf", "comment": "Malware payload", "value": "0dae81fe0851b8dcfd0021c7212197af8e2a1fdb9a7a2d6543d82f3cd0e65e2d1ffabdaa2eaf15883a496edf6db20c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385469, "uuid": "ad71a605-1a6a-4269-92d8-7b9f6c571ceb", "value": "T1280633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385469, "uuid": "584c6552-d194-4e32-90be-a2f89b12220f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385469, "uuid": "9556d24d-3757-4ccb-8d26-4fa6c6454874", "value": "98304:axT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:22w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385469, "uuid": "73d52f4b-b004-47f4-bb30-bfd26ef99b25", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385469, "uuid": "c3bc95c6-2237-4436-a0ad-3ef51f1da419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385469, "uuid": "fc160822-1f37-4a90-96c0-98de90bd8ed5", "value": "3dfe05b9cb7eadbd04282487e93de6ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bbd28a-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393407, "uuid": "2bf3b48a-da34-4c64-a579-4c2ec7f3dd50", "comment": "Malware payload (Mirai)", "value": "43af7d7473b4e3aaea0be53f9ee8e760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393407, "uuid": "d237d510-81e2-4fe2-a84f-f63a3f17b71b", "comment": "Malware payload (Mirai)", "value": "705437d944ac7c8aa81e84e0ffbefd466d2a2832b514c223cd5dda02f8842e77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393407, "uuid": "b54b716d-5365-46fc-9778-65d355eb681d", "comment": "Malware payload (Mirai)", "value": "c60d62c210d36cc3ff11c6738c19278cf87308f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393407, "uuid": "9dc53277-edfa-4799-a605-c8d2d493132a", "comment": "Malware payload (Mirai)", "value": "be4aa6ad7fee020c37db697debc290480646a60aff669bb251a3278c314e4e095a99a050fc379baa3ba7f6545d35af11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393407, "uuid": "7b48548d-6a49-4cfe-9fbd-292f8d2f01fd", "value": "T18F146CA9BA0F6C41F2C2D3F8DE4C87E13E1B35E3C7768971791212EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393407, "uuid": "650fcc76-7a0d-4d1e-a385-21e20423d91e", "value": "3072:nQD3KXmtO27CxpQSe0+a/uWN0ywO9Q7ZTEIKERllMFiy7oq:n8KX2O22xp607/FN0/7Zwqlls7oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393407, "uuid": "111dc9b4-e954-4d95-b403-6eb1b3685dff", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393407, "uuid": "737d03b7-51f1-4243-bb16-c9fec34d7879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393407, "uuid": "c30f1456-8f86-4743-9fc2-b8274b156361", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6628b098-e773-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767314326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314326, "uuid": "da5c5a60-01bc-4acf-9bd3-e998803bf149", "comment": "Malware payload", "value": "dba744d2540b554d92dad2c6e8f50761", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314326, "uuid": "c5baa4ee-d233-475d-a9f7-8890d0b2de3d", "comment": "Malware payload", "value": "70840a80d9fd3a211f90c98583d3565f00aea5dba8d42d060cd85780a3b9aff3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314326, "uuid": "8626d37e-27c9-4511-ab11-db4e0ab462fa", "comment": "Malware payload", "value": "56214f62d4d8ca26bfaea0cc04a0e8ad6e88f48a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314326, "uuid": "f5e68faf-5dad-4fd7-9124-7550c8740ad0", "comment": "Malware payload", "value": "457ad2c94398e4be114dbd5621d3c1df10d7ceb9409cfac60799b07f50bd32b79139088676f8c16fcf2c82f81d43056d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314326, "uuid": "a0f91479-93b3-4e98-9d71-89d265a6df72", "value": "T106E1D686ACF328196407505DCBBFA25C7069901B474ACD9CFDCC66A8CF0C6A49222FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314326, "uuid": "fadc7423-9d24-40d3-a171-a80c6fbc50aa", "value": "192:OZd9auIE/CTK/eDAj0llHYoHsfOBro2Tc/OcSmy:Ob7/iAkYoHsfO2/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314326, "uuid": "64b6e98c-0ce8-4222-b3f3-d7471a158af9", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314326, "uuid": "cc36767e-0068-4195-b882-7b50e40659a5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314326, "uuid": "a5402dba-fa28-4ae6-a8e0-70a292cd601c", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66311ada-e82d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767394213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394213, "uuid": "0f742474-347b-4167-a3fd-932a14eeb9be", "comment": "Malware payload", "value": "82000f585ef7aa261b6dde9001dd7fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394213, "uuid": "67bde501-5bae-4410-ac28-74d03197e897", "comment": "Malware payload", "value": "71223c24385de60d8215fdfa51c48f62ea8018f24892cedbe012a0149d388db6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394213, "uuid": "5fac41a8-aad9-490f-8b1a-c442c460e87b", "comment": "Malware payload", "value": "59f1008e121c4b61d37dc9a2c6ea5f58418f02e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394213, "uuid": "f613555f-29f8-4034-969c-f6b93af9733b", "comment": "Malware payload", "value": "e253626184af1572de1703bc7ebdc4469bd0eee68c090d89605c517700ffab9a3ab77d7bc152a4e0b6c6f5f4d2cfaeaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394213, "uuid": "a49ad94e-bc4e-40b5-8209-9d57183d2208", "value": "T1CDE55B5BB5A354BDC1AAC834475FC9B3B920785942253A7B32C5AB302B33E604F5DFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394213, "uuid": "b2652980-6687-463a-8f83-14888046035d", "value": "49152:WHDn0iweGDmCrFlnaAQZGwmHzqq+7ila13Xg1HMLg6IqomfJC1XxHAc+1bq7Hreh:WH70zeGDZr9QZGwm9++l4kur1pqHGssL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767394213, "uuid": "6a47aafd-71f9-499f-841d-2ecafa841770", "value": 3039976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767394213, "uuid": "40fff324-f048-460d-85d0-86b23f31ccb6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394213, "uuid": "6ac4a745-6bee-4266-b28a-0b16d1239c10", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49c050-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385476, "uuid": "f94f6297-5e0c-4fe6-9f6e-177a0bdc8aa4", "comment": "Malware payload (GCleaner)", "value": "41392df2f3868ec74c2a3711cd744550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385476, "uuid": "ceabba31-26db-4a8f-89dd-408592d0376a", "comment": "Malware payload (GCleaner)", "value": "715271ac4a0198dd7b9a6c9fca69e07caca4715ad53543405c7a9d88eee5c897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385476, "uuid": "9bc638cb-5387-493d-a706-f907d4b81df3", "comment": "Malware payload (GCleaner)", "value": "2b8a728a796b21e936d13cfdadb41a2bcf925f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385476, "uuid": "1883c470-7334-41b0-9dcb-96906f05df51", "comment": "Malware payload (GCleaner)", "value": "a9ec707c8e2c3c1a5d9af23ee7e292564bd2c17da5864624f2aa80c50362a5b761738629e9d862e747293c53b6bd5ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385476, "uuid": "d6b82743-82f8-4919-8226-ae0b600594d8", "value": "T14426D0A7EB43F136C9B23AF7ED01D0E080B41900DBA9714D7792CADA18F66A525DD372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385476, "uuid": "56b31390-a688-4952-ba4a-1bfbad36df85", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385476, "uuid": "eec1e517-2ec8-4fe0-b624-33505f0cd937", "value": "98304:gyglxzPxy6FmF+qn1Cs2IY9iAJt8lVY5aT+3MD/ujM:gVlxzPxNFQ+tJJuaMD/SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385476, "uuid": "6e63b82f-cac1-4626-9a9b-66b64e4328b5", "value": 4683024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385476, "uuid": "b134c47c-e1be-465a-af94-ddb04940a208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385476, "uuid": "dc189bdb-195e-482f-8d39-33190bae0a77", "value": "41392df2f3868ec74c2a3711cd744550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac497632-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385741, "uuid": "0497bf5b-3e61-4c6b-9fe5-879c32a79441", "comment": "Malware payload", "value": "f46aa82c2fd3c3bb2979e21a87b02445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385741, "uuid": "06a3cfb7-9b6b-4cab-80f3-55580dbcf7a0", "comment": "Malware payload", "value": "71c06acf7dbdb38f82163757f56ee3c5d51e5bc4527ba25555f1b5cfaf73453d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385741, "uuid": "f354620e-d320-4fe6-aa41-37e7c23ecdd4", "comment": "Malware payload", "value": "9331510ce041968ed09e0239cabc168d0c4c6f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385741, "uuid": "6041000b-1649-475d-b664-cfdde7a13a6b", "comment": "Malware payload", "value": "88437203033ca432dd42c8058ac114a1d84fba94d92116aa157798eecafdbd552eb5ee54f3a7c7192341f74fe8f17069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385741, "uuid": "6ea5ab5c-cc4e-48ed-bb4e-b53ac6563622", "value": "T15CA43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385741, "uuid": "8bb3f853-dcff-4fd0-87a4-ae5377d1aad3", "value": "dc3120d7b4090566a887530f3c294893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385741, "uuid": "b296bf1e-d3fc-411e-9074-e4a7879d673b", "value": "6144:NqKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:sKZPBhxVLCV2RcG+/CZ7VZBx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385741, "uuid": "2d6d5e5c-e295-4e59-affc-04ea9057bf39", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385741, "uuid": "0c65b8a1-4ace-48e1-afb8-86b591196f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385741, "uuid": "aed5d911-4153-4965-bccf-cc7f5bfe5516", "value": "47e56612832d46163e5b3a6cb042bfc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c648227-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385956, "uuid": "a5008ae9-490c-4366-a958-ac214c917501", "comment": "Malware payload (Adware.Neoreklami)", "value": "d33cb0475e3a183561bb5b99c0e54753", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385956, "uuid": "5c9d12b0-9f49-459e-885f-d6579fd0f0bc", "comment": "Malware payload (Adware.Neoreklami)", "value": "71d9df7d78a54c03949ac6fc807d7bea8371ff4d91b255230f33c50038270b89", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385956, "uuid": "85de39f4-96a6-4cc5-9c56-4e22f64b5109", "comment": "Malware payload (Adware.Neoreklami)", "value": "db47e3a29162353ac18e75c79e7bd59f33a813bd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385956, "uuid": "219d08c0-331b-4d90-b560-5c800568cc5d", "comment": "Malware payload (Adware.Neoreklami)", "value": "0a35226e41ea3731bd5167c0c4752578c1a09ab096e544e21f18f8f655dbbaec3f0730b94cc833602e3b64cf82c317db", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385956, "uuid": "da5972a7-c514-4a49-b4e5-0225145e6640", "value": "T16A7633B7B6F8D4FFE1362D304D142EEBE279CD9D5925689333C2471C9EAD9A490023A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385956, "uuid": "d09ec05a-eec8-458b-9f4d-7c33ad35005a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385956, "uuid": "5506278b-4493-4b80-81ce-994121a2bf5c", "value": "196608:P1OlRwMRHAbqwrY9UiJdlTZz0ljG09W2jZv4VJoIcuo/v:tOX3g+aQXTZz099W2jhYu3uSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385956, "uuid": "d44c024f-4868-4295-91b1-4587f2942a70", "value": 7560595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385956, "uuid": "8c852c24-4a0b-4577-b908-d1e8b0185ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385956, "uuid": "e3ce1b41-b296-48bd-8e08-20a6f6ebd134", "value": "d33cb0475e3a183561bb5b99c0e54753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ddb5af-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385626, "uuid": "33430760-513b-4646-a1fc-28e2ff0ab9ec", "comment": "Malware payload (Adware.Neoreklami)", "value": "7121fe4ce2cb8b919587299f54aa417e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385626, "uuid": "8b4ed214-95a8-49a3-8f0e-3dff5f7e3385", "comment": "Malware payload (Adware.Neoreklami)", "value": "71dbac7168cf2af8dcbeb1197350dcdc3ef4a7271825ec79abd7d634baadc504", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385626, "uuid": "dad80158-896c-4858-af48-8bdb54b95314", "comment": "Malware payload (Adware.Neoreklami)", "value": "49cf183b742ad76b5d3a652d9a87fe0becf19323", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385626, "uuid": "4fc93021-3692-45d6-86e7-85f5f0e3184a", "comment": "Malware payload (Adware.Neoreklami)", "value": "4dd9801c451190b70b7b982d1125a6e00b991b81912208a5a44340bdc22eda2a97ab2b6dd182cc39b968f8e4fc8a54a1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385626, "uuid": "16c4fc02-7427-4108-90c4-75361e3493ed", "value": "T18876331676E0C67FEA4142308636DFD7E1BDDBC90E1604AB07F60057AB7D3D9CA6620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385626, "uuid": "07140743-f64f-430e-92ec-69bcf6eda1ae", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385626, "uuid": "ef8231fe-3044-4edd-8a45-bb2093cf5fe5", "value": "196608:P1OZwXN0HOp/oAFOmqri2YDLPORMdOFEcXUq5PqNwL4sVf:tOZqOEofmOWLzOFOq5PqGdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385626, "uuid": "f1aa0041-a1df-4a50-baf8-63b7a95871ef", "value": 7556071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385626, "uuid": "c45eaa90-09db-42c8-ae9a-d0a3bf177432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385626, "uuid": "945e3213-5eb9-453b-bf81-86f4a9b6c513", "value": "7121fe4ce2cb8b919587299f54aa417e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af90591a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385746, "uuid": "fea84bb9-4f5b-40dd-9823-df743edcf968", "comment": "Malware payload (Adware.Neoreklami)", "value": "94f2d6ba8095e959e8397f900c7a0bea", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385746, "uuid": "4019e7bf-c825-4730-bffd-0a8c7898887a", "comment": "Malware payload (Adware.Neoreklami)", "value": "728e9676dafa84294abae9986e5a65a39a0bf231e328f2b9dec375cc7cb9593f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385746, "uuid": "4a1b4f07-67e2-492c-a558-e298cdbd87a7", "comment": "Malware payload (Adware.Neoreklami)", "value": "9910e8780acef743174e1eda92e0f8b650f8913a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385746, "uuid": "a5388d13-4ccb-4d78-9a90-141667e3b8ac", "comment": "Malware payload (Adware.Neoreklami)", "value": "7cec0594e8ef02b1ea88358aed02ff1ae1b602d627a7a8318ea486426fd9548a462ebb672cb78f51c12563fd7739a2fd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385746, "uuid": "6a5ad51b-18f3-4d32-9ac9-b09b1896cc1e", "value": "T1EF76337876E0C5F5C15404F5CFB92B9E29BAD33A003A54536FB90C1C3E3A66AD20699F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385746, "uuid": "77670905-a4c6-4146-aca7-28d0e927e950", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385746, "uuid": "1d3f8738-18b1-4f92-bfa2-188c32b54f0a", "value": "196608:P1OOIGcbOSK8EeZH4ciRO0MQHRjg9g3OUyLSft:tO1GqOSKDv5RRMQHxg96D9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385746, "uuid": "fc8917f2-838d-4cd7-9039-b2aad61dc87e", "value": 7578355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385746, "uuid": "790bb48a-7a44-4444-ac01-8b38bbf0c44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385746, "uuid": "c373b04b-a2e8-46af-9373-c4a99b4cedc4", "value": "94f2d6ba8095e959e8397f900c7a0bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fe1a8a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385725, "uuid": "0bc333af-79c0-4834-8b04-70b20ded763e", "comment": "Malware payload (GCleaner)", "value": "8d7365889c96bf645d4c2d59adad7090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385725, "uuid": "87758100-525d-4099-8f0f-db3b0a04a2bd", "comment": "Malware payload (GCleaner)", "value": "72de4f6a61978386852d0ff04dcc112e70ef41971844f561f2d09d18f3ad0164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385725, "uuid": "cfb0f4d4-5216-4578-ab2a-d5eddca89cc4", "comment": "Malware payload (GCleaner)", "value": "b6e6049164435aa8e3f3499a1e28405fff786f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385725, "uuid": "5872bfe4-fe64-45f0-aaca-63aa93f717c3", "comment": "Malware payload (GCleaner)", "value": "731b95b9aba96a554ae22c8f69f373f81b1f5ff4922c76dfb63150c49c2c6ac223a5d8ec6b061d9a056a36d31f3b6420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385725, "uuid": "c52d5981-7fec-40ff-8048-df875118109b", "value": "T1BE36E051E8483837CCAA35BCC86793613A24E995F9685903DFA10AC9EF1511FBD821FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385725, "uuid": "0d5c8832-ead4-46fa-96ba-84415d65fea1", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385725, "uuid": "a1c846a8-c64b-4e78-a4b7-ac3394da9665", "value": "49152:xS/NdnNM3zMDaHR/FMnwzRrfHa/63jKhA6WkSAdBl3Ql2H907M9i654iE3Y6w4Yx:xS/NFNAAeW66/QkSAdp1GTJWpIP9pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385725, "uuid": "a68b8100-6c2a-408e-bf9c-023f71eaa069", "value": 5303056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385725, "uuid": "5a479a5e-93b4-4961-b973-c6d6c86bfee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385725, "uuid": "4667965b-490c-40f1-9767-694ba4b65b54", "value": "8d7365889c96bf645d4c2d59adad7090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc00d56d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385821, "uuid": "4a67553d-6e9e-4156-8c65-e6b6c65107d9", "comment": "Malware payload (GCleaner)", "value": "a9c5bf78e988982664b54a487f2c6331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385821, "uuid": "96d20a84-5625-4937-b2fc-85660cec89e6", "comment": "Malware payload (GCleaner)", "value": "72e0aa47673e7c870ae46adac572ffe5446e7e944acb27710c9619c8f1061ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385821, "uuid": "7da7e626-d220-4aec-a6b0-6d9a4a197397", "comment": "Malware payload (GCleaner)", "value": "95c77c7f65a1d35783eb585dd729973d6f4bf44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385821, "uuid": "0071c037-e5fb-4094-841f-541e0ac437ec", "comment": "Malware payload (GCleaner)", "value": "5f10da6a6b8f1452ec8af4fa1d84e53d09caa2eced6d6b4e64655d4c65724fc0ea72bf544a3341e9b6b7731a7710c55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385821, "uuid": "08089909-7ceb-41db-bb1c-9595588fcc60", "value": "T1C236E01DCADD0070E901533C955579302326AAAEC8FFDB596F9978503B306E2E2EEE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385821, "uuid": "01716c2f-95e0-401b-9430-70bcc8befcc9", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385821, "uuid": "1d5f82f3-84b8-4f30-a2ee-7eb53a9e71d5", "value": "98304:AC1NGAKMf1paT5zYS4JCLHCcRYkZLQBMzR5X9x+e3YFg:Ag8Yf2TNYfYHBRYkxNd9x+7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385821, "uuid": "ad6291e7-d16a-4c91-9512-c7414ab3c730", "value": 4995856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385821, "uuid": "86d637dd-f2e0-49ac-acfc-c20af5c434ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385821, "uuid": "4e2ce96d-49a6-454d-9a7d-129679c79447", "value": "a9c5bf78e988982664b54a487f2c6331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b809dc91-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338086, "uuid": "4fd4d299-009f-4690-932c-e51f5f9e700b", "comment": "Malware payload (Mirai)", "value": "ad82fcb20d6e073cb8350fa2367eb59e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338086, "uuid": "433b6477-0d8b-4448-a110-a501a6be132e", "comment": "Malware payload (Mirai)", "value": "7461133dfdc6a0b85a291f6bf3a7766489f8cd886acfa99614eea1f089b2b504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338086, "uuid": "972a7a30-3d4d-4503-8cf7-77cb48ffd5d0", "comment": "Malware payload (Mirai)", "value": "70b724409a6e54b6c253b886ded262178e066916", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338086, "uuid": "88c6b03a-e32f-4834-985d-d253b4b1801a", "comment": "Malware payload (Mirai)", "value": "3f2448e3d1c3bbe748576ebf19f22d59e0bbe803929e1550b83ecf5ae595e1ea4888035e9d07b80ad5d054bbbb89c4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338086, "uuid": "8a78d5cc-cbe9-46c9-be4e-77767261ee10", "value": "T1DF83022C28D082A6FBF851F4F9F0681EB760976F943232276047C0C9BEB41EC4766D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338086, "uuid": "fda4b9fb-76ed-4cac-82b3-3b5539407e62", "value": "1536:2fv/po19WOq0WlvU7KJqpP24+krOuXsRT7isv+6IiAa2C5hZZ9um7yRiNPv+9LfB:2fvBoKOq0Wlv7JGxNOuXUT7i56j2CnZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338086, "uuid": "f7087666-676e-4f8f-a1f0-f3d83eaa5428", "value": 87484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338086, "uuid": "62ea9278-3b59-45a3-9985-25e0229bb049", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338086, "uuid": "8b97fcd6-a5d8-46d8-b45f-7624b0be680d", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df59933-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381851, "uuid": "f2bcb749-e169-41da-933a-42c6373c5360", "comment": "Malware payload (Mirai)", "value": "5c85b0ccff20f942d2e9b348ab07ce0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381851, "uuid": "b87a2855-7774-4dd6-916e-eac2c3ae67b7", "comment": "Malware payload (Mirai)", "value": "747f6caa1b5d724f98351c115d8495b3cf543271bd87c9dabecf0a31ff1fb983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381851, "uuid": "324c7626-baa9-4404-937e-51a7405331b5", "comment": "Malware payload (Mirai)", "value": "a3c498e03c7d7af25e17e29f8e8df64dec1aa371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381851, "uuid": "5f088084-41e6-46d4-b2ab-dcd3d560dbba", "comment": "Malware payload (Mirai)", "value": "771e68ea9b44cc1f3399e380b65f27e8e20381160e002740395f994139894b094c5199a732068ae5abcd77cc5ca90ef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381851, "uuid": "88f8530c-01f8-470b-8b68-920d689e9acc", "value": "T16F830746FD818E12C5C512BAFA2E118E331317B8E2DEB2269D14AF2077CB92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381851, "uuid": "8e5791f8-5248-4b53-8914-801ca0a087f9", "value": "1536:WRncGBT+AM7vuUKMLoy6tAU+ifEkXHWk5Xn49eUgWRKPahfaLAIziAYLFDsav05L:WBT6KSo1t1+YEGHLyXgsmagYLFDsav09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381851, "uuid": "a302f8c3-d330-4a7e-831a-caf0321e32a2", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381851, "uuid": "59327cd8-b44f-40e5-a142-0c2d9495de92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381851, "uuid": "6a78a940-5aa4-4203-a943-a56a4beb0998", "value": "meerkat.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f76e943-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385665, "uuid": "09da3400-7c0c-40bf-9d73-f218c4505a9c", "comment": "Malware payload (GCleaner)", "value": "7e2aa6f9bb11409cc95e1035b21f72de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385665, "uuid": "7a509300-1616-4ca3-94dd-8a21a949ae1f", "comment": "Malware payload (GCleaner)", "value": "74a2b6fd5721d3617cb122d8895e4de00fb3f6eddb19b68a7481a420ea553d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385665, "uuid": "cc0fa0fb-3fa0-4375-8881-368bcbcfb330", "comment": "Malware payload (GCleaner)", "value": "299626f842203221cd2df73623869c8c1dbfea6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385665, "uuid": "7d52514d-5e70-49d9-8872-0d0006e01d26", "comment": "Malware payload (GCleaner)", "value": "ab0e36e1affe5c65c8a894b10a556cd4fcd5845fe344fd2503cf2e73b2665266220defa7ee57c07121cde990077798d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385665, "uuid": "5bd7d7e7-faef-44b4-865b-e6e38590b361", "value": "T1A656DFBBCD347923F4230C388D9FAA04D439E7DECD14ADADD7803A757524A66911BA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385665, "uuid": "48d57a47-3559-4e44-bb17-f5633c4784d7", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385665, "uuid": "4b55f741-5c42-4d1e-9e11-0412687a7b0b", "value": "98304:irSWAyFVte4yw33LqrOUrOKFeqd/x6fSf4S00j/JDW:S24ywHLq6Lsd/x6fScu/J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385665, "uuid": "f2d1d78f-15b6-499e-8e4a-33f2aa2975d6", "value": 5996816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385665, "uuid": "9d82037b-aac5-4ed1-b490-d67c13e705e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385665, "uuid": "dec9a5dc-6d6a-4b08-b4df-621df483d154", "value": "7e2aa6f9bb11409cc95e1035b21f72de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874a42c9-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335857, "uuid": "38aff7ae-130c-471c-8c5b-4ead78ac9627", "comment": "Malware payload (Mirai)", "value": "4ef54459ba85296714c5cfb270f5fe69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335857, "uuid": "0bad997e-044c-4b00-970c-691470c16469", "comment": "Malware payload (Mirai)", "value": "74aceaa687ed63509cad56b6d9a632ac477038d3363c19535fc8066434b2888a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335857, "uuid": "37bde9ae-c715-4b61-9efe-59879613e9e9", "comment": "Malware payload (Mirai)", "value": "0957432916225d75aea58ed47a167d902403a71a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335857, "uuid": "1a1dc4a8-ef70-4221-bfac-b7797487f542", "comment": "Malware payload (Mirai)", "value": "8be09cb95d1fb3bb0d1fc1a838cbfb8cfec967fc6301130b0351a19b555786fbd205a1b0aa0121dc13bf18c3676f9597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335857, "uuid": "ef4c899f-494e-4c42-a9d7-1816ecf360a7", "value": "T1D8A33B52BD81DA12CAC521B7FB1E428C772753F8D2EB33039E265F21778A91A0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335857, "uuid": "8d4736d4-5856-43ca-b543-34b6ffd1d227", "value": "1536:8pF18zmUBOjvZwPj54A28vZgbIkd9YVpbhVjwO2vScz3cfCB40FyGKHcvK:8pF1MvCSPj5682blf6pbLyz3cfWFjJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335857, "uuid": "b5034a73-221c-4d63-804a-e2d946682429", "value": 100156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335857, "uuid": "fa87d17c-e1b4-4577-80b1-5a3a4babf7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335857, "uuid": "bc247f3d-cf8b-436b-a1be-b16d15d7e2be", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc8634a-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385337, "uuid": "d80ffad3-fbad-4323-bf7b-ae20f56d9341", "comment": "Malware payload", "value": "04349bc689a85af48450aa5705876a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385337, "uuid": "c16eb962-9bce-4a8b-9a85-e5478240e502", "comment": "Malware payload", "value": "752e10f416f8d022d63860bd65e1b9bb8f5e564a9e3ea90361aaa18a0d950d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385337, "uuid": "014f4c2c-37b0-41e0-abba-f29079300124", "comment": "Malware payload", "value": "fa924ef4cc845896c9a715ef90be7a50d6f11cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385337, "uuid": "fc02a6c0-7815-4b34-92ee-ca4fbe625d33", "comment": "Malware payload", "value": "b5c6d371e44e523bc31ecd770fc734938f7f3d347250af366eb0a5281b0b639164bb979f4e493dbd23a8493eb44ae57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385337, "uuid": "c61102de-bfa8-4571-831d-4d20e7744d24", "value": "T1370633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385337, "uuid": "b40cab0b-4ca4-4b11-bb52-8607c5bb062e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385337, "uuid": "fcecce0e-f9fc-4dc8-9234-6c6de8402c48", "value": "98304:awT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:P2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385337, "uuid": "a7564cdd-5315-49f7-b8f9-5ac9e20b7c4b", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385337, "uuid": "a2d8eea8-4111-437a-abdc-4391e1dc5daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385337, "uuid": "268ddb47-1131-4c54-a2ed-fe84853028fa", "value": "04349bc689a85af48450aa5705876a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44d17d5-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312713, "uuid": "582bd801-df8e-458b-8ff3-607943320e5a", "comment": "Malware payload (Mirai)", "value": "bcad26ec4f85b231eb3fde1adef52426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312713, "uuid": "885096df-0a8f-4981-928d-cde443a02ef7", "comment": "Malware payload (Mirai)", "value": "757b606d6d0de457ae5fc0a00aec54974ba18e09353721a003631c6f1a82aec9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312713, "uuid": "2256eedb-60df-40e6-8230-463b4c0934d7", "comment": "Malware payload (Mirai)", "value": "8678fd07f6f9e8016d32cba0ad8425c4857ace27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312713, "uuid": "ddffdfc2-5545-49bf-9781-625e4b7c9e94", "comment": "Malware payload (Mirai)", "value": "2437bb9b1624f9782267716c3702c12cebb8e6eee2586fc3015230dd1d0276d6af92fa7a421b5da6dae3715d2fae9402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312713, "uuid": "41c5d09e-2494-4500-924a-f8c62960424f", "value": "T1C8530945BC81DA27C6D462BBFA1E42CC332653E8E1DE7207DD11AF15778A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312713, "uuid": "1f0593b9-49d8-4df6-b23a-51705afdc0ff", "value": "768:89B/+6GJcTlMhv7p9qS+F1WarnKIC6MZhk7evomNdQxVBiko696ocu+7R:6/7Gj9qnrprnSvhWKzQ88Mu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312713, "uuid": "91286505-cc54-40ba-90e5-289cad9d8c12", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312713, "uuid": "9e2152ba-7066-44f1-befc-f649a9238341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312713, "uuid": "14692f6c-5301-48b6-8026-300e4c8e2e45", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61851a41-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393346, "uuid": "fe1ec1f4-4090-4dc6-8c12-b97f89f6fda8", "comment": "Malware payload (Mirai)", "value": "4456eae82acb0b6d47a5333c5ee42887", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393346, "uuid": "24490505-69ef-425d-8c96-77de2be5e2d7", "comment": "Malware payload (Mirai)", "value": "75d7f063e06455c03e548f06265d84412118443ad1bf3cc7b15ed6ebb176412f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393346, "uuid": "d71adf31-e692-42ed-abfb-f41c49acf133", "comment": "Malware payload (Mirai)", "value": "8a23ead960ddec386d8305c941392ad092f45578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393346, "uuid": "968cc620-4757-4da4-932d-c6a1d0bc7986", "comment": "Malware payload (Mirai)", "value": "bcf40f808df8b83d27a536ad5411564967e6e32bed8cf938ed449faf018f3c8237f839a58894db098db9e794576c72da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393346, "uuid": "7c7750a0-e9b2-4b71-8139-7bc29a5860e7", "value": "T137033A2789769B0BC6E4B37701D783A1D0FB1B841284171FBD0B4C5DFEB63416A6A78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393346, "uuid": "90170e82-3ddc-406a-a838-448be5d9d3f3", "value": "384:DLXscLixOd1zHigytBpTfEmg8LYhxdTbVt26jW5E0/B78RVTT3PY57lf34cVx4Vm:fXsM1zCgyjpTfzjCXM/BW1fYHfl5N/pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393346, "uuid": "987501d1-0aca-43d0-b54e-438258492bf5", "value": 38380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393346, "uuid": "0b5a975e-32f6-49e6-b61d-5150d34585c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393346, "uuid": "ce1c3cac-c192-4f09-b548-17414e485b88", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c650003a-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385355, "uuid": "2447cc22-3b4a-49c1-835f-40b2ed7452f0", "comment": "Malware payload", "value": "0af9a094c350205fd9215f7c646f4fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385355, "uuid": "1e55dc0f-59a0-4740-948a-b24eda5fcfd3", "comment": "Malware payload", "value": "75dfc4dc446c5b15e9ea74917220c67ca0d31e6f0cadfe4af63f1489dbcb5815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385355, "uuid": "ba60c3a5-372b-44da-b6a9-df81fb16ab20", "comment": "Malware payload", "value": "59a5e7581f31c233109a45e60750eaebd08ee9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385355, "uuid": "203d5293-4efe-4587-9734-acf3bb7e1f77", "comment": "Malware payload", "value": "4e94f929eb4011beece211e4f30b7233e716c944d26bfdedd07d817ceccf19c9fefba588236d046ca94f296c2d85febf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385355, "uuid": "9a3cd843-7250-4926-8e53-8dff6e554d1e", "value": "T1830633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385355, "uuid": "0a9b6d2e-5a6a-49e5-9885-7d836a503079", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385355, "uuid": "baad44ea-dfd7-49d8-8ced-720e1e606918", "value": "98304:aXT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:U2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385355, "uuid": "0c425c0b-9e1c-425b-bcec-d51bd3270bfb", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385355, "uuid": "74a36233-c5b2-4ac0-bfce-12a29dbe8b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385355, "uuid": "dcbff9fa-f8a9-49e4-8df3-8a847229c6a4", "value": "0af9a094c350205fd9215f7c646f4fd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf43656-e7a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334762, "uuid": "c9b6f688-bdfb-4634-a164-a05d25ad1c4c", "comment": "Malware payload (Mirai)", "value": "82f08c3b0581a4858b094b9ebad27af1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334762, "uuid": "1e3a30c2-6966-4e79-a6aa-71778b333d76", "comment": "Malware payload (Mirai)", "value": "76094f5a374f46754ae423ffd5fbc9f1d40e60378f89a95c6de853b5a8302247", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334762, "uuid": "9358eb7b-90c2-4c65-a068-a936d95c3943", "comment": "Malware payload (Mirai)", "value": "dadb0677200078a17409e90882fb357b198644cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334762, "uuid": "16a0b44f-d8aa-4deb-bf0d-c8bdb8dd1c98", "comment": "Malware payload (Mirai)", "value": "5b29b377a8006086c6e9bfd60443735010a37356bd94fd655d9638cc3308622e12f1f1d9b7d6a498d48ac898b197297a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334762, "uuid": "62cb9ffc-5548-4405-8a42-26dcc1ba25e8", "value": "T1E7C31995BC91AA11C7C2567BFE4F428D771A5398E3DE3203DE185F6437CB85B0E2A206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334762, "uuid": "9944841e-3664-422d-bded-022a39e1cf0f", "value": "3072:drU/lIkk6WeJxg2zo9PjpjjYx8wPcELhPzg2d4k1Tnz4:drSlIkFW8lzePjpycELhPzgil1X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334762, "uuid": "8238f9ed-7ab5-43f5-964c-c45dcca1537f", "value": 120024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334762, "uuid": "a8196389-3dbd-4a4c-98fa-423b6f199c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334762, "uuid": "2fc6b478-940e-41a7-ab44-1cd3473e2b2d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1fddb2-e80c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767379912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379912, "uuid": "db7b7c0e-733b-4862-aca3-e915e8697c65", "comment": "Malware payload (Mirai)", "value": "8f2eebbcb6a28d6fb5a238de9b07d51e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379912, "uuid": "5d661395-6e4f-421d-b5ec-1143246a62e1", "comment": "Malware payload (Mirai)", "value": "7618f8a4658d8670d98baf3270ca3043efb871e5dd2476cf19e3edaaa8ea0df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379912, "uuid": "45cf0882-48f2-4864-98b2-09d77d132160", "comment": "Malware payload (Mirai)", "value": "a05885f030f63860936ad535dba5a5b58fba5ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767379912, "uuid": "2a1d78d3-ead6-42c1-bd8d-7ea8149ecac0", "comment": "Malware payload (Mirai)", "value": "cb185fcd60de8c2d357cdfb83f05a9ea3ba959c38cf75ab68b8dfe7ac4072b221e63b55ce80aa6917334e28e00582344", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379912, "uuid": "2c292ba3-7c62-49ba-bb64-2454ad8e7e07", "value": "T12B73E946BC918A56C6D512BBFA2E118D33235778E3DF73139D106F247B8A82B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379912, "uuid": "c9d676f6-8511-4490-95da-e4e2cdbab9a4", "value": "1536:WRn6/4lbqFQWibiqqkzrWs6u+HweoWxBvwUKoF1sy3Z0M5i8esbCWDsu+7R:1Ubuibifk3Wxu+HweoQvwUKM/esbCWDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767379912, "uuid": "5dba846d-ad34-42cc-b9fa-2739489a97eb", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767379912, "uuid": "aade2849-dcf3-4586-bd78-a2aafb19b6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767379912, "uuid": "377f1642-15c4-42be-937a-b1f3f32204ca", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7513f493-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337544, "uuid": "d39d95c8-1840-4f22-8f00-ed12f8e3b81a", "comment": "Malware payload (Mirai)", "value": "c6349c84c47e972952799501bc28ec7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337544, "uuid": "b4efb497-a68e-4ac9-a71c-a1cea0a0e2cb", "comment": "Malware payload (Mirai)", "value": "76733fa1268ea8d1d65ee034e702f8ff8e6669e71031287612342414e60da76e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337544, "uuid": "22763de8-5f47-469e-8eff-cd986c3937e8", "comment": "Malware payload (Mirai)", "value": "ef7e06200f706ea28081df8197fd2f509a157ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337544, "uuid": "5b246a16-4226-44cf-8919-d698b2ab16d8", "comment": "Malware payload (Mirai)", "value": "b73cbd5b5df990afee6c9f22285ac759dc577a43fe83bd890c3240eccd23e7586a9f19d241b209537790313aba2c22eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337544, "uuid": "661e3c3a-2744-4fd6-86b6-ef922f7627bb", "value": "T177C32985B981AA12C7C256BBFF4F428D37165798E3EE3203CD185F6433CB95A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337544, "uuid": "96bf3350-5c02-4ad2-a7e9-3a9d2062a5e7", "value": "3072:iVHxs4PoSfzW1w8Jc33vtjFePLRH9ALQCv8NnT4:8Hxs4PzLW1PJc33vtRePLRH9A0U894", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337544, "uuid": "aaf2d69b-9db6-4198-8e8d-2a6f9503f86e", "value": 120024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337544, "uuid": "0d1523c9-f2b9-4770-9ad3-34e300f728fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337544, "uuid": "7a9ee062-6e11-48d3-930f-5f9ae5c1f540", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276be701-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381652, "uuid": "83b0aea9-aad5-4d3c-9e7f-f9a983a6bdf6", "comment": "Malware payload (Mirai)", "value": "8b641fcb3307521a14ab5a16072ff74e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381652, "uuid": "9b503b05-7efc-4b1b-89ef-25e63a7e7ebb", "comment": "Malware payload (Mirai)", "value": "76b3c4ccd65710cd270a0b936c6d9cea5f8f8e0d4478bd57da8e4adce12fa421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381652, "uuid": "f84f661e-9140-435f-b417-b1f96e01b276", "comment": "Malware payload (Mirai)", "value": "12280eb84fc01fde66cd09d4ae57d5e1b1cd2c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381652, "uuid": "4190b817-520b-4499-b49d-824397e7afbf", "comment": "Malware payload (Mirai)", "value": "7d6aa4244dd0f6ff38cb755ea49035e83289f034241d7de871af79ac613901553031e3bba49697878599d1f52d873fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381652, "uuid": "13928b69-81d2-40c9-95fe-794e44460687", "value": "T1AF73840E2E619FBCFBAD863587B35F209248339626E1C545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381652, "uuid": "e0509db4-260e-449c-8095-5461450c5dd4", "value": "1536:D4Z8VUay6+vl/R1KIdysUmR9EiYHXwbdyFlKPfNJ1jzETV2:E6Zy6+vdGIdysUKHyFlAfNJ9zIV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381652, "uuid": "cf70c0db-c64b-43e7-9a2f-0d945c2e2580", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381652, "uuid": "9f2f3465-e53c-412c-a1f6-b4f7c4a6bc69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381652, "uuid": "cc169012-ffd4-4aff-ab06-33d8099838b9", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b703a9-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385600, "uuid": "a2e18bd0-c9a3-4dec-9750-6a555f588ac5", "comment": "Malware payload (GCleaner)", "value": "6a960f462107c5cd6926de77ed2e6488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385600, "uuid": "d256febf-d226-4755-891e-14f08d7bb209", "comment": "Malware payload (GCleaner)", "value": "77dc8e54ffac75735a2ad0ae6eb2dc2c30830291b91168a59c3cc534d2baafc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385600, "uuid": "8081a76b-39b5-4ffc-93d2-0401fab4f1c3", "comment": "Malware payload (GCleaner)", "value": "39e71dfc2930481759b659a421ef0f9d321de427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385600, "uuid": "19a97859-5877-43d8-a878-7b3a7fd556d4", "comment": "Malware payload (GCleaner)", "value": "9bbab2e5cca4fe2a411f439f94765c3e0d1611e35dd31da62bc8a8b554e8f95282dc59ba1c22d0beb1e4f95848fa4987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385600, "uuid": "7fcaf15b-7867-432e-8257-bd0fe386e148", "value": "T15F16D0DEF6E81A63E0126EB8CE2E91ED8D1879A3CE30D317165F2C3806755F4153A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385600, "uuid": "26b3ab80-f08f-42a7-b42e-78dc287d1b30", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385600, "uuid": "f8c360f1-22ad-4c8c-9dea-02251f160345", "value": "98304:nrSWmd4APR4RYIjtk2Vp2ME7rmM9d7x/geN:rCQhjt5PE7rr+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385600, "uuid": "631db4b3-68d0-449d-8d93-c2d11afe23b4", "value": 4141840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385600, "uuid": "def01b35-62cb-43ed-9572-4658db715813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385600, "uuid": "5d55e172-f093-4541-aa9b-f8900d8d3f67", "value": "6a960f462107c5cd6926de77ed2e6488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f32424-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385889, "uuid": "fcc7ccf4-45d6-4b58-8519-c7063e8c2c35", "comment": "Malware payload", "value": "c3c16ece51c57b9c192e950ab83ad9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385889, "uuid": "fff69a1d-8a11-453c-9d87-8d145ee19994", "comment": "Malware payload", "value": "77ea8a229e540af84e423dc8f10e2da1776601899383746973a48035e2d0c233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385889, "uuid": "71183546-1deb-40d4-830c-93ef058284e0", "comment": "Malware payload", "value": "2654c82f4e823cfbc811289712f4ed105277fec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385889, "uuid": "37cd9088-5f76-4fcf-98b4-a0341f24642b", "comment": "Malware payload", "value": "8b2a3b51a486f595065a184acce7c423f57b0452933e8b6ccef68fc90ed6e32a302c3b2e699b81fb0d8c623017a119e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385889, "uuid": "bb7e8288-f005-44dd-b909-0f78595f08d9", "value": "T13C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385889, "uuid": "5b394d9b-1b7f-4ee9-a10a-003981abe7c4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385889, "uuid": "854af287-b17f-40f1-bc55-ddca8078e114", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:e2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385889, "uuid": "18b69c9e-95af-439d-9d5e-c5ac8a3cdbfd", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385889, "uuid": "abd82df9-01da-4721-a9af-9ef61b900094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385889, "uuid": "14efa1d5-67ad-4906-95c0-b823e934feb5", "value": "c3c16ece51c57b9c192e950ab83ad9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988eb94d-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767356502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356502, "uuid": "14957681-aed4-4092-a252-98a3207f1283", "comment": "Malware payload (Mirai)", "value": "14eb9148a134f61b3d226f78958683e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356502, "uuid": "a590b97e-087c-45fc-b46d-9eee93e64cc9", "comment": "Malware payload (Mirai)", "value": "77f7f13c428428435e2c77e11c257efeefc580477c9901888bade683c02d3e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356502, "uuid": "49dc4a10-ebde-42d1-aca3-7e84b3bcef16", "comment": "Malware payload (Mirai)", "value": "1c29a77390dfbcbe7b842ba992ab5e201af8d36a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356502, "uuid": "aadb9c2f-168b-4f01-b9ae-519371432af2", "comment": "Malware payload (Mirai)", "value": "721ff87af0a1e44d75869b3c8904ab1386466d7da62f3e183cab66734d2d3289dea0502f09be0a58e775a69412157a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356502, "uuid": "d9fb89ae-9fdc-459c-ba2a-bf50799418a6", "value": "T15FE3AEDBF1978491C43183F427CB5BED6AB752158D2FC4E22C8E967B29B90DB0811B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356502, "uuid": "eef9acc0-e9a6-4edd-b54a-608826cc6436", "value": "3072:vEq9Lw9vplsMZK33ocUpiOC8O2jBgkqSDs:vEasl3KHocUpiOZbqSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356502, "uuid": "35ecbb5d-3a3c-49b8-8490-143c99aefe65", "value": 154292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356502, "uuid": "406c49f5-a326-4c18-adf3-446eb2fabd68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356502, "uuid": "2c0dc968-7304-41d1-b33c-ac2bcd43a819", "value": "rondo.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d797806-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386011, "uuid": "69351cd0-626d-4f77-ba2b-e60cda6d2751", "comment": "Malware payload (Adware.Neoreklami)", "value": "edacc57cfb44cffae503398f1a2206d8", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386011, "uuid": "407db1d9-7469-44b3-a508-b51493e05d81", "comment": "Malware payload (Adware.Neoreklami)", "value": "7815fade77b783cf2e6e7078299515243c45b9dce4b0add67bc9f18056d84eb1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386011, "uuid": "f5b9d7c2-6168-4f52-a7d5-7c669606882c", "comment": "Malware payload (Adware.Neoreklami)", "value": "55eab2227f718eefc8f5d1e26e04161b08d72bdc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386011, "uuid": "27dae3cf-0bd5-4f45-8b1e-e8caf546bbb1", "comment": "Malware payload (Adware.Neoreklami)", "value": "81224cee6d0482bd108feacada890e5b8974cef4ec0a94ea098bc8e610f5c8b366dbc132f7260afd5ebbc5969ec12374", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386011, "uuid": "36b6586a-1e3e-4bac-85ed-258843fdacf3", "value": "T1637633307AE4E6F0D6203839A2A88F97D2C352215E74C427576F876E3D7DD89C532B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386011, "uuid": "d0a14412-23f1-4e2f-9b63-4f037e842d82", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386011, "uuid": "b1c9ab8b-fe75-40e8-bfea-7d177013f1b3", "value": "196608:P1OYkEpn3WqaiYwtRi9H/OnMNJzGTo2iF8lgZ8ToAC6:tO9ENWLizil/OMNJLd8lgZ8TPC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386011, "uuid": "cdefd752-2de1-41bc-81ee-0356f91c2d48", "value": 7585065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386011, "uuid": "e22915fb-0bdc-4da3-b268-89a858f6aa92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386011, "uuid": "e81c0461-7e41-454b-bb91-51d8e34bef70", "value": "edacc57cfb44cffae503398f1a2206d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5483f616-e771-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313438, "uuid": "6c482e49-6b3d-4cd2-be09-24d1a1b77cd9", "comment": "Malware payload (Mirai)", "value": "1fe18f4a971ac371797c7df7da26b266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313438, "uuid": "f09b4044-91e0-4f50-96d5-6825f491cf86", "comment": "Malware payload (Mirai)", "value": "7850121a75430b236979915751dfeb2350c54bf61ed5c4d3b2ecc356860c454c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313438, "uuid": "99c34211-2d2b-46cb-8fa7-9ed3e77af695", "comment": "Malware payload (Mirai)", "value": "4b2419690b11b60b50970a554f13f5e75502559b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313438, "uuid": "ba6e6259-16b1-4083-bf47-022713a17e3a", "comment": "Malware payload (Mirai)", "value": "7799cd29a110aba6920fab96fb8fffb5a30d4e6c7169758a97913e053b891ea104e9667761080ea6f2b71a00cb553d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313438, "uuid": "37de05ce-6bc9-4252-9e81-1a4f0d5e36be", "value": "T1C543A609BB618EABD86FCD3745BD4B4524CC920732A83B757574E428F35A18F4DD38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313438, "uuid": "03629e5d-8d66-4433-9210-975e8424d6ad", "value": "1536:u47fuCr5YaQXtOUCXclcwykJQoGl/hu+7RH:uIjdEVzxGhu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313438, "uuid": "42d9e8ca-4eeb-4d4b-91b8-b89c02e8d022", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313438, "uuid": "5c2728f2-9704-432d-861a-f67f81b8415f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313438, "uuid": "ffb370dc-5354-468f-8bc7-641e75124783", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d6f792-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385965, "uuid": "533c13b5-c0b8-4d35-8e5c-c9da1ca65e30", "comment": "Malware payload (Adware.Neoreklami)", "value": "d81579faef8f493d4b6128dd3480057f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385965, "uuid": "d14e10a1-6ecd-4df1-ae9b-48bbcc20ff90", "comment": "Malware payload (Adware.Neoreklami)", "value": "7851712e3b215db8fdebd6c35a0c278b9a3f2c9a51aa37556aa622c1aa13c27d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385965, "uuid": "4fddfd63-01d8-4338-9a05-37ed35d4180f", "comment": "Malware payload (Adware.Neoreklami)", "value": "a80f648df119a311dcea19d1eba056024ada5450", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385965, "uuid": "40c05510-353d-4e06-8409-f4e62e8485d5", "comment": "Malware payload (Adware.Neoreklami)", "value": "cdf324fa14f3b2d711a687841e1535e7d02c39b2e8e4879c08a738c035d9cd422f9cf940f89a3ea8b87a55aebb090d27", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385965, "uuid": "d0986b01-8b2b-400a-80c1-dc52edd78d06", "value": "T14A7633B23BE489B7E01852F23C793FC9F24DA7E644118937770896292C7DA929633573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385965, "uuid": "7df70b68-5365-4c71-b120-28e44657fb13", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385965, "uuid": "49fde92a-ad28-4c76-84e4-e93cdfb94b47", "value": "196608:P1O0BSmvCllfJUdN3+NxWbXl9ZkfWMADkHjpeY:tO0k06kxDv2fWMADYeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385965, "uuid": "7edbe3c1-d5f4-4096-b498-87d4f18d8255", "value": 7538572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385965, "uuid": "6924b0d4-b41d-4868-8dfe-065c4320c701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385965, "uuid": "4db75414-6bb6-485b-a70a-7b1a7bed6e33", "value": "d81579faef8f493d4b6128dd3480057f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b262dc-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385386, "uuid": "945983f6-52a0-4a62-854f-53a74b9c1b18", "comment": "Malware payload (Adware.Neoreklami)", "value": "1bc6607e23b737e6d08e6a5cfdd4c626", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385386, "uuid": "ddf01648-b680-4ba4-8ea8-a0f5d37de1b5", "comment": "Malware payload (Adware.Neoreklami)", "value": "785fe60cadfb66f6097f2cc32967547088240c6bed3abfbd8026ff892255ee95", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385386, "uuid": "ace5afb8-0b47-4a86-b06e-ef1a3d0ab423", "comment": "Malware payload (Adware.Neoreklami)", "value": "76803b39b4fa272fa16be1005b961817fffd1fef", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385386, "uuid": "6e011c9d-88fb-4240-865f-b070f5493fd8", "comment": "Malware payload (Adware.Neoreklami)", "value": "243c5ea48aabb95b3cea4f659bad8fa204831dad855bb129a5ceb94401d30efeecf23da3a9544901f5713b65ee4f3bd6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385386, "uuid": "2edb5ec8-590a-458a-bf23-11233d382001", "value": "T14176335138EB84FED363163298753FEABE6EE01609610D7363DA681D0E742B6427F06D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385386, "uuid": "4b1948ec-028a-4691-ad89-d1e5c1a2b42d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385386, "uuid": "686bb498-229e-42dd-b9e7-a3d4c8874a54", "value": "98304:P1OmiVZmFIkCfjKp2m0HEhjPCNHqJomvfInUwm1G2bRv9+IXnJHXwSo41iBfBSU8:P1OnVZm080HcPCNqWW9bT+INn0A0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385386, "uuid": "60838b29-6a10-4882-8a49-3f0e5b6e84f8", "value": 7533542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385386, "uuid": "a4e6c4ce-75de-4fcc-ad7e-3663097c07d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385386, "uuid": "9c09e43f-c6d9-4780-aa45-a9d9d970ee3f", "value": "1bc6607e23b737e6d08e6a5cfdd4c626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42278a1-e82c-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767394022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394022, "uuid": "32c48cba-c6c5-4e13-b54c-39c77b7a83f0", "comment": "Malware payload (SalatStealer)", "value": "393332fcd09af2f1e2872000c3984401", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394022, "uuid": "cded0cd0-8234-40fc-9218-4f913a49a220", "comment": "Malware payload (SalatStealer)", "value": "794296c0f888fbeb093e2090c238e6e1a30a02ecbd4de53a3491a95207f17a09", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394022, "uuid": "c04ffafd-b955-4098-9586-087e273334e4", "comment": "Malware payload (SalatStealer)", "value": "1491b946c88496b5151898ef23247cfc8dcc64f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394022, "uuid": "a5d0c86e-87cb-4790-9759-5909cb808de9", "comment": "Malware payload (SalatStealer)", "value": "53326bf88747322f1f4b60d08613d8302d1088169a116f06df8a66640b098ead70022d667f144ce9a3cacd836b3490f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394022, "uuid": "2b32f671-eee3-4c0d-b199-6f3445b41d35", "value": "T198E53366DD4268DBE9A3C2FADA4496CBD00BB185D308AA25D4390B9F4778D2D51BC03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394022, "uuid": "c5d77f2d-01fd-4a04-acb3-d28d70493ba8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394022, "uuid": "195e9380-cd07-4bd9-8738-751824083172", "value": "98304:hgzh1ZPdEhTXQfeqm0Lx7lyfP9gwF7lW:hYrAd1jYyfPiKlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767394022, "uuid": "46c08260-8cc6-4c6e-80f7-b4aeb8b86218", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767394022, "uuid": "a942b5eb-9d1b-4dca-bd36-a1749688613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394022, "uuid": "7a61cb29-3e03-4d3d-abd6-a791ef57afda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e807f0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385753, "uuid": "061e576c-ac69-4337-8d9a-b605e09d116c", "comment": "Malware payload", "value": "95b88e9d8f71314d9717208ba87e9f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385753, "uuid": "8133839f-ec12-4bf5-a512-cd24c36b5de3", "comment": "Malware payload", "value": "7a5417336fe821ed92ff4ba21dab40e468f4ba2687abd66296b7f92f30f76257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385753, "uuid": "f29e1c1d-a39e-475a-be89-173cba11de01", "comment": "Malware payload", "value": "372e81871f28e5ea6596aeaf02eb94fb1ee157b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385753, "uuid": "a8e9cf3f-d8a2-44c1-9c93-7016ec290bb9", "comment": "Malware payload", "value": "4aed05eb84a3b293d5c94aa6b062367ca11a14c556e5b9cd5ab550bc9cc0d2a2592bd7b2a43e2d4d060d2be94bea8b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385753, "uuid": "2e309ee2-cafe-4fe5-b43c-b0085be26d7c", "value": "T16F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385753, "uuid": "ae16b5ec-ebe8-497e-b746-b73b46e384cd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385753, "uuid": "1fe8ae7d-6ae7-4f00-8379-78913c92d0be", "value": "98304:aDT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Q2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385753, "uuid": "81e41ef0-828e-4fa5-93b4-cf486a946de7", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385753, "uuid": "3f011019-9673-4563-a45a-00df1429119f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385753, "uuid": "080dd6fe-ba2d-464e-9ee8-955f7a1a4985", "value": "95b88e9d8f71314d9717208ba87e9f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7770eeed-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385652, "uuid": "5d87f770-846a-41f9-b820-84eccb664dd1", "comment": "Malware payload (GCleaner)", "value": "7bcaf6eaf23d68bbb61956faf6457fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385652, "uuid": "b2505248-8fd8-49a7-ac9d-002df3d01217", "comment": "Malware payload (GCleaner)", "value": "7ae2965274f46ff5b3bc3b8c73c4cd1164dba1a502d042a8a83eccac9e758e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385652, "uuid": "a00643ef-471d-4920-9260-97e4e100f897", "comment": "Malware payload (GCleaner)", "value": "24bba178e821f6e47d259cb6dafe0bcb092ca1e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385652, "uuid": "e1afe575-b692-4640-8c3a-01e1edee25ab", "comment": "Malware payload (GCleaner)", "value": "2a7fecb3d59a18890c48189e06374f2ba0da81e4c67ce72d8f215e3ecb685c9fab4426037d599b644158fcc78407f1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385652, "uuid": "4092accd-d99e-4cfc-8264-2c5b349cc0a4", "value": "T13D56E034E4617DB5E22F29FD3D7222D5C5B8686ACF0F723167A518381E600677E4A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385652, "uuid": "55731cb8-4bf6-4025-b3c6-3e190ada74af", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385652, "uuid": "3acbfd10-30d5-4253-baf8-ca51449f8eb1", "value": "98304:YXAcIV+8/DlcOcX84U1iFzHcJFclPa7YHNpV87HMp11wn:Yn8/DyOcM4U1i5cJFOPltpGqn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385652, "uuid": "052ed6fb-eff0-4b96-9bcc-e0c7416ed9a0", "value": 5892368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385652, "uuid": "b7a252c3-aa4c-429b-8392-9f108fdadc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385652, "uuid": "c62612ab-5d4b-470e-b2fd-e1c3951a479b", "value": "7bcaf6eaf23d68bbb61956faf6457fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50e3489-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385836, "uuid": "bb481391-e90a-4902-bcf5-4d17c62362bb", "comment": "Malware payload (Adware.Neoreklami)", "value": "af0a984a302d2028c3134fca1be6faa7", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385836, "uuid": "855b64ca-0aa5-4df3-bf7e-27309a6c9cbc", "comment": "Malware payload (Adware.Neoreklami)", "value": "7ae65d9d378b288441b88f9709e899a34108efe9d1d0c28dc8a122df7b4cd22d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385836, "uuid": "a18ac1ac-a5c6-4446-aa0e-6756d17255d7", "comment": "Malware payload (Adware.Neoreklami)", "value": "c1ed4578e16f752a4861993034f6b247ca8164c4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385836, "uuid": "900335c6-71b2-4169-8e2f-204bb02d7e06", "comment": "Malware payload (Adware.Neoreklami)", "value": "b3b17ecc1460d83d1681166ca9e9f9919892f8ad2361485bfe5129109f1270c258adbcd6bbb51e6fc4a933e83c9b37cb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385836, "uuid": "cc4518fb-ac3f-4e6e-9758-f65f5fd51b75", "value": "T15576336176D0C9B5EEA4A5331C343FDEB0ECF7951321E9E3678C0A5E0D3A056E0761A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385836, "uuid": "c3d863ce-7495-42e3-979c-f530f9fccade", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385836, "uuid": "b85755f4-828b-496d-b240-86e04b7f0f3a", "value": "196608:P1OWMXtHZeJJqpP6SrpQxULVcFoRkbi9MIlNCz:tOveJvUpQxymun7NCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385836, "uuid": "184cbbc0-c6d6-4993-9e80-aa81ee0bfcdb", "value": 7558486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385836, "uuid": "85cc6a42-6b29-4892-9103-536e66e59906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385836, "uuid": "a8c6e7ba-3ce0-44ba-a800-33439e188173", "value": "af0a984a302d2028c3134fca1be6faa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573703f6-e7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767364553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364553, "uuid": "2ea30525-2c07-4052-97dd-78952df5930a", "comment": "Malware payload", "value": "853132d9f10c384b5acf7b0cb3085ecd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364553, "uuid": "51f716ad-8d77-45b6-971d-3687e7dc82e0", "comment": "Malware payload", "value": "7b12d3e19c69a30625b9e29cd03ca4f1930b9e311b32a2abab7571cf4f872209", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364553, "uuid": "8c66d588-41b7-4c7d-8045-3fd47c921c36", "comment": "Malware payload", "value": "3105ed09336f4f65d420ee38219adaefe905994b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767364553, "uuid": "aaf4458c-3949-47d5-a278-dd4df446e3fb", "comment": "Malware payload", "value": "713bd5effc983293bf2841b1e4d0364229e895fdacb1ba771081848b0d953c21b04e27799f6501ba44f3178d4b2f227f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364553, "uuid": "f9fb6036-a6c3-46b7-8e51-60cd444720da", "value": "T16FE61246F744992AF4F7533349BA8236E1474D268B8396C76D59F23C18B79E01F0ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364553, "uuid": "cbaae7a3-3a38-4a3c-b8af-9cde4190eb6f", "value": "393216:X686J3GogpJEdms1p4uw5IaB6IMveEq7zNuAzNuMm:ql3Gogs4s16ukBsRYN1zNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767364553, "uuid": "33c68029-3a40-421c-bed0-5db429c3e727", "value": 14425017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767364553, "uuid": "dfe068e8-e6a3-46ce-859a-45f4fe1327de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767364553, "uuid": "287315e3-0e8b-42ec-ae48-1673b0926db0", "value": "Navidad_App.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac9fb1a-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336212, "uuid": "39107ab5-dd70-44da-92b7-f01cee87babf", "comment": "Malware payload (Mirai)", "value": "f15bea7fb12439ced32ed0310e8d6f48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336212, "uuid": "377fa953-0064-402f-9f82-092c30e94871", "comment": "Malware payload (Mirai)", "value": "7b21a33d3a75ffc6416f0075b34e2c68ea470f2020a5e939f6390692be74b17e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336212, "uuid": "91a6e196-e0bb-43a1-8186-89c3de120d48", "comment": "Malware payload (Mirai)", "value": "2944258e1fedc4a970825e18e9dd975eb81a84eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336212, "uuid": "f492e6cc-e4cf-4764-ab0a-96d4c073647f", "comment": "Malware payload (Mirai)", "value": "065576603af7f4229413820a75d763a8ee5eca25c677b1f4113318500fcc6e15bb16bc53a5041bde1b54e3995fcb1a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336212, "uuid": "5a28048f-e607-41bf-b5ae-080cb4f29b0a", "value": "T1E5631857BC829B11D5C512BAFA0E514E33235B7CE3DE32129D24AB2077CB96B0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336212, "uuid": "23f78f66-a777-406b-8c8f-e1d6a65c594b", "value": "1536:njnYcnPAYANmxPGCk0nAaaakXs1snQTMNi00biO56Yc:VnP/ANmsCJAaaaeL0biOkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336212, "uuid": "cf58ebf3-4796-40ae-852d-52fad5c0625c", "value": 71720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336212, "uuid": "b6f3d4c7-7915-488e-971e-1a83f9d3c54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336212, "uuid": "25eff52b-427c-4b3d-a40d-a6364e8dd90c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15f3c86-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385346, "uuid": "b5d8de2d-07df-4520-ae0a-67df7ce38762", "comment": "Malware payload", "value": "0739ea59e2a891b4fc207dbb6b37b3f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385346, "uuid": "7f0ffa8c-9cd3-4079-87e2-e6d71ed47240", "comment": "Malware payload", "value": "7b3303adf5a3d38ccbeaf23b694afe53533492aa0f7f512e42a531afa5d12c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385346, "uuid": "c57e2df6-6760-403b-87ff-84470ac40a34", "comment": "Malware payload", "value": "6ebcebb40f036dba84b1db59505fc881c80848d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385346, "uuid": "bfd094d2-21ff-44e0-899c-8a4cba58eb36", "comment": "Malware payload", "value": "52d416347b575207af835b5cdab894c769a98bf8bf0d6e312f295a6048023cc6d5095602060ffa954ebecf854b4c1149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385346, "uuid": "f6d1f8f0-8e50-4eb6-93e9-89c5501e48bb", "value": "T1950633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385346, "uuid": "2551a741-380a-4645-a30d-a22f8a82269d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385346, "uuid": "863dc57b-d320-415d-a64c-8ff28d455e51", "value": "98304:akT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385346, "uuid": "e703cd28-bf80-46c8-bd73-1220677c5e30", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385346, "uuid": "b21bba86-0af3-4b17-ab5a-142e76832fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385346, "uuid": "c16ee16e-aad8-4158-9aab-7fa4c7879584", "value": "0739ea59e2a891b4fc207dbb6b37b3f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18299945-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335241, "uuid": "632662cb-23d4-448c-bf41-678c475551d6", "comment": "Malware payload (Mirai)", "value": "f701b69d9ef2c1594c2ebae40adb9b33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335241, "uuid": "8b4a9d3f-e945-446a-a47a-33e831e0c31d", "comment": "Malware payload (Mirai)", "value": "7bad781707f47c1cc701e156f77cbec4af9abff8ff1badfbcb8a2dd781844da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335241, "uuid": "2ae49754-31dd-4303-b77f-68ace1aa4a6b", "comment": "Malware payload (Mirai)", "value": "52a466435bdd3893fbec79ea4469e67f6dc55f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335241, "uuid": "1c93c4ef-79b2-43b3-922d-35cb2a754398", "comment": "Malware payload (Mirai)", "value": "4d3d8e5e22af49fb5fa1a4e92ae6b0a54584bf61cfac8dc49cb4b6c64dcd891670cf9e197b7ee23c52996476d141995f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335241, "uuid": "d4075640-565e-4c9f-9dfb-775a8332ad59", "value": "T191143B07B9C080FDC4D9C1744BBFB13AD976B45E123CB29B2B94AF222E4DE601B6D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335241, "uuid": "ad97d298-160d-4702-8cac-0b3f15869626", "value": "3072:rNr30O0i5QZNNJSojImT199+xGp768wPt9Cdx1mReiVIfAYHxlqyFL/M6fez+:rNrkO0i5QZ7JSojImT90Zqdmc4KxT6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335241, "uuid": "20bc2371-f289-4f58-9ca9-30b870ba6596", "value": 197992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335241, "uuid": "94758af9-f221-4053-8371-0433f0863674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335241, "uuid": "ad728bc6-5013-445f-b1ea-b40883de26a3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2d701d-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767337717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337717, "uuid": "5d248ef8-b3ec-413c-8c7a-f5acb1f05b8c", "comment": "Malware payload", "value": "e635c465144d623c56e5eed4447958f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337717, "uuid": "6a475995-7fad-40d2-9c04-00728dc35458", "comment": "Malware payload", "value": "7cd6cd47c5398e2104c434731962ac7c468811f0c597063f7ae07e7823902843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337717, "uuid": "87ab9322-df51-49c6-92b2-601e498c61e5", "comment": "Malware payload", "value": "beedb2b567814bb345ad16e39b2b8239e4dedd30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337717, "uuid": "3da6d0a7-500a-4ed8-a662-c53c2850c51f", "comment": "Malware payload", "value": "847826878a09a7c0b02800804629ad080f5fb800157224b670848cf27a6cc06fee5a109b0ca3c07321b1d72081e588bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337717, "uuid": "078d613b-0f81-4497-bdd3-e32b4a4fa6de", "value": "T15FB35C02B328880BD6F71FF027B763E1A36AA79115B0E6C6360993495176F725B05FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337717, "uuid": "69fc6b4a-5e3c-4a49-8827-82376ceb6b8d", "value": "1536:ZeD/zWh4AY6ZEXGQbbm790LIJAG9tWRQXrtHnHBOjFwiXNDZRUmE2O1JW5gNwJ56:Zq+9ZEIRTe5MNnHof2f1JL6DOisf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337717, "uuid": "f15d2abe-835f-408f-8a48-13cad86d820f", "value": 116248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337717, "uuid": "ecd593a0-b79a-466d-9523-96d0dbcc7787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337717, "uuid": "dfe7648c-1d06-49f5-a58d-0c3896289f45", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8d6fe-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385911, "uuid": "00e60b68-c38d-4981-890d-d1720df0fe82", "comment": "Malware payload", "value": "c74b16b0a5facfd1b3fc680d390cdee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385911, "uuid": "bd457838-071b-4b11-9a5f-9e170409f057", "comment": "Malware payload", "value": "7cfda1e1cbe0579d47ab917ccd92dbd276755578e064bd34c02f62d19fec90da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385911, "uuid": "593fc3a6-8fdc-4a7e-bf83-c9a01b577a3b", "comment": "Malware payload", "value": "4b16be25e23559cfdf740abb51a2052dc50e0e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385911, "uuid": "99077d58-8983-48eb-bcba-dc9c455fb1ce", "comment": "Malware payload", "value": "24584e9b49437917d479a24f1dfa736da6f0c25e22f26571a0dfae77c7d00a819896b8e672c51035b142cdd163bc0c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385911, "uuid": "8b84c897-0fee-4d93-9a51-978a88bb02a5", "value": "T1D50633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385911, "uuid": "f5976423-8c8f-48fc-92f3-54c555346d2d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385911, "uuid": "cb02ec25-a00c-4120-8451-e58097ab14b4", "value": "98304:aeT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:N2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385911, "uuid": "e97175d3-1276-4612-b08f-5f7bc8e77bbb", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385911, "uuid": "b0dd5de1-4bb2-4fb2-803d-296289d86d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385911, "uuid": "13e83441-824c-4844-b8ed-d131b4582c34", "value": "c74b16b0a5facfd1b3fc680d390cdee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc80d58e-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385365, "uuid": "7d3c53e8-6365-40d1-9a8e-7cf0c5f00943", "comment": "Malware payload (GCleaner)", "value": "10c9b0a7019009011739126c6925bee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385365, "uuid": "f568d3b9-4864-4449-88dc-4a305e23c8d8", "comment": "Malware payload (GCleaner)", "value": "7d63168e8eaac4bf51fe6380183ca47dcd890ea4e01665af8ae7246e8ee7cdd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385365, "uuid": "39f1cf6b-911b-4c21-8540-7cb3fb0a9ee7", "comment": "Malware payload (GCleaner)", "value": "07ce49c84772d40498d3f159a390f7c6e688e1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385365, "uuid": "c853df02-32e1-41c1-ba46-31b9e615e9fb", "comment": "Malware payload (GCleaner)", "value": "779529ecc1e10fc4540eaa145490082f12eba30e2a23ec02c05f930eb4a2c5307a510112f319643518978dcc9f6c61cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385365, "uuid": "b8719d77-5ebb-4dee-a2a3-6f3d3d41011e", "value": "T18F36E0F3F3405A2AFDE14738D9122386B52AEE44FD22CF4DDB54CD3DB92496A267401A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385365, "uuid": "ebbbb9ca-6278-40cc-ad34-4096b47ff364", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385365, "uuid": "c6862072-ad2f-40cf-bfb5-bd16f6990638", "value": "49152:jS/NdnNM3TMsTHEH+C9zSpriQznkJGIdsQoaLvEZSCDUnaHTFJc77vJyH:jS/NFNAgsWV9WpriQC2onyTFJc77vJyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385365, "uuid": "8ec2fee7-6f1a-4ab9-a1ec-59cfbbdb920b", "value": 5169424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385365, "uuid": "c48065cd-1ae9-4898-b548-ae605a79b55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385365, "uuid": "602a2763-e9df-4538-a522-c36290f32e62", "value": "10c9b0a7019009011739126c6925bee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7134993a-e816-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767384353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384353, "uuid": "63990258-67e8-46e6-834f-cb075d65505d", "comment": "Malware payload", "value": "1867b618949c590de30da215b8d22a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384353, "uuid": "e7eb0a30-602f-4a37-8d83-229873b5c098", "comment": "Malware payload", "value": "7e19d36f49962f9606608514a34032e5b8af6ca64b97d0986f0c08fada006a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384353, "uuid": "1b31bea6-c1b6-43cd-aea5-7129e29c7146", "comment": "Malware payload", "value": "b053c255ee4f1cbb654bb6b56676931fa9ee2b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384353, "uuid": "718bc5b8-c36c-45fd-ab46-f4ff0067a550", "comment": "Malware payload", "value": "7f68873e9d874f29357e2adfb6ca37d36689397ca34c4e6af90abc32cf404fea12dba340d319546e23cd137183753671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.CKD!MTB", "colour": "#C28566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384353, "uuid": "07c20898-c7da-45cf-8743-3e9317b29f1c", "value": "T155D37D4733A450F9D4A78279C9A24A06E77374660735A7CF17A086BA2F137D1BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384353, "uuid": "baa2b427-651b-453c-86ed-1562d5149606", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384353, "uuid": "04db2fb8-9111-449e-abd7-dfdf970e442e", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oM:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384353, "uuid": "778fe32f-04fb-4deb-bbcb-bdd1c6946b33", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384353, "uuid": "62fd0058-ad56-4fa5-a9d7-e366a5704b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384353, "uuid": "008907a9-86bd-41c2-ad80-722c3a2c9ce7", "value": "output_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20969bd7-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385936, "uuid": "bd95b132-ad56-422d-90e9-49695decacf9", "comment": "Malware payload (Adware.Neoreklami)", "value": "cd1c96e83721f98144c05830d791f360", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385936, "uuid": "15736a96-bfd1-4562-8710-ebf0b388b78b", "comment": "Malware payload (Adware.Neoreklami)", "value": "7e2349e7a33fd63c8936c6d481b90d33650d2c2483fa809d8fa3e814df8695ad", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385936, "uuid": "75d81ffd-e2be-42ea-93e3-efb782689f25", "comment": "Malware payload (Adware.Neoreklami)", "value": "afd1386e767f0b6d4a1f4810020e3d12e7e154a8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385936, "uuid": "0fa1d0c0-cfbc-4a6d-b62f-fd1f20d30523", "comment": "Malware payload (Adware.Neoreklami)", "value": "d06850d307fc4e54e8eeb597dd82f03bbba2f7005e52c242124ac3b1c0a1954e17863b7600d9b046725f67bfbcab4c2c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385936, "uuid": "72a08d74-c5ce-423e-8c23-de551c4fe277", "value": "T19676337377D6C5BED24260738019AEEFF0DAEA18DF20C45B53B444C94DBAC948529A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385936, "uuid": "1bd157ab-0664-4b0a-b49a-6106f90242ab", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385936, "uuid": "494e23a9-0aea-4af6-b706-1df18d20a8e3", "value": "196608:P1O76GJaERO34tkOfN3AZYLIdKEdcg1lN0p3NeZk:tOuDERnQuLIdKgcgPmtNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385936, "uuid": "1d835d4f-3706-4d12-add7-008aed712c4d", "value": 7590717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385936, "uuid": "f556bb01-7b92-4a8c-ba74-a8d86c094050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385936, "uuid": "f1a71f64-b63b-463f-ac46-2a108d8a7182", "value": "cd1c96e83721f98144c05830d791f360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bcf2ae-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385938, "uuid": "53fdea53-25c1-4cea-952c-59a472ae8285", "comment": "Malware payload (Adware.Neoreklami)", "value": "cdc1da56e25dc3182519165d35f63e5f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385938, "uuid": "05e21d52-2a0d-43ea-8a2f-a065c9bd28c1", "comment": "Malware payload (Adware.Neoreklami)", "value": "7e3357c6e3bb259271ef462c6375215232b0c5b53d94e1a2e3b002645276d0ea", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385938, "uuid": "26734542-6517-4640-adab-9ea8a5383fc1", "comment": "Malware payload (Adware.Neoreklami)", "value": "2325f371951c0874a83a45888aeb5cbe8cd2ef81", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385938, "uuid": "b501ad78-d403-4f32-8abd-c14c751b2162", "comment": "Malware payload (Adware.Neoreklami)", "value": "53227c4973a0a096880c0190644fcbe7e3719849e310ed632a73e15870122b9304c9cbf77bc5a2b8e55221c6ba715135", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385938, "uuid": "235216bc-5efa-425c-a5ea-a446f2516b70", "value": "T1D57633253ED0C2FCF662083519341F92A9D9E9850FB55A8BF76D6E5F6A3C4C4432B2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385938, "uuid": "3e5fa558-9ed8-45eb-9086-dc928bc0cf4c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385938, "uuid": "41e71f7f-2999-48c1-83f5-f528e2f34376", "value": "196608:P1OSa+TANi15Bwh/k/XbbipJLEuEqXhVpIsazzXC74jkM:tOSh0o1/wh/wb+3EKvafCbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385938, "uuid": "b21c08d7-792c-4500-a4eb-31f4bc812766", "value": 7573231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385938, "uuid": "d9154ca2-2329-4828-9672-23097b93c2be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385938, "uuid": "8403f013-0704-4c67-aec7-859d264d9763", "value": "cdc1da56e25dc3182519165d35f63e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d4aa00-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381190, "uuid": "3c3ffe78-aa20-4d97-a4db-73c23b698c22", "comment": "Malware payload (Mirai)", "value": "e48c9dccbc00121474304ede9ebf0940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381190, "uuid": "fd563c62-f986-4872-9995-6879debe0ba7", "comment": "Malware payload (Mirai)", "value": "7e9a6edd056f77cf77df0c59c7b536c94b29519350613aefe52e69626c1c48b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381190, "uuid": "83e533ce-29e9-4b27-bdc2-121e30982433", "comment": "Malware payload (Mirai)", "value": "76c14496aa63d3d25454e00ac7680d7162d0570d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381190, "uuid": "14ce6aae-21c0-429f-bfb2-e07f27df71f6", "comment": "Malware payload (Mirai)", "value": "fe7409a92dfb78a5e8705b82648e2cf87601e32d05669548b9ba40342c9f786273bac80d8711d1210d728ecb2b933c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381190, "uuid": "f167ce3f-b093-4357-8601-7fb7f8c8dc50", "value": "T12C538E3AC46AEED4C28845B4A9B1CA7A1B53B501D2572EBB5AC9C4594047FFCF60E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381190, "uuid": "397fc7a3-0549-4252-b0ac-7401b79e34c8", "value": "1536:saxwtQltPr3RD1J4dxLRcQUFb5ADm5C5hu+7R:sy/t7RpJ8xLRCF9ADm5Au+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381190, "uuid": "1a08703e-e1a1-439f-acb7-af362ea22c6b", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381190, "uuid": "064697e3-0c0a-4cc4-938b-6691c4f83b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381190, "uuid": "73b61e85-13b0-4eb3-9817-775c70d67012", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c745a771-e7cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767354003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767354003, "uuid": "7b545393-7472-4f39-a78a-670421bda188", "comment": "Malware payload", "value": "e2b52404ee15cac8081b0fd6a2438c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767354003, "uuid": "925320eb-3b20-4d5a-a2f5-bfc4fa86cdb3", "comment": "Malware payload", "value": "7e9ced15f7b9833238a4f6fa0c24e14986237ebf53e1ab3ea798fb6e3209c953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767354003, "uuid": "cb5affac-73f6-4fed-9b7e-8e3130232200", "comment": "Malware payload", "value": "2443908bff00c282cb0f7e53985ebf2129a15de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767354003, "uuid": "22e92e85-4e1c-4e22-ac8c-f4215ac6c026", "comment": "Malware payload", "value": "6d17a3c249744abccc2b9cc6d9def71721fb491546b90fd9b437e3b4059fb430e2aa93f4120609642bd5543d53adad4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767354003, "uuid": "3de84c7c-6027-4435-a7a4-c914f81b9c4b", "value": "T122086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767354003, "uuid": "a732e429-45c2-4532-9cce-d9cb5f708834", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767354003, "uuid": "eaab4d86-64c4-4770-9bbd-18da8c2094de", "value": "393216:Ws/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+H:WEYGD7sJYgNukUB4S5rs3wbpLLNNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767354003, "uuid": "c5bf677a-5f7a-4a5b-bda2-26bcdb6ddb04", "value": 82115284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767354003, "uuid": "bf4878f3-d19c-496e-a406-07d8f14535c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767354003, "uuid": "821e3448-938b-49e0-944e-f393b5ce9f66", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5596fb03-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386025, "uuid": "3722904b-8dd9-4377-92bf-ca6ad6bca01c", "comment": "Malware payload (GCleaner)", "value": "ee9eb5551f5963947f51eb5994ef12a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386025, "uuid": "8a4bd161-64ba-43fb-988f-4f84ca2414d5", "comment": "Malware payload (GCleaner)", "value": "8003e39e6a19f0c56c6640c31188c502170e8bf4c5855606374c91802732e7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386025, "uuid": "6931ce90-9ad6-47b4-8311-cd611154b606", "comment": "Malware payload (GCleaner)", "value": "b0d4ec5264f619644c92ba8cc9cf47a5845c78ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386025, "uuid": "b7714c27-86e9-427f-80d5-bcda47bd2097", "comment": "Malware payload (GCleaner)", "value": "85c55006c57b60d84d7a1cb79a6f98da62f7c8b8f9e80e4cb703770d37068945ee1ccabf5dc27319b627fd6a47c77270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386025, "uuid": "d75261fb-39a5-4f4a-8143-cd54129cf3ca", "value": "T18F16D09BEF93C167E3B2C53936126465E863AE03E51ECC0D1C9C868C8D359D1A72AF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386025, "uuid": "8a41a80b-9727-4c5b-a843-7b104daeccf1", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386025, "uuid": "6a52e032-f905-41fa-b636-226f77166ad4", "value": "98304:pS/NFNAIZB0UL8iexfXsMTS32N66XgSysyOutPwnQfFZHbhvJiRU9M:IV8IZGqe1+329XgYyttPuQfFZHbhvJiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386025, "uuid": "7975811f-2d08-4177-8726-245da682e481", "value": 4250896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386025, "uuid": "bc9b21a9-4276-4d4d-9bcc-ddf2e40277ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386025, "uuid": "2a6f0e1a-afeb-4c40-9424-21ee4007e35b", "value": "ee9eb5551f5963947f51eb5994ef12a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccd1633-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385580, "uuid": "01ac9a69-0972-4355-bb55-97de555a52c3", "comment": "Malware payload (Adware.Neoreklami)", "value": "64fabf2ce64bfd5dd27fcf31ade3ecaa", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385580, "uuid": "2a5fd757-85b8-416d-9656-00a1aea4fb99", "comment": "Malware payload (Adware.Neoreklami)", "value": "804c36ca7e7f52436ccc56663cd7f971153eeeae27c7224809c4f43727191edb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385580, "uuid": "d7b0edb5-3911-4ce6-b9f5-7b13dac092e0", "comment": "Malware payload (Adware.Neoreklami)", "value": "a2ee0072f0797366e45d8033683542c026e6cbe6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385580, "uuid": "fa11ba8d-3df4-4b13-b47b-4cd3e8c0a7ee", "comment": "Malware payload (Adware.Neoreklami)", "value": "b873b9a09a1cb26feb3e4125dfa808340daecec8edc6f10df98fb5d1a440c0836256496e1873410c026d7df0a1234f0e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385580, "uuid": "577bad5b-2815-466d-b1b6-510f01c25652", "value": "T1E17633A3B9FA48F3D148D1F16CCA3FC5D77CC3421A216497539BAA602E3F8066148E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385580, "uuid": "e5e6d546-884a-4b50-ac05-04d9ba642117", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385580, "uuid": "e6470e4b-d6a2-496d-8eda-6de1d1b13e8d", "value": "196608:P1OaVifz/neyVBpoqcwd//W6Cgr+HtW+l+N63FJLJvn2To6C:tOvL/neib/eorG456rLJP15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385580, "uuid": "a2ea5f27-d020-484a-acdd-8ef8237d020b", "value": 7588463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385580, "uuid": "b9b84bad-2444-4650-b765-1b4987d404cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385580, "uuid": "1bbbc1dd-a252-4b74-a1cb-25907f1d38a9", "value": "64fabf2ce64bfd5dd27fcf31ade3ecaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6becbf-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385524, "uuid": "2691068a-07c0-46f3-82b5-808b3c388086", "comment": "Malware payload", "value": "51a294db6227c7c5bc488b978f006e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385524, "uuid": "0dc93bb9-a6a9-4bda-b6aa-c3751aedb04c", "comment": "Malware payload", "value": "806c4fb4623c8bcf5a856b25ed575275933d8769c0d4a628c8f43d9d988e6f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385524, "uuid": "45d5e512-9461-4575-bbcf-fa27f407c466", "comment": "Malware payload", "value": "79f6bece25360e1879f008da538306edef129c91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385524, "uuid": "b1b20093-84a6-40a3-8e3c-75edc561fddb", "comment": "Malware payload", "value": "879058ba2880bf1678679be74f5df902dd714d3b971e5f057cb9fe296414060e0f4ee17521f0d5b4e1083dad3b34aa95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385524, "uuid": "e45e58d0-7bf4-40e0-b268-dd32fe6dba96", "value": "T14F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385524, "uuid": "13459502-3791-44a9-bffd-58d0a13a2a1c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385524, "uuid": "51807aee-fa45-4d67-8217-4b4a9fa103cd", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385524, "uuid": "a8247ff0-f794-4e29-966c-c7ca89cc35e4", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385524, "uuid": "8984afbb-6f64-4fd5-859e-bc98210309ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385524, "uuid": "0b9eabbb-3782-43a1-92c3-61de30363f5f", "value": "51a294db6227c7c5bc488b978f006e09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f584a9-e7ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338262, "uuid": "57583a9b-bcdd-404f-ae60-9ca293ec1969", "comment": "Malware payload (Mirai)", "value": "82941f05e70271e3cbcbdcd0c6925ace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338262, "uuid": "0a405189-180d-449a-ac92-e00a50c01070", "comment": "Malware payload (Mirai)", "value": "80ac8928d7ed4d9027ca268641c3e2e7408fc2f2e28602274d00e660135ee784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338262, "uuid": "0b8f00c4-2d42-4531-a61f-e530711918d1", "comment": "Malware payload (Mirai)", "value": "d2cf2a1f9439124ec4d340ab8be531db64dd2f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338262, "uuid": "3609b411-daab-42ac-ac2a-b83da0eae722", "comment": "Malware payload (Mirai)", "value": "7448c18625a65a52c9ac31887774b5b89937e82b8f72746eb4fbf1a4f0ee4838766ffe182f59de660e22cfb84659fa55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338262, "uuid": "99d63aef-4927-41e7-9473-12c975f3f5e5", "value": "T137935B03B6C1D8FDC44AC278675EB275D922F42C1235719B6780FA167D8DE213F2E2A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338262, "uuid": "f9b31106-b485-4ce4-a179-bc8dce21eee3", "value": "1536:xQEipR/uYB9Snljih9qZFu11DUec+PnUQfUkwQj3:6PRvcljc9qq11DUe3MQfUkDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338262, "uuid": "fe6f97c3-06d0-44a9-a973-8c8acc814b61", "value": 93680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338262, "uuid": "c9b9795b-f6e8-40b5-a90d-d17e67d3b271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338262, "uuid": "f3180759-b256-4be4-bc9f-8490009d48b1", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49bbcb3-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385808, "uuid": "f0bdbf77-7da1-4834-b034-70fc43a40e87", "comment": "Malware payload (GCleaner)", "value": "a518c1968d85cb816386fdfe2c521e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385808, "uuid": "72b22760-5810-47a6-b8cd-6e557c61d913", "comment": "Malware payload (GCleaner)", "value": "80d7b2fb8168381f4d3516811bee39482e1e0ca3a5fad3822727f4a2f19d7f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385808, "uuid": "cd9ff90b-4d64-4773-88d5-c1717084d732", "comment": "Malware payload (GCleaner)", "value": "01a991d6c3b1385ea0bbf8a37b91a6ceceb99599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385808, "uuid": "46923ca8-6bcd-4f30-8c59-a138d3631bb4", "comment": "Malware payload (GCleaner)", "value": "e59e8573c12f13285b2bbb81c740968ffbe5c6901a86610d839cbc661ba67c873caed0498b1cb92e63e667b582ef8f03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385808, "uuid": "f5b2dd04-5ab0-4143-882c-e9ba0666db63", "value": "T1DE06DF3DE5F05C22E93D823A8B254FDF0EC997C0F9D438D925A42D58BF2574F2899292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385808, "uuid": "0bb92d69-ce75-4793-9130-44e106759723", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385808, "uuid": "827cf5e5-1c91-494c-b6f2-4ca6c0f0dc38", "value": "49152:zS/NdnNM30MB5PieglXBVUSUO1QBIunB+g86+BZX8eFnE8xs3bfDgtVWW+imo9Xu:zS/NFNApBgeMIH4vX8eVEEmbQWQA/nnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385808, "uuid": "cc9f0cfd-065a-40ce-98f2-dbd31e5daa26", "value": 3953936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385808, "uuid": "29a30029-e211-4833-88bb-32fa912f1386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385808, "uuid": "6d466350-69eb-4300-9db8-d857b6614700", "value": "a518c1968d85cb816386fdfe2c521e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fad14c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385562, "uuid": "40d246f2-0e3d-463d-ac63-94e484cb2618", "comment": "Malware payload (GCleaner)", "value": "61e785cc273ac71edba746d83ae74cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385562, "uuid": "d1787815-b340-4af7-9878-c7def20191b3", "comment": "Malware payload (GCleaner)", "value": "80f08acb0472fc87c0713fbb8b2f71d0720b5299fc24a674e495407d06220a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385562, "uuid": "6d41c696-cc9b-4700-aa33-0e3758c4193d", "comment": "Malware payload (GCleaner)", "value": "79daba6b84b9dbee399540befbeff75e21d814c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385562, "uuid": "b8a7b1d2-4950-46ce-9564-862af367195a", "comment": "Malware payload (GCleaner)", "value": "d787b5116b2e5c6d778e797718d3ab9aca93b84623101f9155dfbfb17d9b0a7e1bfc2555f015884b932f4dd05e61d554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385562, "uuid": "db058565-6457-4ff7-9a68-590996fd9c22", "value": "T19026E0B0F2A05D29FE9EDB3CC373B734F13A7E91EE3681861168476C56A7A81AC0D541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385562, "uuid": "4fb47207-d280-452d-a0e7-2a4971be05af", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385562, "uuid": "a4568518-48a3-4e32-8f39-78e2925abbf0", "value": "98304:WrSWIh85w6oo8Gn1qIgX0J7Bx8qtO8TR06jEWfnckhIWrv:mW4YoBRgX0FBxrJZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385562, "uuid": "0cec2420-ba5c-46e2-ab2d-24683569e3f1", "value": 4514064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385562, "uuid": "93f760c1-67c2-4be7-ad6b-26f4751b034e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385562, "uuid": "8f74a582-2f16-448b-b5d0-7017c4b8a563", "value": "61e785cc273ac71edba746d83ae74cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20317e7-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338130, "uuid": "dbffdfc6-d993-4075-8054-cd1739c327fb", "comment": "Malware payload (Mirai)", "value": "1bb578799e880f562fe7fac2fbaee51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338130, "uuid": "1e103ad6-8c59-491b-a6c6-90e556dd925f", "comment": "Malware payload (Mirai)", "value": "80f11ebf71926f784a0056d621ad45b3a14c8550dc57818a1a091c3541964e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338130, "uuid": "37811a4d-123a-4e63-be01-c1cd451ac6af", "comment": "Malware payload (Mirai)", "value": "e7dab2db4cb8c043a2146440303365fedec2be2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338130, "uuid": "c78b266d-b707-4a88-8113-498e2340f286", "comment": "Malware payload (Mirai)", "value": "4ead5f98ed062ab75ace59786030e6ad9a69eca4d2e661f434b779882efacba88f0308d3b5292262032a3773665aa67a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338130, "uuid": "fca9e899-3abc-414b-bf9d-f5686ea4aa5b", "value": "T13E14E85CE4608B3AC7D1217AF755428D33735F68EBEA330949356B343BD66295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338130, "uuid": "1a2daf35-ed31-4320-bf3c-d7a773987969", "value": "3072:jsSdmgTmrRjKw5JmIkhSVWOLcrSi2JzY3Hs946y9oBO07GH:jsS0gTmBgIkhSVWOLcrSzgM946Y107GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338130, "uuid": "c3b5a904-7f13-4c29-813e-589838e3f465", "value": 196408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338130, "uuid": "411a9fbf-4a81-42db-a211-54f821a49a8a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338130, "uuid": "8fd72abd-1f2f-427b-9087-073d5c0ee953", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa185085-e774-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314870, "uuid": "08df2af5-f4ed-4e8d-b5ac-37d144044ff9", "comment": "Malware payload (Mirai)", "value": "2dd660dabd831453fb87b2c50e796e70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314870, "uuid": "bc16d52c-482b-43f3-b08d-1f1d8960b4f4", "comment": "Malware payload (Mirai)", "value": "81ddd232e865119cd0432750912900bc8332df625ad7d90e5082c726993c9a19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314870, "uuid": "9a4185d1-4763-44de-81b4-92bf4d4aa6c3", "comment": "Malware payload (Mirai)", "value": "023ee87133f7c331f666a2e44894f66c1b0c73eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314870, "uuid": "f5466eee-e4b9-4698-9950-4255cce92796", "comment": "Malware payload (Mirai)", "value": "27d0415425ffb3c0d2329b212f0055c8e2f7074304595e192d4ab412a864304058a528c736e9fa65412070145082ddc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314870, "uuid": "d83cc5f8-7223-4baa-9431-bca2288f27fb", "value": "T1B49302A0D63DE92EE9017AF3A62F91B3357923DB152B7209E5C142860BD5CDD041BF1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314870, "uuid": "6da4f9d9-20e5-494c-bc39-3942e973f6b8", "value": "1536:MWAgmmDbnDLNlyPrzmcNog+6T3f4FMwUBRLvA29m8Gkvbn+ho61y3Pbu++:MWAgfNMPXmc6Ds3f4+wUBe2A8Z+Py3SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314870, "uuid": "ad7b11bd-bbe0-4254-99f4-cffeb7d90ef8", "value": 91932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314870, "uuid": "b1556f10-f51f-4139-959c-0018b663d684", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314870, "uuid": "ad15f088-4817-45e9-8d53-f9b47e5addcb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ca8ca1-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337546, "uuid": "e7f878fb-9e25-43af-bfd7-1c07b9970bc6", "comment": "Malware payload (Mirai)", "value": "4fbd773f034137e423479c81891e187e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337546, "uuid": "36265398-408d-4e22-b9f3-f921c3d86c51", "comment": "Malware payload (Mirai)", "value": "8218d6c7d0e5b17a0ea2d45d662060908767ff9ab4e3127a455b2a97fa529f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337546, "uuid": "0dd6b685-a7ec-407c-85ce-9db41a68ae7c", "comment": "Malware payload (Mirai)", "value": "778fbfe3980bb73b73fd3dd953b020b2843b2a0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337546, "uuid": "6f7958ac-fce4-4d0e-9348-5e0df83b7177", "comment": "Malware payload (Mirai)", "value": "65315e443bb7b46daebc3e2c0ab90d0668e513d1538ac0d155ce9ac3a11ae552995d224c483abdf7e4672f13439f1098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337546, "uuid": "52345730-ac18-47a4-bc7f-d9890f4c46c5", "value": "T15E535A52BC429A06C6D41277FB1E428D372743B8E2EA32039D29AF2177CBD5B0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337546, "uuid": "420d585d-c132-4d37-857f-309169fae757", "value": "1536:Y+KnN+lvyxADdEONanmW+bClg30eleOSYMZ0/bPw:B8s94mW+bClHe4Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337546, "uuid": "b07ae09b-f6bd-438e-83f5-eba94c663740", "value": 65404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337546, "uuid": "08671b96-c3b1-4b5c-94b4-dec25f13d8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337546, "uuid": "1cbf92e1-1faa-47f8-9043-3bc0e6a3ec22", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d3cdd1-e7a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767334615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334615, "uuid": "a6cc87b0-0fef-4f2d-9b93-f1d2e26d93a0", "comment": "Malware payload (Gafgyt)", "value": "aeac31927b7ae1b91d2d73a17b9e847d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334615, "uuid": "0bd927db-ff8c-475c-b959-847ffc6ca4b9", "comment": "Malware payload (Gafgyt)", "value": "82403f351fd24edcf52a763132f75e235c5ddcfe7756f1a787201c923999f311", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334615, "uuid": "b33e6795-670d-4a46-857d-16cd29987add", "comment": "Malware payload (Gafgyt)", "value": "949c580e39014a1e1d324ae7a6f58fd7a61f3db1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334615, "uuid": "98cce8a2-68b8-4761-8723-2f3316dad2b7", "comment": "Malware payload (Gafgyt)", "value": "36d5a5a9e4ba583f2be7e42f09495cb42b14537844eab0198b4c883bc47637e2b15afd86b2811ef8e3db088618531627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334615, "uuid": "66ca8dd3-34ac-4581-bcc0-396437ad71e9", "value": "T13F83865E6E218FEDF7A886304BB74E31A79933D627D0C685E29CD9002F6434D641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334615, "uuid": "1f0de437-aee1-47a0-ba39-db23d11f9707", "value": "1536:nVDj+XyE/M/lL9xuZWDo1SRWyVehDzI41:nMXFMtGWDrWyA041", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334615, "uuid": "3d16a7d9-ffbe-4b09-af86-370856f61dde", "value": 85416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334615, "uuid": "8b0c8712-de1f-4a7d-b2cc-8dbdee3e4209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334615, "uuid": "4995106f-be8d-42a9-a684-f7466b7c60d0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a47036-e7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767374058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374058, "uuid": "9125d8d0-ba31-49d3-baa1-b228c9661acd", "comment": "Malware payload (Vidar)", "value": "9ff050b6a6db38e4f16fb21dad7f1cc7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374058, "uuid": "666ac41c-dfd9-401f-bb64-9490688fc459", "comment": "Malware payload (Vidar)", "value": "82597d875c6d7f5831f6b73d09f8a499fc1c4fd500c07fca54ec58ddf690c049", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374058, "uuid": "759399a1-6c6b-4571-b63c-7b115fd275bd", "comment": "Malware payload (Vidar)", "value": "ed68f618f51a448bf34544084d03e3ecebb5f69a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767374058, "uuid": "5f204db7-2b1d-4baa-a8b2-d194d5241ab7", "comment": "Malware payload (Vidar)", "value": "43eeda661932530ebe330d0cac12be1ef6299a9bbd0f05a962e809b902b405924761a945d894d0aed635d798e9b03152", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374058, "uuid": "057205f6-48dd-49da-9837-76bb1ba70be3", "value": "T17414235E48E43954D1D6DBB0016A2EAC23C3025E47A87C63D079DBAFDF76120DE4B935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374058, "uuid": "d0fa79b7-2f84-400e-ab35-07e2a2342e0e", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374058, "uuid": "58f455f3-6dc1-4556-8b54-77a1b37cbc11", "value": "6144:a4mjb1YF/U19Wq6aGlffuOox47+skRhG+3k+IJvNTK5y:aljb1YF/K9Wq6aGluOEDDz0dTMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767374058, "uuid": "3b8cb972-1002-47ee-b536-f99ca6ca546b", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767374058, "uuid": "603937d8-d356-44c7-9bab-75190fec0a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767374058, "uuid": "9780afe5-ec49-4640-a1e3-7308ae73b3e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fb6fd3-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381866, "uuid": "73c8531d-48cd-4ebb-b930-91ac46139145", "comment": "Malware payload (Mirai)", "value": "03abf4f2b38d7ec044914e07b33403bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381866, "uuid": "706eb621-f02c-44d8-8502-0bdce264f815", "comment": "Malware payload (Mirai)", "value": "82642bab9fa78603baf0d3781572e2267c88ffe9dd6f6a9e7d279190d7210b09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381866, "uuid": "9f9dd8f2-8e24-4681-b447-82ca84e10355", "comment": "Malware payload (Mirai)", "value": "70056cf28358bf31ae306508dd5ec84a89d95212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381866, "uuid": "778542af-ff9c-4ba6-aaa0-1bd91af5052f", "comment": "Malware payload (Mirai)", "value": "a58ff4c40fefad51932339348bd9c58312c761acbbd46391522f254920595bdff71f2d0306ddaeaae71170cbcc46f0ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381866, "uuid": "4a6c7425-ec9e-4a4b-bf65-1cdc656878b2", "value": "T140933C02BC6191FDC08784356ADFE517FB31F8895214762F37C8A6312FA3F655A0AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381866, "uuid": "8d357f35-e6bb-4c40-84b8-f5e8754fc446", "value": "1536:uVad11RGBGyu1eH96LjsMrG05AkhdZQaor+8RBJuUOl:EgkGe0vn/BlI3R/uUOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381866, "uuid": "c40b41d2-4f6a-4120-8337-9cd69c267ca3", "value": 94864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381866, "uuid": "960c82c0-a91e-45c0-80d2-38594c983c9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381866, "uuid": "3803ae46-94d9-46d6-a1b9-7092af6fccad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef8c14-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767385389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "ef2501d5-d1a2-486d-9052-295ee0b15524", "comment": "Malware payload (AsyncRAT)", "value": "25beb151a4bc129c468fb3373da981ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "9958a4b6-1675-4c2e-96a8-3b87b2bd3d08", "comment": "Malware payload (AsyncRAT)", "value": "82d5f80b5ef62b75ddbf5e9b93fd986d2a212f22cc4baf85a3a828734961bf4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "1ac830ed-deba-44d8-9e7c-39c41403980a", "comment": "Malware payload (AsyncRAT)", "value": "967e2d5060cf27319e41278b9d1cfdec5cf69d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385389, "uuid": "746e9963-08d3-4097-aaf5-1230ec15842c", "comment": "Malware payload (AsyncRAT)", "value": "5f89aa43062e2c0776eb89762c5474714306f4748c40d2ff21a740289172d71bc0fc730675aecaab055ff291c743f9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "596ba418-154c-4689-bae5-8a8081993449", "value": "T147232A003BE9812BF2BE4F789CF26145867AF1633603D64D2CC451DB5613BC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "7a4355f7-7ff8-47b9-b4ef-c7a5fe97e09a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "0c8a61e9-e409-41e9-ba11-b7b5021c970b", "value": "768:vuo1dT1LxHaFzWUfbmBmo2qb5PDvP4uPIazjbNge3iQsUjo8Nqwy7FJuMBDZLC:vuo1dT1LoG2QPbwXa3baeSQJjo1j5AK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385389, "uuid": "a94c41bf-b082-484a-807d-c0d6af5a4dc3", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385389, "uuid": "b79fff64-9f13-4d75-b9bf-00eb0c4572cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385389, "uuid": "97ddaf1d-43d8-46b2-8c32-84ef0fc308a7", "value": "82d5f80b5ef62b75ddbf5e9b93fd986d2a212f22cc4baf85a3a828734961bf4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b1c131-e775-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315054, "uuid": "07a20090-cddb-4457-9685-2addf5adc4f5", "comment": "Malware payload (Mirai)", "value": "7e75f2b2c0f1bd05f7e62c08411db4da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315054, "uuid": "64114c84-281d-4321-be8a-e3f65da779d6", "comment": "Malware payload (Mirai)", "value": "83f706f3ea88c8d85630278dd41812c10cbcad87b8d39ee8527068000b32a544", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315054, "uuid": "9034bf70-2e17-4a21-b4fd-f2e10d60b972", "comment": "Malware payload (Mirai)", "value": "d57cd11f456bd75ab91de1154794264d6cdd1d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315054, "uuid": "e97d5af8-e509-486b-bfb9-a674356620a4", "comment": "Malware payload (Mirai)", "value": "136cb4e964012cf9fb26a4d7eca33a6dbeecdddc94870c6cf017b1b618d719e3439408197ae421c69f500b7a37a823b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315054, "uuid": "68e51639-77da-4d74-838e-4a2f87861982", "value": "T19D83960B6E21DF6EF768C73587B78F21D798239226A1C181D16CF9015E6434EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315054, "uuid": "e1cfdf88-843f-439e-9b00-f27b4362abb8", "value": "1536:MQdFondizAZ0WcyEjESS6Z6GmTMVraoLDS3k/39t/33YBL/e8ipu+7RarA5O:bFcdNy67Q50Le9pu+UrA5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315054, "uuid": "bce6b79a-a457-483a-910b-b25f1d33d39d", "value": 84784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315054, "uuid": "1ad096d9-8c51-4f88-a820-8a59a79cf2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315054, "uuid": "9169acd4-bdd8-4007-ad8d-3bfcd19a47b3", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcf19a0-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317020, "uuid": "d207b3c0-1309-42d0-a15a-2490c9f06f7b", "comment": "Malware payload (Mirai)", "value": "32eefc971b7f8025b165c893434f0d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317020, "uuid": "65a56940-dab0-4649-9631-d7e25bfe7a89", "comment": "Malware payload (Mirai)", "value": "8421cedfc7440456f67007011bc9cdf8959abc9d7f4158fce32392fe85fea5c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317020, "uuid": "bbfae86f-3b93-4ca4-a3fc-12fa94f62c85", "comment": "Malware payload (Mirai)", "value": "90ad2aace6169002e615be765191668c6c50b0d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317020, "uuid": "b3659a47-a1c4-41b3-bb8d-079c20ded61f", "comment": "Malware payload (Mirai)", "value": "27de55f238a88d0c5f2d1f8615446e6aa9d63353da78af0e4332d126f7e2bc0660437788053dad6f23d1b9a1d7adf3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317020, "uuid": "8fb7370c-42dd-421d-8b9e-c8e6739797c3", "value": "T13763020C8B5089D6C8A0F8712985EFD11B132C2FDA5D4AF353828BC706DA65B6F47AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317020, "uuid": "21fbe6fa-20b3-4c8a-9fb8-7af3130786c5", "value": "1536:HUH6aL26e2GEwibhMKDn5g6/ALYAqFjbzK+dhwnpvologX8Fs4u+qgw09L:q2D2/TMY77Ag++H0uloI4u+qgwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317020, "uuid": "6c2a7844-55e9-4326-97c9-dd656df37faa", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317020, "uuid": "35a83024-fb0a-4683-ab6f-561544ddcaaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317020, "uuid": "81861692-ec54-4d81-aefc-9a3a2c0dfeaf", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd667f4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385795, "uuid": "d98093b3-0c86-46a0-b719-d94340204384", "comment": "Malware payload (GCleaner)", "value": "a0c45fcbac424fff474ccedf943f9967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385795, "uuid": "e8e027bb-04e3-4bd3-8b5b-9e653068b539", "comment": "Malware payload (GCleaner)", "value": "843bbe65771418b810cbc95d59dfc4495437bf8a87144ad1933e0374c29d7c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385795, "uuid": "5a6f44c9-4bca-4b09-987f-1f210476d44e", "comment": "Malware payload (GCleaner)", "value": "96ce4a2c80277e2707f9ea4d077a96998b8cb187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385795, "uuid": "963f03ef-1c9e-43bd-b9dc-c050d06ec11c", "comment": "Malware payload (GCleaner)", "value": "d06ada5e38f4460f8b7e4c27219a70411982ca0330f9e58d0814621653a3f9adce456ddda406319ed7dac713fee3c84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385795, "uuid": "c5f67785-78ac-4109-81d6-25648cdfc158", "value": "T1D816E0A3C7B12536C3C11734A85FA990EFAE7543FBE018BE0B9655989AF24C1702F197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385795, "uuid": "85a5f914-fa45-42a0-9d75-cdb14b8ba661", "value": "cde078e68994e408985ac985f5f0d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385795, "uuid": "1f870c2d-a1d3-4bd4-9dfe-f8aafca78a03", "value": "49152:9kDkE6MBDBHr7KFa/hLIiM/+x9UU5WGmXC0fr9T72U1YaDJnQVyIRKcy9j1RE/+/:9kDk0tHr7X/ZIT+xCWU1ZcaxRlG6Er7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385795, "uuid": "d5cfa09f-fb45-42a6-8a42-121a98316d3c", "value": 4292880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385795, "uuid": "a05e6375-d862-4aac-a5ab-1f9e3cb9d577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385795, "uuid": "c12e375c-263c-4ae8-a54b-5886dee279cd", "value": "a0c45fcbac424fff474ccedf943f9967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f955bbb-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381639, "uuid": "ea88378c-a8b7-414f-95a6-47c956319588", "comment": "Malware payload (Mirai)", "value": "242bed95cd0b4e78ef384fdabf670662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381639, "uuid": "b1cfbd03-1213-48c0-b662-49f0c719bd7d", "comment": "Malware payload (Mirai)", "value": "8495fa49b1f1fd2aa275f9f68d6677c7512d1f6364872c8208a68cc79be65bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381639, "uuid": "f4751020-439f-460c-aa3d-543d17441208", "comment": "Malware payload (Mirai)", "value": "7aa78f5709562a2d88faddf470a35a2aac28d8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381639, "uuid": "7d7041c5-652b-4a31-a25a-464046bca262", "comment": "Malware payload (Mirai)", "value": "3a0f338c28cd92e74643622b6159a0d2d670e04ed890577c0fcd4b6d43b23b496f12ea16895d57bbc20ac0724d7e8ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381639, "uuid": "daefbc54-8ed1-4767-b042-8b1bc1a4f85c", "value": "T1E8238E67C82CAD94D25986B8BD248D3CAB13D00596933EF6764785A39083FECF50A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381639, "uuid": "c98e1f2d-1d62-4678-878e-1e45e13aa815", "value": "768:qak/jJNsyDbw5AMO0wtgxYc9DqRrqqnO8oQ4q51zU0z+UfC+wo5y3C1vE:qak/3sGEXwtg1eqRWCozfnfE3C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381639, "uuid": "d6d6749e-3913-446e-b392-83b9af67ab53", "value": 47600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381639, "uuid": "cbcea9f2-645e-42a1-81e6-44a8b3ace409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381639, "uuid": "02cf87e6-bc32-4331-a9a7-f52f18df38a6", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37fd44f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385806, "uuid": "6cf2675b-2bc5-494c-aed0-276511fade19", "comment": "Malware payload", "value": "a3fcb47af0ee956772a8e8f46420af4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385806, "uuid": "ba6400bc-47f4-4891-972c-212bf8759112", "comment": "Malware payload", "value": "850c2472a07bd6cbc5237ebe830e32c4ddbc9cc5e6aea009f1c573879d007f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385806, "uuid": "88369db0-7f4d-4c83-8fc6-cf733037b06c", "comment": "Malware payload", "value": "c68813e99d5262a2549b11f7f7260fb0b5dbb5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385806, "uuid": "936c4b0f-e446-4d27-8ff2-abfe68db1d81", "comment": "Malware payload", "value": "68d2e233e96ac8b791eb4ceeb18cba45ebd1ba2636260edc1636a5ea6aa19337ca484433f125669bb0f6ceda65d56c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385806, "uuid": "b464171a-a05d-40f7-9482-f0c95fc0fd51", "value": "T1540633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385806, "uuid": "a446c40c-2cbf-48e2-a336-d5f7d172ef5f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385806, "uuid": "da9dbbc6-fc86-4eca-a3d9-18ecfd43c586", "value": "98304:aLT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:A2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385806, "uuid": "23612b04-e33b-43ba-8439-3e8d06d36b50", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385806, "uuid": "12410e75-c1df-4f80-811a-bd3c1f458835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385806, "uuid": "b3bfe1bf-8d41-457f-95e7-9842db911ef6", "value": "a3fcb47af0ee956772a8e8f46420af4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2681dc2-e816-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767384516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384516, "uuid": "423d05b4-8a35-4f8a-b616-e0283c9382ef", "comment": "Malware payload", "value": "1dab9b0bc76f1f958f17438144941fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384516, "uuid": "1b629194-d7f8-4562-82f6-2a52499f06b0", "comment": "Malware payload", "value": "852713af646fc9ebe10d87b98556f42763cd8490bcb855847a46e6db0fced634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384516, "uuid": "19af2554-67f4-490e-9798-9126ae17fde5", "comment": "Malware payload", "value": "02d9bf505898811cbd04473ab42c22133feaadcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384516, "uuid": "94b43c95-1800-4f03-b108-cccf61162837", "comment": "Malware payload", "value": "522c091588914b1cf23ba81d178e66db9b7ad074dcf54bce9eed59132affbaa1019b79d852b0757c6c570dd1eb160231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384516, "uuid": "4c31db3a-7e13-48db-bf51-ab25ed7d65c6", "value": "T1A8C37E47B70D0A53E2D619F03A3B27D693EAE9D130F1A648260DBB4492B2D7B1185FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384516, "uuid": "cf18e739-37c3-4de0-8580-1154af815796", "value": "1536:dqu3EpE8v/YsZ3qrFSaRP1HPVYLzn7rB4eM8Lq3T6oVKa/DpAK2b24fkTr5Wrk5V:w8IrYMqAaRZi3ae9uKWAKBTAreV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384516, "uuid": "590b04a1-8983-48d3-abbd-e753fd294f1f", "value": 126940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384516, "uuid": "af4bf90c-0090-47a5-b032-201d95b60b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384516, "uuid": "d46d7f7e-617a-4309-8a50-f5af37ea0a51", "value": "rondo.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c67fb41-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385499, "uuid": "732ca5f7-c7bb-44ee-b18a-63d6d1fdcebf", "comment": "Malware payload", "value": "4845db9dcce533f9878fd493e89e6c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385499, "uuid": "f9e731f4-18e6-4e49-b5d6-079630a152eb", "comment": "Malware payload", "value": "858b19e511b41dc5db30544a9f3811424e4ecd6eb14fb20106fa749ee0bccf57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385499, "uuid": "31b6e9dd-d543-48d0-9880-50cfa87c13e3", "comment": "Malware payload", "value": "7ba33174a86311bcd564cd3de8ea74017bc68118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385499, "uuid": "74979bca-5c33-4588-b386-1790c9dae595", "comment": "Malware payload", "value": "e8b385741a68442455d24baa4aceec82a7f548ad6a4a0b84f9bf2b0f30c1d2f97356e947f52f36e1a6d73c2bf228b4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385499, "uuid": "0495d508-06b7-4704-887a-029a35b044f7", "value": "T1F00633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385499, "uuid": "29edd85d-34d8-48f3-b7c0-c0f94da7820f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385499, "uuid": "5b420d6c-55de-4932-ab92-d0f8fe7a2751", "value": "98304:a0T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385499, "uuid": "1c204694-4fcd-4089-9d67-044604a63875", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385499, "uuid": "f91b6ae9-8eac-4ad0-ac6b-6bc55ddfe76f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385499, "uuid": "9daf36d6-0cd5-4ed6-85fe-6d8acec0df7c", "value": "4845db9dcce533f9878fd493e89e6c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7e0891-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313075, "uuid": "b53441a3-ffbd-475e-b0b7-9c5d6587fe80", "comment": "Malware payload (Mirai)", "value": "9146914799b1dabfea52d9e5983208b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313075, "uuid": "0aba0d9d-b217-48bc-8985-57b62a9d75ac", "comment": "Malware payload (Mirai)", "value": "85d01c9dbe2c1ee23ed4208776adc85d7a0dd398fb958f4391860b8ffaec7373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313075, "uuid": "1de67a59-ccf4-4faa-aa14-f1c217e62bb9", "comment": "Malware payload (Mirai)", "value": "16b725eb0e1831c53da9341690c849949cd99917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313075, "uuid": "e61a853a-e1b6-4944-9d54-0b6d40d3ff4f", "comment": "Malware payload (Mirai)", "value": "bbd7b4fb4727a12a1953e0e79d5ac75b08fb7dea182a07242b3cd2fc25f73e79423fd063c27ff6c2ca89a1c06a0ae3c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313075, "uuid": "af2e663e-8cb0-4fd1-8bb4-e1cb7387dac9", "value": "T1BDB33A67B9919B11C5C315BBFA1E518E33130BB8D3EF72169E106F21238B96B0E7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313075, "uuid": "edd974c8-75a1-4e51-8367-e29ac5093791", "value": "1536:oJn+6SNUtU2V+TQp6mdFZrQo3rM2LPXDNU5fJz2aISaqJQ/dlaXi6xJpXvs7F8EH:SSMmTQp/PoIxUtJaaIpapxJpXvshjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313075, "uuid": "c2a1c8ac-fc4a-45c2-83be-729a3b94daad", "value": 115924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313075, "uuid": "451ac39f-c62d-453d-b09f-49b3d4d51a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313075, "uuid": "e7c7c0a7-3def-4167-803b-9399b085201d", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f80873-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377415, "uuid": "3f604386-3951-4e74-9afa-88a0701cd72f", "comment": "Malware payload (Mirai)", "value": "6ffe11dace89e76ca46fc102ee549ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377415, "uuid": "1ca11025-f604-4418-abae-3d3ea703e0c1", "comment": "Malware payload (Mirai)", "value": "85da8397b80d923e9ad508c94e534dadd7b0daf0c90574e8109dfea77c96e612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377415, "uuid": "8805a05c-afc0-4967-9cd7-eb286e7c5672", "comment": "Malware payload (Mirai)", "value": "06026fd6210dac3b9d22fce5379bfc1cb1dca544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377415, "uuid": "ea416b50-9035-4165-9c7c-3a89a89d9139", "comment": "Malware payload (Mirai)", "value": "9003d89655587bccfa4bec77b101c0a844b3574a7725f636705ef524b74b427aea711840115f3da470600cc488c0e39d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377415, "uuid": "4101190a-4f1f-414d-b1f0-979b11686ac2", "value": "T1E603E050FB0A7C32C69A4D78AF3647469D5B0F94D9E53326A7B007ECAF4281C28E95C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377415, "uuid": "32b97b4c-005c-4271-9b37-a114fedc0e28", "value": "768:JWOiOrBgUj8EgjNCpj5RjIRvN5Wno/fqA+1M2ipFOpKaAs3UozC:J6mP9Ub2or+1M3eka1zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377415, "uuid": "b080fa7b-a26b-4634-91aa-d63b20352d57", "value": 38124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377415, "uuid": "b1a35ad1-d7a7-4992-82c7-132c53a7d054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377415, "uuid": "ba92e70d-5479-489d-8b93-dda0025e1014", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0802af7-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385721, "uuid": "06957541-8632-4dc2-92e0-e21e611e22c9", "comment": "Malware payload", "value": "8c5e18674a2d282ba1e7fcf76547b8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385721, "uuid": "992649f0-24f0-483f-a2ee-1a932e7b4067", "comment": "Malware payload", "value": "85e4db1524b0abec03fce2f0645a3e0f3f78ef5831fcd8812be7ada7247f3339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385721, "uuid": "f396be83-32f9-4809-a31f-f436478ee1d8", "comment": "Malware payload", "value": "7470a4c830cec8f70d9ffc210134d429805c5fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385721, "uuid": "a90a7ce3-6b93-45d5-a0bd-3f8c0cbc74cd", "comment": "Malware payload", "value": "1010a9ea24024cf815b23cc053ffce2322db240ade0957e6cc1f5aac95c02af9bb5331f844fcbbdf73e0af6d10f1a9e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385721, "uuid": "5c843640-1d60-49ef-85d2-957933b93892", "value": "T15F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385721, "uuid": "7565c94b-7ba5-411a-930b-779f3657cc24", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385721, "uuid": "4fdb5662-a818-4d3b-9004-329e5b197c66", "value": "98304:aiT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:J2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385721, "uuid": "3e95279a-b044-4fd4-9edf-1b98453baf28", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385721, "uuid": "21dbfafe-773f-43bd-994f-8cb00f06efb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385721, "uuid": "74339d71-b46a-4d90-8114-c4139a1610f4", "value": "8c5e18674a2d282ba1e7fcf76547b8d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c220a2-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381619, "uuid": "a43bfffe-c7ab-4602-8cfa-06c2a0b9d3e9", "comment": "Malware payload (Mirai)", "value": "d704c6c34d7dd7684eee8aa161370392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381619, "uuid": "66fa702c-7c24-42c3-8b34-49a03ec56f25", "comment": "Malware payload (Mirai)", "value": "85f06192dc0ad87ead2e0dd221d02946a24fb6ed36b110b5ceb653946e9e6a88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381619, "uuid": "44faed76-e373-4bf4-a854-bdc28eedcbf6", "comment": "Malware payload (Mirai)", "value": "46f7d46b5e0fba8d92d5e106f7a061d5b9620050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381619, "uuid": "0c4a83d2-f8cd-4998-807d-c4557e9e2c04", "comment": "Malware payload (Mirai)", "value": "bdc2876e2f64791c2fcde96de24f87488098714c5a25bdc64ba5f7aec0be1dcb42f7e4746632803f40469e46edec7261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381619, "uuid": "02bb7d9a-b6ff-4c7d-b520-bead39d534ee", "value": "T16D235CC5A447D9FCEC190A712077EF319AF7E93E1198DA83C359AD72E942602E5072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381619, "uuid": "c830a287-d534-4829-b78c-f4bb84c2a98b", "value": "768:r+WtjNuFWGttXEsLk+sd6bVHUzFAeWfd/0g6SDZkX1c:r+csttXEsY+sdWVHUTWV/0g6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381619, "uuid": "a62ba4f5-e17a-436e-878f-68a42e293bcf", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381619, "uuid": "e5e09531-c385-4135-bb8b-6ab5310f386d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381619, "uuid": "befc7a32-cb01-429e-8e3a-002a0893080b", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff4e18b-e771-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313645, "uuid": "3b79cc94-2159-482d-a9c7-e9698fd2e22d", "comment": "Malware payload (Mirai)", "value": "312372f7e4a098ea24b0303f1a89cbc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313645, "uuid": "27ade8b7-b861-4970-af44-b5ef8f64961d", "comment": "Malware payload (Mirai)", "value": "870910363f6d1ad1dff9b1257d529ded4219c988f83dfe560cdf861b62b5272c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313645, "uuid": "4dda82db-6c5c-4777-8d06-dee65070b8ca", "comment": "Malware payload (Mirai)", "value": "e290f90d237a47293c027ea8d0ed68d1ce893bef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313645, "uuid": "05b357f4-e324-4405-b2e2-e0dfe74478a2", "comment": "Malware payload (Mirai)", "value": "bb1bdcfbbdf631da2d860583993fee4cbccbb846fe3c5e40e110965f328c7402f5069407f400806f59b11a9a582265fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313645, "uuid": "b68a77c5-658c-48e8-b262-2ea5bebfe15f", "value": "T18414F85CE4608B3AC7D1217AFB55428D33735F68EBEA330949356B343BDA6295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313645, "uuid": "74908161-4966-4857-99db-bd8ebd099d08", "value": "3072:jsSdmgTmrRjKw5JmIkhSVWOLcrSi2JzY3Hs94/i9oBO07GH:jsS0gTmBgIkhSVWOLcrSzgM94/I107GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313645, "uuid": "a34f9358-5304-41b4-87d3-d84ecab1dcad", "value": 196408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313645, "uuid": "46b0e77b-eae3-46dc-98db-74996cd9a8a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313645, "uuid": "2639ad34-5361-467f-8b1a-d8ffb0567978", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cc60f8-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385909, "uuid": "5428716b-2584-4230-8ff6-4e384d919914", "comment": "Malware payload (GCleaner)", "value": "c68d36887365810bd9429cf6d595ddb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385909, "uuid": "229b1d2e-fb81-4708-b17e-94cd7ce388cf", "comment": "Malware payload (GCleaner)", "value": "8751ea55dba604cef6c96db33cd51c3f7716914b8b6c7fe4845e467b01b031e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385909, "uuid": "fd6f3af1-be2d-497b-a62b-0cf55cc28756", "comment": "Malware payload (GCleaner)", "value": "559f934c54d2e12a8131164c6e6a6a04d6faffff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385909, "uuid": "963b3728-a8c9-4a52-9849-4928a5842364", "comment": "Malware payload (GCleaner)", "value": "35a70e74a14c2b22766b2bd1eb13e3382db197ca4feb02a06680369d606ecb46b0094838671ad3f4494dd37e93a5d800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385909, "uuid": "9c31e9e5-e609-4271-b426-e8f58bc8029f", "value": "T18D26D015E48511B3E435DBB89B00B3946322FA37FD31D7D4A5941EFA6838EE26B9CB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385909, "uuid": "084b1089-68d7-4bf5-a5dd-3fb7a30d2297", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385909, "uuid": "761e2ab6-ec07-4ca9-b038-3da2661cf35b", "value": "98304:Hn8A09YnrRVUzMfIyxT2OXV/RoGpZo3CQSa/MEzu3minMHFKFWN:H8A0enrRiofZxT2OXV/RBXk7S3maUFhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385909, "uuid": "3741aae1-4b14-4722-960e-3b25e68578ca", "value": 4442896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385909, "uuid": "c2d4a67e-4df8-40cf-8685-6afd36869666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385909, "uuid": "a782d2ad-4168-4dc6-aa58-5b0f293d14f2", "value": "c68d36887365810bd9429cf6d595ddb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276f19a4-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392390, "uuid": "ba84fed1-f49d-4c9e-a47f-3d84f04decd8", "comment": "Malware payload (Mirai)", "value": "8c4195e82231cbdd34122df213bc7a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392390, "uuid": "59acff3e-ec3c-4fdd-820d-14f3b4847a92", "comment": "Malware payload (Mirai)", "value": "87630e32166753727bef854b5118dbbfb29a5b1bcb524ff5d24e316c2025ff7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392390, "uuid": "a56fa811-60be-4ea1-86cc-97dc55183b76", "comment": "Malware payload (Mirai)", "value": "75a09f077e8b089e8dd93a2a5d33cdf8f3a82b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392390, "uuid": "b8a8b0ff-8d57-4758-9541-867e21f12972", "comment": "Malware payload (Mirai)", "value": "cd86fed4e8e49b0bc3392337b1795bdc16b8cbdd41eb8b371527bd52b56d60ca3886d658353c7644b18051fc403a6c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392390, "uuid": "11b39c60-8b95-4cd3-819f-0c5c710c3c36", "value": "T11E836C68F90EAD41D2D7D3B9F9468BA1712B3CD4D326C1B6BC01B31DD4B6AC4CA90927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392390, "uuid": "7142bfa9-7f76-460e-8929-96b62ae8aaa3", "value": "1536:XLEojjSmJCy9nzVBBkKCWR6Q6a4Ptnpdfoo4Kau9JIrY5xi/:7EojjTDRB65068epdfX4KMY5xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392390, "uuid": "b25e87cd-996c-433b-a4fb-6e9dd2a36bc3", "value": 83656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392390, "uuid": "585805f2-c938-4271-b5d9-f742ff239b05", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392390, "uuid": "a5469bc9-3508-413e-ae31-70a79cd14c3a", "value": "catgirl.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c60e75-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312905, "uuid": "4c8f5769-9211-46b6-82e4-c1dd64fb390a", "comment": "Malware payload (Mirai)", "value": "e9f823c81c0ca91c995f5d7b1eba5b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312905, "uuid": "07a96051-9572-4aa0-8e9d-e1be833b1b2a", "comment": "Malware payload (Mirai)", "value": "87aa64ec3d79b484c92684e881cdf841fe4fd1292c407af5d747ff4511d62e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312905, "uuid": "3c65ec04-a814-4021-ab0a-5e24fdea610f", "comment": "Malware payload (Mirai)", "value": "1db98e3901975ae4d4ba67e64ea0d66030b561b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312905, "uuid": "3ea1c37a-2619-4f76-90b9-84f0c5146638", "comment": "Malware payload (Mirai)", "value": "69b6645f1e9136f8cbdb36038f6642ae2c154dd360c7b9091ec4d483a72323917ab2e19ec34ac918cfbb63b17c246cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312905, "uuid": "86669749-d851-4088-88b2-bc1e5db43ba3", "value": "T14B13FA89BC91D916CAC55577BF0E42DC372603E8E2EE73039E14AF66365F83B0A6B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312905, "uuid": "2b49fef9-43d9-42d2-8b37-8674b85ad09e", "value": "384:PnpegF2gFLwDkLvmAp4ewXUvGW3hZXv1A1irwQgmNMcqr/A4vALkMk6DuSVZoBzA:Pn9/+ULLK1irKmN7u/lBw2zixCgu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312905, "uuid": "91e68433-a556-40eb-93a2-731a3d030779", "value": 42652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312905, "uuid": "c34c3d11-a5bf-4878-828e-8a48b505c15c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312905, "uuid": "7b50f34f-7d13-4408-96dd-61f749eba957", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a41ac-e807-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767378006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378006, "uuid": "8a87367e-039c-4625-bcd6-e01c850f85c6", "comment": "Malware payload", "value": "388dd8282b293eae11d6e79b9efb157e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378006, "uuid": "111678a0-53a4-440b-8eb7-afaa3e15b574", "comment": "Malware payload", "value": "87c940fe8a59ef8658292d1f845b5d0e4f7b4a7dcec15a3d793a97020e33b96c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378006, "uuid": "eb63bc66-816c-486a-847a-54bd8b43f7a9", "comment": "Malware payload", "value": "e0ec165b2ec4928b5257d7507628139610b382a9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378006, "uuid": "5046816d-103f-4540-a06c-4cf513ba5d27", "comment": "Malware payload", "value": "1dcf79fa1ca09657f73f6825d3b7366d06cb7429744dd90f560f3fc3760b4095865b0d6a0461acfabb65458392a0ce38", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378006, "uuid": "23028c29-3429-445b-a55e-88aa3a0c4feb", "value": "T1DE56332081A755EFE52A04F032B553B1B7B2246BC2141FFFC9C848F6A5647D98A1B3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378006, "uuid": "3b8a1496-3280-45e5-b326-438662e558ba", "value": "3106aff70b4ddaf775f5f213aa12b399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378006, "uuid": "51ddcebd-fbfe-4ae4-a9ac-260ac5249908", "value": "98304:HpkopXb1KBpieC8LHtnNyGR5TyD7Yi1y+u8T+8lgijNSNdOQs1EQyWQM54rOfsaa:HuopXb1Q/X5qcYy4+8rBwdnGmnO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378006, "uuid": "a83cb1eb-c392-44c2-8628-b0e173da7aaa", "value": 6100992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378006, "uuid": "33b1549c-7b45-485e-953a-e35393d7090e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378006, "uuid": "4661d0a4-d2e6-468b-88c9-fe618d153a74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3845b50c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385546, "uuid": "a567f969-2cd9-4e9f-93bd-e73b38d20bf2", "comment": "Malware payload (GCleaner)", "value": "5a375bb9267334ace1502ddee07d9860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385546, "uuid": "9aa91bdd-1eff-4833-847d-d23a7893dbe1", "comment": "Malware payload (GCleaner)", "value": "87d321392237a75ac6abd864a16a3c4ebb57d1b23ebdb3d60085ba3c93813149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385546, "uuid": "cfb5c4cb-cc5f-4441-8b9d-b0bfd2bb5ca4", "comment": "Malware payload (GCleaner)", "value": "34bff693e47f39034deb3c1c7193bb2626a703f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385546, "uuid": "76da8b10-a2bf-4c4b-87c9-0d8bca0793ba", "comment": "Malware payload (GCleaner)", "value": "f10712e73cc77dd4b24c1260613ccc07c2f24e0ff664cf391693d2da8b7ac501b80bf2410906d9c5c556097920175b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385546, "uuid": "af3f7ef0-9520-4030-8c5d-61e9815f8595", "value": "T1BD36E1E2D2ADA03EF652C9BB16DB22FCC845DE51F8DC88497A5D54D7EBD6900203390E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385546, "uuid": "df592448-159d-4748-97d5-3bc9bafe4271", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385546, "uuid": "75a8e131-90bb-43c2-aec7-dbf36adc59cf", "value": "98304:YrSWilV/3umqid+l4JMNhbq4ki58OXZ6Y:w8lBh+qyNh/ki5cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385546, "uuid": "93c64745-9255-4f47-aa23-89fdf6187252", "value": 5241104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385546, "uuid": "a8461408-9149-4f34-b865-78c94128ed37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385546, "uuid": "0a71bed4-4627-4fbf-9f3a-1eb99afaf7ee", "value": "5a375bb9267334ace1502ddee07d9860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0687d507-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381597, "uuid": "cebe32b8-8598-4dd0-9a08-b9313d0e7a0b", "comment": "Malware payload (Mirai)", "value": "7c7a713ac77e3b0823919517d2ff2119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381597, "uuid": "193e0708-999d-49a3-8e76-fe12c5269c35", "comment": "Malware payload (Mirai)", "value": "88f3f0f3d490e2ea65f11b9c553009153c01e062d4a27f764dc8d632d03828aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381597, "uuid": "475dc807-2a5c-4d69-b03b-826f31106d38", "comment": "Malware payload (Mirai)", "value": "b8ab28bc702180ddc61295d338024e3dd2589462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381597, "uuid": "dd998198-7b60-48c7-8391-4abd2d1e9295", "comment": "Malware payload (Mirai)", "value": "e2d0e70fa654090c7ca3501a3c8ea44c60792161e731082a6796e61a809e42c39db49c3ddffe522efca00bb912e6c835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381597, "uuid": "03642ed0-a3d8-4ec7-b909-7211bad60ff8", "value": "T16963084AB8918A11C5C513BAFA2E118D331353B8D3DFB212DE106F6477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381597, "uuid": "a7c1e50e-ed94-444d-999c-f6f967d95787", "value": "1536:W5nC2jdJ4QLpoEDGmSf753F7nxczKDrY2VyKmfGEkr2F1iGLgICiVBpyZWj:WqQ1xKmsRF1czKFVMfGEU27BpyZWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381597, "uuid": "e69f69f3-1dc1-4fb9-9ed4-0ab2f0592ed9", "value": 70924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381597, "uuid": "b32e042c-65af-41c9-8c69-c3d3c522fd58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381597, "uuid": "345e5e7c-f83a-41e5-b1f5-56db4201670e", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00765de1-e82d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767394042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394042, "uuid": "e8102251-5c08-4462-ae11-3c875afef07c", "comment": "Malware payload (SalatStealer)", "value": "d7961e9533e851ae39dbdd400d7a8540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394042, "uuid": "15d66ec0-5230-450e-8c06-f1f707fe099a", "comment": "Malware payload (SalatStealer)", "value": "88f9a808ffff1f4770a758245442a7df81bd738b2788436e65812bfced68e25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394042, "uuid": "c5d67a33-1ba6-4c6f-9037-78623ca05950", "comment": "Malware payload (SalatStealer)", "value": "76338081a17481ff01c1347ea0ad3e596f1c962a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394042, "uuid": "2b82e638-730b-4cdf-9fef-c45baf42eb03", "comment": "Malware payload (SalatStealer)", "value": "872ce8e99569d437b13ffb3822c89366c0215e54089b430915e6dd58ad10da0531ccf9944f930f03e4192dec760b9c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394042, "uuid": "2736dd6c-8879-42c5-a0cc-fc9602199cd0", "value": "T149C65B51FA8B54F6E9031831809BB23F23315E048B28DBDBFB547B6EFC776811966249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394042, "uuid": "f660bed5-9ab9-410b-9b27-4f08e76d6e0d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394042, "uuid": "7e9a89a0-28b3-40b7-a5c2-7d90fe1e03a9", "value": "49152:pCQuJiJE+E0uN+8NZJM4gndZQMEs9NjPypup+gH/qJwvNCxfQ/8xPVMZGWki4WH2:MRJiZqJEvXurKbnFHsu4UiMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767394042, "uuid": "0b5ebf6f-01aa-41e7-b714-af8d8b48b288", "value": 11656704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767394042, "uuid": "133254af-34f0-43fb-9c07-9d6d052f26c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394042, "uuid": "a9aaa91d-f4c1-4a86-b65a-019410d50df4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb3741c-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393363, "uuid": "7edb89f0-dd2c-49ec-8425-c632c63b8d74", "comment": "Malware payload (Mirai)", "value": "fc8f24c0c165ae3d2b436e53d6120519", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393363, "uuid": "75736c2b-547a-4189-aa77-65a51e9f589c", "comment": "Malware payload (Mirai)", "value": "8913ee3fa62bca22189588f739ae40cef28a7682593b02c1339ac39e2a165b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393363, "uuid": "44f76de1-a843-4290-83bb-43004a645530", "comment": "Malware payload (Mirai)", "value": "976f0fb4d2a92ff6fe5492c16d8a285d45e66fa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393363, "uuid": "57d3681b-92b7-45be-b509-3c28ab971914", "comment": "Malware payload (Mirai)", "value": "0c057399e57ca3d2c5616521351dee3d718075a3dce3671c68de7bfa8659d5369871ec64aa8882a1f0b66fa2818d36a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393363, "uuid": "ac6285f0-6554-472e-8a6f-ded312dfdffd", "value": "T1D24302301566D8BDFCB295B9E3588F87B13A22B9D1EADB2612046DFC34E701618727C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393363, "uuid": "696b2dba-4fbf-4511-8cb3-965639b3ef62", "value": "1536:04hrha31UiPhv2rXtUhSgyF8L1z0Npu9zd:Vh9KUek0m+6pu9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393363, "uuid": "ca9a8fae-f458-447d-bd17-c4724a767ead", "value": 57560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393363, "uuid": "8509b0f0-f67a-4070-90e9-d86d79749721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393363, "uuid": "35e6cebe-1121-4df1-8a9a-161ba39597d4", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a86adc-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385748, "uuid": "78862966-7b52-43d1-a24c-4086fcb3d039", "comment": "Malware payload (Adware.Neoreklami)", "value": "94ff20937dd9be787b020e35d1f1967a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385748, "uuid": "cedbe15f-21eb-45f3-b0f1-0ce2ffa9f5b3", "comment": "Malware payload (Adware.Neoreklami)", "value": "891f8270a447291ad2e721524c8b811398bb3d2ed39630739337b0e24083c92f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385748, "uuid": "bbda8b9e-c38f-4818-bbd4-76d73920a5f4", "comment": "Malware payload (Adware.Neoreklami)", "value": "e25dc63d274ab91fad10a5ba8454d7c5e4efb172", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385748, "uuid": "79532ec3-0306-482d-9bad-bb66f59a0181", "comment": "Malware payload (Adware.Neoreklami)", "value": "445f9a94db26ec491e8dc7e91b1206daa4379d48c34313edc1bfa48c7ab3e0a34e6cbc10a90e540dd22736c013583344", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385748, "uuid": "f7890ecd-2102-4cc3-ae2d-a76282f323df", "value": "T1E87633703AD144F6FCA848F081586FDB95ADD6BC0E19DC2363C909BB2F2D951D21AA37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385748, "uuid": "91bc258b-9de5-479d-9c2c-935bb0818d3f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385748, "uuid": "2292dc0c-1816-437f-a0ad-e7bb4e148cb2", "value": "196608:P1On0p/KfXCg6R0KwvtWtFMUIGw2ru0HiB3RdiM7p:tOn0p/ParvtQFMUqorHUBdiMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385748, "uuid": "29777d44-9f4b-4d03-b005-b4b20b2eb94d", "value": 7555488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385748, "uuid": "9ea5bce2-b9c0-4bf8-bba0-c39544b09c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385748, "uuid": "c23582ad-335f-41a3-bf44-dd1486cdf1bd", "value": "94ff20937dd9be787b020e35d1f1967a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6fd605-e77f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767319410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319410, "uuid": "109f4c77-fed5-4fb6-bc55-63c2a9c7da45", "comment": "Malware payload (Mirai)", "value": "4bed31fa94abb895207b6e8eee77f03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319410, "uuid": "2ff6e978-1a68-4abb-88bb-49aacacd07d6", "comment": "Malware payload (Mirai)", "value": "89db241fe446739cdac9348ba1c5a31a5ee077c1c5c820fb04f85acae797d647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319410, "uuid": "fd1ef8da-b5d5-4b44-b693-b627648e9ca4", "comment": "Malware payload (Mirai)", "value": "4559726fab14e53c33b188393c67eb37e8d8eda6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319410, "uuid": "788f8442-99c2-40b0-a190-6740f3956051", "comment": "Malware payload (Mirai)", "value": "47a8b80014953ec5c2bff399c1fdf7846390c946d726c63e1c7e8f8c075fe1fe055b84e7aeef2b72218e9975e4def697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319410, "uuid": "75dc2e48-2c98-463d-b539-6f846e1636bc", "value": "T127136C238679DD69E51D89F574348B398B13E201E38B2FFA2619E1548043EACF64E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319410, "uuid": "70c4b141-07bf-4ab5-949d-c246aec4d550", "value": "768:csh3dKTrdpapvwBGjDZSYP7FSdEAkjjUcCJH5CToIOmCH/4u+7R:cseXdeYBXdm/Uck5CkfmCH/4u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767319410, "uuid": "07d10a47-04f5-4680-91e8-699917c15df4", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767319410, "uuid": "80f856a7-3d0b-42ed-ad46-337d19bfba97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319410, "uuid": "60c63e21-9e79-4b58-9d94-6e968dcc2a36", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56407871-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385596, "uuid": "83e5d98a-3557-473b-80f1-d21d474bb102", "comment": "Malware payload (GCleaner)", "value": "694d33614d345c428e73297aa88085c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385596, "uuid": "f8fccc58-e45e-4dc3-a2cd-0aa72e947f39", "comment": "Malware payload (GCleaner)", "value": "8b2b08e8d90143c01cf986c40be25a9b1f79873a502e7df538117de0cc938507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385596, "uuid": "0c68a30f-29a1-41de-9fa1-83a88e999263", "comment": "Malware payload (GCleaner)", "value": "5ef637696471989bb00ea31dc6140ff32bf6e92a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385596, "uuid": "35503657-bc45-496a-b282-4b837e7cc41b", "comment": "Malware payload (GCleaner)", "value": "acfe420818956babef2a26337f0871bcb003f27cf65d7fbeba484807eaf3c10a281ae8f136a77edd89ee0d7aa4b5ebcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385596, "uuid": "fab063bc-47aa-45e0-ab0a-242455ed697a", "value": "T1DD46E0B3D4B538A2CE969736E50972157A297DA0D510DF2E5E73A80ECB3A1C3932D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385596, "uuid": "cdb95794-e883-47f4-840c-fea7a23b8641", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385596, "uuid": "9db531d3-a218-44b6-98a0-4144e31123ef", "value": "98304:erSWu9txh5iKvT4hfH1hyltu7th0fRLeg6Mn:OafvTqfHrizRLegT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385596, "uuid": "a3e42af3-7d5a-47db-9de5-705d762ade48", "value": 5624080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385596, "uuid": "9cb17fa3-97c9-4ff9-84ac-22242dbd8785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385596, "uuid": "c06115c5-cfb2-497f-ab94-e1b80d2f2013", "value": "694d33614d345c428e73297aa88085c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4483491e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385566, "uuid": "f935bcac-d43e-4822-9f46-d9fe05f866f3", "comment": "Malware payload", "value": "63011a069dfc5e61ce9fa21e9b1ababd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385566, "uuid": "4e4acab4-3cd2-49d2-be8c-906b7f2d4f09", "comment": "Malware payload", "value": "8b69c467734f1213b5bcb2759abfeee71a32d84c6dc0b3d18299b73fb3e8f39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385566, "uuid": "55e50627-5a9c-4ad5-b32b-977a777227ab", "comment": "Malware payload", "value": "a3c2731ba7434333709b57a4c8d3220a88fadb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385566, "uuid": "7567ff86-955b-40aa-8d23-6673ee5d2384", "comment": "Malware payload", "value": "44bca2948f369fe52b3280530f91aae9f10e5dab8fb327b8551441b6b18a1b5d6adf540f96e0fecbaf75f02ee43c8204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385566, "uuid": "b8db51d5-a47f-4fa7-bf53-d8fae8a1593d", "value": "T1FF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385566, "uuid": "e3477e7f-4003-4f83-b3ff-e402bf4eed08", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385566, "uuid": "967b6049-0f2f-43bb-9fcc-48bb57dd996c", "value": "98304:acT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:j2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385566, "uuid": "5de74714-f321-4602-b2cc-106cf704dfca", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385566, "uuid": "4e11a7b7-cb58-465b-935a-4cdc8303ce69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385566, "uuid": "1dd42986-eee6-4a3f-9545-3dbbcdd728d4", "value": "63011a069dfc5e61ce9fa21e9b1ababd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94c7c1f-e7a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767335189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335189, "uuid": "7c75530a-0a47-46c7-bb1f-022c725e5950", "comment": "Malware payload", "value": "04a2af746345d0d80a3436e3925a0c3f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335189, "uuid": "30689270-a55d-4693-91ca-f143a876475e", "comment": "Malware payload", "value": "8b965660856e93e138759536cb070b44e882b22bcb9be6821dec3f9748034bb9", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335189, "uuid": "1bb9930e-ad15-4bc1-8f58-a8455cda68ad", "comment": "Malware payload", "value": "708e9dbb5c2793002171cbf5a444352ca05c507b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335189, "uuid": "012ba47b-751e-4261-99c5-32c61afa8bb1", "comment": "Malware payload", "value": "37065511801e8f7fe3e8b5243100beb3e75459f46f897539397bc0e777a3da6770537a428be7b36c4387e6439a003f0b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335189, "uuid": "e93a23d6-739c-4e1f-ab26-e1cf17311009", "value": "T174B6124E96C98932C0B11E3CA7B315C21B3E7DA14B58B74F9A84B64DA9730D0BD3636D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335189, "uuid": "2d000b7f-31ab-4689-a7d3-0f7cbce4fa30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335189, "uuid": "088d3fd8-9df5-456b-bc76-70b0273545fb", "value": "24576:mLNJtI12iVuG4xloAc4Ye2bX+cAyFCoF/5bAHflcH8gen1rRHG:ONJCp4PoAcV+cANo/5UHdcHpen18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335189, "uuid": "2766e37b-60ca-4935-99e7-9bb870414868", "value": 10496080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335189, "uuid": "74f89c04-0b8b-45ef-b6c5-fc0f622a7f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335189, "uuid": "479fa65b-336d-4f7f-8d8b-bdeb2ec40c2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2176aa-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386036, "uuid": "99eb8703-8809-4ed3-b786-bbe8fed16d3a", "comment": "Malware payload (Adware.Neoreklami)", "value": "f31faa457311bbd2e3f7baa5c081ad59", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386036, "uuid": "07cd97ea-27d8-46bd-953b-a38833c5253a", "comment": "Malware payload (Adware.Neoreklami)", "value": "8c36c792b83f9e04d97c9f6b961a92324424c9ce3110f79ebd80d98469764a96", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386036, "uuid": "2a5ce1a6-3d9a-4f02-bc23-18a4a8d5554f", "comment": "Malware payload (Adware.Neoreklami)", "value": "1e3cb29a2a482ba75a99fabba15bed4d1010603d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386036, "uuid": "8d9413f1-6ee3-4c23-b6b8-fd69824ce886", "comment": "Malware payload (Adware.Neoreklami)", "value": "8ebb0e64f52939254b4ef12ff260f6d7d2e8734361d25a1dd75de296a82abc494b408964ab9dce90c3f05ea689611dec", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386036, "uuid": "4a96f394-9a2d-4530-aab8-40bbb3f93d6f", "value": "T1FD763320B5D8847FD1970D322D4C2D55D9FBE5960F218463239C1137AE3F48ACE7AAAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386036, "uuid": "c8f1c10b-a493-4468-a1b0-ed9508661734", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386036, "uuid": "6807367b-e054-4395-8c3d-56bb707de796", "value": "196608:P1O/kRf2W16ptuxfDYaisF2WpIH+d0GF9O8v3j1nj:tO8Rf2q6juxfms8WpIH+d0Aj1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386036, "uuid": "2b0c0ea2-889c-4ca4-a39f-56601be85217", "value": 7542665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386036, "uuid": "0f0faf1a-98ac-427c-bb0a-bbef30f13357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386036, "uuid": "05bf8618-8335-46fd-857f-b800d7a5cda8", "value": "f31faa457311bbd2e3f7baa5c081ad59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be46688a-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377610, "uuid": "96b08dc8-66d1-4129-86de-5ab11434d815", "comment": "Malware payload (Mirai)", "value": "9f2a96817a8fd957bf1a04c7298548bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377610, "uuid": "e854ca61-1673-426f-907c-34e4e97ada59", "comment": "Malware payload (Mirai)", "value": "8c3e615df52998b4a1ceba99ad00a805eec6e04e60f0e69594adbb6949d69ab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377610, "uuid": "84d54732-131f-41fe-b08d-95f1da6371d4", "comment": "Malware payload (Mirai)", "value": "5cecfc30665518c00d5a06cbe490a7a1dba6042b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377610, "uuid": "0600975d-3026-4778-8a17-dd41c429b561", "comment": "Malware payload (Mirai)", "value": "befa304164659484f980e2df99cc226e67353b58c1de6b30d0cc904336ece56276a2bf7cc48166e5b88b02f805a380af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377610, "uuid": "b8151557-cb3e-4542-9baa-53a09890e4a3", "value": "T19E53015E907DF782E91319338A97FE040F00908EFD68812581F94C9BC96AFD3BD685C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377610, "uuid": "474841e6-78c4-48cf-bee8-00183865f663", "value": "1536:TMvZc5AXeMqsvFWSqzdyb/SIy4LHfnouy8Hy7:wvZcdsvMpS/dnHPouts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377610, "uuid": "bcdaa710-723b-4cf1-b7a5-d19225c4eb57", "value": 64812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377610, "uuid": "747be436-7654-49ac-b0c4-4bee6b011490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377610, "uuid": "83d3acd2-1942-4bc6-a99b-ddb557789490", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cf065a-e7d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767356678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356678, "uuid": "3e718eb6-a332-451e-bbb8-19f33e6a7034", "comment": "Malware payload (Mirai)", "value": "b127a7e38693bf573b4bd86ad51443b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356678, "uuid": "ca2c0a35-c5ec-47c4-aa9d-43bbcbe65387", "comment": "Malware payload (Mirai)", "value": "8c87854bd0292cf2d99b994796343815e60c18b0bf9614279be5393c2e01d6e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356678, "uuid": "4cbe1e05-e6ba-4d75-afbc-27da0aded3fa", "comment": "Malware payload (Mirai)", "value": "5a89a9973921cfa11a47f0ab43e0966facf9fb1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356678, "uuid": "8b1ba438-616b-49f8-bfde-772e1d41938f", "comment": "Malware payload (Mirai)", "value": "d1a6115b8532707c0bee5dcfb5151523bff3005ff471fd8e3c3974ec58ec0c6f925635f9d7c316f53996d4361d7d78d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356678, "uuid": "803a2aca-acd4-470c-97ac-b813715a0975", "value": "T1A0C3D65D7E315F6DF268C23447F38F21A75923D626E1D681E2ACE5042E2438D681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356678, "uuid": "485db68d-ea50-4e6f-ae79-48d068d173ca", "value": "3072:6dSiafjKOYoHdGUAXwjeQTdszOj74vvF2w:6dSL8XJQSU74vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356678, "uuid": "d6f8c0e0-9759-4d72-952f-967ecdc0402d", "value": 128116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356678, "uuid": "c4628bed-dff0-4934-9e4e-94f46857d963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356678, "uuid": "e342de55-cad1-46be-a241-c1a33fd045b9", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96b2dd2-e775-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767315406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315406, "uuid": "9d2ac3d5-4037-455a-9692-19dd2e10cbde", "comment": "Malware payload", "value": "30ff6795fd8ad9131ba9ff72a5012e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315406, "uuid": "69fb996a-2f5f-412b-911d-988a3614c433", "comment": "Malware payload", "value": "8ced30593b57b5f84c1a76206db84a9e705bd01a43c96adf7c918b0729ae5fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315406, "uuid": "d6dfda3a-8901-4a0d-a74d-b787da4b2303", "comment": "Malware payload", "value": "5578fefdef7291af727d41ad6e13378a324651e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315406, "uuid": "48ec9bb2-6835-4ff3-aac2-f6658f2e8e48", "comment": "Malware payload", "value": "354e2edddc909c9838218efdd79b05cf6d3fd6d3c4033a1d76a3420818e705fcaed759ec83c20c06151be85f6fd09f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315406, "uuid": "bc041dc5-1860-45bc-bae5-9a530c6786e4", "value": "T1CBA21946D60354F9EE3A047168E7E7FF9A727A215432CC66DB60EE47FB52C2A240870D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315406, "uuid": "e53fb6bb-e35a-4ba6-955c-a12e240e2ab0", "value": "384:he7+h8mNCK1NIBhbDhwcwhcY2/rsw+66SYr0OrZ2t7KaT:M7+h8moK1a0ZhZ2zswT6SYYKoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315406, "uuid": "d3db3ef1-6eff-45ad-ae96-b39e7e82c203", "value": 21330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315406, "uuid": "fbabf4b7-f5fe-48be-abf2-8ab0e2ef06c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315406, "uuid": "8f54af81-44a1-42f8-932e-e182cb5d4992", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.19943.26041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991879fe-e812-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767382702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382702, "uuid": "56f7edc2-3b2c-4597-9f7c-770b1271adf1", "comment": "Malware payload", "value": "63de6874e298e17b5ddd87351e2ad843", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382702, "uuid": "8ac60339-b0bb-46e5-b628-1f0bfe91666e", "comment": "Malware payload", "value": "8d5b5d2cd80e13dbdc4c6c4c5f3809e624a0cb40e8cece90111e7931bfc08448", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382702, "uuid": "99396812-f348-4610-8eb4-16126a152241", "comment": "Malware payload", "value": "f4dcecb49899e85d3f44d887d4a8b97ed9a65df7", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382702, "uuid": "34727f2a-a503-406b-b9fe-215da2663112", "comment": "Malware payload", "value": "c89e4b21a13b70d24f84c1a0146aad60644bfc877a62eb27fcb9f733ba2da4798e9b9cfc114626420fff63489bebde3a", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382702, "uuid": "a06155b1-480c-41a9-a1e3-96d2123ec72e", "value": "T150835901F250C035F0F700FACBB54B7A5EA9AF11536890DB57D855EAAB31AC1BA3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382702, "uuid": "7f2dcdc7-ef05-4eb6-af28-d962f4f99584", "value": "3326b0ed8ca5d20f5013f8b3c04e7744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382702, "uuid": "65b5a07e-c96d-4e86-b573-8f3a68f7ee3d", "value": "1536:z148CrfdXNM840VhyGzirik7okuAhoB2y:z1zmM92yrCksB2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382702, "uuid": "60a8b94a-923d-41c9-b2a9-374936f83cbd", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382702, "uuid": "bde7fc7f-9e1d-42d0-9d72-51c310cbc209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382702, "uuid": "d06e588d-9cea-4ee6-a010-8af81b277211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1288ad47-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381617, "uuid": "4f3f7147-cb3e-4894-9f93-3dafa76e1c88", "comment": "Malware payload (Mirai)", "value": "ae727b2fdc756926e8022822aedf4e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381617, "uuid": "cce5b1e5-cea1-4965-aa67-6e4619104a4f", "comment": "Malware payload (Mirai)", "value": "8d763180808137f0e590e96cd5f32a9a39df1bb659a1b523ec8bf52b97fc66f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381617, "uuid": "5b1335d3-3178-4317-8fd6-073df271bc49", "comment": "Malware payload (Mirai)", "value": "b429ac99f5bf04c83ecf6a79fa5a802f683fa50b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381617, "uuid": "cbdc6f3e-fae6-4248-bf98-9880b33a193e", "comment": "Malware payload (Mirai)", "value": "351b05004bf0dfc47fa671bac8d195ef072edb39f6fd0c7999ce1c00b7477ca0d8b86deb5a1a4406e584f50c1d51465b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381617, "uuid": "176d1f02-5f1a-49bc-ba70-beb6afc21a60", "value": "T1F7E34C46EA418B13C0D6277AFAAF424933239764D3D773068D18AFB43F8679E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381617, "uuid": "7e30cf2e-05cf-4634-84fa-f0f1d6cfa18e", "value": "3072:IwE4TIA+XNhQ7y3v6MMrzOqXjEa1NIMQwIbZ5lHCGLiImyL+M/9lJld:64Tr+XNhQ7y3v6MM2kEa1NIMQwGZ6Guu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381617, "uuid": "7ce679cc-2840-4dc2-8fae-6a67632d04fd", "value": 155700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381617, "uuid": "ccc920f4-8e68-499d-af9a-cc8d3bb9041c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381617, "uuid": "791843c3-8982-460d-b4c4-5a00c9b69ae4", "value": "meerkat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d116a9f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385715, "uuid": "8306873a-3d4c-41a2-9cb4-c847a4188d89", "comment": "Malware payload", "value": "8b72a2f2b50ffda13d31dbfd12d3ceb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385715, "uuid": "7bee0707-2093-491d-b363-326de99e8f01", "comment": "Malware payload", "value": "8db8d911d7708b8fd4ece0e8f378738ad55822d3fba02ee8357418b09b9d822d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385715, "uuid": "602c5e3a-7733-4938-9085-dc3bd115d54d", "comment": "Malware payload", "value": "eeaab35914a6be52e9d7e514d1571eaf7ec3dba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385715, "uuid": "28ee049b-aa84-4b1f-b4fe-c25b90535c11", "comment": "Malware payload", "value": "82fb327c231277020e7af7adafe5c78fff3d8b06b72b3105653f2d757226b9486853560cef7d005d69e0c86965fd5819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385715, "uuid": "08db1241-ac28-4360-b98d-b4c064298263", "value": "T1680633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385715, "uuid": "636c26e7-ba39-4dee-9f21-350a8b1e3bf6", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385715, "uuid": "71730c6c-2cd4-4835-aec3-e70bb8065750", "value": "98304:aOT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:d2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385715, "uuid": "d1e17613-9da2-495f-aef6-fc9d90c9f65e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385715, "uuid": "ca36517b-cdd5-4b4f-b55f-ffe0705c7a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385715, "uuid": "56ec6633-015b-41cd-acd4-7393731393f3", "value": "8b72a2f2b50ffda13d31dbfd12d3ceb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e6f89a-e77f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767319587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319587, "uuid": "5a4f365c-f30f-4511-bc7b-5266c744194a", "comment": "Malware payload (Mirai)", "value": "7d66ace79523ab8e869d2572f599abc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319587, "uuid": "baebcf78-b525-4aa4-803e-498dc5413b6c", "comment": "Malware payload (Mirai)", "value": "8dbd2fea29bc0d9174b2ec9073e5b6b8701b8b1e17c5493dcf7d7c299153efb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319587, "uuid": "b26a5702-6ce9-43ac-bdc1-7ded8c2838e0", "comment": "Malware payload (Mirai)", "value": "b6742c6ff1d170515503626eedc880b6d89aa7f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767319587, "uuid": "6f896973-e28e-4c2f-9c26-6cd027728153", "comment": "Malware payload (Mirai)", "value": "115d1325e02e830a10faab98ec122af006c93db25aed283c30548696a8847034d24c1d85ddaf0b1d1728c7049541c963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319587, "uuid": "2f72ca0f-f51a-4b27-8dfe-aa98ce57b99a", "value": "T191936D02F31C0A03E1A76DB47F3F27D1D39AAA9112F4E649240FBB499071A32655AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319587, "uuid": "7bf49245-ccdd-494d-ad60-ec6b39465e1c", "value": "1536:/h7Ba07C0k4mJNx6HLYLGT3yJp+TxVOqi3Cw9F1ga:/9T7w5Nx6HLdI+dV95a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767319587, "uuid": "7b13c455-d0bf-4ded-8375-ac19931f2bd9", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767319587, "uuid": "9d2d6652-a6e7-4f29-a2af-50de892d6607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767319587, "uuid": "582005e1-fca0-4c72-a79d-305cf6b98000", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c57a60-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385329, "uuid": "d0c101af-eec7-4c53-8ee9-41c11d4ba0a4", "comment": "Malware payload", "value": "01de77d73e82adc2b383f7fdf6127ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385329, "uuid": "1e01a6e3-4901-4426-aeed-272dd2ffc2a1", "comment": "Malware payload", "value": "8dd28d6873a796c5cd113dd13658cdd832b53ecd294f73dbf38ccbe5190eaa28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385329, "uuid": "60c5a3ca-9f04-4112-813f-c000dd1a0bdc", "comment": "Malware payload", "value": "4369f6aeaca1daac3ad744bf96adf4922bbb4c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385329, "uuid": "61678c46-4e79-4e7f-bb32-be1a33cd32f1", "comment": "Malware payload", "value": "83a73873422a4b5fa499ef1771eb826b537d8eb7082c6819f70b108b35e8178cf14fa929d08cbe32500a4db92167521d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385329, "uuid": "0db0a78b-b22f-4adc-a375-4a384aa04898", "value": "T1F30633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385329, "uuid": "5a797595-0679-4ada-bd7e-b433ef7788d5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385329, "uuid": "be89f671-8acc-4cf7-8731-044b0549699f", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:h2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385329, "uuid": "202ce674-33e0-42b4-89e4-f4d3b7c34306", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385329, "uuid": "d95f383f-f60a-40c9-bf3d-96205cfdaba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385329, "uuid": "c51b4100-835a-480a-9a98-de4d14609923", "value": "01de77d73e82adc2b383f7fdf6127ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b4db62-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385428, "uuid": "e878761c-df5d-4107-8fa8-bb02be549326", "comment": "Malware payload", "value": "267d5d9f56c8c3a69c86c26cb3558e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385428, "uuid": "f7e31288-3efd-43a4-9ca8-96d3ee524142", "comment": "Malware payload", "value": "8de0c1571451c40dc156fe7a4244f824061142565accdf5125f98068536dcedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385428, "uuid": "5257d7f9-842b-4fc6-b435-98272839125f", "comment": "Malware payload", "value": "1b55cfc1bf34f6a793d7588493286d716809b908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385428, "uuid": "45ffbe6c-4c47-491e-9216-4d3dd8153a1e", "comment": "Malware payload", "value": "26f93c6e5003c01011514b3abf3d2f8feb10d88b6cc248e92cb3e677c25553336e8feecb1aa8e7eb41790dfb28e9af09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385428, "uuid": "0ca693eb-6891-4c8f-ab7f-b51fcbe447b3", "value": "T1D40633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385428, "uuid": "c2a6d785-2413-4cf1-bc1a-6b0317f610ec", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385428, "uuid": "14ab8853-ad8a-49bc-a580-9e97cb53dd53", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:22w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385428, "uuid": "6ba5a1bd-4b77-48a5-947d-f2e0a0d0c196", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385428, "uuid": "527433c0-e081-46b5-b600-74fae963f67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385428, "uuid": "b0219293-122c-4e62-aca2-e861b10add4e", "value": "267d5d9f56c8c3a69c86c26cb3558e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcc1a7b-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385693, "uuid": "e6ba0e1d-82c5-4958-bd24-c361f28fbc1b", "comment": "Malware payload (GCleaner)", "value": "868ce5a9dd1a92997feb12af87c6023e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385693, "uuid": "bbff5fb3-8fb8-4432-a685-b37dff3991c3", "comment": "Malware payload (GCleaner)", "value": "8e09a03dfba63824fc0ae59207802eae9f8e4c8983b63abcae17b20c96a21ab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385693, "uuid": "998a81cb-a954-4617-8c47-dbf5de1ac3b3", "comment": "Malware payload (GCleaner)", "value": "7ffb71c902dd09fde6cd6397576767dcaa365b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385693, "uuid": "c93f65e0-a75d-4429-8123-2a3f28211ecd", "comment": "Malware payload (GCleaner)", "value": "bddfd1c325652f3ef828db8ef8feae0be0ed0acc556f758a535d5802ddcfd3459f5f80e6f0406155d8a7d928e2a89014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385693, "uuid": "b1f7a529-f2ac-4de9-ab9a-a54e156bbb71", "value": "T1C006E015EDF10C72CEE21E3CDDCF86B078082D5863789B925EC64A496B3973276261B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385693, "uuid": "a11d563e-c886-4bb3-9c58-ce5268afcff6", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385693, "uuid": "e8bb48fc-4952-4510-8a1e-026115c262f8", "value": "98304:dS/NFNAuq7HZrz2oCeQbtlstwffOaOoRE7yWD:UV8uq7Hl2oCdtCtwffOmPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385693, "uuid": "6dd09caf-e876-4c15-b847-dc94d3b4258f", "value": 3911952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385693, "uuid": "7f691d44-3ab1-48c2-ac01-f33b69107dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385693, "uuid": "8e96f8a2-7b75-4647-8b4a-72f2c7af00f6", "value": "868ce5a9dd1a92997feb12af87c6023e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa30db28-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381872, "uuid": "705c0617-b28e-45c7-ae03-622c4bed1470", "comment": "Malware payload (Mirai)", "value": "9c184359463a1f7bbcf7f22619879f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381872, "uuid": "1d0d7d4c-8a80-4575-8a06-56e8c2181d8c", "comment": "Malware payload (Mirai)", "value": "8f0887cf5842ef0c11adb992918386435b5ec8f34e806bf99b845cdd47fb5f87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381872, "uuid": "ea6425b5-ba2f-40f2-979f-1d5c4dd20a42", "comment": "Malware payload (Mirai)", "value": "e425810f6476d3f17c82618366d2ff5271e77e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381872, "uuid": "dc2e927e-d9a5-4a06-b27b-59233a5df940", "comment": "Malware payload (Mirai)", "value": "723450b61daaebe9269eba720b8331f64ca2c610c9ec7f3fa75f50015820cc8b9e0d5d90739752d0546d2b95f4176188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381872, "uuid": "acf3ae62-ea1e-4eed-b093-4f12ea2a8d8b", "value": "T18C638DD4F2067E7DC897293DD48E2B4ABF1C5FE056439511A0B2BE471AB31531D22DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381872, "uuid": "3a90a8f0-bf56-4691-9395-525f70c2a8a7", "value": "768:w/4bvzQoJs8R7PvsV7KaXG658bV+SyaFvxYG1OM7QHKp1IzM7MvVvC6MEYa9GPuU:w07Qk7naXVSsa1x+EQ3zK+vC6Sa4PuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381872, "uuid": "40aa3f3b-c4f9-4d58-be9b-4d943bb62d84", "value": 66956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381872, "uuid": "61e24025-0318-45ee-9d02-46475b03871f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381872, "uuid": "4c34687f-c03a-4250-8660-91bfb750b26a", "value": "colomam68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1542336-e811-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767382313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382313, "uuid": "a5b83107-2287-450b-b316-dda6d9e5523b", "comment": "Malware payload", "value": "dcec7d589cde5b96768df5912a60dedc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382313, "uuid": "5d1ece22-9762-458c-b029-732bdf908fa1", "comment": "Malware payload", "value": "8f7fb9413db42c0edcab9fab6fa49318c4c6b93c71ad340e83780b52fdb327b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382313, "uuid": "7799d7b7-5880-4022-a493-45be2acf2d51", "comment": "Malware payload", "value": "3765c19e630bcd36261bbfc10ed97a634e6131f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382313, "uuid": "4341fbd0-2992-478b-9ae5-b09abdc9c124", "comment": "Malware payload", "value": "04c18fe418d8cca443b49a208e8c8e05bde3758619731f21387be9b5a663e441441188603feeec2098d84f76a844f467", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382313, "uuid": "8382591f-220a-49e0-ab29-75dbc1991b19", "value": "T165E086CA091362A1158C5F6D70B7C004A16BE0C4B010ABC9FCCD552AC1D441831FAE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382313, "uuid": "a11b8f6d-0e4c-4be2-9f91-f31c6ad8c70a", "value": "6:LQVhQ5vGVkoa9Uzhk+Ivy9hk+I3abLKLhkeZdxn:yov4koaYk3Mk3qvKdk6Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382313, "uuid": "aa8ac730-8ac4-4636-8e40-1ab520e87172", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382313, "uuid": "ff809f46-80f8-489b-920e-a8ee28bda66a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382313, "uuid": "a2336022-19a5-45a1-9612-7d1ad3e04f32", "value": "goon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ceb315-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385810, "uuid": "cdf0e99e-bcda-4099-886a-2e4d209ecd80", "comment": "Malware payload (GCleaner)", "value": "a5c2f7a87b51d60f73e279cb90c826cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385810, "uuid": "761d97f8-9625-4cb2-8a30-118bb7f8f7fa", "comment": "Malware payload (GCleaner)", "value": "8f843d1c5b0433a0937c6bcfee3d6efb8e996a84794d79be53d710e48c7329f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385810, "uuid": "91f030d2-9532-443f-a727-4d22e60e53bb", "comment": "Malware payload (GCleaner)", "value": "4fa90ac2fcb9409dd282e296d1e709f8f38d68d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385810, "uuid": "0a378a01-8eb6-4efd-9a20-117bfb758485", "comment": "Malware payload (GCleaner)", "value": "c1c03fff36a754912c25281dd3c5ab6e943ae84d576c4548c3a17d8b5945d3908a996a672926b43e4c20fba9b827db95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385810, "uuid": "ce1e0f71-9033-4849-8b52-1c53311db680", "value": "T11226D0BFD291DC22D0496B7D6A12810FF36D966AE917839D6D873E2CF9204C1316EE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385810, "uuid": "dbeef1ed-ac68-4ee5-a6d7-1d327eba482d", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385810, "uuid": "2aa370a9-b4c0-416b-9760-cacb68e210c2", "value": "49152:/UzNgP32rPWFCidXidlLEaqzR0bBcGsK3zqDvyr/gYmX5Z2Ok3dFRDaC8vBvhPIS:/UzNgP3gd7dBZlRrC2PdF38wmas9mI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385810, "uuid": "bae81cfc-e932-4ad3-bfa0-b542f46b27f0", "value": 4630288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385810, "uuid": "335a1727-4f57-4689-9ce9-5139263fa5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385810, "uuid": "2330a06f-0d82-43ec-bad1-b9a8d7da4a19", "value": "a5c2f7a87b51d60f73e279cb90c826cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcec99c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385552, "uuid": "6a201788-d763-479b-8674-d031d9fe4c27", "comment": "Malware payload (GCleaner)", "value": "5c951cd2e736536224bae1306b8b6bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385552, "uuid": "e05cc1d0-1cc7-4bb4-9823-c1f626380912", "comment": "Malware payload (GCleaner)", "value": "8f857c499e81f3189de5a3da8355e8afc9c15e92f5a415777f125eb9bae31268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385552, "uuid": "9e67471e-824f-4fb6-9a7d-2240ab6d05c6", "comment": "Malware payload (GCleaner)", "value": "dc4bf3c16f05ac89b33d47db2bc35f545a35c312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385552, "uuid": "1e385406-deea-47e1-9062-f56e8ba43dea", "comment": "Malware payload (GCleaner)", "value": "dca74520441fb6974ad4a655f96e009bb681966d2e444ce17de8774b04cec4c4d375f0530d182e9a9dfff00714cce61a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385552, "uuid": "9a868cfa-dd61-4fc1-b877-750d1c60a5ed", "value": "T18116D029D6E132E2E2F513F90CA7163D79325E21E54CEA4F23FD9C0A6F25A43B12056D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385552, "uuid": "3f92517e-f63b-4646-acba-ff73e1585e35", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385552, "uuid": "a0be716e-480c-4a9f-957b-6e712d3f2cdb", "value": "98304:9S/NFNAcJCzbiHs4Vne3Y62fabxKJXvXDYmiOgJXMi:0V8cJCzmM4NebY8xa8tH5Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385552, "uuid": "2e31fffb-b9d6-4024-bb7c-8c7e7aac73b9", "value": 4308240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385552, "uuid": "01dc3e97-be8e-4809-b9dc-04b856adfa79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385552, "uuid": "959efd15-52a8-47c6-834c-39f6c5ee25f9", "value": "5c951cd2e736536224bae1306b8b6bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e634f4-e772-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313791, "uuid": "5ec9a008-ac69-4d06-9d74-3650f2829088", "comment": "Malware payload (Mirai)", "value": "0bddb9f5c7143feadab6a7e43d24c21a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313791, "uuid": "43c6bef1-b105-47cf-b4b0-e0fdadf973ec", "comment": "Malware payload (Mirai)", "value": "905a10009651d97432b96dada0eff9da46481d13537bb545a1f34645cf0d30b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313791, "uuid": "762d80f0-6907-4b2c-b81e-6c04017d22d5", "comment": "Malware payload (Mirai)", "value": "839c87c61d5016f6d64d51f19ee131fcfd04d324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313791, "uuid": "591f8026-368b-4a74-8325-b27547459a17", "comment": "Malware payload (Mirai)", "value": "b669473d94187c95db7f05e220728466e1aef1778b03896911fb0f48319bc23b2bf1213efee5bccdb6a31fddc1c3667c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313791, "uuid": "4c23b9fc-d505-426a-ba44-8cc821cdc7f8", "value": "T15E634B22B97D2D1BC5C5A47B21F74365F1F55B0E22A8CA2E7D720E4DFF2066021079B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313791, "uuid": "547692fe-3596-422f-8031-84c2eb7aabd2", "value": "1536:DScSMmxuY0NFohyx3ZePRgYqu4kjGuSwre+chD:eZMvNFhYtk2e+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313791, "uuid": "f6a9ee48-0358-4912-9e56-215c2968c712", "value": 68672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313791, "uuid": "a9d10b4e-a283-46d7-b9a3-a3bb03615b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313791, "uuid": "5411624a-1bbf-43d3-83e7-c49255d67c0d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed7e8c3-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385637, "uuid": "ad00e7e0-5a06-4f9b-821b-82bf99fc127b", "comment": "Malware payload (Adware.Neoreklami)", "value": "74f61b5956dc0727326410ec3eb59f8b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385637, "uuid": "1376f388-df02-48ef-a770-fe5ddd5ff251", "comment": "Malware payload (Adware.Neoreklami)", "value": "917aee917e7a27f459d57a8c2b458127f75b2f31ccbc4263f947ae5d3f1df198", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385637, "uuid": "24083e1d-04eb-4e22-b36b-0755ee795e38", "comment": "Malware payload (Adware.Neoreklami)", "value": "5bee3a696b32b8d4d90781c056be4a007fc5a9a3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385637, "uuid": "12a7afba-40d5-4709-a2a1-f39b5d4f3c6b", "comment": "Malware payload (Adware.Neoreklami)", "value": "870f79f27c38b8e89955941da187f708eb2a7c543b83c586eaf0ebed65264d3ca713fa061580534247a864376b25e370", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385637, "uuid": "9d39bb92-a7a9-44c5-8cfe-114ddf0f6d35", "value": "T1AF763342B9E6E4B7FC1901B0C9E409E1B5EBE93E0E2318C75791157E720D8DF8293B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385637, "uuid": "8b4dd100-1918-4606-a934-059d89d96716", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385637, "uuid": "9d7c541d-b82d-49f1-a0ce-9085fc28958f", "value": "196608:P1O9T1N5BqYbjLuFXbTRx2PD6JL1tqSYfds0xk:tOhbqgjLuN5PTQSuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385637, "uuid": "e4022844-7630-4f6a-8677-ebc91a045aaf", "value": 7491209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385637, "uuid": "9c1c0fcc-ad98-45da-9451-30f65349de75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385637, "uuid": "83dd39fc-6167-40c7-bdb7-b52682b2e176", "value": "74f61b5956dc0727326410ec3eb59f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c4df7f-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385413, "uuid": "ed9540bd-f067-45f4-b48c-e7dd40487877", "comment": "Malware payload", "value": "237f3092cd0a175aa3a54c964488c4d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385413, "uuid": "729187dd-a903-4f4c-91f7-d1690d687a6d", "comment": "Malware payload", "value": "918503a7f5a1b021166d4735ef8a8775f9ca641562a63d2dda3a1d4868869497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385413, "uuid": "82d3b525-c9b3-4d5b-ad93-4af11e01d852", "comment": "Malware payload", "value": "e4177cf0d67c984c3af7522ea1f17c89d9217b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385413, "uuid": "9aec12c1-1692-496b-8532-1542e15a8ba0", "comment": "Malware payload", "value": "4f17d1f0a717811ce5f1b4b1a1f766adf2edab4d77d3d4015aeb0227ce56a4f3676584320fd35fa395a9f84dd486c25a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385413, "uuid": "5e4db7d2-1992-431e-9f72-df8496afe6ed", "value": "T1610633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385413, "uuid": "10c21a13-d7d6-4b36-94ae-49a1835d0f66", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385413, "uuid": "5e455fd7-2db3-4d32-b13a-d1287be85fe0", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:O2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385413, "uuid": "f0bda16e-cec6-45b4-8725-9825b7e425c4", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385413, "uuid": "cea4501d-d791-4644-8669-688b6b740712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385413, "uuid": "9338c78e-59da-407c-b78d-483d1e99f7d8", "value": "237f3092cd0a175aa3a54c964488c4d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434f3e21-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385564, "uuid": "98f51252-1853-4487-a8b3-2887d19da864", "comment": "Malware payload (GCleaner)", "value": "6260edbf646ab0df8985b63b548cef46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385564, "uuid": "c69beaef-c9b3-4aa1-927b-9e2641b34f33", "comment": "Malware payload (GCleaner)", "value": "922c6a5b5f07e1ffbaf405f55af7fd8b1f0e6da923ae302737b5634e423a75ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385564, "uuid": "d1e75fbd-4a0e-4efb-9279-44bb8012f5de", "comment": "Malware payload (GCleaner)", "value": "e1236c88774398f1d48d55d594682d8511f36718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385564, "uuid": "0ec688c1-4822-4ec9-ba06-2f3ac1ba55e6", "comment": "Malware payload (GCleaner)", "value": "6d93ed72628ae8906f4dde35edba28aa971b34e6f6dab99efb6385b8207783d0764f8995b0cad2343180ca9b52837b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385564, "uuid": "fefdc642-f4c7-42a8-9181-18539a3917dd", "value": "T12136E02DD99387F2FFF2427D3F2A9C6870685850FE26350F1BE6D9837604A1D061B64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385564, "uuid": "54177245-ee38-45a3-abc0-222c8d20b74b", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385564, "uuid": "e5fdee38-a8d5-499d-8c13-580724557622", "value": "49152:dyjLuPfI0A6WucifGvbNp0pfX3Ls6WT85P58k75XT4P99Co8Ft4S5NpNdzFJRGIn:dyGVO30FAjTQ8kd89koCt4YpnRZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385564, "uuid": "d37a7699-f94d-4ab3-a23d-c18c60247d27", "value": 5189904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385564, "uuid": "818a44eb-792b-44ee-896b-9815d61764c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385564, "uuid": "05134724-74f8-4861-8199-d27a56b62d09", "value": "6260edbf646ab0df8985b63b548cef46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847dc359-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381379, "uuid": "57080a05-2a1e-49a5-898d-3d7582dbdbb5", "comment": "Malware payload", "value": "ac2ec8f6ecdac91a153be559f7eb6ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381379, "uuid": "60220de6-e24e-4c51-8713-fc0c5f289f1f", "comment": "Malware payload", "value": "93022a082cd9bba5639c62fdb87a30ba3a941e375acce8d517eaf502d77e60ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381379, "uuid": "2b53a445-546a-4995-97da-8a58394cca6b", "comment": "Malware payload", "value": "49c4dcbefa6527460ca4a0e96b718622ce74dd54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381379, "uuid": "cb623db9-11ea-462a-bb52-19fa76f15269", "comment": "Malware payload", "value": "1421ec06f1a1eea7a718ac0005ef3dd80e8dce85ce07750635127e1e15e49b4c16cba959f4dbc3480a47c68ca3254c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381379, "uuid": "a42bf00c-99d9-4c13-96df-0dd074e6bd1c", "value": "T1A0D42855F8809F61C6D129B6F75D42AC73070BB9D3EB71069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381379, "uuid": "457a2365-7299-4a68-84fe-82841a018fc4", "value": "12288:VMYpt3UmSJFGRCGq/29Ov6SAYdJ/wNBU8mqbv8pflKjS:VRpt3qJCPq/2I60/wFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381379, "uuid": "712787e1-8d99-40fa-9141-c87747fbb211", "value": 653396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381379, "uuid": "417736b1-de8f-4db9-8c73-c99034dff50a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381379, "uuid": "ba1546e1-cf42-47ff-9782-32fcf4ad1086", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916abc99-e777-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767316117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316117, "uuid": "99613408-7812-4acd-8a26-7735012b2b56", "comment": "Malware payload", "value": "12ba8444dcfab9cf1a68ab274632a72f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316117, "uuid": "d05b3782-3de5-4d7e-8b9c-16f2dcc07971", "comment": "Malware payload", "value": "93f4eb074aa9f73882a3f7c4209247543f1b9fafc8454a7724cce1fce5f423e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316117, "uuid": "f10b3446-b146-414a-ab58-453d30ebe4cd", "comment": "Malware payload", "value": "3b9f306d2f7e609ec5d62d474607d481183f034f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316117, "uuid": "d02bd116-38e8-445e-a317-2670f8914b88", "comment": "Malware payload", "value": "212e096b925c26fc4db260d97d1d977687800c101bc3f41369dd340b4efc1db9771d58e6776a9e7035b74aa980573c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316117, "uuid": "c613beab-1c36-4bdc-9910-087d01804b69", "value": "T1217423D63A806AF447B8E0CB57985D0816ECE130DF376D88DEC518CA7227E1BC5892F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316117, "uuid": "29aff462-daa1-4223-ad7a-c906418606c0", "value": "6144:v7lQRaj30gcNbrlFZxd/YVvFJAc9Yq+UzCUSTqaNf3eFeyh825fXl7:j+ajEJnjwVvPZ9YqLbWq6258q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316117, "uuid": "95c065bf-6205-4ee6-844a-aec7ce8a1ad0", "value": 360188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316117, "uuid": "2dee5f98-6858-4876-810c-18432139747b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316117, "uuid": "eb5dfbdd-50f2-4726-a280-d68c39bcceef", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a1a5a0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385860, "uuid": "44139004-2e0d-447a-a128-5bddf565c718", "comment": "Malware payload (GCleaner)", "value": "bb4279a2a389feb8ba8957bcfc59dbcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385860, "uuid": "e03f744a-74bb-43a3-b9ce-c74796736d35", "comment": "Malware payload (GCleaner)", "value": "9492f6c166927fbe90d23837bd90bded20c9d1daa32edbd6aff318cccbce3cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385860, "uuid": "a6889e39-6422-48e7-a0da-88389d977920", "comment": "Malware payload (GCleaner)", "value": "d73ee2b8fba138fc32af1b8832f4baa77f63fb24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385860, "uuid": "7946906d-7e2d-4a1f-963a-e14c73035ddb", "comment": "Malware payload (GCleaner)", "value": "806c74869db21deca993bc2085b6bf8d2582cbc70df26d73318866f792224b07d0542862e86775dd229913b8710033c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385860, "uuid": "b9656f02-fd0d-4209-965e-8d1598a54e4a", "value": "T13B26E033F8125229E45A4EB1BC03441984012B96EE1461CBF7ED3A5BBA75ABD7D273CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385860, "uuid": "a0689c06-1f44-4e97-9d30-1616ba242eab", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385860, "uuid": "f871e4f8-0e7f-4162-beed-88f526758ec4", "value": "98304:irSWRo1xAhCk1Bb7gO4mWgYHRRhz8VqnYf3DjylFc7:S4A8kbb7gOJKhIQCDejc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385860, "uuid": "47182dd4-4160-414c-ab4e-d868c7831d38", "value": 4426512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385860, "uuid": "6e71bfb7-b7c4-4c81-9487-88930f80e97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385860, "uuid": "4cc572cd-2875-4d40-9c00-9a118a7a52cf", "value": "bb4279a2a389feb8ba8957bcfc59dbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149a6255-e7f0-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767367877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367877, "uuid": "ffd63a7d-0809-4234-b94b-d62a2a718d69", "comment": "Malware payload (RustyStealer)", "value": "a0d1223ca4327aa5f7674bda8779323f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367877, "uuid": "0de6b511-dd27-4b91-b013-f41c51e45d5f", "comment": "Malware payload (RustyStealer)", "value": "949b0bea5bd7feab58e280dde49310521920b655714c5f1b7d9de8719373dcd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367877, "uuid": "ef349856-6a09-4d0f-897a-67e4ae5526be", "comment": "Malware payload (RustyStealer)", "value": "96ea4a649f67272e305b75401a4045efae91c926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367877, "uuid": "e5d43224-a9d6-4283-82f8-d86984d2eb8c", "comment": "Malware payload (RustyStealer)", "value": "469e2ce66e7082a6440944d1275555bac9a2575fc3a5fb9fc1db79737637227602fc297408d6d95fd0e3001d7832e7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367877, "uuid": "8426b0c8-a9ac-4df9-8520-801c00d40d49", "value": "T190A4A03BF25BF462D2C4A438E0E4922505AB6D0D3E0CA9F37A94E911D4B5E907E63F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367877, "uuid": "d5b2ca26-9337-452c-85b9-a975c89bced9", "value": "50bbdc5493b2128804629378f200a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367877, "uuid": "15d08495-50c6-456c-a4c8-ac61def41531", "value": "6144:rXcD8g9Spj4XXobxfsQDgF2vyJCqAi7JJIKMtUwMWefBO2BAes:rw8kobxf93eAi7JIMBOofs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767367877, "uuid": "5892ba65-5514-496a-b935-dc531b649018", "value": 488888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767367877, "uuid": "423a1503-4ec5-4627-8e53-c69776de629e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367877, "uuid": "533ca2de-43f4-4582-bcf6-8a544777f52d", "value": "Open the file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc3ae1a-e82a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393150, "uuid": "199b1691-fc63-49a3-bb81-625b6e997948", "comment": "Malware payload (Mirai)", "value": "5edb4373bbcc9dad9edd56888c7cd283", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393150, "uuid": "04d2f189-54a4-4285-897c-5eccfa0c7fae", "comment": "Malware payload (Mirai)", "value": "94e79ad351f605b460be42491e6954d1f03c2b50a432c80f1afdd847df16015b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393150, "uuid": "2f90c266-9f92-4619-a20c-39f76123556e", "comment": "Malware payload (Mirai)", "value": "b442bc209c5e647ebf425370703ac4fd28aeb76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393150, "uuid": "db733dd9-b5c4-4c91-bd9a-ce324817406b", "comment": "Malware payload (Mirai)", "value": "9d115c59db84ac58b5d53a1811c66270c1e088fce7432a5955096e71ed6cee8638a35f21f1c982fd65a06a3cbb389d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393150, "uuid": "396c32df-21dc-4fb6-ba69-f6e5166ed915", "value": "T1055302159A29FE53CBA6ED3F8D018D875E970A7CB2ABFE1151B24138A4D2829357D0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393150, "uuid": "30484663-3dc6-4370-b030-c2387f1643f5", "value": "1536:GzCaZ1qhUnxd+cQ4ZqFeSuyyTo8yOsguXZsaL8:ICaZ17Q4EGuauhL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393150, "uuid": "94f0367b-d947-42c5-86b4-a99a12389651", "value": 61464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393150, "uuid": "7900fd4c-9c73-431d-a893-e714e4b01448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393150, "uuid": "74bd2f44-7ca8-405a-a217-cb99c09df5d6", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38911fc1-e7e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767363642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363642, "uuid": "10aa8484-27b5-44bf-8ee7-90a7623e7d1c", "comment": "Malware payload", "value": "3e3f6bcb7287afbc9c3d36f5423603dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363642, "uuid": "fc735925-44ac-42ce-849c-fa1aa33a5b93", "comment": "Malware payload", "value": "94ebc159c809112e88823eb92c51f88ad99532b09c05ed7753c26000ef185319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363642, "uuid": "f15099db-52c2-45d6-935a-ae10183659d1", "comment": "Malware payload", "value": "aa5a739d140d6158b08b3c5be4d0f24010855efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363642, "uuid": "70eed79b-9788-4d68-bbd8-ca386699d1f4", "comment": "Malware payload", "value": "cbfcadb86a153df8f77db205fca12ce5fda448c3ee1bfa60b615cfea9e3e279b6ac115091cdd8201c0e9d15cbb38383f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363642, "uuid": "65adf0a4-4cdc-471a-b2f7-6c546a3cef2b", "value": "T19027230262879029E46E063E35625FB557BB6E3060626D3296F7B348FEF5C701D3E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363642, "uuid": "a54710cb-9e33-43f9-8ced-29c932629144", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363642, "uuid": "5ced5bba-70dc-4301-bf68-76a9c41e0099", "value": "393216:xdZ+knNZAyqBbCRnjoH5TMiL5od2giiHDIWNLYsEmFFxIFcAbGSx:F+ONeGxoZl5PluDJYMFFxIvbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767363642, "uuid": "787a48f9-073d-4feb-9f08-47b832d5302a", "value": 21757912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767363642, "uuid": "f9f8fa67-ab34-4b6e-b72a-1a309281adfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363642, "uuid": "9499da39-b108-4f1d-b43f-dd31bf6b01e8", "value": "SecuriteInfo.com.Adware.Downware.20721.28281.6996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f4bf71-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381648, "uuid": "86b47647-5555-4927-9736-db76bb169d88", "comment": "Malware payload (Mirai)", "value": "772969a3e2d8ede58c19bad7d6d65d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381648, "uuid": "073673f9-523b-4016-af8a-7e80f76b7921", "comment": "Malware payload (Mirai)", "value": "952eb6c801ab2a6943481487cb69c0d7027646cb5f505ee60a9b2c76fbfe88fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381648, "uuid": "952e6a28-4f6b-4171-bd7c-5f899a13ad6c", "comment": "Malware payload (Mirai)", "value": "9f5b246e99b8bfd6d4cad578b2fd6a2d808c441d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381648, "uuid": "6d15f179-959d-4fbf-a2c1-ea62e1d06b5d", "comment": "Malware payload (Mirai)", "value": "249630a4f4a13f81b288d33ca7fb457914d27c299f3a42a0ef7cd670105abffb8d97b20902e6e0fbde84c7f4389f2d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381648, "uuid": "f137bcab-67df-494b-96da-e85acb1c8a54", "value": "T1DF435BC59593E9FCDC1015393077FF7256B6E93E1028EBC7E7A8A932A941A03D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381648, "uuid": "9629224d-2886-4ed9-882b-1e3371126346", "value": "768:CoXHT2eWv2WAb3Mn6zDjbr63UM7Jwv3U/HYXwgWt1XfWA+LtOfRc3X1:CojZWAb3O6zDHr63UywviOWTF+Lt+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381648, "uuid": "d958fcb8-8e2b-483a-958c-2778d877831a", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381648, "uuid": "5b0143b1-e0ee-4807-bb58-31518abffcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381648, "uuid": "c1e2ee55-3eb5-47fc-b55f-052a81774a94", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c026c36-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385606, "uuid": "ab4f27aa-9977-40fa-ad29-2f3cecaf00b0", "comment": "Malware payload", "value": "6d3a7754e253d65e221ad981554fb9dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385606, "uuid": "a13985b1-87e5-426d-8c12-432270486f58", "comment": "Malware payload", "value": "958b36efce8504bf2b9879d7d7aeeb5b81d54e97f51690987573ecab064ba64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385606, "uuid": "bc6129a4-b129-4543-9f57-ff6048f4be2c", "comment": "Malware payload", "value": "9c6f997215f29f1a3401618b22148508b82bbd35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385606, "uuid": "dcb88586-dacb-498d-bf24-9d46c804cbc3", "comment": "Malware payload", "value": "5885a963ef4ae4adb8826041a6721fb64f96c218e8afed125af71923cbd4b3e4e89d116d94a9be995207ecfac717e720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385606, "uuid": "5310172b-7764-4356-9a4a-2b17ec5b531f", "value": "T18F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385606, "uuid": "9667dcc1-8729-437a-8e9f-227deb210a17", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385606, "uuid": "85e783d6-11e5-4e97-9c55-5b1fd0526ba1", "value": "98304:aZT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:W2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385606, "uuid": "63314261-c1c1-4e13-b2f4-9cedccae22c2", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385606, "uuid": "3a663d13-3a65-4307-996a-d128411ca8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385606, "uuid": "af6d05d8-d2d0-457c-983f-804aad980a69", "value": "6d3a7754e253d65e221ad981554fb9dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3309bb6-e7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767362184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362184, "uuid": "cd26d809-3d68-4bfb-92ba-6be232dea4f9", "comment": "Malware payload (Mirai)", "value": "c3055a87fdaaba149574825ecd9df74c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362184, "uuid": "ad018ce1-6a2c-43d7-8d3a-6fd1654adcc7", "comment": "Malware payload (Mirai)", "value": "96bdc158a0a8655e020f2b4cf081e121596740f5a13fe99771b9747773a6a0f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362184, "uuid": "20e5d29d-7b1d-4a0b-ba25-213be19239bb", "comment": "Malware payload (Mirai)", "value": "ec5d13fb8e12778235400f775425336310c3e9a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362184, "uuid": "956f0c18-f157-4cf7-ad76-979a6c2495a9", "comment": "Malware payload (Mirai)", "value": "f11a5faaab347a9beb1054f4714322d71e7898600199034a5d06c765939fc7e2064ef5c84cd687869812a7a86b89862f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362184, "uuid": "adf78340-7c9e-4613-889d-0ec1001fc36e", "value": "T1A8047B73C8686EA8C664D1B8F0A19F391B63E11481471FFB65A7C6B54087ECCF50A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362184, "uuid": "177ce77d-1162-4dea-bdb8-cfc6f6e0d00e", "value": "3072:FmENJuQRL4p3wAdklj1knFQThvahkdWcIx01BA98:FmQpR43del5knF8hbocZ1u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767362184, "uuid": "a7791686-3c0a-4cb1-9809-8a43c5712d5f", "value": 174144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767362184, "uuid": "3c0c7c8e-a4d1-4c90-b966-0cdff3f158a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362184, "uuid": "9aa966c6-cef8-42ad-b4d8-6e981378c68e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063c2766-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385462, "uuid": "a5941b45-400a-4d21-9e36-c6a086e9cae2", "comment": "Malware payload (GCleaner)", "value": "39bb18d2e5eb8a4fac6e2e16465bf852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385462, "uuid": "d5416887-55e0-4615-a722-683b97ea841f", "comment": "Malware payload (GCleaner)", "value": "9711aa6d783bfa5438cd95bf181c7820dfc0ba47d6799e231a1599c40c59e402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385462, "uuid": "bf48861f-4d31-4fb0-93c4-3c3812b2317b", "comment": "Malware payload (GCleaner)", "value": "fe73c4a0ee9f777aea8f6ea94b235c033c8f33a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385462, "uuid": "e9d01806-7683-40d5-a4db-8d1c7dc1256e", "comment": "Malware payload (GCleaner)", "value": "533f57d83c1e7c337306e0aad9734da8eefd6c443e319bd0369f6351d463b17b8e11a3d965db51ede5c8ef2af11c4f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385462, "uuid": "4bd5ce76-fa76-458b-9f77-4375c2a6c11a", "value": "T19E16DF71EE2107A2CC028DB689F6C015E8E37AA7EF1CC41293DDEBC96DB055FE115266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385462, "uuid": "1066ed5b-8854-45a8-ba59-474da85c9b73", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385462, "uuid": "369e934d-3824-48d6-8a35-d42622f38d58", "value": "49152:hrSWlkVUIg+/iORx5gjrAtEiQ6cw2bcqPfzat1ppHz1mqnhmC3icMCK0eUFDocbM:hrSWlk/p5mkcwIfGLppHBmUhd3icTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385462, "uuid": "6663b448-daeb-451d-a96b-4eeebe48bc5e", "value": 4312336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385462, "uuid": "b9678c46-f075-4654-ab7b-271b4fc8e31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385462, "uuid": "9a4703f4-1e90-46c6-a2d3-3f313ec00201", "value": "39bb18d2e5eb8a4fac6e2e16465bf852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664c6ba4-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335372, "uuid": "ba027f74-90d7-465a-982c-ca2c4b254ffb", "comment": "Malware payload (Mirai)", "value": "e661b176694f9735e5a012f4a0d40f38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335372, "uuid": "7284867e-4b23-4241-a366-d6c66789a9cf", "comment": "Malware payload (Mirai)", "value": "972a86c8081dbba7b85b95f1bde99d157a431b6469ba23505735e73f2e406598", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335372, "uuid": "42ddc63c-8e21-4a72-a39e-042a41ba953f", "comment": "Malware payload (Mirai)", "value": "c40d0fc11aaeb970110030ad46580e7bc2ce806b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335372, "uuid": "21d69cfc-d146-40db-85b8-82f2007bb751", "comment": "Malware payload (Mirai)", "value": "8b26e5db6ccbd04ff8b4fffc2e66cca3cf4cdb3fa6e125ce366592887d64484a96ef815335e323b3aa2234d2dc2e92e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335372, "uuid": "25034532-6ce2-409c-9822-32f92314c717", "value": "T1A7C32A85BC51AA11C7C2567BFE4F428D371A53D8E3EE3203DE181F6437CB95A0E2A256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335372, "uuid": "2f50bc49-3125-407b-bc0b-66107ad8c09d", "value": "3072:QbUtHCGh1kSlDn5vQG1GTMtQuAnvecexFHULHimdPt0coW4nT4:QbECGh13JNQWOMtDfHULHimdlJoWQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335372, "uuid": "eb7170e4-b3f4-406b-b5f7-e84e13ba1368", "value": 120024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335372, "uuid": "36c42161-290c-4a50-8d63-8f4ebf5d5a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335372, "uuid": "ef2c0e70-edf8-42ef-9f70-a0eda29b0a25", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93438626-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385699, "uuid": "c3c0ffdf-dfa4-4f81-8402-acadf92f68da", "comment": "Malware payload (Adware.Neoreklami)", "value": "87bd9b7ab7c141feedf7f10e09484c09", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385699, "uuid": "42b61ed5-60bf-48c0-90c0-98c1a01b03c2", "comment": "Malware payload (Adware.Neoreklami)", "value": "979e9e9e69d257ce490d4b631356c50d2ef5c76967982aa73569a4bc58d178d7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385699, "uuid": "9e93c6b2-62bc-4384-9a21-4c9ad60b506f", "comment": "Malware payload (Adware.Neoreklami)", "value": "d48b0f43bff82219764f939a85e4ae0dee4d0d21", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385699, "uuid": "e955e106-a619-4791-995c-f4321d215f15", "comment": "Malware payload (Adware.Neoreklami)", "value": "2512044b0d076ee02353503cf40b2bd7637700d6382d9828f821b094039814343168072694fe1f4907cc2686baefc6b7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385699, "uuid": "71bbf1ad-039f-4d13-b213-0a4f0e969cfe", "value": "T1A176332574D7CAF9C5172D31CE494FD5E1E8DA4A0B2F8CA343A281F8B23E8855A5336D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385699, "uuid": "a951c389-7a78-479e-8a12-f983c0864076", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385699, "uuid": "99861844-8220-4730-ad09-ee72aa074083", "value": "196608:P1OoAjuzlYcmESgQpbHNo42wJ6rQ/5oT/:tOosuzl7m1rDovsQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385699, "uuid": "1fe585c0-addf-41e4-a3b7-e73e91344346", "value": 7511758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385699, "uuid": "659488d0-a894-4640-a948-6d3ba0bce430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385699, "uuid": "dac5fb31-9025-40b9-a3be-1c9e3f72e091", "value": "87bd9b7ab7c141feedf7f10e09484c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09415ed9-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381602, "uuid": "fbbe8da8-3856-419c-891a-4c7595f7defa", "comment": "Malware payload (Mirai)", "value": "2ec15940351cecec8b04549d03956b7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381602, "uuid": "9701e26b-89ed-46a5-bb03-6ee65cd93342", "comment": "Malware payload (Mirai)", "value": "98e3229cd28fc8a5cb936007421bbe94715ddac9b0f56da2e26894e70e0eff14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381602, "uuid": "738a7f78-f7e4-491f-9bcf-53368bc679d0", "comment": "Malware payload (Mirai)", "value": "da4a0d714b5e441733af2a30cafde3243807d370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381602, "uuid": "9268dff1-fa9a-4746-9025-fa2cd03f0405", "comment": "Malware payload (Mirai)", "value": "4a83278d584da9ec80d71f74ec9c82e3ef88c3a68348daaac4ae51dfe2e296d6cb17efdaa385bf210e109aa7775094b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381602, "uuid": "bd3aaf08-775d-45b4-833c-6b74981a774b", "value": "T17C63954E6E719FBCFBAC863447B75F209248339666E1C684E15CEA011E7030E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381602, "uuid": "66b114c7-9939-41a3-a874-82c11b52c23b", "value": "1536:d8aCKgyqz+SIjtr3st2jpoJtFH8ITTlpG01eer:2HhkJr3fCJtWITTlpGkHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381602, "uuid": "d0efce8c-5d27-46f9-a2a0-c66b030efcbd", "value": 68272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381602, "uuid": "9aeaea1a-6902-4f20-87c3-202a51128fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381602, "uuid": "d6ef3f16-6148-441a-86a1-e64309fb53d3", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7addd0fa-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385658, "uuid": "419383b8-46c1-440b-b237-122bd53d5576", "comment": "Malware payload (Adware.Neoreklami)", "value": "7d1ef4a9bd170d61916089721090166b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385658, "uuid": "a49ffd03-a607-4af0-ac4c-8b47a15159ff", "comment": "Malware payload (Adware.Neoreklami)", "value": "9907d4082684d393f2f0ed13860c564e7c97dc0f394c6ce981e21a3008081da7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385658, "uuid": "06b5e27e-a020-4aba-98b7-98bd73cbc74e", "comment": "Malware payload (Adware.Neoreklami)", "value": "cedc91933854fa3bc2faaf893d79ad5cf621a2af", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385658, "uuid": "6e57cbab-8a58-4577-bc34-0726f1390cdb", "comment": "Malware payload (Adware.Neoreklami)", "value": "57c30d583005d3e83a772b185ed592348dbd445099be71a86483dd34aad35890962f29203912c10ccd5c4c6ab6fad126", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385658, "uuid": "50b644f4-97de-498b-9812-11ac9ed512ae", "value": "T1AA76332339C1C538D3A00075C966ADCA28DF7BAD4E129B7323D9657E5F36E18C61AB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385658, "uuid": "9af853f0-7fe7-4c57-85e0-2478564440bc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385658, "uuid": "6080e52f-68e3-462a-a9e0-c138b79517dd", "value": "196608:P1Ob1vhAvvu9QdO5rQRcOidtM/ewxdN0dZ002cGWL:tOb1vhAv/ZaVdtGxpcGWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385658, "uuid": "f615bdcb-9946-4b35-b590-abdde3542c3a", "value": 7538570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385658, "uuid": "c9c04f6c-cb5f-48b7-8b56-b552be130416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385658, "uuid": "18a77939-0421-4ee1-953f-3fe02d762cd6", "value": "7d1ef4a9bd170d61916089721090166b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca5b1c1-e7b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767341503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341503, "uuid": "441b2ed3-d9f8-4fed-9ed3-26b21ccf24bc", "comment": "Malware payload (Formbook)", "value": "54d578429d9721c3d3d5462452914003", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341503, "uuid": "1b43bc7c-d12d-4b00-a3d7-c55960ff0da4", "comment": "Malware payload (Formbook)", "value": "990bf5a43a31baa9e799def1c68552ae54d2357be5b0ccd9ae7da22fe02e53ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341503, "uuid": "67926376-d811-4736-8520-4360252f2117", "comment": "Malware payload (Formbook)", "value": "57c35e8836327d686e46de475f99a774f15cc9ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767341503, "uuid": "f7687efe-1249-4516-9d6f-0ebd284e2f18", "comment": "Malware payload (Formbook)", "value": "818e777d08d8de57524f538f4d7780bc4f46c8886688e113d7031dde6062affd0fdd98fea5abec089ecbad1eeeb03c5f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341503, "uuid": "f559489e-d4a5-4a89-a3df-90c61a16b1a4", "value": "T1CE36334DE592CECD4AB2043D63DC97FF6AC6F2A3E9946378645B43CCCE9454088E721A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341503, "uuid": "266bd890-5959-47fb-bf88-a490db75f64e", "value": "98304:3vEqmaaI1I2zn1Wg07ulGjtv6c2y+yuynOA0bIMC5fRn5CFA4jja:3EMK19N8eOA0bzC7nUFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767341503, "uuid": "1660e485-0783-4d8b-ac37-c535223e652a", "value": 4972854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767341503, "uuid": "cf691533-52af-4c1e-aad8-57f751cb8958", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767341503, "uuid": "0885d757-9561-402b-af76-89e800492148", "value": "aaa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9206dd2-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312721, "uuid": "cfe00a50-b434-4705-a6dc-932f35aa53cd", "comment": "Malware payload (Mirai)", "value": "8027f209a7cd164555e1d218fb5cf548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312721, "uuid": "2ba537ec-29ab-4058-bbc0-1a2d65815434", "comment": "Malware payload (Mirai)", "value": "99a8703cc7bc7eafb968434197b7a5f044638ee2423e585234955d7b56cc854a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312721, "uuid": "fc7a62e8-a594-404f-a399-e946a0042eee", "comment": "Malware payload (Mirai)", "value": "bfe48d1a8127b139aa9431f2abf93509193de4dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312721, "uuid": "020dae70-76e3-4135-926a-ba9edeabe151", "comment": "Malware payload (Mirai)", "value": "0772c7e079c2cb0dc5f034a57e492db6a1592c324f464df42e2c60c73d2b1ae6da576b827a673f5679ccad8fa45d0ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312721, "uuid": "260e7e5d-3c97-49c9-b02c-8443e91b0ecb", "value": "T1B2537D26D47AEDE4C14C85B4E9B1CAB96B43B204D6432EB76E89C5594007FACF60E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312721, "uuid": "a188d425-18b0-4e10-a0c5-d20dae0bebc0", "value": "1536:jajwtb1EZ74GfQYpdXjR7t9UyU5bxMjuC/Eu+7R:jYiEyGYYjXjRRCyabmjuzu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312721, "uuid": "39e02f84-5dc6-44b8-906c-3ada96e841b4", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312721, "uuid": "b9d89855-3808-467c-9528-8fba85bcbd40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312721, "uuid": "4fede657-255e-46c7-9c28-d4f989925edd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacf9c91-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385819, "uuid": "8c312488-3fe9-4313-8c22-0c0feef0954d", "comment": "Malware payload (Adware.Neoreklami)", "value": "a990e035d14a41816e7b9728a41a86db", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385819, "uuid": "917bb9a1-6877-4f4d-a2ee-c9a82f437d97", "comment": "Malware payload (Adware.Neoreklami)", "value": "99bfb3f8051da019ef496214daf2e6828b388d599d01fcefb710d0da47808b5b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385819, "uuid": "36a438fb-23c9-4bdf-87e8-eee4fdc58d50", "comment": "Malware payload (Adware.Neoreklami)", "value": "add26506d4f4298169095d46ee8d94b50c453f3e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385819, "uuid": "221498e9-01de-4992-b74c-b8cde9329962", "comment": "Malware payload (Adware.Neoreklami)", "value": "b3d262e5aa4f9e648df574a180e8b25d403f4f5d67a7fc3b329ea002e92f72b2be50b719ccdd6dc42656f3180822cfe3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385819, "uuid": "82732c7b-f90f-4149-a25d-23619ae469ab", "value": "T10376333032E1DBB2C29310B0DA743E97A47E5B7913664E9B27BF16BD3D786C1C921A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385819, "uuid": "1bd00e0b-7095-4749-8c82-7a0f99d89e40", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385819, "uuid": "210fd0cd-d07d-4347-8d51-096c98c7272c", "value": "196608:P1O5hcYQXZNI58r4P/sHACI/x52NhnWLcbPhj:tOJQXZU8I/x52NhWKPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385819, "uuid": "6182013b-6290-4cba-9f9d-429c7c8454e5", "value": 7609357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385819, "uuid": "be692862-09c5-4152-ae4a-44574c9168a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385819, "uuid": "966528b8-4f95-48e1-9d6d-bd32f625bd07", "value": "a990e035d14a41816e7b9728a41a86db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26dab07-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385375, "uuid": "39ea7af7-2cec-46b1-98f3-f314ed0e4c9b", "comment": "Malware payload", "value": "14ec210591f8512fff1da3532ecf3be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385375, "uuid": "4e0f9729-ea1b-4e25-b55a-1d04f5b68adb", "comment": "Malware payload", "value": "9a9049cef8033f3733147f6f6f9c2ee66e77d36bcaae830460db7fc8621f7f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385375, "uuid": "1f64f343-bad5-4df4-923c-50d01c3f1e5f", "comment": "Malware payload", "value": "a8b1ba74c1a0b4efa107ba0e77ae7bf362e4f9d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385375, "uuid": "4d552d70-68a2-4844-b4eb-f9e05163fa01", "comment": "Malware payload", "value": "2bb74520c374ea9b0a7e40105a3da575f757e12b063ccfe1951e364da251be8399344649fee23dd07af0434542ca402b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385375, "uuid": "fc9639c8-fda8-487e-abb8-d1f638a3befb", "value": "T14E0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385375, "uuid": "7f11cc7a-a564-4dc6-a362-5196e0ab5121", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385375, "uuid": "be6a5131-5e5e-4b67-a5b0-7da537f730e3", "value": "98304:a/T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:w2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385375, "uuid": "5f25b27b-68ef-48eb-a448-c5ec407f2438", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385375, "uuid": "2a99de99-9c17-4efd-80f6-4ce4bf931879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385375, "uuid": "1d78566a-8124-4055-84d4-b26ebb96dea5", "value": "14ec210591f8512fff1da3532ecf3be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b216db0-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload (Ladvix)", "timestamp": 1767381390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381390, "uuid": "f658d6af-aec0-46c1-9e15-4a0b9caaae62", "comment": "Malware payload (Ladvix)", "value": "45c7b3b9991719c02f13b2eb2bdd9608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381390, "uuid": "7d18e37c-76e7-45e2-931b-fa6b5523aabe", "comment": "Malware payload (Ladvix)", "value": "9ab3a648fba46ffb7ecae2eb66e319af7a6206b551ea1d265f609c8419fb5c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381390, "uuid": "f9d5b071-fbc8-4371-a655-705b1baca867", "comment": "Malware payload (Ladvix)", "value": "60b4de5d9ff6fe9095342670d79e3acd61cecbe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381390, "uuid": "76a0c42b-1098-4cbc-ad34-d5faec5aad97", "comment": "Malware payload (Ladvix)", "value": "e6a29ba2d919595f366d7af5eaa6a0d07e8cd7002284f54e0e384c8dced8a7a70a36baa9a00c2b007220f99894808209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381390, "uuid": "99847543-d942-418e-9606-6fd3498d25a9", "value": "T144845B69E1B330FCC65BD131472FDF226C75F4AA00226D3B42C8A57A1D51EA02719FBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381390, "uuid": "b45b62ff-5ccb-49b2-92eb-176990d3f102", "value": "6144:6ISMjvB9iqKQtW/cF/YTeIFnnzwk6FEudsRRHxjR+TkhVMhyNYqZ4bDUEwg:6JAvB9iGtQcFl6EDFRwN++Ywjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381390, "uuid": "694c6f0e-1b26-4c8c-b4f9-f981b487a5fe", "value": 397046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381390, "uuid": "7edc45d6-440b-4cfc-b905-ecb70ebb74d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381390, "uuid": "8378a954-e77f-4922-9281-35442a8312f6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c14d245-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381606, "uuid": "8b742291-8890-4298-bca7-be7e0ccecada", "comment": "Malware payload (Mirai)", "value": "9f1325f12c7815a8b0ec219ceb9082bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381606, "uuid": "08b6de6a-5065-447d-b783-c65941ca6383", "comment": "Malware payload (Mirai)", "value": "9b9479c41998a59cf193fbd3654c26973b2198464eb7069f6d83a5e9db590fd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381606, "uuid": "820be9d4-9b04-4806-91bf-d541c6d98ea2", "comment": "Malware payload (Mirai)", "value": "52d71adca28532629267978276dc1a2012dc1a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381606, "uuid": "78fb072f-cb4a-4a7b-9e4e-056cb2db63e2", "comment": "Malware payload (Mirai)", "value": "1a7aec0eb5506d1b9b3ae41b29e9a04c8b6eebb6d9410332d9393b990869e3da2751655803fc77e600ab36823ce36659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381606, "uuid": "20e975b5-c95d-451b-9a19-543708c294c6", "value": "T175735A2169392E27C4D0A53B22F74661B2F1574E39E88B1E3DB20F4EFF2098425975F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381606, "uuid": "5c1c2d76-a3f4-4864-8380-bb07571d68c2", "value": "768:CZFLoO7SVSiNzMV4YLcIsznwx3/obSmJbPLVGOKKFTO+75jkaDjT1tZcFBIM3:CPLrbczricIsznwx3/obxhPp753twh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381606, "uuid": "0c9e1ed3-abdb-4a02-92ee-3f021f2b7f3b", "value": 75508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381606, "uuid": "0fbfbd4d-e134-4dd2-b104-3fdc2b8c510e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381606, "uuid": "5efcd46e-f3d7-40a7-9cd6-932f717383ed", "value": "meerkat.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cc6af0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385869, "uuid": "b24cd58d-96f3-4dfc-b15a-aa11b90bdcac", "comment": "Malware payload (Adware.Neoreklami)", "value": "bce4a957731c7d42ed60de31583cd8fe", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385869, "uuid": "905ca0d2-de09-4274-b800-5de8220ac0c9", "comment": "Malware payload (Adware.Neoreklami)", "value": "9c1436a7b33da2fe1b2a8739067c19fc7eac4e1b6095525ceacf31ad8019c351", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385869, "uuid": "78bb423f-b2d6-48d6-95e3-e87e5e629f5f", "comment": "Malware payload (Adware.Neoreklami)", "value": "78bde15a5da15502f0626d9bd8e5da12e966da5f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385869, "uuid": "070fae47-3bef-45e6-9757-d1bb366ec25b", "comment": "Malware payload (Adware.Neoreklami)", "value": "c56b15148aeaf0be78384f1173426e3072dd6bbf3587776ddb3087a551942c10cbd5b2a5085a6f914ddbe3bb5223bae6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385869, "uuid": "167d7126-3c60-4cac-87fc-e76845b490e1", "value": "T17476337279E9C4B6C60A0433E4DE1EC2E8EC81590F244C83378647791AFE5AA537F796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385869, "uuid": "df2f4b14-ebf0-479b-bac7-0f42e677c22c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385869, "uuid": "923a22e8-8616-494d-844e-fa240decb2a8", "value": "196608:P1OJ6t4kY3x8cqFpHbcNfEeSFYUPvjLzFwKuV8lI:tOJ6t1MHib4fEeS9TLzF5+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385869, "uuid": "42ccbe3e-c212-43e5-acf6-65ddfc9397e8", "value": 7528461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385869, "uuid": "f95e4655-b9ab-4c43-b1ed-a8ac15a9eef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385869, "uuid": "c2c18e97-081e-47bb-bd04-56cf942e1966", "value": "bce4a957731c7d42ed60de31583cd8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6897ed29-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767380473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380473, "uuid": "c1152c35-f14b-4938-8d08-6cae8ea08984", "comment": "Malware payload", "value": "4093192b41d23bcd2b795e68ce591cc9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380473, "uuid": "ed4d32fa-0010-4bd1-87c7-281cb218ca3f", "comment": "Malware payload", "value": "9c2e1a084971f03e182ca54e09a4781db80a8158afe25ef0fdc4b2fde7ff5ad4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380473, "uuid": "97e587d8-819b-42b0-a239-14b4794aaeff", "comment": "Malware payload", "value": "25648272220b726ebf660b8663088426c68d542a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380473, "uuid": "1e62fe46-ee6c-4e44-b795-668dc7d1bb24", "comment": "Malware payload", "value": "a86169f6438312a55268fc5829eb788bddf2648357e7fada3032c9c984d4957d5e92519c573ddb72ddf6a87615f8d849", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380473, "uuid": "afa5345d-2c36-4e80-b6e1-36ba0802e2e6", "value": "T109B61241B3E9C857E5B14F30E8B469E33A37BC610528875F9987788E4D736868C31B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380473, "uuid": "3d228a3a-4244-43fe-a245-53a8e725bcf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380473, "uuid": "e9231303-068c-4940-96b5-76c7b9a995eb", "value": "24576:wwi9RnWDwaBNqsaFvJDXwN7bU0hBTUQ4L6mECZOhuCp0y2FQfEXZSF7GzwFf:JUQNCnANtBTUpLp1Oh1j+IF7/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380473, "uuid": "8d999e47-9406-4136-afdf-5c234d74cabd", "value": 10496040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380473, "uuid": "485d8d2f-6d77-46a7-b08b-6440d347529d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380473, "uuid": "c5476ad0-b26b-46b9-8cc1-d3f6b5d54758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894b89fa-e7a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767336719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336719, "uuid": "0791e11b-2047-4400-a3b2-4d2cd5f4ebe2", "comment": "Malware payload", "value": "e03ec630ef45743ab93801720bf1f1d8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336719, "uuid": "41b121a7-8c8f-474c-aba5-8e9ec170ee29", "comment": "Malware payload", "value": "9c3eaab04cc0989c3b8e330f5bf5cbd44f44e497bc93befe73f9b180ebb0c8d2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336719, "uuid": "393baf53-dd1f-4583-ab18-b328787ea371", "comment": "Malware payload", "value": "6388d44ea548251ded90de6d6b410b720df3c5e8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336719, "uuid": "d4dd9b55-9dc8-44da-adda-deaa8548fb49", "comment": "Malware payload", "value": "abebf253404515306254b497a31e13898d0d9c1f5e6055b63ea764b1e4634b51dd8d4b9ef3cbd0c8eabd2d87ef7b82a8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336719, "uuid": "a33952c3-8977-447d-a225-248dd478b4ea", "value": "T161E1C896ACF72408641B806DCBBEA25830659057474ACD9CFECCB6A8DF4D2A45722FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336719, "uuid": "3f45f14e-24cb-4435-8e23-4be970e2480a", "value": "192:OZ8gIE/CTK/e/l0llHYoHsfOBro2Tc/O3Smy:Ouu/vYoHsfO2/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336719, "uuid": "f66f70e0-6208-42a1-8abf-545c3a9c77c9", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336719, "uuid": "c77e5e61-f068-4e0d-a1f1-1e28447a07a4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336719, "uuid": "13f31c94-ec4c-480f-bfa9-08203cb9eea2", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08084370-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385895, "uuid": "235edca1-0ef5-4ce4-bcf2-012a773f8863", "comment": "Malware payload", "value": "c3f77554c8b216a610ac7525d6e20fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385895, "uuid": "cbd65c64-5b0b-4653-84b0-5dce60f2428e", "comment": "Malware payload", "value": "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385895, "uuid": "7438e0bb-6e0b-4641-8eaf-c74e567b714a", "comment": "Malware payload", "value": "22a2c4a8abc718cd8745dfac922def822d846de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385895, "uuid": "86639f7d-a391-4f22-8bc1-831dedc5b2a5", "comment": "Malware payload", "value": "ef78332b18a26d113048b6dd63d53071a063199307da8f58ef4bbf316b8e81b0b2b26e1918c54342b3bc91c4be3958bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385895, "uuid": "595aaf19-166a-4b94-80ff-e6f00fa0d856", "value": "T1340633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385895, "uuid": "b7f31f72-b826-4aaa-aea4-002157d18641", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385895, "uuid": "055e4267-c160-4013-be7e-d4a0f58c4940", "value": "98304:aYT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:v2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385895, "uuid": "9b500ff3-1768-442b-800f-1fb2409da43a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385895, "uuid": "9b9709e3-aa29-43d2-b753-7ef0c7b09832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385895, "uuid": "bf934ca2-5b8f-4a91-98ac-90ae7d74b303", "value": "c3f77554c8b216a610ac7525d6e20fb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76534550-e7b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767340982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340982, "uuid": "1bad68a0-6a55-4b75-8bba-6adc7840c2e0", "comment": "Malware payload (Mirai)", "value": "338920317b08691ef9f989bde7ba7eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340982, "uuid": "d2201140-d98f-4ba4-8d34-96a224b46eeb", "comment": "Malware payload (Mirai)", "value": "9d0150b16494f3d54a011214145d3567e2b3ff4f9e6382f61a74792390fcd46e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340982, "uuid": "07f0e262-656f-452a-af4d-8d5d918f68ac", "comment": "Malware payload (Mirai)", "value": "1825e53fa8e494a602ca546defe8cc17484df11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340982, "uuid": "7a7b2887-67e9-4904-9c2a-ef73ec774448", "comment": "Malware payload (Mirai)", "value": "7fa17073c286977b33aeeae6301cef408d60a2737fa58a9d9472385704243e3c625187c1b6c340cb87db09127a2f319a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340982, "uuid": "a41713ca-9891-4992-826c-25ef4146354d", "value": "T160D307327A701D1BC8CC533A51F78361FA727B6960A8871ABEA30E9D6F393847517760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340982, "uuid": "c342ab06-b470-4b7a-b68f-cc683b95a790", "value": "3072:EwoGGU5Yb12jL01RoBfIxOb1F3c6CSPI89OjN:kGGU5YYH01RoBf73cHSBOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340982, "uuid": "03e3e119-f07a-4737-93c2-68af25675691", "value": 132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340982, "uuid": "7ddd037d-ca26-4de7-ab6a-6d771b0cbea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340982, "uuid": "a34e1a86-7635-41de-8a0f-49880549c7c9", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c268cd95-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385348, "uuid": "fa41fe7d-0927-45ed-8e19-c29329d446bb", "comment": "Malware payload (GCleaner)", "value": "07bfc7007a953c9176fd50ff1b21b043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385348, "uuid": "d3da2849-4784-47dd-9b95-6e3337c0e3f3", "comment": "Malware payload (GCleaner)", "value": "9deb7afc4a198eb612588e55c3744d25e9f904ca6ae8a159b14499a1882ed9b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385348, "uuid": "fd197188-7a43-44b8-9232-00de4ad4e38a", "comment": "Malware payload (GCleaner)", "value": "0355018404be36dcd68998758f0d0f7474885071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385348, "uuid": "876b4e37-9e4a-4a81-b607-557c909bb3a2", "comment": "Malware payload (GCleaner)", "value": "931f2c296122950cbb02b0450b5e4390fc832b772d879db4372765d42852cfff26d3e06d88adb708889adfb52ec7fe42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385348, "uuid": "07c71019-6771-4fc1-9f0e-ee30fb602636", "value": "T18406D012E375DA61F12AA07F4F134DE8A820BD5DCD17C60EB969D73C38E7A0E1A8E145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385348, "uuid": "46898b58-2c2b-4c75-8eb5-d52cd7750280", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385348, "uuid": "76d17037-ead9-42aa-9711-1cc17a32f123", "value": "49152:knyrwPilLY96CLs3wpQm4IQ9HaOnSzPM/st14tq1THRNaLj:knCwPoLYYCs6c96OnSzk/Y14taTHnij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385348, "uuid": "a98b1e0a-a262-467d-a002-5fec0568b4df", "value": 3874064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385348, "uuid": "65b6f4e1-24c0-44cc-8e61-3104f3070a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385348, "uuid": "dd99515c-a14a-4689-8601-dc05b72bda34", "value": "07bfc7007a953c9176fd50ff1b21b043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141826ca-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385915, "uuid": "e8ac1a0d-eec6-445e-857c-bc3a8419df69", "comment": "Malware payload (GCleaner)", "value": "c9b01960f7c02e5ef9101e705598aeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385915, "uuid": "d1689ca6-4af7-4115-90ac-087b5ca8680d", "comment": "Malware payload (GCleaner)", "value": "9e1123417e035bb697687c7b80e947cd7a2fd6fb9f3204873bd23ae6d3cbda3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385915, "uuid": "414c9717-0ab3-44b7-b810-013c61590790", "comment": "Malware payload (GCleaner)", "value": "f00651f1030a646531636d279669e87899285987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385915, "uuid": "c9912d1d-4da6-40c2-b8dd-94220c042763", "comment": "Malware payload (GCleaner)", "value": "30dc07d0da0b024bc96cb8f371e2105f3c3506f8362694bf7bfb672e4f8d86734f07dbc4af81ff964694df2fd15ce784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385915, "uuid": "d36ae0a4-7335-49dc-8586-95eb5dfffe8d", "value": "T1DB46F111D9A0E8B1EA6DC03CE77E4D14C93F8797DD9E6FAB49781EC86A361C874181C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385915, "uuid": "b5fa99d0-f3c9-47b8-becf-21cda0a8f3b9", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385915, "uuid": "a1c7ad1f-9186-4919-917a-bb0b6099b018", "value": "98304:JrSWgvl+3DeXTey4B/m4mRueu9Vi14vToIQo:t+l+3DeX74B/mtu9VEyMI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385915, "uuid": "092c5250-eea7-4036-923b-f57f6a8fe9fc", "value": 5460240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385915, "uuid": "bc71977b-203f-4807-b0d9-ecf37a8c04d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385915, "uuid": "5fd1bf15-89b8-42a8-84b8-dcb3ef78cc66", "value": "c9b01960f7c02e5ef9101e705598aeea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b74af4f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385632, "uuid": "15417864-cc65-454c-9d3d-4d299eefd570", "comment": "Malware payload (GCleaner)", "value": "736e5f0b523b6ee1ee809eeec0777c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385632, "uuid": "60ad2cc4-5cd0-4386-be42-05cc44d2781b", "comment": "Malware payload (GCleaner)", "value": "9eaa406ec5b5abefb96a285724af519f7ee7c3241b75e67acee2eaa9b7a40daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385632, "uuid": "6d051bfd-997e-43f3-a64e-738740cfa1c9", "comment": "Malware payload (GCleaner)", "value": "fcba4810b362afe848acae07a13d9feb6f2045f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385632, "uuid": "1a4dda1b-3ce2-4458-960d-eed92d798f81", "comment": "Malware payload (GCleaner)", "value": "74686df4298550430c3dfd312e55b8a52cfb7d94ff74b4731024f057bb03ba5fc2abc7379ed2970f917bca63d26c7bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385632, "uuid": "5a6be7f7-3cff-4231-b9a8-6ea56c190c60", "value": "T14526DFA2D6E8E82FC039CFB369A63F7062953E28E418660157D738C6DE735C13A3915D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385632, "uuid": "0815953d-bba1-4ba8-bc19-3850c6ddbb76", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385632, "uuid": "23e5cb3b-43e7-4edc-93d5-9c87d53c8446", "value": "49152:IS/NdnNM3SMUc14GW4qP85T/fo3eodElqu/P9judHxR3bmBzKEjEbhlOwaosBbBq:IS/NFNAzUcCbMzfoG8K9j4mxBQqos0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385632, "uuid": "1ab99d5b-bbb2-462c-ae29-15464c2d7beb", "value": 4743440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385632, "uuid": "77d3dfe4-7bb5-4036-a9a3-c3b571ede7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385632, "uuid": "99e3099d-be33-4aec-903f-391788203b9f", "value": "736e5f0b523b6ee1ee809eeec0777c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d3e9db-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385332, "uuid": "f005bdb3-d168-4384-b4ee-6464c7ce10d1", "comment": "Malware payload (Adware.Neoreklami)", "value": "024421f3649cff036196a2431eadba1f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385332, "uuid": "c47abb4d-995f-49f5-971a-c6ef58edb49c", "comment": "Malware payload (Adware.Neoreklami)", "value": "9f08d9e191458fafec101ca3fc13a3b6eba632942a7cabfc7902009a7da834d4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385332, "uuid": "807895fd-6c98-49d7-853b-803710a3fa4c", "comment": "Malware payload (Adware.Neoreklami)", "value": "e90f1949957a521c405166ec85b1d11fe1df6dc1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385332, "uuid": "c210de1a-84cc-4470-9bfc-f04d40bf1c3d", "comment": "Malware payload (Adware.Neoreklami)", "value": "ff9ff3789c6a9e2ecee553b109aa1b47a381a2590ec3fff90ee7d030d35d3845ddbd106360dea91c584778e5b49f8215", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385332, "uuid": "258573f5-89a6-455b-ac53-579eade388b4", "value": "T1FE7633253DE6C8F9C08222B113F6BF9DD698DA351D3DCCD77BC809A5682C4C48526B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385332, "uuid": "accc22d2-16b7-40e6-a0ab-e44c84291209", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385332, "uuid": "b505adc6-9763-4b44-87c5-167ec8454de7", "value": "196608:P1O1RWPO0LiML5wx/uqBJcGNv4UGs67CT+g9+s55u:tO1APO0LiMSx/ukJcwus6+P9+sbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385332, "uuid": "3f2c2703-5069-47b9-8497-0c6fd60cd649", "value": 7608295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385332, "uuid": "fa10f8f7-9924-45b0-81b4-e29ffb79d349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385332, "uuid": "5b2b0d93-18c5-4475-9931-85fc5f5a8638", "value": "024421f3649cff036196a2431eadba1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b097beff-e811-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767382312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382312, "uuid": "46a975ea-9822-4e4f-8d24-e26827e2f94d", "comment": "Malware payload", "value": "873167caf2bea40dfa6db889cdf95a6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382312, "uuid": "cf84e862-0396-4879-821e-f0e1a102a31b", "comment": "Malware payload", "value": "9f0b1eeb5dfb93ef6b2c9b0c9ed38623e3ad688fe83f65c9c501c542d9965776", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382312, "uuid": "0b20acd1-1b78-4b4b-83f2-a7b03482147a", "comment": "Malware payload", "value": "b5d9e127c120c609c9ef7938057a2b57ec812dfe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382312, "uuid": "b6a46cb5-f719-4191-b34f-b2e6f3021176", "comment": "Malware payload", "value": "4a9c598ce5b66fca07b3bab090d1f4d416f95ae02184adbd56447b480540ace877b6e3538027b86eace70aa173247d2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382312, "uuid": "4adf49c7-c0ab-4233-9fa2-52ee0e870cc4", "value": "T10AD0C2CD795422C56844AF80E0BAB50CA05183C9D0A04B0DD448263A94A8C047421E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382312, "uuid": "709b45a3-9523-482f-b5b0-b5b1a34fdf89", "value": "6:LQVhQ5vGPLtKIsJqQARF7LtKIQiQARF7LtKIQtFa0LKiqMQARF7LtKIQkISqe:yovK1sJZA51sA51+c0LKPA51QjSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382312, "uuid": "867eeb24-3901-4389-9b1b-d22874a721d4", "value": 280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382312, "uuid": "b78132b5-d098-4b95-a0a8-b894d6331bb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382312, "uuid": "94814989-020d-498d-90fd-a2dbe4ec20e1", "value": "nigga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d4f819-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386045, "uuid": "53961b24-88d5-4138-96a3-8cdeca6a7aa1", "comment": "Malware payload (GCleaner)", "value": "f6223c2dc8711f8c3f384cf2814d2c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386045, "uuid": "0254a8ca-5ed6-4974-8f4b-a0f885dbd831", "comment": "Malware payload (GCleaner)", "value": "9f77f54ccacd0f90964c828c71fad788275eeb8d2b1e170d2c19d19d38aae46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386045, "uuid": "7161c40f-e027-43a7-98c2-41756d80fba5", "comment": "Malware payload (GCleaner)", "value": "a70171444452c89eda69f6fed02d6049eafd52a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386045, "uuid": "0e3609ba-1e19-4f51-9952-610e254367f5", "comment": "Malware payload (GCleaner)", "value": "3ea2663cbe5e3b73a72fc0a77639247f1d0c18923a5d7bbf95c7f94c98dc0373231a553e66d5b29fcdc9ff272551b6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386045, "uuid": "9eb6417f-82e6-4793-8916-19e4d8b5626e", "value": "T17B46DF9BD2538636F03F11FDBC09B58A1F2FEE1BD0145CA1A796AD08FD1986924C0E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386045, "uuid": "061d99c3-1bd6-4fc6-8398-95a24335d5ac", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386045, "uuid": "6ff9dc6b-67fc-4118-969d-49051506a1ba", "value": "98304:gC1N8ZutR5zM6FxFetytXj69hv1m3sZTOdVU:ggpM69tXj69htm8pOd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386045, "uuid": "6ec8b1db-c932-45dd-966e-2715eaf1dc59", "value": 5629200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386045, "uuid": "208dc842-39ac-4fcf-983c-759911f79192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386045, "uuid": "7efe3b7f-362a-4aa5-a945-43b17b2bdb24", "value": "f6223c2dc8711f8c3f384cf2814d2c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a459964c-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381862, "uuid": "c5e78805-71dc-49d9-bdf0-ded2eb2c7315", "comment": "Malware payload (Mirai)", "value": "a706e5de45a1373d4ef2f9b66f044e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381862, "uuid": "63424286-203a-4f5d-817e-f7e3ee176e1a", "comment": "Malware payload (Mirai)", "value": "a02e85dc213544cf7bc081626a2f026e28808edcbfa70e644b212225e6067b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381862, "uuid": "d376832d-0b94-498b-aba5-9b8adf36d71f", "comment": "Malware payload (Mirai)", "value": "9346b65f37798030a72e8ebafb9c8da7240cca65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381862, "uuid": "257d1eeb-5bae-415a-82d8-7aea2e8ce604", "comment": "Malware payload (Mirai)", "value": "cf10d18fdcc836090bd9937b638b2959f581af14783c0353863e4902cf35e20ee5511b30a3c0774e644e6c8fbcc43ff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381862, "uuid": "a9db2fc1-70b2-4252-aca3-4c85b447dd3c", "value": "T119432950F957C1F0E44305B0016FFBAF9B36BAA60236D5ABEB943932BCB17920C5695C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381862, "uuid": "e5f7df49-73f8-4da0-b376-3434905599c1", "value": "768:y4TE+5JYKFl0Ogw+RINPKIvoAfSeYtKXD+cJXImo9D3Zma+Gi3VznYPk3gmzPRZZ:yOB5EeY8z+WImoBJmuidg+RZaho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381862, "uuid": "c27c8db6-de25-4a1b-ad0e-9f6291606095", "value": 58364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381862, "uuid": "8d073681-dabd-423a-9c7f-d615161eff7e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381862, "uuid": "574417c7-cd11-4c3b-8fc7-4a532630e253", "value": "colomai486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662c9015-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386052, "uuid": "ffc2b62f-8a11-479c-971c-c80eb5301d94", "comment": "Malware payload (Adware.Neoreklami)", "value": "f9a525113879180ce186e69c704da9d6", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386052, "uuid": "30e13662-2569-48c3-b9ec-f2e20dc709ec", "comment": "Malware payload (Adware.Neoreklami)", "value": "a0e7608800181f09b38f929adf15e11130af3ee73372503c9024eb56876f4694", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386052, "uuid": "e96cb9c9-96ff-4da1-8e2e-e54241c42063", "comment": "Malware payload (Adware.Neoreklami)", "value": "e137dc5e364c2ea8625406fd0222a68a4da63884", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386052, "uuid": "75fe9f6b-0a37-4f6a-a65d-c6e53a3afb60", "comment": "Malware payload (Adware.Neoreklami)", "value": "cb11e7b8ac101cbd03ff67354b5dc00b9f47c756e27ebc6a331f91156bb0de1c518f35cf46af766007db98cebc6350f7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386052, "uuid": "81de346c-116e-48f9-83da-7d6bb6724b1c", "value": "T1D276334530E7C67BE071C43287B8AFDFA3F5CA844B629C5B1792663C3E7EE518221990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386052, "uuid": "488dbf6d-e5ba-4707-8513-6ed23c1fb471", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386052, "uuid": "3ab80845-8560-489f-abb9-005667a4fce3", "value": "196608:P1OvPLRCMeRviTDw+7W2qHUQDHffAAIDVBhYznco:tOXLYMQ6TDXK2qHUQDXATVBhYznN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386052, "uuid": "ffd1d346-6a49-4376-a7d5-59b65b2ad5af", "value": 7538783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386052, "uuid": "930b7404-a69f-40e1-8f1a-0f6397ea9b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386052, "uuid": "feea4abf-85d5-40fd-b635-a1c8c238dacf", "value": "f9a525113879180ce186e69c704da9d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15369c03-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385917, "uuid": "e96f4396-00f0-42ab-95fd-6255ae1cc157", "comment": "Malware payload (Adware.Neoreklami)", "value": "ca46acec09c8ac63961957ab2018aba4", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385917, "uuid": "ff96877d-4452-4ed5-9cee-43f0d007b9bc", "comment": "Malware payload (Adware.Neoreklami)", "value": "a16cd0d3d329dd730643b89a1c3509c72e2976d40581ee7fb98b94123c1fa39a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385917, "uuid": "1f4e35cf-7094-434c-ad79-62002b1078b5", "comment": "Malware payload (Adware.Neoreklami)", "value": "ce8cff2f3e76aa206cc4ba8e5eae3a48e7727c83", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385917, "uuid": "fb6a9ceb-b3fc-422f-8b45-1a01642693c4", "comment": "Malware payload (Adware.Neoreklami)", "value": "dfa13d5c4be84f5b374c8a00f2517f6bb70878b2488e2980ec14bbd597d0aa2363e1f82dd3d03632d54a1c46d4569795", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385917, "uuid": "c055618f-0d36-49a4-8ffb-87b242b852d6", "value": "T1C97633D372D780F4C6A64172D576DF6261DBCA00163A14CB26AC180C4FBB2E64F77ADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385917, "uuid": "325630fd-ea2a-45fd-b335-1765ffc97650", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385917, "uuid": "a7797cca-984b-4d0d-b960-a73dcc82a80f", "value": "196608:P1OfalxKbR7pgaXMgZg9hwurkZZz6yrbJnxp:tOfOKbMALcWDztJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385917, "uuid": "4c3e5c91-1619-4b02-8887-590a84cf1e11", "value": 7513223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385917, "uuid": "5d46ebc6-017b-45aa-9e91-b51bdb3ec10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385917, "uuid": "cd70f0e6-e2a2-4de1-9de3-0ff489cddfaa", "value": "ca46acec09c8ac63961957ab2018aba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b83cbdd-e774-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314684, "uuid": "ee4ba408-3747-41c7-99c4-4e873ec3d5ef", "comment": "Malware payload (Mirai)", "value": "9dec264c17f1c55d47c6f8c9defe6895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314684, "uuid": "da2ec8cc-9797-48fa-88c9-39d633200b10", "comment": "Malware payload (Mirai)", "value": "a21448eebaef7099666c8cd8ee12f9327ef1b9e7addeaeed2eab9e7b922f2bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314684, "uuid": "b5794336-ca1d-4bd3-b4ee-9094354fa8e8", "comment": "Malware payload (Mirai)", "value": "7a72fb85523d3660c7ada942a8509174b3b65392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314684, "uuid": "b09bca3e-f262-4b6d-ad61-c14ec8fbddf8", "comment": "Malware payload (Mirai)", "value": "1ce42f0d331aa5b818c2ff0e1338739e77d6d0c8041ab1c1ce1f1bad9b4db7c4e26bd4d1d363cdeaad338234afba7672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314684, "uuid": "d44df8a4-c870-4b60-a9d6-c18b7497c327", "value": "T11D7312CA32E29811F4296774CD8F0178D322BA5DA96E5CD179283DE42E930967C3993F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314684, "uuid": "a3dc809a-0dc5-4328-a156-74c7493e31ee", "value": "1536:nEpxhOCAeIIdwGiVE+oWBQqkBAuPTu0z9w/bnzwZ6cYgSrh:4A3IdwGnCQPAuLDxwTtgAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314684, "uuid": "7f7708fc-0f37-42bf-99fb-6ce54ccd19ba", "value": 74992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314684, "uuid": "7115a3b0-fe87-4b2b-8ec7-e1ab86ca1450", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314684, "uuid": "c7e9d3a2-9768-425d-a6fa-d48d9d79cc7b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a943c6b-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385684, "uuid": "2295f88a-fe64-4f78-9d01-12dec8c25246", "comment": "Malware payload", "value": "8520723cbeabe08ae19186476c0919cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385684, "uuid": "ccbc0a4e-f3c6-47ad-8bb1-53307f3cffb7", "comment": "Malware payload", "value": "a305aaf3b1a9a1ffaccb04459bf5c6769db30edf192a6f2eac9d118712e7a92b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385684, "uuid": "401d5624-83d0-4553-81bf-430e62634f39", "comment": "Malware payload", "value": "76929c8f45d04a2a31c8e3c256f4fa7a66367e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385684, "uuid": "88a7dd7c-48f1-4240-af3f-f9bffe7521a0", "comment": "Malware payload", "value": "7163ca7d0efca9e281264279b5750ab1b277ee5d938243cbd2f5e14c9e20b7742855293289631f1a027a18b667712415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385684, "uuid": "6b389893-2cd9-471b-af98-73e52697dbd3", "value": "T1FA0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385684, "uuid": "80433c9c-e439-4e37-aca7-1d3775a809f2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385684, "uuid": "5197a68e-7b46-4141-8e8b-58fa1263afe9", "value": "98304:aBT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:y2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385684, "uuid": "6d58e9ff-2062-460e-9ee9-d36ce450ad2b", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385684, "uuid": "c25b2069-a963-4a57-81c0-e0a67d2188c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385684, "uuid": "40948959-d267-46cd-bb65-570545620ebb", "value": "8520723cbeabe08ae19186476c0919cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa33501-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334341, "uuid": "a955df65-be5d-4a81-8539-621da740fd62", "comment": "Malware payload (Mirai)", "value": "bf3e2002f9aa0d1cd2397d9cc86ad5b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334341, "uuid": "b13ca0eb-0a83-48f2-8eeb-09df8f9411f8", "comment": "Malware payload (Mirai)", "value": "a3a826097222de356cb2030f1eb1d2b032399db8e66842b4bf3fb0cfc2607942", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334341, "uuid": "788c6bd3-cb36-44d8-a626-736f9d8c950f", "comment": "Malware payload (Mirai)", "value": "c2a4802f17932aee68e5c24edc977517e49933de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334341, "uuid": "69af0faf-a430-4a7a-a352-682ff80e7eb4", "comment": "Malware payload (Mirai)", "value": "ea505086365bb2acc648ac4e820f03afcf1fe3040975927f4a1bf5c550f938b8f0b7f3579743f3dfc75cd8d808909223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334341, "uuid": "25d24702-e8a6-4fc1-88cf-ea276cd24164", "value": "T167144B02771C0907D2A22EF4363F27E183EFD9A125F4FA45694F968A8271E33554AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334341, "uuid": "aaf6f52d-b69e-42e4-806d-fbc65c13056c", "value": "1536:w+FGQeQBfV9OFy9kRwXbZSXc2tTUkgfRot1xq1Rm6xoTWwrWcc4AFHsAOPEtvA01:wRQVDkRwLZSTtf1xC1S7KcGFQEq0ZkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334341, "uuid": "906952b4-a7ba-4e2e-aa46-a57dc83958a4", "value": 191744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334341, "uuid": "454a4ef4-567a-4746-84f9-e32541fb366a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334341, "uuid": "c7c8dfcd-6076-49ef-a5c5-0515926d1ccc", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb19d0dd-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385846, "uuid": "611a7d31-048f-4d09-a819-445dc125b9d1", "comment": "Malware payload", "value": "b2ccebce1b76531628f52d16e5b44440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385846, "uuid": "e20f931a-811f-4c10-8eb3-22e9cfdea2b9", "comment": "Malware payload", "value": "a3edd2e4a899f7a69d38cce33f741821ccf75f4c830310830ecc6c3c9aeccecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385846, "uuid": "988951f2-5a08-4a98-a97d-b7be46ce20b2", "comment": "Malware payload", "value": "444eccd839ccc276c5894c457e2aea87116ad395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385846, "uuid": "f1798859-398e-4c25-ba16-2b18392b313e", "comment": "Malware payload", "value": "4ed0128caac708b31fa48ab7dd7c9e1c85ff63b0e3fe07122e351bc5bc36e2c81ea8ef9859068907dcbb163d4864259e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385846, "uuid": "8744aec0-72b4-4b7d-947e-cc65c759ef1c", "value": "T1390633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385846, "uuid": "aacfff1b-91de-43a1-8cef-1150729a1d94", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385846, "uuid": "d81784ea-f7a2-4e3a-84cd-46512bff3d16", "value": "98304:aaT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:l2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385846, "uuid": "e18cec12-04e2-49f6-91e9-5877f6b151eb", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385846, "uuid": "da2f5677-c010-4d31-852e-05ae26eedbc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385846, "uuid": "1aea2606-1f83-4fdd-827e-5e73f508b914", "value": "b2ccebce1b76531628f52d16e5b44440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76ea478-e77a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317523, "uuid": "d1943b5d-0d48-40f2-81ef-80400c3549db", "comment": "Malware payload (Mirai)", "value": "48d4913c8c21ab3cb70bdb117e9da390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317523, "uuid": "9c92340c-fa59-43b8-adba-983b1b9e7dec", "comment": "Malware payload (Mirai)", "value": "a42f881831afa3b1e916db3c2423c70916d5d3b7ed7c004d6fd527d2febccfb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317523, "uuid": "b86570fb-1c3f-4ead-9344-2649232a0e81", "comment": "Malware payload (Mirai)", "value": "c511e78733d14c8b320111703e7a1dd1c2f82bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317523, "uuid": "d197c357-87cf-4872-a68e-65fd47d61ddc", "comment": "Malware payload (Mirai)", "value": "e00b322bd2b14ac0c9060a1ea6844aa3afe06cc7b64dfd644c2e30f3c9561183fccfdaa5b8e28b3345778fb791f262bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317523, "uuid": "04b518b9-20ef-470d-a730-7754e8b03935", "value": "T17AB312B45F11F65E61022EDA3E932B93A108E39F6590EE66182EF71235CF386D0D099D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317523, "uuid": "3bc5c8bb-d002-42c6-b1f0-2cc09db0a0f2", "value": "3072:FquUu9F5Bj1bON9IqQpbSXzpIUChxQu9a+QK:Fqu7FxiNaqjXzqQVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317523, "uuid": "2215b223-672e-4805-8183-7aeb7e87062d", "value": 117208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317523, "uuid": "c70b54c5-5676-4548-8c5a-52dd1e668179", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317523, "uuid": "d99ecb80-441d-454c-bd3a-2ebd75774f81", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760e8f8d-e7e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767362457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362457, "uuid": "a239eaec-ed43-4667-a94a-a361ef3e6b6d", "comment": "Malware payload", "value": "e5b219a45076f795ba0032c1c9597aa6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362457, "uuid": "07b7de06-39fc-47d1-ac92-158d498620c5", "comment": "Malware payload", "value": "a498cdd37380d37071ffb4bfe304666aeed3948ed735a2e71de1dca2e7e16375", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362457, "uuid": "1484129b-17fe-4e30-861d-66215da7ce33", "comment": "Malware payload", "value": "815ca3478462b28823a66c95fc22fb67bf6bcef8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362457, "uuid": "bdeb6795-5fe0-4216-9c73-65c941bfbb2e", "comment": "Malware payload", "value": "437365d266f28690a56405547ec887ddd40191fb34a34af31b44cfbc626a1bb9b11a427f0ff745e39ef6180c585f2b0f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362457, "uuid": "e98f9746-70a2-42a7-b7c0-7cd9882b5d42", "value": "T13795123197DD0121E9B71E3952F85EB10D3D7D324BA95A8B27823E2C2F30562CA29777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362457, "uuid": "7ca0dd30-9102-42d7-9780-361557ad6ce1", "value": "7899cb8ba886a0690bdc28d8b481bbd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362457, "uuid": "63272e34-b6d6-4fbd-8e66-78554322d65d", "value": "49152:c7iGe3EEJssZPPbWglP/KCKacj36Kn/xCJNsLcr7MI:Ii8E6s9plP/Yacj36Ucs0AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767362457, "uuid": "55a10eea-b9cc-45a3-b836-677628d4be77", "value": 2010128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767362457, "uuid": "598fef99-da89-4985-b60b-8bf5e2f83668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362457, "uuid": "a86b7470-ad88-44da-8196-e99b49063d5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99851a4-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385736, "uuid": "ec9a6fa6-bca4-4ded-a6f5-7e905e08520f", "comment": "Malware payload", "value": "945e3a40b84a2f382e6120f37eaca38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385736, "uuid": "303f8714-918c-472a-a099-96832ab959e2", "comment": "Malware payload", "value": "a56d7723c323d50b78a253245be3d4827666883384a9ec0b834f0a4b2e68b604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385736, "uuid": "dd11ea73-a121-43d3-b151-2eeea98afe1e", "comment": "Malware payload", "value": "e9671d6501b5ca4170528672da4d722aa6e3603e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385736, "uuid": "b754b095-73c2-4d44-b193-7dd54acc31e4", "comment": "Malware payload", "value": "6b9114b438cb0583e72f25b0753254e993be0228f77522d0f2ef507181c521d7bda8dc698b0a1e2daa2f3cac337f7c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385736, "uuid": "6221f9c5-24de-45ec-b052-c4fc52724cdb", "value": "T1EA0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385736, "uuid": "3e9825c7-027e-4298-82df-685b681ad910", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385736, "uuid": "afc7c1cd-4451-4d2a-a182-f700d04d8e67", "value": "98304:a/T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:o2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385736, "uuid": "cd9a66cc-cb3b-469e-9cf9-91bc24564d15", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385736, "uuid": "a6c2ec1b-8dc5-4154-a719-d52c26289c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385736, "uuid": "a2e88102-837c-422c-8895-7b8a4311d4be", "value": "945e3a40b84a2f382e6120f37eaca38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd40c35-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313074, "uuid": "0a4b300c-57ee-4552-bdc6-0c7026291467", "comment": "Malware payload (Mirai)", "value": "f6a87c8d731691fce1ede65d7d98f430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313074, "uuid": "a73ececf-b792-45e6-9936-fb34fb344b79", "comment": "Malware payload (Mirai)", "value": "a570c17d36ff0e054d57606d8d83c6028f338c1a984c0e09a28769eb1bdd7594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313074, "uuid": "db0f422b-22c5-4c5a-809e-75eb8b32489a", "comment": "Malware payload (Mirai)", "value": "122d08ba8d02eb90da54cf99db83fee460747270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313074, "uuid": "6a54f471-266b-4ce1-85f0-5f8b887a09e0", "comment": "Malware payload (Mirai)", "value": "4cedb33d4acaaea521cfbb4f0f4112dd5e0854bdc8b7ce2e94fa39fcafe4577fb4131e10658d7f813fff4603e786693d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313074, "uuid": "2fa36b25-6865-4f1b-adf3-87274d3ec578", "value": "T1C8534A217A796D1BC4C8B87E21F78238B1B1174A32B8CB2A7E720E5EFF1055461179F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313074, "uuid": "aece1cda-2652-44de-a533-3479cc71113d", "value": "1536:HpcSTDaKFCQhk2il6Djv3uad9+6/BlXe8chG:JZtoQ2OTfXe8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313074, "uuid": "844653fa-aa8f-42f0-af95-cbf02d4260a2", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313074, "uuid": "24bb2635-c5f6-4226-88f5-ba07700d0ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313074, "uuid": "02d77556-0c06-4d50-9e29-972273d31f9c", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bf673c-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338087, "uuid": "443eb552-6458-4ba9-8397-97fd0f21d9ea", "comment": "Malware payload (Mirai)", "value": "ccb767e72646b365bc0ed3b9c6e2a1c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338087, "uuid": "27fbc475-ae9d-4bf6-9202-d3cb307c9fa8", "comment": "Malware payload (Mirai)", "value": "a579baab4641a72699bc2926bd5a527fba6c66996bd9a48ae7cdd87a5484fcc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338087, "uuid": "240fb1db-438f-4274-ab78-91269fa58939", "comment": "Malware payload (Mirai)", "value": "a696f23bb6de4ba460651e0838a61d6790f6f994", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338087, "uuid": "8bb27d9c-a9e7-466c-9acb-7710b5d91b18", "comment": "Malware payload (Mirai)", "value": "868112b31482fb7058128f4910a9642afb172b469bca300662bb2b78bd30a43dcaf0094cb15ee6238513a0d97b18fa69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338087, "uuid": "b400de8f-0b69-4170-b0cd-eb30e1a304cf", "value": "T19CB423E5A8765339DE38BB7B390961979CD00DB7FE8E80278E6DB9334F652038C48651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338087, "uuid": "d68ed4bc-9784-4a9a-a046-8142c55b54a3", "value": "12288:2hw6o+xMreLUnzQSVHg79wIk2+xTGvM3VAIKH:/6xEnzQ+g7mIXGGvM3VjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338087, "uuid": "96b057e9-615e-41a5-b0c5-5b469eaac138", "value": 532240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338087, "uuid": "ef44a6ca-e020-4637-8719-fb779fd96523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338087, "uuid": "e90eb000-2648-4ec3-b466-4ff837a1a50e", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65815b51-e773-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314325, "uuid": "551f67c8-f416-4011-a9d4-b21a39eee578", "comment": "Malware payload (Mirai)", "value": "0f138132dd231327c4c34ebf952c8375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314325, "uuid": "41ffbe3a-5f59-4820-bda0-22f8e3d72321", "comment": "Malware payload (Mirai)", "value": "a706cc528d6674a78bd4314e0668e8d9fab25843c48fbf0c70137743d11fe0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314325, "uuid": "b893a20a-a306-474a-bf5f-b327b3c3b4ae", "comment": "Malware payload (Mirai)", "value": "55e6f9983a96dbe8d65f72d91c4e2ffd0f31330f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314325, "uuid": "5a6bec47-811d-4629-8465-bc7dcaa8775d", "comment": "Malware payload (Mirai)", "value": "e27c76581124851ad08ff58dfbf9de7f8cfd244f62b6211a4edea529d80ac794a4619f7effe5aa117e71cf96c7587312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314325, "uuid": "97539215-d537-418e-9909-3a15caa0b703", "value": "T18E73E986B8918A56C6D512BBFE2E118D33235778E3DF73139D105F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314325, "uuid": "036ccfbe-a938-4c87-9bb7-00acd8c35887", "value": "1536:aRnxaf8a/aUoqweM+bAqKIvosmaHwea7We8W7zQ9L38Mtiz4AAWhHu+7R:Jf7/geM+bpK0oVaHwea6e8Wh4AAWhHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314325, "uuid": "eb93b320-ebae-45a6-adaf-b0f9df61befb", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314325, "uuid": "40c5a858-94aa-4c1f-9730-b70174b3007d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314325, "uuid": "38634a0b-3bf1-48f3-a26c-e97663f3a008", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606071c7-e7d7-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1767357266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767357266, "uuid": "43899e43-4273-49a9-a503-c9e7a2ed1c0b", "comment": "Malware payload (OffLoader)", "value": "ac66074cfda99642db6964e5f38598a7", "object_relation": "md5", "Tag": [ { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "StealerC", "colour": "#68E4F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767357266, "uuid": "be926287-14da-4025-9b95-fef6de59fee7", "comment": "Malware payload (OffLoader)", "value": "a734adc41b09e5bbd8488e86b7402f32d9b2bc618c25a2c55d2c8b80a542b66a", "object_relation": "sha256", "Tag": [ { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "StealerC", "colour": "#68E4F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767357266, "uuid": "ca976185-a90b-43ff-8090-cb2e3357fc7e", "comment": "Malware payload (OffLoader)", "value": "d4b830937ebe034e33919424d0b958974ac85795", "object_relation": "sha1", "Tag": [ { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "StealerC", "colour": "#68E4F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767357266, "uuid": "1b6d8502-a35a-42bd-b00d-c618489644a4", "comment": "Malware payload (OffLoader)", "value": "91180fe50ecd744609df2d06ffb764389f07f9a353fdc2385bccf134c5757507a6eab603e8299f38a34ac4b56d32d183", "object_relation": "sha3-384", "Tag": [ { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "StealerC", "colour": "#68E4F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767357266, "uuid": "8e14d6f8-dac0-4701-9b06-c7c6e6a8111f", "value": "T1BF160233B24A673EE06E4A375AB2D2105D3B7A61A41F8C569AF40C4CCF2E1601E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767357266, "uuid": "c110a559-af19-42d8-8364-2d517c2eea1e", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767357266, "uuid": "c2c9d8ae-2adf-418c-9dcc-0aa1b4d746ee", "value": "98304:MN66huSRWQs83lK3aFxnaZ63NdIoAYdHIgJIH:o4BQs6iYxnaeNVAQjIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767357266, "uuid": "691e765a-4abd-43fd-9665-76ea6f912e00", "value": 4112560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767357266, "uuid": "3db65cc5-7510-449d-96b7-1f34c5c8eb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767357266, "uuid": "7b558b3b-7e37-4b57-b715-a777edc0cd26", "value": "Team-oriented_5.3.47.98_INSTALL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10f2eab-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385802, "uuid": "46588792-044b-48e6-852a-fd5507c3af91", "comment": "Malware payload (Adware.Neoreklami)", "value": "a25e77b2c1c93f6da8b3aef9966c6cf0", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385802, "uuid": "672ea0e4-4466-4635-aed3-1574755d1c75", "comment": "Malware payload (Adware.Neoreklami)", "value": "a768cc37d6084bf0adc7c5ef25b078846cbfef52bcf180daf722d39099d3c8f0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385802, "uuid": "0735bc5a-7817-45f6-a394-de0c89800960", "comment": "Malware payload (Adware.Neoreklami)", "value": "7d44b3d87d3ad5b6c489fbabfe61da7966c1d837", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385802, "uuid": "bb55ed6d-48d0-4897-8520-1d412f9270b5", "comment": "Malware payload (Adware.Neoreklami)", "value": "898e3761dd771b1fd0a2539e7e6dc95c8cb5ae07b317a8cc2ed6bb601d7422a335fc2946500839e5ef4209b373a1bb85", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385802, "uuid": "6b2ff0db-db71-405f-b24d-5d85871335f5", "value": "T1567633007FDCC8F6C99007B588297799267EE8741D1007AB72D601EE3DAC64D96BA63B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385802, "uuid": "a85cd696-beb3-4c76-ba7c-7a524daf42c9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385802, "uuid": "7cd831e3-11d4-4268-be53-df7750f53fdb", "value": "196608:P1O8nA9v7jDP2QGGwO0QNFPZqREc1GsGT+sP2Y:tO8nA9XDOrMFuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385802, "uuid": "0c66f247-2e3a-4dc8-93b8-eda099c6e34f", "value": 7590887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385802, "uuid": "4028cd7c-94e0-4bcb-b801-de3b715afd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385802, "uuid": "e4a8f61a-fd82-4272-b700-ec1a991f2096", "value": "a25e77b2c1c93f6da8b3aef9966c6cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d679a3-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317061, "uuid": "52906116-11b7-48cc-a944-a22f8301b442", "comment": "Malware payload (Mirai)", "value": "1226d6d9c5ca5bcf20959fa41eef79ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317061, "uuid": "a021dba8-113e-414c-9691-2897990dba21", "comment": "Malware payload (Mirai)", "value": "a79f08f494b5e4617fd158c0a8d23c64cc5c72b3b3e7b2bea36a93af8e364631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317061, "uuid": "511130e8-8da0-405b-b961-b713626f231c", "comment": "Malware payload (Mirai)", "value": "44ef7f75e970a72c2861e876a79d240f4ecb20b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317061, "uuid": "e25e9c4c-f74a-4463-bbb0-511ca15bef11", "comment": "Malware payload (Mirai)", "value": "fe97d6baa3fdb3b2bc3e2d3bf5d88a3e53e13572831cb5b24c29c02d5290b67a7095d924ea17cb9b2800fe8b2edfe5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317061, "uuid": "75cb92a2-1289-4ac4-ad92-62fbe797f65c", "value": "T109144B02771C0907E1562EF42A3F27E183EFD9A125F4FA44695F9B8A4271E33158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317061, "uuid": "78d8795b-38e7-4ae8-af7f-2071661075ce", "value": "3072:fAdqPCONfNZSBeoxyg8gclFaBL9XWnNS3:4IPCO/9oxyg8gcl0BLFWNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317061, "uuid": "a3cfff3c-be5b-4768-b8f1-7e975a4fb831", "value": 193056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317061, "uuid": "15900a8f-a52f-4c47-a9ad-497ae1d86eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317061, "uuid": "ed121993-f661-4092-9978-70485e3dafa1", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a55551e-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385979, "uuid": "f65b4d74-edbc-4fe0-a84e-4fc0aca77601", "comment": "Malware payload (Adware.Neoreklami)", "value": "de35c7c478ef7b7738827b6850c01a73", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385979, "uuid": "c4847c37-598b-4eb3-9703-a2cd1ae0023d", "comment": "Malware payload (Adware.Neoreklami)", "value": "a7be4b960abbb4af1ea7b419e502ef11dda9c3825ad73cf1a61f526ba3c1ea1e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385979, "uuid": "78d9eaf7-c2a0-4de0-9c64-79203f559143", "comment": "Malware payload (Adware.Neoreklami)", "value": "e1cf9e4d57bc581bfcfa58c173d4dd67716d4764", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385979, "uuid": "3875fc7a-e658-4074-92a9-b1bd9ef51414", "comment": "Malware payload (Adware.Neoreklami)", "value": "2df9f19e258d49af03dd47a51acf19eedd3adbcb748a2f8ad615e90f62dc8006f44ad4d47651cc46e9035c488a8f94db", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385979, "uuid": "f5304a29-0901-47e6-840f-d665915bd276", "value": "T144763352FED8C8BDD742297469110FC1E032DB792B2B9B1363220B465BBCBA6F177494", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385979, "uuid": "02985683-b678-402b-a135-dc98686b5304", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385979, "uuid": "4776cd02-d94f-4f25-984a-69d589e26b8b", "value": "196608:P1OGNS0Ew0059CC2fgIWCNFpsWnPkgBxhqR4j:tOzwHPIfgBCNFZxhq+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385979, "uuid": "381c7b3d-0e14-4908-8c88-94c4b513dfac", "value": 7591429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385979, "uuid": "0f8a8ade-36c0-4ef0-a1b3-22d0f4a0e170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385979, "uuid": "734f4205-70e3-4035-9462-f01ab1fa330c", "value": "de35c7c478ef7b7738827b6850c01a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806b70c7-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767335416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335416, "uuid": "0d966b7d-1625-42be-ada1-838525cf8d7b", "comment": "Malware payload", "value": "4607e325942a0aad5ee0ff929df2c2f2", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335416, "uuid": "50a07e7e-45e3-482e-90b8-4ee4ef6dc6f9", "comment": "Malware payload", "value": "a892411b200d2bc9848d1c2cf44f9cb653f64724a550eb424c8d7858ada567c0", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335416, "uuid": "0f0fb2ba-09c4-4e3f-8bbd-055b57efff1b", "comment": "Malware payload", "value": "2df75cac8e8ac138cad30ee1fb75595f4a611dbe", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335416, "uuid": "e7c20d96-abdf-4fcc-94d1-28a3b759c844", "comment": "Malware payload", "value": "686c703cefd41ecaac06d38e1d1abacd14ed979c2714c52c678e07a0262ecc724d41a5cebb2de3d845fdcdf75462b495", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335416, "uuid": "5511e179-11e3-41a7-bd0d-dbd9d2bd6a9e", "value": "T10357F10BF61CD82BCED6F07CAD56076232267D948291E3172515B22CBEB76C84F667E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335416, "uuid": "586b9af6-3433-43ef-b628-8a8cb8355ecc", "value": "786432:8bDnV0IP2B/1ivvLg4tcIVj0mr1CczcLfl:8bzV0IP2HivvLvitmhhgzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335416, "uuid": "046b7905-61dd-4cc2-8051-34281f0ba7e2", "value": 28412864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335416, "uuid": "a8eb8523-2866-4d1a-80bd-9c65b12bb9d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335416, "uuid": "cfaaa6ea-3e88-4f54-8b58-dacb1eda7f87", "value": "AI+Space+Cleaner_3.0.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae652696-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385744, "uuid": "dca14cea-81ac-4672-99e2-b23bec4fc5ec", "comment": "Malware payload (Adware.Neoreklami)", "value": "94e808ec8f06de61a85455b356d36904", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385744, "uuid": "91b68fb6-b6c2-4897-98f3-7cd359978f67", "comment": "Malware payload (Adware.Neoreklami)", "value": "a8e334d0829397317b6ac2f76aa15572f1c17dbac62c21f270147477c18a720b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385744, "uuid": "27127c44-3a3d-4eca-b2ff-3c289c2653d2", "comment": "Malware payload (Adware.Neoreklami)", "value": "83334d60079b32d6832ae985c5875ac504bc68d3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385744, "uuid": "4523da64-4e8e-4e71-95e0-01c1155623c8", "comment": "Malware payload (Adware.Neoreklami)", "value": "bbba178be83c19ab1e60975cde28fc62eab0123031608564ddedf6f1f4df844b626ca5d40781a57f572820d55b0282c3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385744, "uuid": "d975be4f-b833-4508-a566-25566d37b86f", "value": "T15076335137A88CBCFA410230C7E8BFFE7975C2568530156F7B5B0E08E77A49A962F864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385744, "uuid": "e8a19ea2-7667-428f-b2da-adf79a2a7f90", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385744, "uuid": "468f324a-0845-4c11-8919-dade3bcd827e", "value": "196608:P1OUj6iluvuKxvymXgnER9AcmCLvKPiQuFEaQXCR5UNyIeTUgX/KUFo:tOG6iluvu8rvFYXIQyxIgXZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385744, "uuid": "ba575337-f737-439c-8cd7-e7f52fc5add6", "value": 7566679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385744, "uuid": "19377373-3bb9-470b-b5da-2255cafc1400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385744, "uuid": "1b495d33-d1c2-45b2-97ca-30cd34829482", "value": "94e808ec8f06de61a85455b356d36904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b2efd0-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381643, "uuid": "e285df6f-a663-4dce-9fa2-36988f5e3103", "comment": "Malware payload (Mirai)", "value": "5c136d6e5feaf56f5c6c9fa3001d0d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381643, "uuid": "854729c2-215a-426c-8ce9-66128caa7e2a", "comment": "Malware payload (Mirai)", "value": "a93b1272ab3e1bc8ffdcd8802104e17612602cd8c1483396857a3fa8f37b2017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381643, "uuid": "b4973816-efb7-46d6-9a55-4432994d869b", "comment": "Malware payload (Mirai)", "value": "05c13384cb01e140371e467ad089da77f9d736ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381643, "uuid": "0fca28be-0165-44a6-b37b-bf882b1eac84", "comment": "Malware payload (Mirai)", "value": "df727581c2c1e7bcf86fa1a9ddf6c8db1ea25e14fcde4058a048bb65e02546492ad8c3975ffaeb414a36998be022ccff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381643, "uuid": "119bd2bb-daa4-4e03-9cab-e639e7dab969", "value": "T1A6534922A8792E17C0D5F57A12F38328B2F5170E24A8CB2E7C720F9EFF1495066576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381643, "uuid": "ea6bd14f-4afb-447b-86f4-281e2e01dff8", "value": "768:YSog7YUFo+q9/gOpg9brc84IxLmeQwxc0dImi2pE6hug+O+hwVYFUp:YShYERS/gOpobA84IxLvQwxc0dICMhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381643, "uuid": "c89e316b-57f7-47a2-b5a2-62f9b6ae422f", "value": 62492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381643, "uuid": "53e97580-af81-4c0a-af36-c44ae297b442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381643, "uuid": "492922c1-ec30-4bf2-bb65-9fd97ffc22d9", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898b0f4f-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381387, "uuid": "a0e6e075-e2fa-480e-81b8-024e003cedbb", "comment": "Malware payload", "value": "b1558f7c8f2b4c373445497b5042da91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381387, "uuid": "dd551ee5-c505-4ddd-b3d6-3731428b8c30", "comment": "Malware payload", "value": "a9799f6e79dd9257e1d82c3c651442423a56e89e2275cc2f2b3865f3c8fb829f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381387, "uuid": "2340d8e9-84e6-48ab-a4a8-432df6937b3a", "comment": "Malware payload", "value": "d2738bdb89f365eece567f2582484bfdc0ae67f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381387, "uuid": "82769cab-7ab1-44ff-9c86-d3873e137f63", "comment": "Malware payload", "value": "770441cca69ecd03f0b804f97782d255e269062fb63803954240152a4458f3cea5ab6c2248825e91f7f216df17a93eee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381387, "uuid": "626ea1a9-ce51-4f6c-9d88-520f98535fcf", "value": "T1DAC4C0867B4A3D3AE0B3693E84E54F13BB38EB9145C3272B2028B56555335BC2F71687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381387, "uuid": "05c5ea71-96b8-493d-a5ee-239e981f9a58", "value": "12288:yhp5/QJ3eZI1Dbu7YHGg8IwfPL04WkySi8MNuNbWhV1CT:ynV2OZIpa7/gj4WkJ2VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381387, "uuid": "e089f582-5c88-4f44-98f7-a8fafff8b0d1", "value": 576400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381387, "uuid": "bc5493fc-9a9a-4393-ab4f-e3ee2de4e5f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381387, "uuid": "c8fa59fc-baa2-484d-a596-e72f6b8513cb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2513a1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385630, "uuid": "251630a2-a0c5-47f4-8f4a-9b25d939cd1c", "comment": "Malware payload (Adware.Neoreklami)", "value": "728fb5db6647717968cf925d13a5d2c1", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385630, "uuid": "1c5b0472-1d22-4df5-a8e0-25b543d74db2", "comment": "Malware payload (Adware.Neoreklami)", "value": "aa04dcd94c5ac41ab3edf8b83e0be0c39d882068e14593815018d5d64216e068", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385630, "uuid": "c03e4ac9-deab-472e-bf78-3b833cc4d5b2", "comment": "Malware payload (Adware.Neoreklami)", "value": "1821677f0a6f3d3baa548045cef7dbe8e269b699", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385630, "uuid": "dfed7b20-5b45-4fa9-8f74-8d5264ae6121", "comment": "Malware payload (Adware.Neoreklami)", "value": "98c5e2a355d6384914b4b2ca724a14fd6708f347eed774a0dc403ba8abc40c5d670f1dc806c282aa891c0cf8557ba406", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385630, "uuid": "486d2c81-5842-4643-abff-f5d9d78d11be", "value": "T17F7633233AE619F6C9842272B9582F7B7DDD99584F20D88713D1182F7F2E271CE4689C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385630, "uuid": "6fa5ba01-2c2c-4c50-9f94-2a630a2cf49d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385630, "uuid": "f2724bb5-b442-4607-8f59-b7e810ec917d", "value": "196608:P1OQzq1GWrccnc+qdcL+sT26VeP1BV0T9tt21UYuJ5q:tO+wc+qdULu1BV0xn21Nms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385630, "uuid": "fc4fc9bb-74d0-4a33-a607-8c68c4122b75", "value": 7574616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385630, "uuid": "fdb51315-3769-46cf-92c2-d99520f94da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385630, "uuid": "612fa11b-cb46-4467-9a99-8f5ff4c03dbe", "value": "728fb5db6647717968cf925d13a5d2c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c247c6d3-e7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767372893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372893, "uuid": "ae94d0ff-5bd4-48c6-a4af-d412afde8737", "comment": "Malware payload", "value": "cd3f138480d6e8ee8f8cab826781fb84", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372893, "uuid": "54506f4f-a402-4ad0-be70-44967c334968", "comment": "Malware payload", "value": "aa5381241d4098aedad56fbb16582b38dd3ac372368519d7ec9f52612a211f3b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372893, "uuid": "57dcaa45-e06d-4921-8b5e-a638afbeadd6", "comment": "Malware payload", "value": "76b599f5a53bd9ea5017749f485ce39aef54bce2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767372893, "uuid": "49033a4d-ffe7-4502-b7eb-6aa8fd4c6375", "comment": "Malware payload", "value": "0ca548d4b5cf814404213a585e091bba3f58f553aa685ac2d3172675b5a769299eaeae1cf19ff52d350a1b4d0280617e", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Infy", "colour": "#AE94DA", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "Prince of Persia", "colour": "#6BFFA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372893, "uuid": "f4ae27ab-502c-463b-94a7-166c9bf0a6b8", "value": "T1E4F43313EC059C4CCF8E04C7D29DA2B983C5D9E4AB68E62DF51335F945AE3AA361F580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372893, "uuid": "99b5ce27-a78b-4f5b-a003-e9632d2c3250", "value": "12288:/8Y9mNiLDSZy+tVbzAfAuoxwFsVDIMIVQG6o0kn42TiUMo0XzFArWuDeHsveMDrB:/8YQIZ+tVbzBuoxhbvWezfzarWuDeorF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767372893, "uuid": "af17fd0e-611b-4217-ab36-8c55ef1c6a61", "value": 761442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767372893, "uuid": "0cfca8a3-b425-4352-8d88-09bbc601c87f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767372893, "uuid": "8e6d5d19-7aef-4c3b-b64f-d822e2c331ce", "value": "23761caf7f4c6d7b3b4608c59729eb807c961deaa23aac94db5289b9b9739864.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fb1c73-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385628, "uuid": "b8227496-d44c-4c26-8502-2daa87aa90ee", "comment": "Malware payload (GCleaner)", "value": "71f3e143dec3c68c76200809e13efa0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385628, "uuid": "7a58ad84-4e79-4847-9be7-ca1a81fcbfae", "comment": "Malware payload (GCleaner)", "value": "aa6cc5620a249bcd76935677ffac9b8b934631903955addafd90eaf277267e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385628, "uuid": "7b846429-1090-4ee0-89d4-7ecb19b8bad2", "comment": "Malware payload (GCleaner)", "value": "117f0a88e6a9df3c732e730347fea2acace54baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385628, "uuid": "49e6b324-28c2-40f2-b71a-673eae703c53", "comment": "Malware payload (GCleaner)", "value": "49237599be7028df5f2c63acfb2796a3c3cb539fea0a6f58cb4acc0d30f7e3b017d0aad7aef5607a6727db2228b38c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385628, "uuid": "bc8c6184-cf56-4d71-88a7-21a16e5f7048", "value": "T1EF26DFE3F4A829BAF3F30E76293F2179C169F94ADE5C9BB616513599A577003B002343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385628, "uuid": "bd3db9d2-33b4-4beb-80ee-0587dc0e4001", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385628, "uuid": "cb1b7b90-3e83-48f5-ac12-c6909fd856c0", "value": "98304:rrSW/zgTWm06mirbobd5QtE763/BVG46AgtQsJof3:PtzgTFFboJ5p63JZ6Vt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385628, "uuid": "7bd1b737-801e-4ff6-8fd4-1f90ecf9a353", "value": 4716304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385628, "uuid": "75ad9d55-9b0a-4c32-829a-4db6d36d7dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385628, "uuid": "a18c137b-6a2b-43e3-9c80-6f6916b80c47", "value": "71f3e143dec3c68c76200809e13efa0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bbd29e-e82e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767394606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394606, "uuid": "71188dce-117b-4108-9b2b-7efa63fe0947", "comment": "Malware payload (Mirai)", "value": "88469c102783733d662c24de7b22a9f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394606, "uuid": "88df4c15-9539-4ea8-9c15-6836eeab3bd1", "comment": "Malware payload (Mirai)", "value": "ab9c3de69364fb40a512fb37f95b21570a8791b406b4aa88ac406993a724a553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394606, "uuid": "45a722d3-dd89-4c29-8e94-7272bebceb59", "comment": "Malware payload (Mirai)", "value": "e7e1cc54b519c0fecaf2df0e48d62fdaa7933cc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767394606, "uuid": "9c1bdf27-94d8-45ca-a204-c96a31c24815", "comment": "Malware payload (Mirai)", "value": "867da973678233b0800f9e77f180c50971ecb968e484895fc40323a4961d211a7344e813bca45386022284f99b5c24ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394606, "uuid": "e9f83451-07cc-4d32-99d5-9b2f042c095d", "value": "T128234B99A401AD3CF94BEA7E84130A09F631335520D30B3B67BBFD936D722A45D16E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394606, "uuid": "3135f516-6074-4143-8d56-428e1fe69d25", "value": "768:pvehW+sy2e+F3GjVrFJGsM9FbVLaXfRXPZ6jT8Txh8:dEWde+FMFJGsoFV4fRXR6jT8TH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767394606, "uuid": "609d6c67-57ef-4b05-a5c1-c1e2bb605816", "value": 49384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767394606, "uuid": "969e54c1-c43f-45c7-9ad4-c87891e7c5ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767394606, "uuid": "58d7daba-7c0a-44ec-9b8b-c4cace48ea19", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7099be2-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385812, "uuid": "48f8b0bb-9b70-425b-b2eb-3ad66f0d21f3", "comment": "Malware payload (Adware.Neoreklami)", "value": "a7120a0ae7cee524a1bb1c326220f26c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385812, "uuid": "8dba1279-e0cd-437f-a78b-bf8d42b95b2e", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab9f6906ee3eb229d14c697b52d8243d9861a41b85b82cdd55237e55b6b74524", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385812, "uuid": "cff9c85f-188c-4714-9046-6214b327b075", "comment": "Malware payload (Adware.Neoreklami)", "value": "4dbd5f0352754776616d21c9782bb33c4f1fa178", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385812, "uuid": "49aac49c-6761-4f0b-9b7e-97102c34b4bf", "comment": "Malware payload (Adware.Neoreklami)", "value": "c9ffe9b80518e944e9ec5393ed4add3beb9651de32749e47eba5e0747ce3b8e5c4cad23387de4557a47d08cef5c6c6cd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385812, "uuid": "a5991897-9d8d-4d27-84bb-0894fdfcdc5b", "value": "T1C77633A0BC88C97DE78654B28DBDEFD540E9EE084D2449B62335471CEFBEC91842536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385812, "uuid": "1f79473f-eec9-4ecc-8033-ed3e71584543", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385812, "uuid": "6b02b494-8e9e-4343-abc2-270c9410f4af", "value": "196608:P1OBlrTSLO7uN9cJ+OHjIGsKwPvAnxCiVV1RkVTJX:tOBVm2uN9cJ+OHjIGsK4axCiVVEBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385812, "uuid": "f556004e-0751-4d61-8e6d-49e3bff408c5", "value": 7560609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385812, "uuid": "1b495908-1d84-4b2e-953d-6f7a8094e61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385812, "uuid": "42f40e11-aafc-4c71-a19d-c3342117d869", "value": "a7120a0ae7cee524a1bb1c326220f26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8c5dce-e7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767370011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370011, "uuid": "ddc0cc3c-3311-430d-b0ed-a00d8f0361d5", "comment": "Malware payload", "value": "e79e3e4e379382162c221a30acccaa69", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370011, "uuid": "5af9e143-2c35-4331-b85c-63038da7ad66", "comment": "Malware payload", "value": "abc71570f1db8f5cda7b93dff0b65320e2cb21891c8e158ac4d70ac8056a2f90", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370011, "uuid": "6cbf5387-e027-4feb-aec4-0e6018e586db", "comment": "Malware payload", "value": "5ad84b33d42d7d72e0cd7871df3beb3ee0c45e71", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767370011, "uuid": "cd86c2c7-3aba-43f1-94be-1e91c05e0a66", "comment": "Malware payload", "value": "f84bf7408fc9b0e6bd0a71f8a3443020473ae57d247d91fae29bb82cd5c096c2183348ddc8872e96de2da713aad8234c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370011, "uuid": "8d134ef8-2316-4d34-9d7f-b1791c94dcbd", "value": "T1FB362241EFF7C326F8F55B70A9F519D35B327CA12821864F7A09916959B2300EC6237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370011, "uuid": "b00ed4d6-aec7-444c-945c-0d3ac276e65b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370011, "uuid": "7fcdc811-4f05-4ab7-880f-0cce55adc4c5", "value": "24576:he3vDeIXqFxQEPLSnC+DIlSkHs8ySTsHIwzpo9/Y1WAryQnTYgpbpCPLBCm6o7:hSreS2LSVDgSknySsowzhWGnTYhCb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767370011, "uuid": "edad11fa-8ddc-4f4e-b962-404c024634f0", "value": 5179032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767370011, "uuid": "865e6352-e486-456f-ae05-d5f2028d5de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767370011, "uuid": "3ba7accb-4fcd-417a-a6dd-da12df9d8e6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c52c72-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385649, "uuid": "f17e0a67-0f15-45d3-9337-fa79483e9660", "comment": "Malware payload (Adware.Neoreklami)", "value": "7a90a0bb0fe474ad9efe70e18d8e0c4e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385649, "uuid": "529a8321-6b88-442a-b067-b5b0e862f85e", "comment": "Malware payload (Adware.Neoreklami)", "value": "abdc1a8587645495514d8dffdd144c7972a0c89afcc0538fd1d539296408834b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385649, "uuid": "ee2ae07d-0730-42f5-9380-19956234ce81", "comment": "Malware payload (Adware.Neoreklami)", "value": "d1f99f6e051b546b118f3f78023db4c735c755c4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385649, "uuid": "5cd7bc7e-2e56-4781-b205-d610b2789c03", "comment": "Malware payload (Adware.Neoreklami)", "value": "deb3892d600e521ffcdc832c417c5fc87cff6d192feb529bff4405f932657ed90732a40b00760ef38fa4a4f7504032c9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385649, "uuid": "2a134d26-b05b-46d9-baae-1c48570845c4", "value": "T11E7633B034E041FAC5129A366CD6AFF4E136B9257FB0017B22441E092EBD7766970AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385649, "uuid": "375be355-c9b6-4626-ad27-cbfa320a1c25", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385649, "uuid": "c1223e4f-d8ff-4faa-8a1a-54e59265e787", "value": "98304:P1OYw/ySVN6Qfj5/GKKHedcMw83KSQqCt9WNVWy0r31YZhMXPCbu:P1OYGySGQfNAHefw8HWsSyGaZW/Cbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385649, "uuid": "5f6bdfee-ca84-465f-b7e0-802fb22c99fa", "value": 7514390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385649, "uuid": "9750dcb7-3efe-4f97-b6d9-761e2ee82848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385649, "uuid": "a2c71437-7037-418c-88f6-ba3f4883c271", "value": "7a90a0bb0fe474ad9efe70e18d8e0c4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c15391f-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381633, "uuid": "b9285c4e-f092-48b1-abe7-43a1b8c0cb8a", "comment": "Malware payload (Mirai)", "value": "afb91a62c7a77afa286d71e72a04d4b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381633, "uuid": "6ba3ecd3-982b-4b6a-a48c-cc16b2489a35", "comment": "Malware payload (Mirai)", "value": "ac260feb7fbc191cc5d0358eebf75e9d39eb98f18a652a9f931e524bdda18996", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381633, "uuid": "04db606b-6b5d-4e06-95f0-b678cccdaf57", "comment": "Malware payload (Mirai)", "value": "ece862c3df139325da3f89d32eaa23aae17df368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381633, "uuid": "77d4ecff-0ad5-42b4-9afc-77b376cf4996", "comment": "Malware payload (Mirai)", "value": "cf1a7b11023ba6495e14e9621219134e1d51691f8aa899cbfa76aa476b0b301a47f20968bf5ad011a5280173e186bb1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381633, "uuid": "17cbc83f-e182-472c-a160-2f532961fa61", "value": "T143735BDAB800DD7CF807EB7E4023090ABA71A25556A30F3B665BFD837D721A84D13E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381633, "uuid": "b8d25820-4df4-4f34-91b3-523ce4ea8114", "value": "1536:kiXjOg+EHGZD50gosa1xJJQp5MQnf8A2cUbUyB/i5Lz0kROKN4c:kiitV0gBa1xiWQne5Bq5XX4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381633, "uuid": "ef6f8955-f462-4b40-9ba6-9e23f0039514", "value": 76312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381633, "uuid": "40d76e8e-32d2-42fa-9e19-99b28116a13a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381633, "uuid": "1ea4d1e8-9720-458e-8fdf-5c2352320829", "value": "meerkat.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7461d34-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385786, "uuid": "d647c484-b660-4d22-bb65-c107c9f954eb", "comment": "Malware payload (GCleaner)", "value": "9e3d1eb3e86feab824b614a845dbcabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385786, "uuid": "fb16aff6-1711-4de2-bde8-e5f9e1c6aa71", "comment": "Malware payload (GCleaner)", "value": "ac5532114eb9b23831dbdd2edd643ba5ce9d372accc9483c9d249b9aebf666ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385786, "uuid": "070d81d8-a3fe-4cef-a71e-817c31c9a5be", "comment": "Malware payload (GCleaner)", "value": "519fabbeaf9db2ecc7ca23e0c75e6559f2ae117b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385786, "uuid": "89685bea-32bd-4350-b743-cf21c530b49f", "comment": "Malware payload (GCleaner)", "value": "5be8b094b819869b01109aa61b7aed042adb0ecc827f96b4293411850a34f65f9664349e130f8a1fc8971b6a89c9bff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385786, "uuid": "c4726890-3ed9-4195-bfdb-0e2f39bcef9d", "value": "T1EF46E0E2C64C78EEC2E2367C5F0B5DA544FAAB60D73147CD7D96188C9B6F1A012212F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385786, "uuid": "889577a2-b458-4fb8-ac2d-ca8bc3eeaa65", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385786, "uuid": "8005253e-bcc2-4dff-82c7-81e5b7af37de", "value": "98304:BS/NFNA39xTxo1QB0pdlmTHUVabxSNi+TnILZAyJOKL:wV839r67tVabxS8qILZAyYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385786, "uuid": "5f6f3071-6a9e-46c9-930c-1964a27e8cfb", "value": 5665040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385786, "uuid": "daf1b161-8b4a-45a3-903e-1d136e41b3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385786, "uuid": "68853278-2d65-4bdd-94b0-285b69d564c4", "value": "9e3d1eb3e86feab824b614a845dbcabc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d62a43-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334160, "uuid": "a65c1f49-93eb-44d8-8139-011948c002e9", "comment": "Malware payload (Mirai)", "value": "e6b68ac6ac1e2345057a73cb32b09cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334160, "uuid": "5f963586-3da9-4cde-a597-1c8d6457cace", "comment": "Malware payload (Mirai)", "value": "ac63edb2666cd818362f199fc0d2eb9e9342e3315f9aad43bb750d2c1de3aadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334160, "uuid": "dd85ed63-987e-4eea-adca-013a679a2162", "comment": "Malware payload (Mirai)", "value": "214ed1ec2fa67ada72b22b8684a44bb33714c026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334160, "uuid": "e9a8c53b-a1f1-47a8-9dd6-9af9cf08ed3b", "comment": "Malware payload (Mirai)", "value": "c34e9dc04f28ba66a605e930074864620d5284ffd47f34c730149067cc06cece1707cc0b6101336093f785e304582c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334160, "uuid": "9b9a0b96-a248-4137-8e7e-b7e865cf3e9c", "value": "T1B8F3E80ABF601EF7E82FDD3706A90B0525CC650722A83B757634D928F64A64F89E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334160, "uuid": "aaf27c1a-d19e-4a2e-af54-4c00e5c1cb71", "value": "3072:8uNIWy7H2Rh5XHE//UooH7Tjz4hOXonzV:8uuWnRjX2UoU3jz4/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334160, "uuid": "24102980-231d-47e7-91d3-0e8046aa4923", "value": 165712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334160, "uuid": "728d525f-770c-40a7-aff3-1c8eb0866859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334160, "uuid": "45d3f4ac-3186-489c-8818-cd021686e2b6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dbe929-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312531, "uuid": "22e527b2-7982-449c-bcf9-d9665b2fcee6", "comment": "Malware payload (Mirai)", "value": "565ede00b67887f3c549b64b6dad5e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312531, "uuid": "49710ea1-e9b6-4490-aa88-e70f021400ea", "comment": "Malware payload (Mirai)", "value": "acacb9cd011b9df93f5a0ee16176704bce0e07d694b8dadfbb4e3a03b1b05cfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312531, "uuid": "38c35405-0851-42e7-af45-c55ed214be3b", "comment": "Malware payload (Mirai)", "value": "a5bb4902f826bd7bb4133b5ce3008e74c5ab6af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312531, "uuid": "dfa9559b-71b3-42fb-81a7-d1be21c673b9", "comment": "Malware payload (Mirai)", "value": "65dd567d5e1b5192216b20dd5d46a73c2f4d26adc40286cb271e1feb60f9bedeacb92f03cfcba859dfba077a2d108f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312531, "uuid": "dcc864d9-2a88-4d3d-95be-f747d9451b6a", "value": "T185A33BD7F400CEBEF80ADB7B4497090AB635A7E106C31B276757B963ED321951862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312531, "uuid": "e7c6f461-fbb6-423d-b932-1907c44c5307", "value": "3072:WtQIMfjbhxIbhhTykLVGSyYYZmdCu3IKDMq6H:FezykRGSyYYZm4u9Mq6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312531, "uuid": "957d1810-2c18-41c5-8d30-8b75b18b1173", "value": 100329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312531, "uuid": "233d4f99-4b8f-455a-9b61-49aec3a750ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312531, "uuid": "9e40f7e0-dcfb-4ea5-99f2-166264ac57f3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf02eac-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385659, "uuid": "97791d5c-c12a-4b74-ada8-0b323d9db86a", "comment": "Malware payload", "value": "7d32c2a697493a3b24a46d0961c54f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385659, "uuid": "a6760525-62fd-4a83-a380-730cd247fa2b", "comment": "Malware payload", "value": "acbe4c6f669af60da5e348627499b23b637e86fe1b1822a04d971ef481958f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385659, "uuid": "a5294d3c-86bc-45dc-8ea3-d0580d3cd4d8", "comment": "Malware payload", "value": "9c1d864f97a4e4c12196f5703a9b714a95430de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385659, "uuid": "3ffefe05-8d21-4dde-bc03-cc919a0c65bf", "comment": "Malware payload", "value": "df02fc40811a4221e57bbf3caa9292783d03599bc825348e2a10fea230f042f7d22bf7df557f0e80ca02d08d44072847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385659, "uuid": "a82af37a-9ebc-485e-8ef3-e66129a49c8e", "value": "T12B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385659, "uuid": "eb2d917b-73c6-4024-a251-1f9fc2b94175", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385659, "uuid": "f4dccd98-8be7-4bf2-ab7a-fe282be5f81d", "value": "98304:akT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:/2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385659, "uuid": "d94946f0-bc86-4e58-85bb-c9882fb99035", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385659, "uuid": "0b5d0d19-7342-4d1f-84ed-0037338b352f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385659, "uuid": "664eb06c-29b4-41cf-bdd0-258767f15a5a", "value": "7d32c2a697493a3b24a46d0961c54f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b92b259-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385578, "uuid": "b1e350e6-4b48-49e6-b374-2910bface4fe", "comment": "Malware payload (Adware.Neoreklami)", "value": "649f4c9f6972a6975af7c874735f4900", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385578, "uuid": "f3d3251d-25bf-461d-87f3-4138ecb7577b", "comment": "Malware payload (Adware.Neoreklami)", "value": "acd89995827f48309bc091f4503771e867600b66c104475c852c2fc4134a3710", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385578, "uuid": "fa8874bd-2c2b-4894-835c-1ce3b7311e6c", "comment": "Malware payload (Adware.Neoreklami)", "value": "35440140f5318457099556506f439cce7064f2e6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385578, "uuid": "f7b3c444-cfbd-4ff3-baa0-14d4e76a7bf3", "comment": "Malware payload (Adware.Neoreklami)", "value": "615632ade252a058232b178e47859b6abd6b61de8b304539a9c00b75376175f51fdafd62043f96ae9502b00385c70cf0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385578, "uuid": "904d3509-109c-4be9-b1ec-5553ba40d0db", "value": "T1CE763310F9C08838E643A8348B994FD0F29A91511B269437D7D3C84F5EFDB6AC2A57B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385578, "uuid": "29129fbe-66ab-441f-a581-e54085c1eb13", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385578, "uuid": "81281bd2-44b2-4bbc-90d5-520b7dadcde1", "value": "196608:P1O4bYHb9ne+dsjCF5JPz9cVsmzXc3+bWJSTx/h+CxmwZfKksd:tO6YHoWj5wGAXc3+aJ6/h+Cx1Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385578, "uuid": "05df18ad-9333-4f99-87ea-87e182bd1de4", "value": 7573855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385578, "uuid": "0cf178ef-8e5b-4dca-8f50-c89bc8319349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385578, "uuid": "981c0419-ba50-4b81-b811-3f8cd4581a99", "value": "649f4c9f6972a6975af7c874735f4900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d2ee13-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381646, "uuid": "93d10ef8-1c80-46a6-a265-8c395408218a", "comment": "Malware payload (Mirai)", "value": "7b7ae6f72c8da0c04a3d1e163c865666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381646, "uuid": "5d1bbd46-4777-4520-b116-2e7d113f4224", "comment": "Malware payload (Mirai)", "value": "ad99a603b72ea264dc3759c8c955164e051f35f90eb0578dce08facdff0e5985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381646, "uuid": "2581a4fe-6132-4da6-b4b7-c202905fd84d", "comment": "Malware payload (Mirai)", "value": "18191372b2744c45aa699ac28a9dd90a31c1d6d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381646, "uuid": "db5572f0-c2a2-4152-b29b-171f9d1a8361", "comment": "Malware payload (Mirai)", "value": "184d638b5e20da65c0b31ff1150de2cfa9fe16f543f197f664598d43d7e4a02a75042a01214408dc8e111d5e89716c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381646, "uuid": "85af3877-4033-4629-a014-af4517c82d92", "value": "T13D330891BC919502CAD82376FA2E01CD332663E9E1DF72579D226F1137CA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381646, "uuid": "45ea2e68-27d1-4147-9b8a-f73e4f22fba4", "value": "768:xMGLInGoXP3624ILThNGzGUiTkVpCDL0IIesBJNoiTQhfBNwoxBA1sP9AhE:qMInGoX/r5xUiYVpu0IIeyJ0Hxea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381646, "uuid": "563f6970-6fe6-4c72-bc95-f7608c16d782", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381646, "uuid": "31a0eaee-5214-4c0e-85cd-0f200f2840ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381646, "uuid": "8ee6f1e4-1e72-417b-9e01-7fc8b7bea315", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be4be7f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385713, "uuid": "37cacdfc-253b-41fc-9224-58c799b8a36a", "comment": "Malware payload (GCleaner)", "value": "8b55f18c5b8f6bd68a872b1eb53808f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385713, "uuid": "1fc8b214-6303-4876-8321-fbadaceef09a", "comment": "Malware payload (GCleaner)", "value": "ae80241c931dd85bddf152c5d299d05f85161270fc13205e62acc805050ab37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385713, "uuid": "5ba81b6f-b470-4e0e-b55f-8cc9a0afbec8", "comment": "Malware payload (GCleaner)", "value": "44af94ef8747e72e002ba7d4f3791a7e44a49d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385713, "uuid": "5e2b47a9-62fd-4e64-82e3-c6b58bd5afa4", "comment": "Malware payload (GCleaner)", "value": "59fcc9b5716e59a1b028ddee261448a3b00acf32b0151b5cc4f1c9aa198ade7723224684ac598a8f809d0e1c7fcbaea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385713, "uuid": "0edd3883-79a4-457d-a0c9-7bc58001f2b1", "value": "T12F06D0CB17C0A4E5D7A6163B88811E4893C3EE800C7B678AB7D45B665137BBC6DC62CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385713, "uuid": "8a6ff903-2467-4af0-8028-75888b3f4e07", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385713, "uuid": "95062b6b-2eba-4fb0-9df9-1e5b17faa2ef", "value": "49152:eUzNgPeBh2Uz1k6wAGvTZRmxMHMGFXYAVMlod+WblMmnQhsjCShZ:eUzNgPeBh2UJYSx26AVMlU+WznQhsjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385713, "uuid": "7104bc49-3f49-4b5a-a0c3-984ba96b5735", "value": 3696400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385713, "uuid": "4dbb69f0-f639-4f3f-b9e7-a71ec28097cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385713, "uuid": "53df74e1-710b-4b02-a34b-7834bc7bea8b", "value": "8b55f18c5b8f6bd68a872b1eb53808f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c65593e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385472, "uuid": "e14f36dd-533a-4f25-8c80-aab43483262d", "comment": "Malware payload", "value": "3f8704b1f3aee194fa62cebebfee001c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385472, "uuid": "d9451ab7-6504-4c22-807f-77a1bba9822d", "comment": "Malware payload", "value": "ae842277c611e5fb13549bb6592c4c81ad8259c5fb59d1668cc46351c0575959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385472, "uuid": "2620c1db-6e61-467c-a3b8-51c996baa22e", "comment": "Malware payload", "value": "28706380e10695b93717cc2ccb4f7c6b7b2110b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385472, "uuid": "b4d8b467-9f8c-4438-aedc-8709cece2149", "comment": "Malware payload", "value": "2d360ba446309a6651a28af5fe1ea22b5b3712807f76248a3d22a742efe35b7c08d997d241f87772e3e61b6dab4acdaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385472, "uuid": "35eb1968-0cfb-46db-b2db-73d9b78bb191", "value": "T1800633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385472, "uuid": "59d684c1-ac32-49e1-8acd-c4022765699a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385472, "uuid": "730205d9-b810-44ea-aa8a-074dfb5b05ad", "value": "98304:a0T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:n2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385472, "uuid": "e7a19188-7af8-49f0-b259-72dde7e6b955", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385472, "uuid": "74a6fa03-66c4-4faf-81b9-8ea48d2cdbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385472, "uuid": "f99e1718-d8e2-4f33-938c-5a0ff4188a07", "value": "3f8704b1f3aee194fa62cebebfee001c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52df2dae-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385591, "uuid": "aad599b1-64c1-43ca-8219-8e483a05f63f", "comment": "Malware payload", "value": "6633ebd602bdfc0d3d7402177b032638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385591, "uuid": "583e32a0-c26a-4a63-bce1-8e1621db4bff", "comment": "Malware payload", "value": "aeaa27be58c07855b737c7dab07e1a3705f27df982ba4a0eb019a3b09df2663a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385591, "uuid": "36e7757e-9be4-4d66-a25e-2a071b77dcd8", "comment": "Malware payload", "value": "f106cc12b7b72af296ac89604cbc395d702f9c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385591, "uuid": "7866f1d2-a606-4319-b620-b6efaf84245d", "comment": "Malware payload", "value": "dc18d49833c8fcd1e79c8c68f12a53a3500342660f609e13afa475c96d38df26083e933c19c839b6c06201176b8f8af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385591, "uuid": "1910d8a2-b0f1-48f0-b9df-ed11ddaa6008", "value": "T12C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385591, "uuid": "a6529f05-51b1-406d-9923-42328d150be1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385591, "uuid": "bfda73e0-b8f6-41a4-aae1-9cbf3be4d702", "value": "98304:aHT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Y2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385591, "uuid": "38ac5dde-3bb3-456d-83eb-4a33f258ab7d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385591, "uuid": "2924da1c-2352-4a37-9bdb-f6b3cc7745f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385591, "uuid": "c69200be-f876-4470-887e-93f926cc567f", "value": "6633ebd602bdfc0d3d7402177b032638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac70095f-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317021, "uuid": "4273b9ee-4196-485d-bd8c-ccd37f86ffaf", "comment": "Malware payload (Mirai)", "value": "75bfd8f0d64b78b80e963edb0aabf18f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317021, "uuid": "a1fd396e-e21b-47fb-82f6-25239353122b", "comment": "Malware payload (Mirai)", "value": "aecc44f53c9232d9b1dd1c1a525b5d9164facec2c03ff3dbafbe41c6cde18faf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317021, "uuid": "c3677623-4e26-4cd6-8929-1e107d7019e6", "comment": "Malware payload (Mirai)", "value": "c7594275b93a062c475362ada6ac67c5d5ab38a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317021, "uuid": "1f01a7f1-c574-4aa6-af6b-f28881f7af75", "comment": "Malware payload (Mirai)", "value": "2e2ebe38f6132d6a95506bbcf7429b47c8079be1de72ef2278212f3b1816beedbcf400de952c055829bfbd8b8f92a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317021, "uuid": "d566b6d2-21ef-4ec1-9833-95b0389d74e3", "value": "T1B883084AF9819F15D5D922BFFA1E018D33636768E3EF72028D105B15778A92F0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317021, "uuid": "3fcac07f-446a-401a-90f6-8f49827b5d73", "value": "1536:aRnZLuyteh2l1FWc5Xsw9HweV0KlrDAwIDRrysZ+MbjNl94i43T7RlruM7R:ABtLPFXr9HweVlJDAwIDRrysZ+2u3Trn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317021, "uuid": "90415cb6-fb31-49af-8ab0-d1b93a5ffe55", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317021, "uuid": "8182a753-9617-4393-aa2d-26b617d2abd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317021, "uuid": "41d384e8-3909-466e-af55-45a187fdf2a2", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78357c8e-e78c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767325094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325094, "uuid": "39e30182-9ebc-45b7-92d8-617e0b28a9bc", "comment": "Malware payload (Mirai)", "value": "3b9840cdf3558d535c95fbf6cf295b56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325094, "uuid": "35009fb3-d288-43de-8968-b86f2acae3e1", "comment": "Malware payload (Mirai)", "value": "af01b08dc2cbeb6883246bbbf361f31552c161f901683c6f721629ea45509c6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325094, "uuid": "6420f5e6-da2e-48bc-b551-21979e0380f7", "comment": "Malware payload (Mirai)", "value": "95b5b4e7f4993f0fe49a9df16ac00437ef79352c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325094, "uuid": "3c614956-d8bb-45c8-a285-9fa7803fd1b4", "comment": "Malware payload (Mirai)", "value": "a23633867630c6319120d778a520478baabafe7b5b0906c029ea38519a58bc6258a67ed0d8b9665c9528b191668dc41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325094, "uuid": "505940ae-44e3-4e40-9b0d-8c809c69e9fe", "value": "T1EB041745AD819B11D4D632FAFA9E018D33536BB9E3FA7102DD205F6023CAA9F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325094, "uuid": "3826f349-593d-473f-8909-f4f5f950301a", "value": "3072:u6I0T7aIGUyVS8na5REHKVAbW58fyit/fKNwODuxEHK1gRPPKGpQSPN9bta3iBuG:PBT+IGUyVS8a5REHKVAbW58fye/fKNwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767325094, "uuid": "c604aed7-f667-4010-a5b4-c43958bc7dbc", "value": 175108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767325094, "uuid": "fbeb1d25-5b45-4c48-81d1-d7a2a2891864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325094, "uuid": "19c35bcf-46f6-461f-8043-6a132c5a22b4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d25c558-e829-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767392372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392372, "uuid": "47244d52-6d53-4ae8-b8e8-7f8ba8648928", "comment": "Malware payload", "value": "78aa70e39408f08738527c7c4910ec29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392372, "uuid": "74e32c5f-7f0d-4653-98ac-7fca59f5c1aa", "comment": "Malware payload", "value": "af524c3cc9c894c6b6e91094cbf7c834ebdf5acc93c17dbaf5f8cb9a51c53187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392372, "uuid": "f03c34e3-b4eb-42fe-afe8-13443438ccac", "comment": "Malware payload", "value": "18d00e60822dacdc971e586a1a0f16c6c17cc2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392372, "uuid": "c463d9f5-8164-45b9-9911-693a6ad4ec8a", "comment": "Malware payload", "value": "f98a1c8bb58d15b0f6bfabace9ea10bef2db6b03a6f8a19848d2c0938278962d99ab0414d4e1944edbcdd6c4df5deb3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392372, "uuid": "50eeb01c-71c8-4ad3-9819-947a1cd68edc", "value": "T17AB2C507BFE50E50F034493699B7EEE9C8BF75313F04C55BA690092C98A4191EC2B76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392372, "uuid": "b90bb5ed-31e7-4fd2-b6b5-c8d95cc0ece9", "value": "240bf818bf43534904728523de5afd35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392372, "uuid": "03d2f54c-6681-45c2-aeb2-2a57eb262db4", "value": "384:NPqo+CuJU678Ck4y+v1dFONqosirUZ5H8k9QhDVcNtBb4:Zq3ECkoAgehDVcDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392372, "uuid": "050ea5ae-f988-4e7f-98ee-0c997d271fc5", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392372, "uuid": "281b0939-4c01-46b6-a0e6-a9a4b1041645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392372, "uuid": "e28e2fc4-edcc-4249-99b2-72c7341e9384", "value": "getexe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d3af2c-e815-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767384037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384037, "uuid": "c90ff9bb-ed76-4f95-a1d5-b102ee36c86e", "comment": "Malware payload (Mirai)", "value": "0fb90a198253a0d4e5f533cbe4318edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384037, "uuid": "5365f4cb-4906-4052-92e8-56fcc0016d79", "comment": "Malware payload (Mirai)", "value": "b022832468ca7db695fca5bf7a3b0db55b15391bd2887de222c67f64cad1477a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384037, "uuid": "a77c481f-ebc6-4425-bfd8-b0cdea436a55", "comment": "Malware payload (Mirai)", "value": "cec8730efddae6608c6c2678c824caf3c1da34d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384037, "uuid": "f61e17b0-ccd3-4286-b08f-4de58791e80a", "comment": "Malware payload (Mirai)", "value": "c14590addd441730456896491cacb44f48b51419cde8b92859ce7ea4a172c1ef24b379462c3bd503245f45de964afab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384037, "uuid": "3b006321-a380-45e2-b146-597404440ad3", "value": "T142240846BD918F13C5C122F6FBAE418D371A67A9D2EB3102DD216F60378A89B0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384037, "uuid": "34590e3f-4b55-44e0-9d68-dfbcf16268d1", "value": "6144:g/MFyy0JatHI+rybrjC8tVpu4Dn4MSbkPPfVy:g/8yZYtHIE83/Bu4D4rbkXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384037, "uuid": "a2270729-8d34-4bd4-90f4-9069e1c0a935", "value": 225056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384037, "uuid": "4c38b693-de5a-4eb1-a8ab-6ab58780fe35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384037, "uuid": "fe730707-b2c3-4b03-a686-bdbe94ee5d00", "value": ".5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec815bd1-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334309, "uuid": "f1c7082f-bc04-45ba-9e51-02a98ea61c15", "comment": "Malware payload (Mirai)", "value": "82a2ba152e95a6cd6f6fb3beb415d95c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334309, "uuid": "a408a370-1760-4513-9013-1497afe5ca09", "comment": "Malware payload (Mirai)", "value": "b03305336b5262000e40d7e8172ef8c981a5dc80e7bed9ccec140f9636a67de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334309, "uuid": "b0af9e65-e2f3-4f7c-b7d3-dbd3bdc90bf0", "comment": "Malware payload (Mirai)", "value": "ff8904c1269b73275a0b679f552d0bef3d48336a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334309, "uuid": "749eb2e7-d26f-4ee4-b0bf-4b07b350b8c5", "comment": "Malware payload (Mirai)", "value": "fe8f7102da6f1027f22667d3e82b5c897d2b8036f853ff21babc4340ca00727be882914d484de1200428019b610ec43a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334309, "uuid": "07ffd364-4feb-46fd-9035-f1d4ae7ff2e2", "value": "T1A56302E0EF0C7B92FB77FEFD24D4C7D3B1010F0B01469EBE314086895556566266D684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334309, "uuid": "b3377ea9-e1a1-49da-99c6-ee3f32c793af", "value": "1536:ZyVNvEYtHS2OvjNDyNyX6QFh16h7XpCEdfEtC4u+qgw09l:o4wHxObNk3QFhYfCE5YC4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334309, "uuid": "cd462857-a523-40d2-ad65-b64d2de2a35b", "value": 70604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334309, "uuid": "8387591c-4b64-4eaf-a8ec-12cf3d01a153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334309, "uuid": "fb57cb2c-d623-41a4-a7b9-02ba6fe99cc4", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd0ef0a-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385340, "uuid": "b899e000-5469-4c3a-821b-675be8c79ac0", "comment": "Malware payload (Adware.Neoreklami)", "value": "05b17e628c86b9e2878a08a7e38d33a9", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385340, "uuid": "2df2665e-25bd-458e-b8db-fdda75070227", "comment": "Malware payload (Adware.Neoreklami)", "value": "b04f4b21b114c6c2972870fd7b18754ebe0a245700d78046df2718906c175398", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385340, "uuid": "bc775ad0-4c09-4a30-a82b-874af5c8f28f", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cf38b34c929223c7dad41d2224b9ca77ce9c5a3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385340, "uuid": "11b699e9-3a33-485b-9edc-8703367ea62f", "comment": "Malware payload (Adware.Neoreklami)", "value": "e3577bd97407737f4884a1d3428baea78676169add324019fd5b8adeca37f7d4cb3854fd409206f62f7ae49f3a61b3e7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385340, "uuid": "f9edd116-ffb9-4a52-999b-fdc01ace23b1", "value": "T1F0763368BDC685F1C2C6223308C13F8864A9D645596FDB1BE34E4E3C7B6B192E5E780D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385340, "uuid": "3048e1c5-b5f5-4ad0-855b-435cbbc305b5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385340, "uuid": "1acfa85c-8a22-4084-b2f5-2ba2dd82b68f", "value": "196608:P1Oi8jH9Gww8ZUAVTnl4qtd3uYc0ejl4nS45Jj+moSIS:tOtUKuAh2qtdcBl455pzJIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385340, "uuid": "07220cd2-50a6-4e7b-bff8-96bb99dff82c", "value": 7533244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385340, "uuid": "b61becd0-2f4f-41e7-875d-d75b1892302b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385340, "uuid": "6c852e6e-3650-4941-bd59-5665937ae5c5", "value": "05b17e628c86b9e2878a08a7e38d33a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c41bb-e7ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767365362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365362, "uuid": "e9928d38-0597-459a-bd87-8c0a68578d36", "comment": "Malware payload (Formbook)", "value": "6370c14619ad7cdc462fcf47fc00a6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365362, "uuid": "8988ce19-a29f-409f-8c4a-1da6ec0cd141", "comment": "Malware payload (Formbook)", "value": "b06f763db65124fc25523c16d8850580af3769771440e6fc9cec856718740f15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365362, "uuid": "0d06df25-0b3c-459c-a823-8a5a8ca78340", "comment": "Malware payload (Formbook)", "value": "d9e8c087c4dc7abf060ec6a7f374d689b70285c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767365362, "uuid": "0cd82c4f-86c1-4ee5-a9e3-c0ca83e52374", "comment": "Malware payload (Formbook)", "value": "19d6be8593f40467eeaaf2e71f34c689bbf6461a8b46fcefa240aef66f9098822abc96b7f89fa64617a989554504b63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365362, "uuid": "010289b2-deba-48d1-9ccd-f8c1c7ae8656", "value": "T1B375BE16E3D911A8E567DA34CB626232E6B178064F70B9CF0699D3152F73ED06B3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365362, "uuid": "6662b85b-ff60-4b63-9cad-7f9fd7edff36", "value": "51573b5e350d818866d94a5d6dc9477b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365362, "uuid": "9d23b5b9-bc73-4a99-8e20-ad82ec84a942", "value": "24576:HI/5Lb0/IHZkMCtQib3HRuuAYlM4GkDZa7g+aFoBe9VLq6Op1C+Qh16x726:HI/5Lb0/w6guAYK4Gwa8+ar9VHOpz01y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767365362, "uuid": "453b21f7-d33e-4823-a6cf-76527dca70a6", "value": 1551872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767365362, "uuid": "5757c669-af93-4864-98dd-82f237a9eedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767365362, "uuid": "c66d58f2-dc11-41e2-bdd6-c9610671359e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8e9f4d-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386041, "uuid": "e7aeb838-8fcb-4774-af3a-caf75a718cf4", "comment": "Malware payload (Adware.Neoreklami)", "value": "f5f8cb6bb3f88922fd95a2c62d96914a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386041, "uuid": "d3c8877e-c66b-4eac-9f6d-b12db52372f1", "comment": "Malware payload (Adware.Neoreklami)", "value": "b0da5659af6c9f1af973408b77445c20ceb256009b84b390e13005e83bbc40a5", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386041, "uuid": "c81b6f94-9bdd-4f9c-8a82-b2ed9c4df8c0", "comment": "Malware payload (Adware.Neoreklami)", "value": "46a03007a10eeca243446d8b23981e6f22f27dd3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386041, "uuid": "05f8ca17-9462-4ac7-acba-cda8e2166009", "comment": "Malware payload (Adware.Neoreklami)", "value": "662e996d608b7763ddbec9fffafc40b0b38110db36775fed7a253f5bf3601101aa30ead68baac3be3df00dd9993994eb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386041, "uuid": "3c6a9209-728f-482c-ac18-abb6334da519", "value": "T13276339279E9CEB0D9173131808C1FD270D7E2470A179C7717FAC8AC6DBF8A5D62192A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386041, "uuid": "d6ccc126-3524-4b88-9ccb-8ef579011819", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386041, "uuid": "cd76ebf7-5b16-4f8e-8b92-5568856b6d18", "value": "196608:P1OW+yPqLbssCXEDepdNtHNZS9NBdH3tQj59TYYq9+02:tOnyksIe3HtZS9n9t8TrB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386041, "uuid": "b883b517-350e-4d58-a285-51050d1cbc31", "value": 7562905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386041, "uuid": "728f350d-0790-41b3-9740-0c84b530a813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386041, "uuid": "00273240-35eb-490d-8af2-7d540270acc7", "value": "f5f8cb6bb3f88922fd95a2c62d96914a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eec6ad9-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386013, "uuid": "83450fa0-738a-4620-ab11-ca624f71791f", "comment": "Malware payload (Adware.Neoreklami)", "value": "edaf32322e31069c04d055cecb2e85b8", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386013, "uuid": "35dc611c-da4a-4f82-a397-766669415dec", "comment": "Malware payload (Adware.Neoreklami)", "value": "b121099dad516a6c5dcde8e28f9fb0b3976de2c26367896fc1e48038d9e399ac", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386013, "uuid": "87443a95-1e04-4d8d-a3ff-7f6ffec4c9a5", "comment": "Malware payload (Adware.Neoreklami)", "value": "f2521012a7cda3e25d150b7e6584e9dc100f3338", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386013, "uuid": "7e887694-2f04-494f-970e-bd288997a9af", "comment": "Malware payload (Adware.Neoreklami)", "value": "2ddb70a01d66cb887b3c6f814688f7823a04d011e2d69b804e53d2484a9eadcf06a76029e3c17f32a60a871c37dbc847", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386013, "uuid": "c65c5f7c-a243-4cd3-9849-4dd5c38cd439", "value": "T17476331134E88C79D3051832C8722BF8A999E7652B618E1797A10FBC7FAC9D1F07A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386013, "uuid": "512531ce-b202-4fa6-aa84-a7e3f397797c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386013, "uuid": "ff6876bc-b837-4b6c-aa23-bef68a0ba98d", "value": "196608:P1OMFPozXn3jMsnkR0kP3R6dPL5Tts/ZwuwQbZXhXcB:tOMeXzpkfRqDlt+GMbjXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386013, "uuid": "067f018d-8a97-4ea7-a3dc-413f669dbed5", "value": 7558551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386013, "uuid": "4dd323be-9f67-4d74-905d-530812c8f779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386013, "uuid": "87b6cc47-2547-4a37-86c0-c8bfa03c4598", "value": "edaf32322e31069c04d055cecb2e85b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2d1030-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385662, "uuid": "4d71a6e4-3dc0-4e57-a646-8239b6f81ed1", "comment": "Malware payload (Adware.Neoreklami)", "value": "7d98a96f4ff63a97369f7a3386cc81db", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385662, "uuid": "6379a89b-39d9-4ec5-a8f2-c85a5cb9c2fe", "comment": "Malware payload (Adware.Neoreklami)", "value": "b1781f51092b17f376b884019d454bc1725580b7a1d6d9aa36e6e25be2409916", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385662, "uuid": "9911ed5a-ddac-431d-8971-2b347b499b3a", "comment": "Malware payload (Adware.Neoreklami)", "value": "8f625933ce125e04804504ceadd7dc793a277f57", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385662, "uuid": "47f5786a-6ec9-44b8-9f87-65b2c6df7f75", "comment": "Malware payload (Adware.Neoreklami)", "value": "5860c8588687842c28a61a616e32badccba3f7b5c26f0a36f1221caf3aac68f2c8d00f3394682a28852bbf49fad16a51", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385662, "uuid": "ee9e286e-279c-4bb3-aa59-e6a04a0a5076", "value": "T1777633363EC396B9F6036632CBAA9FD9F0FEE7490F28441B231886346D7D6519721784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385662, "uuid": "fd9ad767-11c5-4c63-979d-7a67d55a7aae", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385662, "uuid": "1dd32c84-7545-440d-a406-920639796d43", "value": "196608:P1O0AMsGfETn8dasgFZ+9qcjJu/ru+xmYh7iMf2S6o:tOSsAmn8dasgFZ0qcjJC3M7Mf2Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385662, "uuid": "87adf8ce-9974-4a1c-a5de-b4a3649a5c7c", "value": 7568432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385662, "uuid": "bbe00a13-7003-40da-a06a-8662ecaf7aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385662, "uuid": "64a2f2a7-b093-4145-ac31-b013cefa976a", "value": "7d98a96f4ff63a97369f7a3386cc81db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40285192-e7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767369668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369668, "uuid": "b6a833f2-20db-4439-ace5-13512086f11d", "comment": "Malware payload (CoinMiner)", "value": "bd1ca536690988374680da3bb70d6424", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369668, "uuid": "bb03843d-dac2-402b-bc96-0ccd7797f0e6", "comment": "Malware payload (CoinMiner)", "value": "b18b904ee3ea588ab2c4642d9660e77e2f9ad15b43d2e6d7c5a098dbe03e5454", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369668, "uuid": "7c11fbcd-1f54-46fa-b3e5-2e5f29a04db3", "comment": "Malware payload (CoinMiner)", "value": "dfe8f5b75ca34f89e6647fc2f7c25c8b14259b26", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369668, "uuid": "eb0852f4-aeff-445d-8f95-07b2c98107de", "comment": "Malware payload (CoinMiner)", "value": "29a8604c54fd6cc0c52cfbb06ff579babc82a755460814fed4ca4bb49e2764a4f1a35f80759c9f4931c14c78dd85a6a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369668, "uuid": "1c3a6d96-0a5d-4ce7-94cd-58d9e462f14b", "value": "T1A886F001FC9B85FAE507623255A762AF23389C050F36CB97EA447B7AF9772D10837249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369668, "uuid": "8feb2d06-953a-4feb-9334-ccfcda59859e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369668, "uuid": "757ca673-f9e0-4891-bf43-1a300cba365b", "value": "196608:OWmAXwku2hb4cDBJ1K/x8717Yz0o3KeO:+AgNkFDBJ4/x8x7io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767369668, "uuid": "49d216ea-e42b-4bb2-9b23-f0122d00a520", "value": 8603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767369668, "uuid": "c3afeb3b-34d8-4bef-9e02-2ede16be9a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369668, "uuid": "7787677a-8c94-4fd2-a0af-2bafa0cc605e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697312fd-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393359, "uuid": "8878bc0c-e1a4-41fd-8171-a2f28c5ee039", "comment": "Malware payload (Mirai)", "value": "bfa68692973e279c2d90fc737f59477f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393359, "uuid": "9c61a6f9-b151-477e-8303-71be9bcdd975", "comment": "Malware payload (Mirai)", "value": "b18d640b959d7fb54caa1e0f526a450f12b1ae39128df7234c1a707b2e510120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393359, "uuid": "c54d4584-1096-47c5-a099-7591c3acc1bb", "comment": "Malware payload (Mirai)", "value": "acae4f1e390d1ae151e75f0fce978eda45720ed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393359, "uuid": "bc615386-0d13-46e3-82a8-744ad103528b", "comment": "Malware payload (Mirai)", "value": "6597b018194e64401c73c8ab58d36023bdb432fa0343399f1ea821af7c89e4ceb9ec6559df7bbcd1877fbc9d3e26f532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393359, "uuid": "6fb8ceed-b85f-487e-9828-b1d4e9194fb7", "value": "T183935D8AF743E0F0DD4606B0115BF77D8674DE114024DE6AEB94BEB7ED32A02A15B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393359, "uuid": "94c1c445-5d11-4e35-92b5-a12762ee3fc7", "value": "1536:V8aqBzzvEWYy6uAzvZlMN0m3uun/OEdthGIlYff/YjwUj31IiSx4r:rszEWZNIlMN0zu/FKfWSil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393359, "uuid": "0ef16da7-d1af-4611-a1aa-48495be49109", "value": 96552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393359, "uuid": "4afddf4c-55be-408e-9527-77a6af791560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393359, "uuid": "c508eb54-8d25-4504-b752-0422b348a170", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cf500c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385834, "uuid": "e199ee23-db3f-4f74-9b30-8e1653d97617", "comment": "Malware payload", "value": "ae94d51504ae6163148086f050bbbf7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385834, "uuid": "0f0f5183-c581-44a5-ba42-a9db97d8da13", "comment": "Malware payload", "value": "b1a6444ef8aa4a018e876d462e0f32cfc5e8e4aeb7fd7617ba1abfd3c83577f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385834, "uuid": "539c8473-bd61-40a5-8038-9909fffebc26", "comment": "Malware payload", "value": "4c8d0b25389227c49f0b48fff9ef0db9bcde6938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385834, "uuid": "2d3b6922-1bf9-4110-bb26-e491f45b63f8", "comment": "Malware payload", "value": "612b025b87df2cd5d2ecbdba834e258adce6eb85e351a43d1f92514e7f2082c52668f23c882e072a397efa0804d347b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385834, "uuid": "36de69b2-4203-4c0c-9085-50d619528f97", "value": "T1E20633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385834, "uuid": "ef503197-1413-44d6-8d78-832dda937599", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385834, "uuid": "c004348e-867c-48c7-a2fa-d7aa8070fc48", "value": "98304:a/T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:w2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385834, "uuid": "a4ebe32e-7031-49b2-809d-48612811da19", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385834, "uuid": "a7ecd8ae-d147-4237-86db-869aae29b15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385834, "uuid": "c3513079-d5bb-442b-9051-fcc77f3b02e4", "value": "ae94d51504ae6163148086f050bbbf7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a785cdb5-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385733, "uuid": "a3ee3762-d51d-45fb-8b3a-d7d7db6d1e27", "comment": "Malware payload (Adware.Neoreklami)", "value": "923907e8844b3b7cc0e473a03799fe57", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385733, "uuid": "16e9a303-e400-49fc-8e20-16b177bed7b6", "comment": "Malware payload (Adware.Neoreklami)", "value": "b203d2cead2fb13f7da3bca30cd1cd54d7b9c280dd50a8d278a73d6042ac5dbe", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385733, "uuid": "afc73c06-261d-4525-aa8a-760d500d3d0e", "comment": "Malware payload (Adware.Neoreklami)", "value": "f756f9670db748fc82fe232524cb7340024a7594", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385733, "uuid": "c8a6f5c4-bc9b-4dd3-90bb-425c4ac05c92", "comment": "Malware payload (Adware.Neoreklami)", "value": "a435b87660c453ae3c018d15d281bbc9982aa61066754b297ab43490d7af9b9a0204823f82159a4b62afafa9b23f4389", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385733, "uuid": "fd681361-d9aa-46fe-9beb-c38ca13a8eec", "value": "T15576332135E168BFC5D51830ADAD1F8256B2C82C4A3E4D67FB9A4609BE35CD4C1FA378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385733, "uuid": "c9bfae21-adf6-4680-a2c2-ccb54c1407c4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385733, "uuid": "491b5bf8-21c6-478d-ac94-6fe8209f20c3", "value": "196608:P1OEZCmYzAgwZQJdonXHmQcgHMktZ7HJhb:tOEZCBMwdo3Qktp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385733, "uuid": "0f3003a8-24c2-4d71-8db4-2a084953b674", "value": 7552552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385733, "uuid": "47cd56e8-128b-4c26-af66-6168095ac5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385733, "uuid": "ed5a335f-3278-4837-9367-96483279cfe5", "value": "923907e8844b3b7cc0e473a03799fe57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6debb0-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385771, "uuid": "5fc0e754-3fad-48d5-9956-0d2386376be7", "comment": "Malware payload", "value": "9b94fc2a6191f740ae7400259a618207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385771, "uuid": "ece2c3ea-fa62-463a-835c-92ef65ded532", "comment": "Malware payload", "value": "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385771, "uuid": "f620c812-919c-4788-bead-2c296fad86fc", "comment": "Malware payload", "value": "be047da5999e9b1640f77beb033a130b5bd7128f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385771, "uuid": "99fea817-a0e8-46f4-90ba-1b7be5c6375c", "comment": "Malware payload", "value": "ac7edfb13d4eb980bdbc4612eb712a374c3b6a75ac4de311e8abd224d146d44387dc7501d8ba37063adb4aa4155c2636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385771, "uuid": "d0ce3fcc-d8cc-4da9-801a-3e7c3ab75d01", "value": "T1550633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385771, "uuid": "96acb515-637e-4c65-942c-abd7deebda3a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385771, "uuid": "e59e42f2-141a-46ad-b7ad-4dda9623d0f3", "value": "98304:aGT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:F2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385771, "uuid": "48ac8b7a-3aeb-40f2-92e0-2f47b474a4ef", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385771, "uuid": "1dbd0aa5-904a-4c44-b2f2-424f6e9d1d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385771, "uuid": "818a2b1f-b096-448b-befe-0d57f74c929e", "value": "9b94fc2a6191f740ae7400259a618207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a76d2a-e7c6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767349833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349833, "uuid": "44ce6a0a-4dfd-4745-b286-cfe63b2f0e0f", "comment": "Malware payload (AsyncRAT)", "value": "2312d5474fc130795473416cb44639ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349833, "uuid": "9cb29d16-4794-46df-8aa8-f45b0c805381", "comment": "Malware payload (AsyncRAT)", "value": "b2e08abb29bdb7387887d494fdafd5c8e8ab7d1ecbb1480a9dcd6331c7cd54c3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349833, "uuid": "5960f4a2-3ac4-447c-b09e-ba9e68ce282d", "comment": "Malware payload (AsyncRAT)", "value": "b4df9fa29e0f9eb7b37da5944811ca005f3157e3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349833, "uuid": "d24fb684-9964-4f3a-9502-10db1db6654c", "comment": "Malware payload (AsyncRAT)", "value": "c8beaffbb39d0ee69f1f4b4b4caa9f607bf035f76bf0ffbe16a454811c82e51302feebbd102e60d7d3614273b377f597", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349833, "uuid": "233d46fb-665f-47e3-8b42-fbf231130bda", "value": "T1D3535A002799C925E2EE4AB4FDF2454006B5D9772012DA5EBCC404DFAB9EFC64A127FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349833, "uuid": "0c7088d2-04b8-45ab-9ee8-61908d31eacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349833, "uuid": "12704fff-2ae0-4c76-a5c9-356a9797354c", "value": "1536:/BHdRJGuSud7sDKGbb0g7SLLEpGi8VclN:/bRrSM7suGbb0dLC+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767349833, "uuid": "8f20cc22-e59c-434d-ad47-d5cddace0529", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767349833, "uuid": "2c7bc104-a75d-4061-b129-6bedc58b817b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349833, "uuid": "bd13032e-af14-4334-a6db-09e1dc7c5380", "value": "VanguardNetworkSentinel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0865ec06-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385466, "uuid": "8e8c647e-fc88-497f-b466-a010fb2e1378", "comment": "Malware payload", "value": "3ce301d20a02d3a79c5207ca32ac7f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385466, "uuid": "05fc13b2-258d-4a0d-9574-47914604d17a", "comment": "Malware payload", "value": "b32cbafa8c9a13507893b68d3dbb8da019bd793816714899fa242f0cb1325d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385466, "uuid": "cbcd4eaa-985b-4a05-9a34-648aeb0bb78d", "comment": "Malware payload", "value": "413567f436b63b9de43e982b5189df1dea74bda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385466, "uuid": "29d1a38d-7e2d-4bca-9b54-a270a31618e0", "comment": "Malware payload", "value": "623c5fb0145417f4ea24c689da71cafe9e78362bd5753b590b95ef3345c58d47d386d1c34f90bd6142cb90fa8bf94483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385466, "uuid": "9a0fe55e-9ece-427f-9434-4a1fbea1d360", "value": "T1AC06E169B6A0C923C0621CB95E3992AB7997DB8F2F908DF25DA09804CE341D77D3731D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385466, "uuid": "cd67dbcf-2c12-4a55-8d1e-4535c4c482de", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385466, "uuid": "d57b1d04-9d34-45a4-9a28-9cff73158a96", "value": "49152:PS/NdnNM3mMTazrsyL71djeH0gedQN2KLu52mqsJqttezfzjmPKW6oyBHIp7:PS/NFNAvTaz9vWqdycPueLjmPWoQoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385466, "uuid": "bd60266c-719f-46b9-878c-5dd366bcb206", "value": 3911440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385466, "uuid": "4121ea97-d780-45dc-8eb9-851b7a1475d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385466, "uuid": "cf23cc22-9bf8-4c25-ac02-6d17ff5a3e53", "value": "3ce301d20a02d3a79c5207ca32ac7f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde3543e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385797, "uuid": "f669b0de-b3f7-40c8-9879-8e87c0de5880", "comment": "Malware payload (GCleaner)", "value": "a1bf5b4d50a38fd847ead0f671b1e153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385797, "uuid": "9e1f6232-56a2-4f72-9e88-1c4c5ad41646", "comment": "Malware payload (GCleaner)", "value": "b357ace9d2161166465c831da5ef856bc36de458338b78944426ac7f5e8ffb1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385797, "uuid": "fc843f83-41ff-4b39-a784-089ab5fe7e64", "comment": "Malware payload (GCleaner)", "value": "77c83b2f557a8e612318fee03abb9fce4d895c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385797, "uuid": "216bb852-2ff2-4738-bb42-19b20bb2909a", "comment": "Malware payload (GCleaner)", "value": "e81b435088cac2b615bc4b4503ed08d1a1ca72d7068c91825653ebead55fc72397e28b3c108cc51ef016a11e43b7dc56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385797, "uuid": "ada74af8-6343-4776-b2f3-79aae57e2208", "value": "T1B046E016CD78473DE78B25386443AE1498EA5AD2DE29272EEEC108B2F71C48117D7FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385797, "uuid": "1d61ac9e-c637-4d2e-886b-d9333304837f", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385797, "uuid": "3ec4c565-7479-4d3a-954f-aec6f7da1c28", "value": "98304:CC1N0O+Yndh60x1MkJiXPOTF1ErRA8904xR9he/q4az:CgS5Y/xx1MkJ28+FA8/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385797, "uuid": "f19d5824-fe7e-4613-a7b5-70dc4213ac82", "value": 5606160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385797, "uuid": "4e4125e1-d54b-48e9-b045-52335924a82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385797, "uuid": "03016935-307a-4fc7-8fc7-ea1ef63f9c67", "value": "a1bf5b4d50a38fd847ead0f671b1e153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2ee4a4-e78c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767325044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325044, "uuid": "3e653fb7-1a6b-40bc-990e-392227b48ece", "comment": "Malware payload (Mirai)", "value": "31388946fb3fa25aab8d62913f09ed66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325044, "uuid": "b2dd9a63-1c0c-4305-a593-080a9e564e5d", "comment": "Malware payload (Mirai)", "value": "b3805f13074fcd4dcfb1abfeb47242329b751bfa25598517e8a7d617a2188371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325044, "uuid": "ea2fa102-f778-424a-821b-040cabed94c7", "comment": "Malware payload (Mirai)", "value": "3a5499b9cfb0fb32948b02d997d51a712b81c4fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767325044, "uuid": "4731af12-60fe-42c4-a562-5f196ed60ce6", "comment": "Malware payload (Mirai)", "value": "b866355092b1d581ab85ab3e51b45696fe40a5c9cf39929e4159731846a3934512409e6e90d16e4e7c3079e2e13dd626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325044, "uuid": "cbb39dbf-4ad4-4294-898e-174bdd6c68bb", "value": "T1E2631254ACED268CDAC201FBE54B58C42F031DF4E4AE346A6F150D9975E8E0EA6903B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325044, "uuid": "f45118e5-19c0-4459-9a12-8add51f50581", "value": "1536:jSu5t0/RrtNifJGLzw9O78+XR3GOMZGa4Hr43Lm:jSu5qHNixO2O782FXM1BLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767325044, "uuid": "95b766a8-5dcb-494f-959a-3724a6b74635", "value": 69220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767325044, "uuid": "623ea86e-098f-452a-a8dc-dfe51b9fb731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767325044, "uuid": "4d440fb1-3d00-456f-895d-2987be9fdb46", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609ae1dc-e7ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767338798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338798, "uuid": "8d08d355-9b94-41d3-bc8b-bf487ea9384f", "comment": "Malware payload (Mirai)", "value": "fe67ffe4065bd997dfcf908a8acd4696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338798, "uuid": "8a652f89-a540-4467-9fde-d4018432a981", "comment": "Malware payload (Mirai)", "value": "b3b99bb56b17beb0ba362bb542310110db9d7b3dfd88f376562343a6f6b7b4f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338798, "uuid": "dc24047e-8a8f-426c-a762-17b9fa3227bf", "comment": "Malware payload (Mirai)", "value": "b62431c65ec68c777d352c1084fefac9e274514f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338798, "uuid": "557d00f4-6e6c-42ce-9a6a-efdbe7ebe2e4", "comment": "Malware payload (Mirai)", "value": "d6d263d7eccc861c07f4b803915813e31f41c5fe9a55958d55300436e9851c3c9646bd5d4f0e3c5edec593696f7b08ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338798, "uuid": "13ac05c8-3838-4ca0-b194-f6bd3607668c", "value": "T1C0D32956B9519F11D4C721FAFB5E414933136FF8D3FA71029D20AF61238A99B0FBA602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338798, "uuid": "3a1251fd-3c99-4452-b4c9-94975ae22406", "value": "3072:Mg+BSXqyJfteDwaPQ9NpLPvZdRmxrbzNgWtp+:MguSXttawaPQ9NpLPxdR2zGWtp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338798, "uuid": "fa482554-9edd-41e8-ad6f-870b4d8287d7", "value": 131880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338798, "uuid": "8335300e-b18d-4aaa-bb71-8afac4721dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338798, "uuid": "2ed3c775-e649-469a-9991-f1ebc46313e6", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b14618-e80d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767380470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380470, "uuid": "010614e3-6eb9-40c3-af6c-721714e7834b", "comment": "Malware payload (Mirai)", "value": "95f78207950332860a9510e804df56e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380470, "uuid": "67960470-d7a9-40cc-843e-975d4dfed0bc", "comment": "Malware payload (Mirai)", "value": "b3e85208379e3836dd6d45b8156fc5aa86920c8f1e6317cd5b937105cca04686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380470, "uuid": "d57cddc2-0446-438d-b8c7-7fa1a8f40016", "comment": "Malware payload (Mirai)", "value": "59ac31320a1720d9a5b92eddaa2b5aa6ca239f15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767380470, "uuid": "a88a97ae-d14d-476f-a75e-7a95a70ec325", "comment": "Malware payload (Mirai)", "value": "61f2d5219ba866785ed1de58d5b632d25550e11f94cf580896b99ffeb997cffd5742df3eb19448679e5bc0e3be92c674", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380470, "uuid": "1660c8ce-fd66-4fec-bdf3-7266aacf3439", "value": "T1D0130A83E600ED3DEC5AE77AC5071A09B170758682514633F7B2FD935D722D8982EE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380470, "uuid": "fc73b789-011e-4ed9-86b2-ba804e4c1642", "value": "768:qFwQ2Q/XgvBoV1Eh62WPIooYwy0b+8gykkLmamxADszt0DPlp:qmHiEoV1Ehuwpq8+8g0LmacAQzSDPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767380470, "uuid": "b70fc4aa-aeab-4b32-9917-9778d664bb43", "value": 45048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767380470, "uuid": "ee791b7b-ac5e-4874-b8c8-4493c2fc5609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767380470, "uuid": "cce34856-864b-4aaa-baf7-3aedf6137d97", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d592e59e-e778-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316661, "uuid": "00259a0f-dc5d-4a66-895f-8b36ff113a17", "comment": "Malware payload (Mirai)", "value": "b251ababd5baa89111a94c8c6e3d2d6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316661, "uuid": "998d226f-1092-4fd6-8aa6-7a8eb5ff6063", "comment": "Malware payload (Mirai)", "value": "b41a641b43819e89c0fefd55a340577f0399390fe1b74e8949ae3243b8f3f013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316661, "uuid": "ea16fd39-70fe-4636-aef0-80478a22738c", "comment": "Malware payload (Mirai)", "value": "979faebe1ec0980fbaa14c4e888359786c990d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316661, "uuid": "01ca8879-261b-4b0c-aeb3-18e559e4859b", "comment": "Malware payload (Mirai)", "value": "728cd1094ead0cc2346af885b51f3599d7c5880b6fe86ad3b14b7e05d9fac6a6d07db258bc40e8d1ee3871e63354775c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316661, "uuid": "b48950f2-1bea-4228-90df-6cfc5fa98cc4", "value": "T1B1046D91FA2E7D7BD2634E3BC64247157F3CAF008E012517A0AE725B29BB1D10F6674A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316661, "uuid": "ab162731-4ad3-4b14-886d-948972095225", "value": "3072:03yoqH6Vq+HQF+MK1b5aOUHNMLcvQ3F4/Keo+Z+6iiEjoJsAeLfzV:QGatZ5ZWN5vQ3i/K/7JhoaAe7zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316661, "uuid": "9acc6c4d-f106-41fb-9be4-65c69c43fa1c", "value": 184052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316661, "uuid": "4dbe393a-aabd-4c95-89c2-92b4daf33a9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316661, "uuid": "f0a36b51-8f65-409c-8675-3e684016d0df", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c97ed19-e77a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767317371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317371, "uuid": "6a7d4999-5137-46f3-bd8f-54b82483628f", "comment": "Malware payload (Mirai)", "value": "ef852fcaff21caa49449295535a56bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317371, "uuid": "f9a1c4e3-7837-4d5d-8320-133f3fd4a959", "comment": "Malware payload (Mirai)", "value": "b4b4acaa4ded42e25977d6b11c480bff3169bd55da16b685126f7432b52bfeea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317371, "uuid": "7be12eeb-598a-4020-9f9c-897e68ecb551", "comment": "Malware payload (Mirai)", "value": "d6ad81bf6c9c5155bd3e92f5c8acb8c8a1dd0b72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767317371, "uuid": "8cf6de8b-0c01-40ba-bce9-1a53b1b23714", "comment": "Malware payload (Mirai)", "value": "deecb6999e13c65e274f33773a2a12ceb889466f8dbe9256f401a81fcb0b9f6bc3f93ab811948c99851fb91cf08093a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317371, "uuid": "1fb2a8c2-2b3b-4e35-a936-58219ef2a3e6", "value": "T182C312DCA81B642AF1C66777859E4BBDE992C73F9B8B1307AC8CF6CC2E440144E65117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317371, "uuid": "e4a8f1c6-7232-4663-b974-dbcafda517fa", "value": "3072:kOPFh+KjD6d6f9nB7vec+GExImgbc4EfjLtn5UPz:jFYRonBi9GQtEmPg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767317371, "uuid": "46f7264b-472e-4a95-b4eb-0419da9e986f", "value": 126860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767317371, "uuid": "ecf4ec8a-39d4-412c-8a46-dbc44e5c0684", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767317371, "uuid": "f071e400-764e-4d8c-9f72-88c7510a7b39", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f93516-e7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767367210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367210, "uuid": "5149fecc-8918-44f7-88fd-7e4dfc06e029", "comment": "Malware payload", "value": "f756a45ad04768c820fb5e9657e4376a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367210, "uuid": "0e3dbe2a-b9fd-4f87-8c52-e767ffa02bc1", "comment": "Malware payload", "value": "b51e78b6963fa0b031673a404ba1846dc6037ce179f5fec06f818320ad7ead36", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367210, "uuid": "e710af73-8af6-4ec3-aba6-af832277dd87", "comment": "Malware payload", "value": "4d8f0b8444cc7cf824d38765cd3aad3de208520c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767367210, "uuid": "cfebad73-52f4-49fd-9629-3465c671f167", "comment": "Malware payload", "value": "16f1d21cdf2ac937c17f3de88d6b8e8e053237a79ccee5e972f5aa63a0869e68daca8ef0b7199eb872d202b7aa11d813", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367210, "uuid": "add246ef-dcbd-4f24-b3e0-7a2bb5e32c9b", "value": "T11DC6239796D653E8C4C74A40654782CB70C1B5AEC5EF9D2E36CB5C037620C6B428EEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367210, "uuid": "9308999e-c322-46e7-915f-daf8ee99b73b", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367210, "uuid": "7de5b58b-6dc7-4ee8-a03c-5f078cd63fcc", "value": "196608:JFFJRSExokjKL0GzgkF6/B/VMVKqzAK8/P1aVirr1t1fVPh2eAfmA0QK1:TFJR1OLPzgkF6/BtMVKqJ6P9ff8k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767367210, "uuid": "cbfe7db1-2453-479a-9905-d30d78917619", "value": 11723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767367210, "uuid": "2bf97ff3-3623-4da1-99fd-ac99505821c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767367210, "uuid": "3c8d3c48-e16d-4d4b-978e-41a639febc7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a94305-e778-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316475, "uuid": "91527205-a5a4-4b3c-83f8-10e0585264a1", "comment": "Malware payload (Mirai)", "value": "e4ae387ef34e50102be7289635cd7b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316475, "uuid": "b7135859-9ad7-46c4-bd70-349351312ade", "comment": "Malware payload (Mirai)", "value": "b5ab9cdf7636b4b616853275a21a8b6e4d9884cffa23720f28da88d37f6b8dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316475, "uuid": "5621fdce-97c3-4939-9342-eeb5fcf60a78", "comment": "Malware payload (Mirai)", "value": "3d75d5b9b65bafe3c9a3859f4289154db511e7ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316475, "uuid": "a6c7836a-861e-40f5-a961-5cb99173771f", "comment": "Malware payload (Mirai)", "value": "1f1f639055ee59ea91e9be44abd077148bdde538b72d90932dcac25fe95967a00d467c4131aec40fef753d6701d0407f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316475, "uuid": "1d0e3875-fb2a-438a-8732-47a15921dba1", "value": "T1C5436D86B409DD3CFD5AE67BC41A0E04F5287351A6830F27A7A6FCA39D731689C17D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316475, "uuid": "f1c45403-fc54-4afb-ab04-df75d0b19651", "value": "1536:IXiZAYUI9Zy0p5yd0gHUyMMM8SvbtMHdTKGZPm:IXMAYU85ydXUAkCHhXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316475, "uuid": "e4378e25-4419-4e29-b175-56a6b46aa7c3", "value": 58684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316475, "uuid": "638565dc-98f5-4167-bf18-388cd2ad08e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316475, "uuid": "04e3eb9a-3ac7-48ca-8c10-0702388a5253", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08f7a2f-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335899, "uuid": "7e52a0a2-962d-4961-8ea4-02c18c469122", "comment": "Malware payload (Mirai)", "value": "f313d2cfca12c5f0e996229438192c4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335899, "uuid": "86a1e33c-52ee-491f-b6b2-d11840ebcf32", "comment": "Malware payload (Mirai)", "value": "b6583ac22b273c602e013f298fd5e16ac4f38663a12cdc2571ef277644ca0f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335899, "uuid": "e9ff08e1-ce2d-4932-8207-87746a8c48cc", "comment": "Malware payload (Mirai)", "value": "02e4d468667a246d7faa77e6deba232587339b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335899, "uuid": "9c81a6ab-3d38-4b2a-8dde-a281b15a30d6", "comment": "Malware payload (Mirai)", "value": "81dc55880d19d5f1f7b98d006fda0d47d17529588529e66d232bee03663ab7b2e19290b1f8758b44362e2ce948325417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335899, "uuid": "26b87554-5e70-4ddd-873d-236caa4f8773", "value": "T1BC141B42BD519F13C5D622FBFBAE018C37167BA9D2EA7103DD21AF60378A49B0D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335899, "uuid": "d9fa7168-74c4-4eef-9353-186df33910af", "value": "3072:Cuk19XvB8vwKO3IAcsMo5Yf4ItYEPiECgbt1veuj:Zk19XvB5KOYAJfOf4InPPC8t1veuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335899, "uuid": "92d316f7-a3b0-4a82-ba09-fcf81be94c3d", "value": 198012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335899, "uuid": "5ecd4d81-35a6-46f6-8c6c-19b656d674da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335899, "uuid": "07099333-dcb3-4fde-ada8-56c2d3588669", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157129b0-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312903, "uuid": "c1584819-a45f-4d1b-89a1-a9bb1a34fa6e", "comment": "Malware payload (Mirai)", "value": "de44544adc4f8dcebc182a4575c30081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312903, "uuid": "96c172e1-f14e-4ad0-815a-b14dfc5c1462", "comment": "Malware payload (Mirai)", "value": "b666419fa7037299fa46a083b179b21f52a55948c9a4e9ac7c561ff74e1ef641", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312903, "uuid": "bea7e362-f3c7-4501-ba7e-7fad6846c20a", "comment": "Malware payload (Mirai)", "value": "75402cb621b8344c33ad572dd0ba420bb26c26f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312903, "uuid": "c9cb4f73-5351-4249-a023-4c4c2a567f07", "comment": "Malware payload (Mirai)", "value": "034ff1e7ac975029170bde24cf33d71c764f0d68ca292f13834c83f01404f7f97bfaab311f767cd4d413d97f4a444585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312903, "uuid": "aa263ad6-11d4-4551-8810-63c74216a6e8", "value": "T120936C02B7C0CCFDD49AD238576F72B6D922F42D1231725B97D4FA266C8EE113B2A194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312903, "uuid": "1f481ac0-a092-4701-a989-ce16dc106769", "value": "1536:U8jBAK3/SxbYMvV2riqEb4LyFFyTqMVux1Tk38pXlQArhDMPRyMP:z5SvvogF8TqZx1Tk38rQAxSXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312903, "uuid": "a1c4aaef-383e-443e-9517-5705e0d0d477", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312903, "uuid": "114d59a1-00ec-4418-92fe-642968b10354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312903, "uuid": "4cd061a1-b5c4-468f-9a7b-15e0f82e5ddd", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbaf994-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385907, "uuid": "1481dde4-a2ed-492a-8570-f274e4e3a748", "comment": "Malware payload", "value": "c65eb04541470eb3396cbe8fc1cd1069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385907, "uuid": "b404b056-e929-4e07-b2e5-a8daf8b2a415", "comment": "Malware payload", "value": "b6f17cf07f8324049366617197dfe66a6514c007ade2cf9118244c29b19bf3a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385907, "uuid": "728890f1-008b-48a1-82f5-62149597aac5", "comment": "Malware payload", "value": "726e1a934bf3325c33bc7385e4c8baa31b74403b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385907, "uuid": "3521eef0-e674-44d5-8f76-589792fb8a06", "comment": "Malware payload", "value": "5c841434cfb02a5759e58806301da5e4599505d5e9d92154ad50a73b764168aebbf1d83e15cbc3e1d6b4a5ee985e402b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385907, "uuid": "39557022-f1be-4c72-a23f-ca4e98d0a017", "value": "T19A0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385907, "uuid": "52077613-9bff-468f-a26d-b69e9ca3c792", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385907, "uuid": "1ebed8ad-f4a1-4389-b73f-f8f1f7c289f6", "value": "98304:a8T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:r2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385907, "uuid": "700e040e-ac9e-4971-a74e-6fbe8705ef81", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385907, "uuid": "59c32824-e221-4a06-a149-e447d9c918c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385907, "uuid": "38837367-3233-4cf0-b6a2-975dbabd3abb", "value": "c65eb04541470eb3396cbe8fc1cd1069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c748d9e8-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336394, "uuid": "78047979-eea1-49ba-b4fe-f2d3750adc33", "comment": "Malware payload (Mirai)", "value": "017e29f4bfdf56b67db3ffe123112d5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336394, "uuid": "e683cbc5-70b5-4bba-8918-1ddc84001537", "comment": "Malware payload (Mirai)", "value": "b706b05eb5ec97cf5e6e460afaca22a66991f00d497e62daae049121aba834e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336394, "uuid": "032ef279-9f05-48e0-9627-b93c13b559f0", "comment": "Malware payload (Mirai)", "value": "d722e665ceea50622c1ba1a282c9d81ec730cc3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336394, "uuid": "bba7765e-c7cb-446e-b954-56e0d1240be3", "comment": "Malware payload (Mirai)", "value": "7ac44dfb68229eac262bc55ac01781350f07e9cba809210fbfa10ad16954f547303438865cca1eb6ca21b0799c283a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336394, "uuid": "38775f46-35b2-4e3c-a5f3-4b849fb30ee1", "value": "T186B36D02A32C890BD6F70FF027FB53E1936B679025F4D286360897495576F729A06ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336394, "uuid": "e3bc6ef3-e387-48fc-b743-1976e2c8905f", "value": "1536:oCKz9acakaS/Vf4G8zQ/jZHSQjCT23rqdsXOn/aqmuThOTuLNLxqHexUhEAVDmu4:ozIcla9Q9y+mwrq8O/oTuBMxSu6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336394, "uuid": "9a2554b9-bb40-49d1-9e0d-84db7903395e", "value": 116248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336394, "uuid": "f4f22216-cfb1-48f7-92c1-406266ee3f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336394, "uuid": "7e018400-f54c-4a12-b14b-b24a1bb25b2d", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cbe037-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381644, "uuid": "6fdcd211-427b-4f2f-bb37-751c9f5f90c4", "comment": "Malware payload (Mirai)", "value": "fa95c6b57d0bd2d194d0e8a248a3cef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381644, "uuid": "a84c7f69-d517-4816-bea1-939cd3a4bf91", "comment": "Malware payload (Mirai)", "value": "b8304ec887bf660e0ae6f0e792e078727b02519103476d3d36e85a5684c0f332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381644, "uuid": "831c2ae3-4181-481e-9908-180b99cc9d04", "comment": "Malware payload (Mirai)", "value": "4cf22566014df42386b0b501369872ab9935fd3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381644, "uuid": "adfa2ed3-810c-46a3-b842-b1377cdee66a", "comment": "Malware payload (Mirai)", "value": "8dfead7e8657fd0cc282084c4d93fcda10341c941b6098482914dea3475437cd9942dc6492a1a352f75ab948bf042916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381644, "uuid": "2ba3dbae-b91b-44c3-a121-d9b164ef65c1", "value": "T1EC535BC99593E8F4EC120A70317AEF338677F13E2129EA87D3A99563ED41642E10739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381644, "uuid": "30ecfa1e-65c4-4675-ba3b-f37d2dfd6ea6", "value": "1536:Qs3hMUoOZSSwOrVnGm5tg3nHihz78IN1gfTS0DVsS/4Qj5hYoLz5xqOE5tSwj6:73hMUoOZSSwO35tg3nHihz78IN1gfTSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381644, "uuid": "c9ebb737-2cf3-4564-a8cc-8802814b03c5", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381644, "uuid": "371c8f0b-920a-46d8-8eaf-7491672e950f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381644, "uuid": "a5ebea36-5475-4ea7-b1de-eb4bdd5a674b", "value": "meerkat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28306d20-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392391, "uuid": "eb36140c-cbdc-42c9-b386-3825cc28b5c4", "comment": "Malware payload (Mirai)", "value": "5b11f6d653dad974d19b4c2e08be7947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392391, "uuid": "3601eba5-1c95-4753-a18d-b8ed47747537", "comment": "Malware payload (Mirai)", "value": "b85a2ec32a2e4a0b8762297dcfa51b87309e92b0d930b66ba523d4133d1faffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392391, "uuid": "c21ca46d-4923-43a8-9684-b883b0a4c703", "comment": "Malware payload (Mirai)", "value": "7b06a5d4db870203db6734fbe75988c207fdb845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392391, "uuid": "1d25c5e4-59af-4c56-b5a5-6dfbb60eb13a", "comment": "Malware payload (Mirai)", "value": "83d715dcdbc7f8bcf051e90c37a5a272a79986823d267ee1ccea5a063c19cad1dc5bbb60fa605c3b78042d8ada236be9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392391, "uuid": "1aea4f02-ec04-46d8-81b6-ff91bdc87719", "value": "T1AE835B44F783E0F9F29345B1422BE3FA5A748D156026EAE1FB0A3779BC717124E4A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392391, "uuid": "4f4113c5-afc8-436d-9810-b67f2b067cd8", "value": "1536:HZRpW2ymYeX5t0hcIZA03cY+alvWLSN3oroC:o2X3uhcIx3cPalvWnoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392391, "uuid": "53d936b8-911e-42c0-9f36-fc0562f7b571", "value": 83208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392391, "uuid": "78a8a913-4be0-415d-89b9-d6ebe6a811df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392391, "uuid": "b021d67f-80c5-4214-887e-e03a10b03135", "value": "catgirl.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c4f00c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385569, "uuid": "be9491ca-88f2-4409-afb7-3dda28fb4d5c", "comment": "Malware payload (Adware.Neoreklami)", "value": "63b749c1a4c8febd9475077b4a9cdb3a", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385569, "uuid": "e67e40ab-14e2-4a2c-85cb-b0064894865c", "comment": "Malware payload (Adware.Neoreklami)", "value": "b8bbefa8d805b23e45b97a73921154035628902580b5ad05082ad521b246ee2c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385569, "uuid": "ab476876-a07e-48ea-a973-9875585f8a92", "comment": "Malware payload (Adware.Neoreklami)", "value": "4f99c07573d0a3230a0bd4b25c9bdc3f6bdd371b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385569, "uuid": "96ca415b-5ccc-4688-ac5a-1b3d454d502d", "comment": "Malware payload (Adware.Neoreklami)", "value": "308b779c1485165a16a9d8d0d88124e9c3f007aae45f5b130940d8c890c531d2b67dca068ee19bcb6edaf95499652e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385569, "uuid": "fb5e98d6-bbf0-46c7-be55-ed1ee4f64120", "value": "T16A76338376EBA7F0D6B453385CB92FC6766CE3750A2648533716CA086C3ED8B456206F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385569, "uuid": "d1927e81-227c-4133-b1bb-264e40b8b789", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385569, "uuid": "3abc9c10-a382-444f-a2ce-50e89b8b7a58", "value": "196608:P1O143GsnZtb27QAS+KNItdvQ2KMs4TBJQ/t+k7egekaxQxAZ:tOG3Gsf4Q/IIUByck75FuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385569, "uuid": "310ce8b2-f2be-43d8-8331-66181d906e8c", "value": 7579895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385569, "uuid": "89c9d891-b4be-4827-89bf-9dd75422efc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385569, "uuid": "14b856a6-e131-4331-b020-cbfa143ad03d", "value": "63b749c1a4c8febd9475077b4a9cdb3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eed5ff-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335373, "uuid": "7e1a3970-97c8-4cd6-b79b-bd09dc68d1a3", "comment": "Malware payload (Mirai)", "value": "2e64d25d0880c65cc045c22d585a7d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335373, "uuid": "cfebde89-cdb6-4b66-b469-5352218956a7", "comment": "Malware payload (Mirai)", "value": "b9587731e0d78011a1e68d95fd123159276689f0c1ad7420e78f4d82123c7151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335373, "uuid": "0a90d1c0-a138-4983-a258-17223379bf78", "comment": "Malware payload (Mirai)", "value": "72e6319359694d429b2ce30fbbea8e58c8489317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335373, "uuid": "b0fe6c7c-dd23-4dd7-a0c9-33c3bb3e8527", "comment": "Malware payload (Mirai)", "value": "1c36e43272e064fa5bccb397027a22bc0b27111d9de5fe3710984374ed32d2948ebbac1301603d3b0031bfc9ab8fb448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335373, "uuid": "76779df5-5bdf-40b6-bd19-4103da647a68", "value": "T17F7302EBB7132499C7A4A134BA8B43B679D80E17BC334C515313A35F0E5A451BAF3744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335373, "uuid": "522de687-f5b0-4438-a5bd-572bcdf872e8", "value": "1536:YgZe0UdZ24N76kwPbuQ/xOXczCbyXpI5VrQWc72VPoxjWbkbeVJuEO:ZZebdvuKQxaJZGaO9beVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335373, "uuid": "eeae736c-fac0-4743-8684-27ba118bdd73", "value": 76668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335373, "uuid": "bd7a2f8d-3e7c-4358-8907-a23a6e71254f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335373, "uuid": "ef8bb19d-e6af-4b2c-aae9-f9f88c3e8693", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9861a85-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385816, "uuid": "aaf345ad-ff16-4b86-a4f3-b255b9bc9071", "comment": "Malware payload (Adware.Neoreklami)", "value": "a921c3393561d0c31c44154989e717b5", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385816, "uuid": "e4eacfd7-3d61-4538-89dd-bda4f2facd63", "comment": "Malware payload (Adware.Neoreklami)", "value": "b984862d77be0a9d68a22975c0ddc4aa7c0ab2c25ddc76ef2c2a27e6fc2da525", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385816, "uuid": "c6d70582-a3dc-492f-9fd5-32dc4e7799e8", "comment": "Malware payload (Adware.Neoreklami)", "value": "ccdb125864306a87865e490afea72ed5db60cf56", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385816, "uuid": "a05ac6a0-8d3d-459a-a5ba-29cc633b5eed", "comment": "Malware payload (Adware.Neoreklami)", "value": "76a5253ef2ebec5fc812f5cf6f0058f558bff6a514f7f0ff6f730070da67eecac34d99d433783cf50c93aea43a72601f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385816, "uuid": "14740705-d1a0-4db9-9d96-c462229eea22", "value": "T1A176336C37E8C9F6C58D203745752BCF859F91002B60B20BA7995A5D7F7E2C1A33262B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385816, "uuid": "2baec28a-650c-481d-925f-2aec53e3f0c8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385816, "uuid": "bbc2918f-f693-4cd3-a142-00a4dfd81744", "value": "196608:P1OHPpEtpMFF4wwQMw1/kIEv/vI+gq77hjxel63xSm:tOHyMF/wTrIEfXtjxel6Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385816, "uuid": "6e7ee806-a324-433f-a69e-f833adf15775", "value": 7624274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385816, "uuid": "8e164eda-d7ec-4f0e-9ebe-7aa608a6d0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385816, "uuid": "b4af30d5-db94-47c8-a7a8-c605ff813e12", "value": "a921c3393561d0c31c44154989e717b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c12609-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386030, "uuid": "c070f8dc-43f0-46ae-9893-4bcc3c86b4f9", "comment": "Malware payload (Adware.Neoreklami)", "value": "f05bc9db17c3d671cb4e207d469bf9ef", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386030, "uuid": "01ddd9e6-be67-40ed-a847-58e7a2bc0347", "comment": "Malware payload (Adware.Neoreklami)", "value": "b9a3a1c9dc8b656324515ffb14d94cd1d1e63440c34c4868e89b47a24b6a9dba", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386030, "uuid": "cabb178d-4283-4556-9f57-2e8283f9e5ab", "comment": "Malware payload (Adware.Neoreklami)", "value": "b1eba0bc5d6cd574621e849894ce34f7384656fe", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386030, "uuid": "8a6b031f-cf99-4f4d-9dcc-70a161f3d6bd", "comment": "Malware payload (Adware.Neoreklami)", "value": "416e9b96ebf1c181daf0c013e72746ec4ec11079fa91da1863107a5e63a2db0766860d70056161bf16d6ee383e9269d5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386030, "uuid": "64fbd97c-e807-4689-a575-4dfce9510ec7", "value": "T10976330271D1CAB9F60E54778482A3C6B989E24689348A6F77F6453D3D7E86C612FC0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386030, "uuid": "6ecee462-3eff-42dc-8046-fa8169bc00a0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386030, "uuid": "b1ff3d40-7daa-4435-80ce-29215ff589d7", "value": "196608:P1OPzAmQRPxSl5K1Xd7Hhe6kuktnZQYELYPqs:tOP8mQRPEK1Xd7BevnzELYPqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386030, "uuid": "0742914c-b15f-41fc-93b2-a0530e7b502c", "value": 7506583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386030, "uuid": "a2393038-27e2-4ff8-b5e2-323312c38b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386030, "uuid": "c9d4665f-fbdb-4bc1-9be1-6f7e01892bd9", "value": "f05bc9db17c3d671cb4e207d469bf9ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7510651-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385356, "uuid": "98ca57e2-8d31-430c-9405-cde81135348e", "comment": "Malware payload", "value": "0c2b51c8b031f00b02dcbe0f48a84d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385356, "uuid": "25d5ec1f-cc7e-4916-afe2-42d2948b850e", "comment": "Malware payload", "value": "babd85139bfdb9223435f21d35ee2d3cccb6d56df0056d8b68f37fec900ef96d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385356, "uuid": "77de59db-81ab-4976-beb7-0e86a1270a1e", "comment": "Malware payload", "value": "0edf7da30c9f1a553d06e0f91abe5887b15a1edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385356, "uuid": "62eb02ca-54bf-4de2-90e7-cdb909766d39", "comment": "Malware payload", "value": "6fd18f60854a7642568500cf956871ff737b638dd135204b991334fa7f7c076a799d43624ae0b998dc423d8d2e50c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385356, "uuid": "47cbeb7d-39bb-418d-893a-5df562c88f8d", "value": "T1A60633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385356, "uuid": "161cd29b-4e03-4b8f-af44-4b2ce2538771", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385356, "uuid": "55fbf11f-d5c8-4340-a18e-b1f0bc455316", "value": "98304:a9T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:a2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385356, "uuid": "12b07c54-58a0-42b5-b7d3-5a857e6c7c3d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385356, "uuid": "de70c4e7-5d17-4d5d-86b8-69944d325bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385356, "uuid": "390000d3-cb97-41f3-907c-ee2af239be04", "value": "0c2b51c8b031f00b02dcbe0f48a84d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ab90ad-e7e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767363283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363283, "uuid": "b2912605-54ea-4915-b6c0-85e9964d8e5c", "comment": "Malware payload (Gafgyt)", "value": "c32e9c83c23db5bab094ce529a416401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363283, "uuid": "5e8bc4d3-9718-4551-aa01-a56da282fe28", "comment": "Malware payload (Gafgyt)", "value": "baf1b13cba87c9ff798cf283829516181728bf4dadab85e2de1f6bd3be51e8ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363283, "uuid": "ae27f99c-32b0-4e93-95f7-e973078dc26b", "comment": "Malware payload (Gafgyt)", "value": "89ddc3f15515c959ecd4231ccdb3d2ba1553ae11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363283, "uuid": "808ce341-9daa-427b-8918-72b7f9debf49", "comment": "Malware payload (Gafgyt)", "value": "9b3b9d778bcd4c3887c6bdb242b39e5f722a5aec4a9f80d0e0514c0ae7080971d161828c0ad6fad2b2b690477a3f8ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363283, "uuid": "39751f01-1e23-4edb-9ef4-ce5cea5d6b35", "value": "T142C33906B5C1D5FCD8ACD2B82B9F6129E531F168113035AE3B88AF16399CA143F6BDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363283, "uuid": "c4e0447b-e510-4072-b960-ded27061f878", "value": "3072:jXjv0sR0VrjL7FRekG9S1T1h1pA8b3jOjtoTGGL:jTMsmtL6kfHTtjaKnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767363283, "uuid": "41561ff3-080c-481d-8a60-f900d0911d00", "value": 119416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767363283, "uuid": "52541355-1dd0-41fb-a944-160d4ffaaf84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767363283, "uuid": "cbda939a-7505-4193-9ef2-51bdecfe3394", "value": "rondo.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa60098-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377658, "uuid": "a27e3d83-ab23-409b-990f-c326453e64d3", "comment": "Malware payload (Mirai)", "value": "84152d2c2168d77bdbda4c060d20871e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377658, "uuid": "b80507d2-6685-4242-aebd-035cb4a03aae", "comment": "Malware payload (Mirai)", "value": "bbb60a775e9d010dcfa99ef48582e68d787b580fa840240a0f48949c2794e5d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377658, "uuid": "01354def-88ae-4e12-818b-88d433898b50", "comment": "Malware payload (Mirai)", "value": "b070d378a90f2da7bcaf7d31c813190346169fc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377658, "uuid": "1fa7124c-5e69-4a54-884a-4f963d6edf83", "comment": "Malware payload (Mirai)", "value": "e20d60fc6283e5909e2e81e96e675163bb7878a06454b251ce092c7d0431602e33532fb5e830400d4d416caa656d917f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377658, "uuid": "433ef758-24d3-4768-a94c-e9cf84d00664", "value": "T1E8141A42BD918F13C6C622FAFBAE018C37167BA9D1EA7103DD21AF60378659B0D37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377658, "uuid": "df4f99c2-a63d-45f5-831e-2e3640431446", "value": "3072:Er1FHCFjmjD1SiPFvOOF5tK4n0ncWpc+vlP5ueaK:Er1FHLjD1SIFvOQnK4nVW++vl5ueaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377658, "uuid": "e4f42b35-0149-4d3c-8f1b-c8fa6dcf40dc", "value": 201672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377658, "uuid": "3e1d6df4-530d-40a4-9fa1-9569c8080fd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377658, "uuid": "37c03043-d0d0-4bfe-921a-7d02f9f70c8d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b061ef-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385381, "uuid": "e004c5e7-1590-4e48-86fd-a4b6c7d18888", "comment": "Malware payload (Adware.Neoreklami)", "value": "18db3daf397b66b632b346ed5e11c9e9", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385381, "uuid": "8cfe0c8b-c844-43c2-8b44-8499d8e9c22a", "comment": "Malware payload (Adware.Neoreklami)", "value": "bbc7f5f56a5d7549b13d19221dc822f70fd965b9f287e39b6aa45e427e2bf134", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385381, "uuid": "4f17cdd0-1a6e-465b-baa1-ef98468820ab", "comment": "Malware payload (Adware.Neoreklami)", "value": "5fbc1b6710af94c8f8d037c984273e26a7beb7bf", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385381, "uuid": "453907af-b05c-4512-b7e3-65cf8bf6e059", "comment": "Malware payload (Adware.Neoreklami)", "value": "bb61ade14a33c452dc01f542136923ea9f2b0677bd82e9cd1716c8311b16e5313921760720d03155456d0696d87d8132", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385381, "uuid": "03c34b1c-b2a7-48fa-a667-33b76414f3ec", "value": "T180763363B6E9CDF6D2120A3259A079EB83A3C7714F70442333A1797B177CD62D0B2669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385381, "uuid": "44cc1169-ece8-4d6a-bd55-a8c2854f6a7f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385381, "uuid": "7debedf4-074c-4b56-8e98-233d5033920c", "value": "196608:P1OjBqVHE4tDdYgwIVTuGPVxytyNspyhj1mW8HerSQ2iDoWqv:tOjBqS4ZYgwOyuVxy0NsEhJmBs2K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385381, "uuid": "a53489c5-9905-49b3-9c13-46734baa5fa6", "value": 7575817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385381, "uuid": "6bcba6f0-0d03-428c-bbf6-9761ce450e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385381, "uuid": "ee4b5c43-043c-4f1b-a179-2c1cc12aed2d", "value": "18db3daf397b66b632b346ed5e11c9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6376a693-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393349, "uuid": "3a749410-04f2-4f43-8ef0-2d5437e27f26", "comment": "Malware payload (Mirai)", "value": "a5dbad6ec73677707c841c6d0ef2995d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393349, "uuid": "ccaee536-93f4-457b-a2da-17ce02c89bce", "comment": "Malware payload (Mirai)", "value": "bc0a99dbc918d0274a1302dea811ccb51ce34ca4bacdcdea37f1d9e6bc923f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393349, "uuid": "a7614d33-6c5b-410f-91bc-7ad9f870d3ec", "comment": "Malware payload (Mirai)", "value": "13b8194d90cba7152718acdfaf403a78ad06eb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393349, "uuid": "980c23ab-90bb-4895-bde8-aae51c4da929", "comment": "Malware payload (Mirai)", "value": "247f5b48ce4d3c6d46a889ae27a84afc2685b947eef5493ea535ec6b198891c98933d7ebe3d9e957e2b349ff97bb89ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393349, "uuid": "c38721a2-8c6c-4c1e-b1c9-7627da5f730b", "value": "T1EC5302E3990AEAB8E039B4709B6442A4EDA7D252BE15C34713DB34FE5C972D63113742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393349, "uuid": "76332612-26c2-40e9-b159-31cd7df9bbc7", "value": "1536:L+RFknUtq+pU7dBK0S97lxR1Twk4aOB+9neZt+:ibk7z00ST9N4vseu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393349, "uuid": "5a449630-00da-4fa6-b393-7fc467d8b044", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393349, "uuid": "8e2cc9e7-1ead-40d9-ac35-159adc3560ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393349, "uuid": "f07f585d-5540-499c-bec4-7ce875319cb3", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dde1316-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316836, "uuid": "96797abb-5acd-4829-ab1c-67695f0a8459", "comment": "Malware payload (Mirai)", "value": "6e177945dc758e8f120bbeb9928fb268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316836, "uuid": "edb04874-fe69-4ea6-9e2c-73001d6e7b63", "comment": "Malware payload (Mirai)", "value": "bc997b805cd5f05ab9dfa003b99b686b9989461cea9a577e4a28aca0039c0553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316836, "uuid": "13bf7c66-8d55-4004-a1e4-717c15f4e5e3", "comment": "Malware payload (Mirai)", "value": "bebe92a0aefb710545d24400eb10af0704ba1f1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316836, "uuid": "3075592c-da1e-4449-8031-999ba9240d4d", "comment": "Malware payload (Mirai)", "value": "eaa46f7877a6a9bc794865e20991af693734c66557e2c5d92197b65882f1735e4b4a622441cf6e5384bb17b402ea0893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316836, "uuid": "7f7281a0-e1b0-4e77-a3dd-7cbdc07f6a29", "value": "T1C3338D66C5BADD98C18846B5E8308EB82F63B205C2531FBF1A9595695043EECFA0C3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316836, "uuid": "e226612b-b285-4b7f-be90-ca7b1b82cb2a", "value": "1536:LauwtlnxmS/kpDisFdhKJQjDU6SwMC6nuM7R:LBSxL0isvhKJQM6SwMPuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316836, "uuid": "a320bc04-7fe3-4ba2-b4bb-299d7db38d72", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316836, "uuid": "0daa2633-ac7a-4c13-9563-5949541a5a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316836, "uuid": "632ee87f-f639-4e83-8af4-d8c78daacd00", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18d2126-e773-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314507, "uuid": "40909a92-2724-45eb-8631-f6e81c7eb41b", "comment": "Malware payload (Mirai)", "value": "23c68904b64b3f3bce4fc11adb650d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314507, "uuid": "7c92de8c-2c4a-4414-ad75-d82a876e1f18", "comment": "Malware payload (Mirai)", "value": "bcba904ded837cb17c899d969fb6e8049b8772b6326baa732d504c27fa0d3b6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314507, "uuid": "ef4c81c1-6283-4b35-83e3-5c0baa612527", "comment": "Malware payload (Mirai)", "value": "e0af92074d2c164ac501091f7397384087a3d2c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314507, "uuid": "71894159-e3ca-4bf7-bef4-d91b5d970e0e", "comment": "Malware payload (Mirai)", "value": "be14dcd94f9fdfe9a7133e4d729ed8d66be72a0021cc0bdf9effee14d2f63a17ce34519cff8cb0dc45783d253e134320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314507, "uuid": "0ec4bf45-2d4b-4e5b-8ed4-1b0753ece675", "value": "T14013FA89BC91D916CAC55577BF0E42DC372603E8E2EE73039E15AF66365F83B0A2B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314507, "uuid": "9841cb28-c33d-4861-866c-5f14091577fc", "value": "384:BnpegF2gWwDkLvmAp4ewXUvGWbhZXv1A1irwQgmNMcqr/A4vALkMk6DuSVZoBz1K:Bn9Y+UvLK1irKmN7u/lBw2zixCgu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314507, "uuid": "3b65ce5f-1b45-41a0-b232-7f3be568c6bd", "value": 42652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314507, "uuid": "77939d86-cfa3-40ec-8c2c-4bec5ba59939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314507, "uuid": "668c8d73-c5c5-4054-9a73-ede3610f6170", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073c0baf-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385464, "uuid": "6a7612ab-7058-4642-adcc-aa07f441d88d", "comment": "Malware payload", "value": "3bb72cfd14129f2675556fa290526661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385464, "uuid": "33b4b67b-1eae-4852-bd3c-92f716a1e7a9", "comment": "Malware payload", "value": "bccd9fa588acd90e91169529efa9bc60f50f1464eaaee75dcf8c0a9cf8b915e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385464, "uuid": "559bc386-b6b3-4912-afec-060eb4b0afa2", "comment": "Malware payload", "value": "1a174813281e493df6a900f4fe876ef1ea49a277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385464, "uuid": "4977fd62-d234-4cc1-9723-3b67b83d1672", "comment": "Malware payload", "value": "a8c2828ea76501a7a896aa89245ce9c5809c56002e4cda58da0d83ab525b71f0f8fed38aacdd6ba7a99188bd7627e8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385464, "uuid": "f373a90b-8d54-46d8-a61c-cbe41248c89b", "value": "T1660633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385464, "uuid": "395e39fc-9cce-4d2c-b2ab-a80e38d92e78", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385464, "uuid": "21dee1e9-3a8f-4098-be56-05c4c7bc3033", "value": "98304:alT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:G2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385464, "uuid": "91c15d51-47c2-4771-bfb9-bbf7737c531d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385464, "uuid": "bbf97d98-b9f9-40ba-bdab-01f79332b03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385464, "uuid": "2d287707-3989-4864-ac72-ecaa06248619", "value": "3bb72cfd14129f2675556fa290526661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005f2d21-e778-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316303, "uuid": "0e24d15a-2fa7-426a-a746-0576862bd41b", "comment": "Malware payload (Mirai)", "value": "ab6a0a7c1096bfccaa79f7ba64e543b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316303, "uuid": "dfb80141-3c70-493a-8bce-54e9d9cc8c55", "comment": "Malware payload (Mirai)", "value": "bdb3aa76345bdd920e90d85c1cfbd2ce4c7bb6520870758662bec687c15accd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316303, "uuid": "22d8047b-e8ed-4f46-aa29-9831bdc2fc43", "comment": "Malware payload (Mirai)", "value": "c993c090d2ce6b4896bf64bdd88d3050430f1e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316303, "uuid": "2251d764-68d5-4a7e-9b4e-9fa7bf4799e8", "comment": "Malware payload (Mirai)", "value": "c7cbaf76d7516304bac69a8ef5d0bfc966dd2753a0ca87f55d2bb96edad0444fb5d28e302f31f2428ca731de089307c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316303, "uuid": "48e800a6-5a2c-4775-b706-2f6240ad435d", "value": "T18E535C96B405DF3CFC1AE67BC1120A06F624374596830F3FA7AAFC935DB12988D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316303, "uuid": "dfb99a10-862f-476b-bb3d-060abfd31f46", "value": "1536:1C7aP7ml6oIYb7BHvILE4kxd+2qn68t755xSPAQ1JaDPG:1C7Cy1RHQL2+d57kPn6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316303, "uuid": "9f0e7d5b-97b3-4a5d-bae2-d083e4bbd9b2", "value": 64220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316303, "uuid": "1e9faf83-b2bf-4a8f-98f5-785e4834b980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316303, "uuid": "77d803ae-5046-43fa-81fd-10334d6b3afd", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb05b605-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385873, "uuid": "7557970b-592a-4436-a995-95216037e275", "comment": "Malware payload (GCleaner)", "value": "be537f0dcf4bd7bd3f5feffaaac8a411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385873, "uuid": "b40b0d4a-831a-4384-82fc-faa168e41879", "comment": "Malware payload (GCleaner)", "value": "bdda13fb8958ecdc15b082d20f6a279840cde4d3d995e640c082294e25431735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385873, "uuid": "b93549e6-8c3b-4725-9196-8e1b73ab961d", "comment": "Malware payload (GCleaner)", "value": "8091144e68080b8a7eaddc404aace267a55b470d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385873, "uuid": "125a15b0-a812-4939-b572-dd9eb940b3ae", "comment": "Malware payload (GCleaner)", "value": "511bff1ed674d384799377d0c4ca0af9e7138b487f3f3ebfac10d8b61f7d6ee040a1eb3d2b9c9e14bd9ae78cb5eb555c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385873, "uuid": "0e25c8b2-b189-41b0-8989-e3b38cb17e36", "value": "T18106D07AFACC85B1E5126B3CAA2A4FE9FA57FB112458748276F438C8853B1B415317C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385873, "uuid": "8c755360-e407-4186-8258-55d504d5f2a0", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385873, "uuid": "fb074391-e6c9-4768-8968-b6084e407386", "value": "49152:+yjLXZCYuNOGsBHqksjmUaMnpp+0mfwNc1IJxEXr+n8d7HaIYzyIH72Fu8Vs:+y8NNsBHoTaaQDI8Z++r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385873, "uuid": "06c4c947-17e2-4859-9109-666ae1cb9a4a", "value": 3718416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385873, "uuid": "ca34250e-5c91-4804-97fc-66df80db07a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385873, "uuid": "2b263835-af94-4725-98d0-1c44e5cb00cb", "value": "be537f0dcf4bd7bd3f5feffaaac8a411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c7cc9b-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1767386074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386074, "uuid": "e3b0c3eb-77a4-40dd-8dbc-7e9d14a7fbab", "comment": "Malware payload (GuLoader)", "value": "d174d5c86f7ba1c229afd13eee0e0a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386074, "uuid": "882a9a05-ba7c-4e12-ad8e-8331a1cdfc1e", "comment": "Malware payload (GuLoader)", "value": "beae6088915fa50f1c8b52f6187ed8516e99f23bb2b67f700b3864ab21bb97f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386074, "uuid": "b1d57aba-d200-42b7-bd8e-78b012d2b978", "comment": "Malware payload (GuLoader)", "value": "9276f9faae7c6e678f86775031c9b4d339f39828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386074, "uuid": "47157cbc-fdf6-4a73-8fd4-6331c21f36f9", "comment": "Malware payload (GuLoader)", "value": "dc1734163725901c8cff739eb292f9110b455e71f32713c26295a9c230ed6165fba20b2bbfac16ebb25c7effdf94f548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386074, "uuid": "5b7a111b-5811-4f9b-bfb1-f590db03f9d0", "value": "T1029412102200C547CB7E5A704867E3AADBBDAC142498234737A27FAFBDB4707F94E652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386074, "uuid": "6e042076-2c10-40de-ae9c-80dd6f358dd5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386074, "uuid": "c4cca059-4222-47e7-814d-43d4f1e129ac", "value": "12288:UrfR9wu90agMmU1rk8lMDe7ndedXFCF3yct7:8fb1Lhr13M9dXF+ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386074, "uuid": "5cf282ef-5a0d-4ecd-97bb-c591a35d0d75", "value": 443560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386074, "uuid": "99c26713-1dfd-4ca7-945d-00965e59fc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386074, "uuid": "20a50539-4867-4000-890a-c874d39ccbac", "value": "URGENTE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02355711-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385885, "uuid": "ad2c7b2b-ffcc-415f-8924-c346dd6990f2", "comment": "Malware payload (GCleaner)", "value": "c28c9c7fa398efe358d9fc8520c880e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385885, "uuid": "4669947a-315e-4e48-b6b2-9b5a90fc23b8", "comment": "Malware payload (GCleaner)", "value": "beed9d3906ebfe7d6f606a0d6369dcec1ab08c1716c984af9a9dbc3ef5c41dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385885, "uuid": "b1aaa296-ffe0-421d-90fe-667c45760677", "comment": "Malware payload (GCleaner)", "value": "4f3a2cd64247d1299db5a00838dcdeb0af6478a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385885, "uuid": "8b3eecf8-e90b-4fa2-b73e-533d98310260", "comment": "Malware payload (GCleaner)", "value": "ac9b4ef26894767eafc939147f1e6eaf4c6dfec8e64fc1075a6d92588f6ec2e2470e5165a497b79f92ed01a9c39ffbfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385885, "uuid": "b079a95a-381f-45ae-b29c-6a1cf0aac097", "value": "T10C16F017DEE10FF1CADEF33E1977B528E822BA73D50F640351A46F0757D4862A22126A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385885, "uuid": "88cd4dbf-1849-4084-a3ee-c592240cfb64", "value": "33c8892e589b294de8333a87bd765dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385885, "uuid": "2464a599-254b-4fc5-b2a6-deec1c733e2b", "value": "49152:lUzNgPBInT3+ds9ANhTOSyjj1KzQ74HvxgkIiAog3VSaCD9/BUulW9wZ+eLic:lUzNgPBInTKNhUHnAZ0D3M9/Suv+eLic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385885, "uuid": "4fdc4e83-b877-4448-8b19-311d366383ef", "value": 4134160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385885, "uuid": "be5e4b13-0c19-409e-9f95-75161ed38a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385885, "uuid": "5d53d9f1-5130-47b7-8423-952f3115faec", "value": "c28c9c7fa398efe358d9fc8520c880e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354235b9-e7ca-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767351611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351611, "uuid": "14e60b81-e704-49fd-a9df-87f290ddc7ff", "comment": "Malware payload (QuasarRAT)", "value": "bbe23c43616fef3bbba2950089b1d282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351611, "uuid": "a88e98de-ec7f-4aa7-894b-65bc78881c31", "comment": "Malware payload (QuasarRAT)", "value": "bf60c46bb7b655a56feb99ec85c63a8ca91539e4ae6ee5d5865a3c84e36593ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351611, "uuid": "f9e08d2b-ecde-45b2-9199-10b01408c1e6", "comment": "Malware payload (QuasarRAT)", "value": "43a6676923d819c025010d47319f4039b459d5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767351611, "uuid": "c35b2b49-0da3-4aee-81f0-4c7252ae1c68", "comment": "Malware payload (QuasarRAT)", "value": "c7550a06756e5b57eb17e1999a1acc35adcdaaf81e9188d5f96938b13dbd8740a9bd03f989f2a6c45caf0fdd0bee7099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351611, "uuid": "d8847716-b98e-4919-ab17-7afa25f96dce", "value": "T158F5330DCAE19E72CA762D31C349903482F5EE21039AF752FC9634F51AFB7985925C8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351611, "uuid": "493099ef-1620-4b8a-a2b3-75c1671c9b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351611, "uuid": "8f227e86-f7fa-4217-bfd0-0cd21f48f7d8", "value": "98304:a/K/l2y66mZc+321CJflrJqUMge1q7tWh3:a/KN2BuCDJqrY7ta3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767351611, "uuid": "3e7e86b1-d4e0-4617-a34f-62a2c6b435f7", "value": 3390464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767351611, "uuid": "0c20d40f-6d22-4ace-8ee1-6d9ce53ec1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767351611, "uuid": "a9d57bd2-6d6a-47c9-bd24-35f0cf04ee17", "value": "rInformaci__n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d10e31b-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393392, "uuid": "62f7056c-5fde-4432-9bd3-1915d2e10910", "comment": "Malware payload (Mirai)", "value": "178c9dabe495a87938025018cf58ebad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393392, "uuid": "45b50380-b947-42df-8b74-f03b89ae77d7", "comment": "Malware payload (Mirai)", "value": "bf955bc6dcbb784e748593e683cc047f73b6b67246c3c76c52cea014aedead07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393392, "uuid": "bcc1f297-0572-4245-a5f5-2540cb5a8a8d", "comment": "Malware payload (Mirai)", "value": "5b0617a57739111a7b131e5d04953beedfdbbad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393392, "uuid": "1846ffe9-9fd7-4f6d-9523-0bf9a0c5d363", "comment": "Malware payload (Mirai)", "value": "f547a4ec55e74c4de73b7f6ad2e266a74ab7fc23e4b26a6c4f7cc87e8a2b2b785d7da38e11b82ffa0fb970879b29cf8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393392, "uuid": "a83aebf1-2bf5-4e91-b100-aff5a1f1c1fd", "value": "T12914C80A9F510EFBD8BFDE3342E9070625CC650722A97F363674D924F64A94B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393392, "uuid": "d8dcde37-6708-4b2d-8455-bc56c5562d5e", "value": "1536:/Ntg/OCFELqfWmyxQMMRSiwSnFhxZ3wTXFvjqj1Ye+cVZjTqD1Ed3ZeZzjzZwpoR:yFqq7SwXpvV8Dm1iPfRD5wEIFX9Gebo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393392, "uuid": "12a9dd01-bc61-427c-88d8-7d93e2a8b224", "value": 206360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393392, "uuid": "15bd7938-22d4-4f94-b461-6faf319532f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393392, "uuid": "52a1a005-bb1f-4ead-bf31-e5ab95ec4dd2", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d22179-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385589, "uuid": "32668dc8-96ce-4374-a2bd-ef68c2dfcad4", "comment": "Malware payload (Adware.Neoreklami)", "value": "65f91bc27113b488f97508335ebb6eba", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385589, "uuid": "9ca4f622-d0ad-4aa3-ba96-5e122b389f74", "comment": "Malware payload (Adware.Neoreklami)", "value": "bfac644d575fd4af0328c3770a2ed5989d6cabd40d21ce2640ffa3a64ebbd205", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385589, "uuid": "5468e151-d99a-479e-82b3-c0aa66d79bae", "comment": "Malware payload (Adware.Neoreklami)", "value": "60cd30ee016ecf50199b9d1940243f30072d90ec", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385589, "uuid": "6a8a5fa6-8c10-4423-9484-e8eb8c394ce7", "comment": "Malware payload (Adware.Neoreklami)", "value": "989b6adcbd08c81d37eb69a712ebae7b8d7354778f49737aae961e593e71e56976882fdb00e37d07c7e73132149cf396", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385589, "uuid": "796b0a12-efa4-4d39-9fab-d2f6c31aa52a", "value": "T11776332437A94CB6E7D14030D9A4FFDBB4E6E000AD5305931BD6643E2F7BA670A93792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385589, "uuid": "e0693b07-8155-4bd9-b47a-fbb4f6a4ccbc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385589, "uuid": "e4e05422-746a-4d9e-a888-1737ba13f6c0", "value": "196608:P1OQBFsqyKVW2ds1Ph8mpNBSI8CS4xw705Ywuu4O3:tOsf7gIqZ8mpzlSWwgz4O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385589, "uuid": "82783d99-62f1-4d55-ac6b-df81e52c6340", "value": 7533932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385589, "uuid": "ec25b0f7-6834-4cc9-893f-95bd0e0d0e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385589, "uuid": "1d916405-bbd8-4295-871b-6f27c5116f87", "value": "65f91bc27113b488f97508335ebb6eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33305c9f-e811-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382101, "uuid": "f7028296-2e1a-449f-a12a-120f74546dd4", "comment": "Malware payload (Mirai)", "value": "210cfb1b40d8d5ff0014cd86b4b6b80c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382101, "uuid": "b91aca90-7560-497f-89e5-509e2fe995b9", "comment": "Malware payload (Mirai)", "value": "c021ac9e198c744c1aada58ff4888b24a2f48bb4c4af4f2e0d6dff97c0de22ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382101, "uuid": "1188da7b-180c-40e1-b2ee-8bf51a6d74e7", "comment": "Malware payload (Mirai)", "value": "4a35332ca83ab2cb02e6ee06eaeacd037e263f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382101, "uuid": "669e743a-895b-4d09-8b8c-1666409c5beb", "comment": "Malware payload (Mirai)", "value": "9293e7a3a20d757aa4a5a870781f7a2024eaa83c9cdf9eeb7e9795b4771ecf0729f5beca8073a73a0307f5d4665c5ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382101, "uuid": "0e49cfa0-66e1-4f0a-b97d-a438bcd9374b", "value": "T1B973020CCAE21ADACF0211754232CB916DE013794F55DE4DFAEF9E6F8C5C2E52A43691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382101, "uuid": "a2ec3b53-2a0e-49ce-99eb-131668361cce", "value": "1536:YEHsLzkJy3+nPulf7DDBj0dZj8EGXUJ9P4aNgkVrsdxuFTytce/VJu5:YWMr3RzDFj0ZDG29A2DsdIFxKVQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382101, "uuid": "db315053-2024-427c-9745-cf43362e1652", "value": 78212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382101, "uuid": "b6f538a8-f220-4a82-8bb3-90308b042156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382101, "uuid": "f4fecdc1-43e1-4e35-b54e-77a6250d9e20", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac382ab-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385335, "uuid": "14160936-add9-47f9-b271-849aa7e5b308", "comment": "Malware payload", "value": "03e2fd84d450d9bf8633e6478eae0309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385335, "uuid": "b81a2dfa-15a4-448b-b6fd-2c9f9684ebf0", "comment": "Malware payload", "value": "c0911a5c7bdfa63aabd9674af529958a03836a15ce685535200d0f7725c090ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385335, "uuid": "e700a0b5-e1b6-46d9-8a12-e20610d32b7b", "comment": "Malware payload", "value": "8dcd032b48fe0ba6e29b90bbd9c1622e8c5744a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385335, "uuid": "c02a595f-2334-44c9-b545-89386d96e8cc", "comment": "Malware payload", "value": "427805f4d4c9fcb71e8a2018c03451c11e5726c06ab98efd57fb4da945d1a46974271d14eaa1e4c24d66f583f5cd7e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385335, "uuid": "fcd96f59-e7d0-429c-85d2-ab667b4fb022", "value": "T19B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385335, "uuid": "dc5d9312-65ff-441b-a1fa-1a0bcb6f271f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385335, "uuid": "19ee2b24-478f-434c-8ecd-073e20ad2e7a", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:q2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385335, "uuid": "90a91c03-bf26-4346-b5f6-9fbc169f3c5e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385335, "uuid": "1dfeb5ca-881e-4828-8503-c5cbcac00b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385335, "uuid": "95dce3b8-e40c-43f1-9edd-67dc13abb051", "value": "03e2fd84d450d9bf8633e6478eae0309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da1c48e-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385635, "uuid": "f75387a1-bd49-4bea-8d9b-9e7e2132fe60", "comment": "Malware payload (Adware.Neoreklami)", "value": "7450c0d77f81bc78a0821d8ffc6787be", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385635, "uuid": "006af2f8-9035-4499-ba1b-8bc26d0be441", "comment": "Malware payload (Adware.Neoreklami)", "value": "c0c7c6bba547b7235b2259b6cecc7e6a3860a310fdbdca4658478e28f5ea9b58", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385635, "uuid": "295310eb-376d-4997-81eb-abee703cb858", "comment": "Malware payload (Adware.Neoreklami)", "value": "ef487193ae77cdb85010d721988107dbc9ee5719", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385635, "uuid": "24cc64de-aa81-42d2-8939-c7065207c666", "comment": "Malware payload (Adware.Neoreklami)", "value": "64ab5b39a6b55e7b5a611fc4822574cdede9c512556eef17ad95a8a2fb31a469c7a91f99ccd815d8ad3dfa1c97f271d7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385635, "uuid": "158d3f0f-dda6-49e3-ad70-ed22d7f19c72", "value": "T1107633B0FEDAC4B7EED31032D9A4ED922059D3850F28684727F485A5AFFC793C126916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385635, "uuid": "2598ae10-f11d-4996-bcee-fb6bbc36ae45", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385635, "uuid": "788ee49f-5586-4efb-a1aa-614eabbd2705", "value": "196608:P1Oy4xaXiEYuRmSW4sIfbRNZRevlZyIyd6xOQ5:tOy4xImoJfbUl4nd6xOQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385635, "uuid": "4bc10e8f-281a-458d-ab2b-c5400882b473", "value": 7547491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385635, "uuid": "6ef9d123-f932-4bc8-a9a6-65617edbde59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385635, "uuid": "d6770701-b1f3-49f3-887f-e53154b85eef", "value": "7450c0d77f81bc78a0821d8ffc6787be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8af83c7-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385842, "uuid": "01ddd5e7-4565-454a-9d9b-0515615765f8", "comment": "Malware payload (Adware.Neoreklami)", "value": "b19acc4d02179b236849da0fd97759eb", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385842, "uuid": "69246d0e-cc58-40c6-b804-c3d4af06b2b2", "comment": "Malware payload (Adware.Neoreklami)", "value": "c111597085e463b197f0aa374b0ae99c611b58c9503ac1f55ec845e910d22f98", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385842, "uuid": "913b528f-741d-4e99-90bf-718f69c68da9", "comment": "Malware payload (Adware.Neoreklami)", "value": "1477af226cc4bfa88b74a7d21c74c7723b83ad9b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385842, "uuid": "9f5cee2f-bb5a-4f4b-9f95-9b5518e54dc0", "comment": "Malware payload (Adware.Neoreklami)", "value": "bcba4040fca60390654c21043d2a4e3cf53702e6d73443f96bf86a0be9ecac3860616911277119f7cad8cbc8d423a17f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385842, "uuid": "dac252ff-ed6f-4fd9-97e8-eac98815be36", "value": "T1EE76332078F6D47ECF819134C37CADE853E8B6798A29DD07E75D1B087A7C480C9764AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385842, "uuid": "c87f99b6-3015-4fc2-80ab-f58eb9e59a66", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385842, "uuid": "1579c1b6-39f3-4245-b47c-1ecb5707773f", "value": "196608:P1O1ndXojoK/nN01U/BgUIOjJymMZBm7hWSMoQzegAqkjlQ:tO1naT/nec+quBEhMXqgAqkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385842, "uuid": "41a27183-9469-4843-8c5a-141ebc1f1fa1", "value": 7565991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385842, "uuid": "542f3b39-010a-40d4-95c2-746b8909586e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385842, "uuid": "782f5870-5dab-4e9f-9ec8-c085767e6355", "value": "b19acc4d02179b236849da0fd97759eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee07101-e7e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767361156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361156, "uuid": "ab517887-1634-4174-a746-bd701632cc3d", "comment": "Malware payload (Mirai)", "value": "870829335e2a5bf08e921536a0c45da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361156, "uuid": "0c6eb738-64fe-4b3f-9dfb-0d29e8673af7", "comment": "Malware payload (Mirai)", "value": "c1238548222a1c67093e3d4c571dd0af407dfd8ba64d02aaf86580bf88859e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361156, "uuid": "71e6d852-d1d9-479c-8125-c4a9c21aede6", "comment": "Malware payload (Mirai)", "value": "bf54b83adc55c22f8b1324028e52c4804e1a503b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767361156, "uuid": "49560c3b-ab65-4e85-992e-6d68fff8e68a", "comment": "Malware payload (Mirai)", "value": "9492bb548cff4bdd383933504aa16ed0ef2aa78128975bf52403b51100a8b3c51a996daa18c764615d3b1c6c58d6f7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361156, "uuid": "2aef7067-8f04-4939-90b9-c3bf5a67352b", "value": "T1D4E37DC5E283D0F6EC5605B52077BB369A73E53A312ADA83D3B95A32FC51540C91B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361156, "uuid": "dcd94e94-2275-4c70-b910-51a81a28b753", "value": "3072:+WkfXyDwQHTnUB39ctColdf+TJXSgkz9mBpoF3z3q4zQN+vkdfw:dkfXyDwQHTUF9cdf+TJXAV3L5Q0efw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767361156, "uuid": "f18fa355-5bb4-4200-85eb-3b937e61552a", "value": 151240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767361156, "uuid": "12d2bbdc-d5d3-40c9-984f-01e10e624c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767361156, "uuid": "9dac57c5-b824-4558-80c0-aa53fa3bb655", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ebd2c3-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385923, "uuid": "fa32efad-50f3-4d0d-b0d1-d5d1a015707d", "comment": "Malware payload (Adware.Neoreklami)", "value": "cadda6d302b2e0de75b8cdae9a324c41", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385923, "uuid": "252e658c-338c-4421-bcfe-814cb66978ba", "comment": "Malware payload (Adware.Neoreklami)", "value": "c163beca3bee47b81303b31cd9220693b257c3f52cc23cd2950fc6fe278d7810", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385923, "uuid": "0da17e28-8180-4b2b-94a2-e87800996418", "comment": "Malware payload (Adware.Neoreklami)", "value": "a66f882a007a8df958c9845e1ed869e3f11e1cb5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385923, "uuid": "099c716d-15c1-4361-82f2-672536ebfdb6", "comment": "Malware payload (Adware.Neoreklami)", "value": "1661c004c68bc7b601ac210465b2bc122b70b57bcc6897cb2d2a4faf68fcd2e7cfdfee8a230765b2976033624c1c1ada", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385923, "uuid": "62742db6-4b09-41ce-8ef4-62937d0c7c4d", "value": "T1B176331536F18AFCEE870232E56C0B519269E5444A22E2E773E2CD3C7E3DE59D391878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385923, "uuid": "30eabc42-aae1-437c-91a4-e5cf3e045dff", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385923, "uuid": "50bf84aa-71d9-4e74-bd3a-95eac4a4b89f", "value": "196608:P1O0TQjiNiqkbZjhZzfTyNOme6iVnabghaVrud6/D:tO0kFFZnyNjicccdU6/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385923, "uuid": "0128310f-036d-4357-9ad2-1e1c4e4bdee0", "value": 7582844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385923, "uuid": "8b9672eb-aa1d-4fb2-b05d-8f3e1ef3f78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385923, "uuid": "9582edec-f03e-40b5-ab2b-068989de954c", "value": "cadda6d302b2e0de75b8cdae9a324c41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e5833e-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385438, "uuid": "aaa91145-ca7f-4d00-bf12-734bf038d848", "comment": "Malware payload", "value": "2a0b46469b8a65a93bbc8fd7fb34fcf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385438, "uuid": "66fafc7a-d549-41fb-a1ec-9d0320fbecac", "comment": "Malware payload", "value": "c16c7cba817778dbc5d9392819571340dc8f24a469d4f9141f9d05a0b755d0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385438, "uuid": "dd6d78a8-aeee-4252-b4bf-83ac889307fd", "comment": "Malware payload", "value": "560c085462f1dd6b88e302de792b7300ddd993da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385438, "uuid": "b9062da4-1ed6-4623-b26c-ceaac2062e88", "comment": "Malware payload", "value": "70ce6c475364ddcebe35dc9a8bb1920c0475ccf1acc449370e0614ecd890d4b1a38705de536e69d9a0b23a2a9f3bb82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385438, "uuid": "fd491e28-4185-4d66-b0ca-27ae1dd9d938", "value": "T1880633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385438, "uuid": "9e0e7ec2-54ad-411a-9f0a-f9089a7e5fa6", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385438, "uuid": "9fd0c6ed-3def-441b-a7fa-aef31b2788f9", "value": "98304:aST3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:x2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385438, "uuid": "a0f565c5-0693-4f7f-9c41-952d8588763d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385438, "uuid": "21337e22-1f68-4ca8-ad96-5bd10e2a8fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385438, "uuid": "7805444f-15f9-4500-a2a4-00d8979f8e30", "value": "2a0b46469b8a65a93bbc8fd7fb34fcf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7887b756-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385654, "uuid": "2cd308be-3317-4af8-afe7-f7fd773f6d4e", "comment": "Malware payload", "value": "7ced089069a0291411fca7469ff0e042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385654, "uuid": "fbb3e04e-d99c-492a-bfa9-e9798ed12cef", "comment": "Malware payload", "value": "c1ae3736c931250d863c01342b42a6a6872f3ef23c4d4a766022b621f42cdd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385654, "uuid": "f11e806f-9aba-4f37-be55-212c5f4cd49d", "comment": "Malware payload", "value": "0c9f8c06fc72390b7b6648e04622d890f5bf51b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385654, "uuid": "ced89fcd-01d5-415d-b105-7fba73db4f20", "comment": "Malware payload", "value": "f7b07133142f17efc4f383871adefb98806862aaf87c6f4c8303c6932ea4a77c837f7548c65559098fa24389bcc3cae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385654, "uuid": "3c2cbd9f-3838-4e4c-8afc-a9bd39543ef0", "value": "T1460633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385654, "uuid": "d01398df-a7c5-4256-831c-3dcc91664ae5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385654, "uuid": "e2c1f68f-b0f6-43cd-b912-2c8c0175b45e", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:A2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385654, "uuid": "c0ccecad-127c-4ddd-86a6-3ba6ae7caf0e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385654, "uuid": "3e3a5ec5-e83c-4863-b238-424a1c5ef76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385654, "uuid": "fcf00e67-514f-49f0-bd6a-8e38709d5c0f", "value": "7ced089069a0291411fca7469ff0e042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db89ab72-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767337716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337716, "uuid": "d8367001-0119-47fd-9c51-ad420edb5158", "comment": "Malware payload", "value": "60165bfecfd71542ff84eaeedd526522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337716, "uuid": "be48c955-5e99-4c66-a21e-356c727ca9cf", "comment": "Malware payload", "value": "c261a383f8bb61ecd5177c0effc834f7cddab520321f0ea295b3f76610cf6224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337716, "uuid": "d56cb787-e257-43d4-92b0-5bccf3a23b6f", "comment": "Malware payload", "value": "1db22f4e9683b5f36084db43c2b12ad8fa7c6bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337716, "uuid": "de15cdb0-4497-4873-8578-e7b26b9dd8b7", "comment": "Malware payload", "value": "1c4ac31204bd3382879c0a95c5ce2f5766e863499bd4a3535cfc4be835a34cfef784bff6d84c6e8bba5a33a36b3885f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337716, "uuid": "85e96fe3-e419-4c8a-8d70-3a213a0ee3a8", "value": "T1AEF3831EA9218F3FF26C833647F7CA65A32523D723E7E24AC15CD5201E5838A581FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337716, "uuid": "05cf07f2-5a48-461d-a02c-228a0fbcdc72", "value": "3072:NoS3Ue2xJ3gZnas/3MHqoLkgE8VcnGN+67MYWpW:N3U5xioKokqcnGNshc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337716, "uuid": "9ef33a38-bcee-4fae-ae02-4b2dfcb9b3d5", "value": 159816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337716, "uuid": "7b0321b5-0d7d-4543-a828-4bc1e7da4415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337716, "uuid": "708a2c20-7603-49f1-9156-53f8246b9338", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29462e43-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385950, "uuid": "0fc185f5-04ac-48de-be37-4cfe5949379b", "comment": "Malware payload", "value": "d2ddffe8844ff35b703b3b40513b82ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385950, "uuid": "ba9541dd-8adb-439a-b4d0-5639ba8ad225", "comment": "Malware payload", "value": "c2ab01130afa4be5b39f01ef7f5947269db0eb84f115b0ea13c8788c1af6d85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385950, "uuid": "2686ea7c-9cb4-4f93-9d09-746fd5d63c6f", "comment": "Malware payload", "value": "de3fe2ed2f2f531100a332e0effa70058cb10a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385950, "uuid": "96494c4b-d8f1-4f6d-a95e-315818508b0f", "comment": "Malware payload", "value": "d5cd4da2c48b5105c9b0cc810680955f306a0dda5aeaab4bb551e93f00af1c8934c47778b0390da0213b7ed0c55eb3ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385950, "uuid": "e3be61d5-38ce-4014-8b74-3f4cb1cdd045", "value": "T1300633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385950, "uuid": "20461e19-f0a9-4b48-8fdd-9e5a67ac8e5a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385950, "uuid": "9a6ee6dc-3886-42e6-9baf-f96cd383d9dd", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:y2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385950, "uuid": "40dde9dc-cf69-4632-ad37-8204b792e500", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385950, "uuid": "6cf27cd6-0f65-4b63-ac4e-6a797f9d92ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385950, "uuid": "d24ba5fa-4f17-4835-801d-9a29946dcb5b", "value": "d2ddffe8844ff35b703b3b40513b82ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825afbd6-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393401, "uuid": "e96f9cac-78f2-4527-8758-8537e2f1e1fc", "comment": "Malware payload (Mirai)", "value": "e741baca76f74b214c9d733e7e725c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393401, "uuid": "4c158ff1-0ce9-4664-bd32-e767919080c7", "comment": "Malware payload (Mirai)", "value": "c2b6d45c0119844ff9feb524616b968f81531c52892be169bd0598f70cd7dbdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393401, "uuid": "3e22c434-da36-4907-abf5-9f23f974c96b", "comment": "Malware payload (Mirai)", "value": "32723baede5f39f370f4d757add6a4681bd585aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393401, "uuid": "893f8f59-4170-4868-87c1-20c0e0fd338c", "comment": "Malware payload (Mirai)", "value": "ef7c5b80c4f1cd0da3e2eb8aee8e3f16473d74b26075f2b90e23a9ff890c3266267535de700022238ee464fb60a5e382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393401, "uuid": "d4e8a5ea-f0c2-4d2c-889b-9554f621ac25", "value": "T19DE30945FC419B16C6C662BBFF4E428D772B1768D3EE32039D256F20378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393401, "uuid": "39e87705-d785-46f1-97ec-440626d03989", "value": "3072:H7HCtPe7Lzl8B4Vh0HYG4Y5d7hk4d27hNwpAQWr9bxe4d:bHCtPe58B4r09/Nk4U7h2pvg91e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393401, "uuid": "b99af83d-1611-4545-8dbc-74c5649e0ae3", "value": 150072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393401, "uuid": "b3e9dd35-b90e-4ebc-87e8-8370969774ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393401, "uuid": "65b8b427-f772-4206-a408-f58dd5991f34", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714e6140-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385642, "uuid": "0964788a-24ec-434e-a8a3-8ce56b597bd2", "comment": "Malware payload", "value": "78811b5d08e97832e52ec0d94296217d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385642, "uuid": "561897fb-68e5-415f-99a9-8de8a63d3aa4", "comment": "Malware payload", "value": "c2bc7e3165fd209ad3456530c6ea285559ffb8ee8a13c29a2987160b037a0ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385642, "uuid": "3372a836-d936-41cb-9c61-8e32ebc2e938", "comment": "Malware payload", "value": "141ade03c456b06016bf9a92ef7628fcbebd3cff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385642, "uuid": "8e31ed04-7042-483c-a4ce-2ec4dac0d35e", "comment": "Malware payload", "value": "1ef66935ffa105d57f0927a267318ada6e2faa8331737c52f8b7a4c4a33f44e927bec70a2c2ce600ed674f4e4ae11f39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385642, "uuid": "8f0e6bf4-8e1a-4ad6-8d7f-561661ef83b9", "value": "T1E10633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385642, "uuid": "e0fc9776-2ce2-4ed5-bf30-bff43b585ca8", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385642, "uuid": "345ef5f0-bcc2-44d3-8a0f-6a37fd09d734", "value": "98304:aPT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:42w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385642, "uuid": "d9be7f45-c07f-4a56-8788-726e3c70dc53", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385642, "uuid": "f2ae9843-2450-4489-bf61-bafd58deecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385642, "uuid": "d11e8865-a1c2-41e1-b27f-cf7d73d1ad45", "value": "78811b5d08e97832e52ec0d94296217d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea18ac3-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385691, "uuid": "33bda2e1-b6a9-44fb-a001-ee3237cf3760", "comment": "Malware payload", "value": "85c42b4a1139c36a70885f8057c2c8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385691, "uuid": "2cf19255-1e9c-4cd2-9752-54bee683a356", "comment": "Malware payload", "value": "c2edcfe270a125807ef7e47a0bcf3167715f4982d0f5408dcaf34e7371253b4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385691, "uuid": "1322c218-15b5-4b4e-892b-cd8ac27e8f9c", "comment": "Malware payload", "value": "cde8ef9d54206bf81f7a5d85b61ac5f3e815fc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385691, "uuid": "ea699ebb-96b7-4a2f-b901-126fdf839fa5", "comment": "Malware payload", "value": "1754d99de8596994204b2e19c718576181439185e0227b174531fa9bdc92a24cbdacc844aacd135ea62881937f6b0ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385691, "uuid": "c9904155-f969-4f7f-bbbe-8e3513ed05d7", "value": "T1040633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385691, "uuid": "1ca6a927-cd8a-4fe3-b87d-a1ad02ab4029", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385691, "uuid": "327afa28-48db-403a-9c96-533153b44a89", "value": "98304:aQT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:32w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385691, "uuid": "5e4da1d3-a142-4069-b96e-88bc7a5a934a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385691, "uuid": "19ea0ba9-b4f0-41b3-a3a6-02ff6139b210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385691, "uuid": "2e2690e7-928d-45cc-a233-4cd2ca1417a7", "value": "85c42b4a1139c36a70885f8057c2c8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767eaff3-e7a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767337547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337547, "uuid": "04f7f97d-3882-4c2a-a9f9-44e5815f7a9d", "comment": "Malware payload (Mirai)", "value": "dd927435655ccc7a47266644fb22c5ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337547, "uuid": "4a9bb8f1-98d2-42ff-a93f-5de3d51756da", "comment": "Malware payload (Mirai)", "value": "c31b9c7f355c00e671b162ffdb5c07182a32dbdbe693852d536bb3c1ff42df34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337547, "uuid": "44babcd2-1dc3-486e-b9c4-88358b69f0ff", "comment": "Malware payload (Mirai)", "value": "5556a920ad747f9a7c214c9cb4768f7052edc2e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767337547, "uuid": "a54a2efa-36fa-45e5-93aa-8e0e4a64bd00", "comment": "Malware payload (Mirai)", "value": "733cdc04cde0e2625cfbef183727a75fcf77dbaf0c80dfb4525710b3cc3d0c07aa41ada0b8240f08707f70249c70e795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337547, "uuid": "3952b1a0-da80-42f8-8482-dd43aebd11f7", "value": "T1A283C50AEF600FBBE86FDD3706A81B4235DD540721A83B797578C828F65A54B49E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337547, "uuid": "9a4803bc-e018-4063-aab3-c86f15d59cac", "value": "1536:qdTGNiE/Blx9gMfu/PnUxc0pb+fHZ/caG9VQtgu:WfcTvFy0QHKcgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767337547, "uuid": "50ffddfb-28e1-4741-9ba5-e382a12fee1a", "value": 86136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767337547, "uuid": "1910327b-dc2e-4374-8439-9fb27795c2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767337547, "uuid": "831a2d50-65f3-4ca7-be5b-256532e14f35", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a5b094-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386016, "uuid": "91237f24-027a-4860-bdab-4b594a89ea3c", "comment": "Malware payload (GCleaner)", "value": "edcb3c20386c4154a4ab711730cffa32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386016, "uuid": "863e0b53-d995-4d7d-ba63-5ad924df82cb", "comment": "Malware payload (GCleaner)", "value": "c323b77f37250416106784ce344aa6f6849454301547b94d0723493b6cc9353a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386016, "uuid": "47a18e29-03bc-424e-85eb-d3fc2c5a7540", "comment": "Malware payload (GCleaner)", "value": "b929f2856854d1d217f1b6a919157fb2a4bbaa1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386016, "uuid": "1449d74f-e562-45d3-9bde-d98d6bd9da74", "comment": "Malware payload (GCleaner)", "value": "110f608e98029cfe202bd55aeb05aa16f44496cbcbc8ac68a90e055ca6765258f6c7832a2ec4a572079cbcd15207c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386016, "uuid": "f5991391-8e3c-489f-88e7-e80c129709bc", "value": "T1C856E068E5605030D1729F782A32F668B44A2B54DFF1CF59F1FE184DBEE8266583E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386016, "uuid": "4cef93bc-8f2f-4f46-b899-e6c4f65b4ed1", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386016, "uuid": "1b631783-b0b7-4303-9798-5a745dc7ee71", "value": "49152:LrSWosn808eJtpU9YiXFquUfheGz6BAateJ1DV5Wh+mv2TFWd88gGDVBZUNxG2bh:LrSWoyjffpenqmBz0fET0FW9UTPb9Fxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386016, "uuid": "68e7b9e1-a333-47a4-aa4a-11a4abd1b4ad", "value": 5987088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386016, "uuid": "f8df4265-dac4-4157-aded-1bdd278f628f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386016, "uuid": "daa5a581-832a-4b63-aa74-00568196c2a3", "value": "edcb3c20386c4154a4ab711730cffa32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a9a519-e773-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767314574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314574, "uuid": "2dfd9293-463a-4493-ad37-a19dad0061bc", "comment": "Malware payload", "value": "14ca4b2ed515369c92b9089a3768370e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314574, "uuid": "c077010d-3585-4f0f-a6bf-2b9361844bdc", "comment": "Malware payload", "value": "c442f8a60887fcccec3a2c284037f6f786f57209389542838f00ff731377651d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314574, "uuid": "c227eca6-0c0c-48f5-8eac-10bd56259d5b", "comment": "Malware payload", "value": "4adefaedb76b03c6945cfbf3412a5990ddacda8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314574, "uuid": "1ac44618-acd9-4882-993d-c554d176ed4f", "comment": "Malware payload", "value": "5b31a69a33ad3b96c857a80eb8c39b1d3b42390e6fafc98e2a4d7ec8468b22ddce5b5aa53ff4ae88ff02f65d9dc89f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314574, "uuid": "ab6dc52a-1c29-47f4-b447-79db06dc3780", "value": "T177086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314574, "uuid": "9ed190f8-f388-4079-b1d4-0d5be7785711", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314574, "uuid": "92acce98-3b2c-443f-8e3f-4b15d4fefafc", "value": "393216:Ws/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+n:WEYGD7sJYgNukUB4S5rs3wbpLLNNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314574, "uuid": "c98fe194-f7e5-4383-bd19-d756eea30748", "value": 82083171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314574, "uuid": "2f3f9241-c396-4fb4-b2f0-4b1dfb58058b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314574, "uuid": "bb12a15e-dd61-4062-bf4a-fa4d5688994d", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1616226f-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312904, "uuid": "00830fd7-bdcf-4d69-b581-7f763b1b3318", "comment": "Malware payload (Mirai)", "value": "8f917408d5ebfc59b73c98e4b7261992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312904, "uuid": "e4426cbb-2527-4099-8dbb-ca8450b3bee0", "comment": "Malware payload (Mirai)", "value": "c52597dba4c606c3464d9004e18d17eda1b65d39e00afed7e665abc5c989dd25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312904, "uuid": "e55d07a8-3e45-4284-bf87-57c52962ba6c", "comment": "Malware payload (Mirai)", "value": "0e5b40116ad96ea91a545462156bb71e9aa18182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312904, "uuid": "06a2d61c-62f8-420e-82ac-e69020b1f918", "comment": "Malware payload (Mirai)", "value": "25ad554a6bcfd2ae9913c5566336f2e6879c7f081f880deff4194a107ce3d30c040587c37b4c32d5f2738bf613c91566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312904, "uuid": "d0461818-85c3-4612-93c0-ec8a46047d96", "value": "T14283C705BF614FB7D89FCC3705B95B09289C960A21E83B3A7D34D818F25B24F59E78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312904, "uuid": "0241edee-83d2-4498-afb8-2504e7480982", "value": "1536:BLP7dBiwqevwYHMSKq65JPpp96zk6yRNGhWQfQxvu+7R:BLTdBwevrHxKXJPdWIxvu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312904, "uuid": "51980b0d-4c34-45bb-9ba4-f6aac6838575", "value": 86672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312904, "uuid": "fa8b0c7a-46d0-49a2-9a8b-1f0bc3c2b3ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312904, "uuid": "bf889839-ac3d-4de5-8af6-afe12a1713c5", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944cce6e-e772-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313974, "uuid": "9bd663e4-6f03-4eab-9cfb-47f724f7164e", "comment": "Malware payload (Mirai)", "value": "f5bdadcac0b988f440c4f1d8fc5a54eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313974, "uuid": "a0af548a-ec2e-42f3-bf36-977cd296e22d", "comment": "Malware payload (Mirai)", "value": "c654842f84241f6f2d0cbd326ac0cc22fc0450d40d363cad39d64c3f5f4a85e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313974, "uuid": "621102b7-9f84-4c26-9b12-c20b32dc65f1", "comment": "Malware payload (Mirai)", "value": "ba241178c00b6acb38de44160d99ae46fa5b6615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313974, "uuid": "012b509d-92ba-44b3-8319-43a81c440814", "comment": "Malware payload (Mirai)", "value": "81d8799cf9fbac0bce4b50fb5a25736a410a142635b9554a97240ca8f5f74ab4d2726c7e7972938ae2aade66f2432c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313974, "uuid": "6d10ffb1-2b1b-47b9-8764-c6724b5d2fdf", "value": "T1911318C99D83C8F5DC0A1575147BE73256F5E536107CFA9BDB94E9326863302B20A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313974, "uuid": "05ee666e-6058-4ed6-9da2-2b0fa3979614", "value": "768:Nz+DIU4tvf3fBYcjI1U9HiBSjVX+I4PQ2Pqa5njtXf3/Ue06Z9A6AS6GdIC8f+qb:NzkI3vPfBYcjI1U9HiBSjVX+I4PQ2PqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313974, "uuid": "1518f5a5-efc5-4a5b-9524-6362a9a60dc1", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313974, "uuid": "2ba12ec7-f56d-4f1d-a58a-1cb95167fa92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313974, "uuid": "e18e272d-66ab-4f88-a618-7d24c42dc44f", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df97cb45-e813-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767383250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767383250, "uuid": "4304b6b3-2adc-4233-9a0d-9cf411583a0e", "comment": "Malware payload (Mirai)", "value": "c9cdf400cf742b03bb56aa6f65db67f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767383250, "uuid": "c9b9bac4-f5d9-4fa0-954f-f4c2efaef756", "comment": "Malware payload (Mirai)", "value": "c6d68bd7477c8da50d6453c2b393effe10c0bccd15099d92e4b3962734d52a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767383250, "uuid": "3b078a79-3664-4c85-ab3d-184036e358c2", "comment": "Malware payload (Mirai)", "value": "dacf630276f5ed5531ca66fcfd985bb3eb925a98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767383250, "uuid": "def80e60-707c-4ed6-9b46-7af3aa0d212a", "comment": "Malware payload (Mirai)", "value": "ff43c9d8246972d4d5ea7ae99108f60352706f4bd079f219c3b9b4ec5ea2822f1c6c0c2ba1b8c86d4258f1ae6222fbca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767383250, "uuid": "ac8d550f-0c29-4393-9d89-13c3c1c635a7", "value": "T1331317C99E43C8F6DC4A09761076E73266F5E536607CEE8BDB95D831AC52302F20639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767383250, "uuid": "2e5c68dc-a44f-4955-bbb5-ed9c346e02b5", "value": "768:fP+5Rr8hR/WztxM2bCQ5dgX67r36GbyrQyzcYGzrxRAx:fPYrA/At9F5d77+GbyrQ2jGzrxRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767383250, "uuid": "f74638f6-d37e-423b-8e3e-dd537be9b353", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767383250, "uuid": "96eaa52a-53a2-4691-95be-21399990564e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767383250, "uuid": "a66b8986-2a03-4424-ac33-88597706b720", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2254c47d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385509, "uuid": "003fe03f-944f-4432-a7fd-3c0ca672332c", "comment": "Malware payload", "value": "4b568a2e7d5a2ddb54949a487dfee9bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385509, "uuid": "cdfc6660-760e-4842-beea-6a9b2589a5b4", "comment": "Malware payload", "value": "c6f93e587535af06fce55135888bdd6c7de45a8823b8823e8cee7bf17b18ad11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385509, "uuid": "a4bc2f60-bf45-4871-adc0-4d940c661530", "comment": "Malware payload", "value": "f1377fc0ba69ba03c0400d955e8dab505c229b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385509, "uuid": "1f0b15b8-bb0e-4001-8f52-36dca81de809", "comment": "Malware payload", "value": "d52861fdaf7f52c13e9a3c278ef30072a06b8299f8dd847fb8b4a7ef459ab3869d997cb29981561afd9cef72ee766d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385509, "uuid": "0fa1a129-b960-495f-a0db-afae6f3f4ad5", "value": "T1070633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385509, "uuid": "eb8730f7-9c45-480f-9737-337e1f2fd54b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385509, "uuid": "17500f43-3530-4001-8ba0-85925a65aa16", "value": "98304:aeT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:52w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385509, "uuid": "3b504822-80c9-42b0-9fa9-b89d0001c068", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385509, "uuid": "98d9f60a-1382-4bd6-beff-cd145db8609f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385509, "uuid": "dfa03415-1f5c-4908-bab0-f747b0b78401", "value": "4b568a2e7d5a2ddb54949a487dfee9bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382bef1-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381860, "uuid": "e9454317-b17a-411b-9803-da2c322ad849", "comment": "Malware payload (Mirai)", "value": "9d488e58c68538f62c14fb12f818456a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381860, "uuid": "7eb19887-bb2e-4307-ab2f-da4f3c0b1be3", "comment": "Malware payload (Mirai)", "value": "c750c9a9f79ccda6646d26dc89d975d53f99ca26f1d6fdb30c4b01099e3e64c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381860, "uuid": "e5797060-da96-4aaa-a4cb-c048f05f4391", "comment": "Malware payload (Mirai)", "value": "972272fb2d90bcc7b763c528f8aadbb2aaac718b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381860, "uuid": "4d259347-9b85-477e-b97a-8c186651b68c", "comment": "Malware payload (Mirai)", "value": "7e8204c4a8c50b85c4bb79d95e1e94db61a6cd5299dd11cc01b879fd25b3d916599a23a8013620a12e79ca6aad8b809f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381860, "uuid": "00bdda72-0788-49f0-906a-e47be144c471", "value": "T196430994F880CA26C6D02276FA9D554C37175BF8D3DA71028E206B347BFB95E0E2BD52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381860, "uuid": "e32af4af-0d3a-4e02-addf-aea40e5e23d6", "value": "1536:/4WarENAAfPbxDA8D1aDlHVBaRmC4J0K4El6VX2EAMwqOegH6+vpPkN9u:QPr8Vnb1GymfJ0HEx9egHj9Yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381860, "uuid": "020150ca-f3a8-4f54-9616-123e932285d8", "value": 58556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381860, "uuid": "912065e5-42f1-4a82-801c-1d15e5149a07", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381860, "uuid": "20c212d4-31e9-4e10-9e93-116ccf8a993d", "value": "colomaarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33df3c8a-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385968, "uuid": "58f86f97-3f7c-4cfd-9e9b-477285b3dc6d", "comment": "Malware payload", "value": "d9d7ce1b977fca1b3b8f213cddc49331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385968, "uuid": "62edc2ae-6f41-4f43-877d-d5c2035d3636", "comment": "Malware payload", "value": "c77432fccfac5c1eec9b0132b2dc4e14fe22d5f5a8509894ba1f78e4959829fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385968, "uuid": "e9adae41-12ba-403e-b146-8196516b354a", "comment": "Malware payload", "value": "68a051d6024f67f2d34eb9dc148f39bdf9ae1c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385968, "uuid": "3b3a6dd4-04bb-4ebe-b970-b10c7af5b5ad", "comment": "Malware payload", "value": "aae7e8669aab226c6a81abc408f59383717306252a9621e0370d69dba546bf43ba248954f1e216cd065d7e37bf836245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385968, "uuid": "abb9de17-add8-4d79-b5cf-136a3225d92a", "value": "T1AF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385968, "uuid": "d2f8240a-e480-4c69-99fc-de78864a3405", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385968, "uuid": "9c586210-68a6-4f7c-8c00-c1eae76f4fdf", "value": "98304:asT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:D2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385968, "uuid": "4c141455-517b-417a-b32a-eb37be7d434f", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385968, "uuid": "0e6830cc-c38b-4fb4-b774-2f9af5b01094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385968, "uuid": "36c5f87c-7095-419c-b972-8345444f248d", "value": "d9d7ce1b977fca1b3b8f213cddc49331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31de83d-e823-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767390154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767390154, "uuid": "e83498b4-452d-46bb-a68c-505c11d60c1d", "comment": "Malware payload (CoinMiner)", "value": "ca7eeda8298504c955940a6c5f8df826", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767390154, "uuid": "f7bdc129-acaf-4fa6-9606-d450dd0ea12b", "comment": "Malware payload (CoinMiner)", "value": "c78ba64e698b6db6a9a1c05b3c82c5d12ba12d668a440f844f287828c031d825", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767390154, "uuid": "d9e5cf87-d174-41a9-85da-fa2d3ad67ee5", "comment": "Malware payload (CoinMiner)", "value": "5921ef6c429af2cc5edddbe13c60146055a65c0e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767390154, "uuid": "5681073d-10b8-42b1-b3eb-f3013dc201d7", "comment": "Malware payload (CoinMiner)", "value": "b367bef8aae8eedbb94ef4fb4eb0624675bb9c7dec514d37a4213ce792c99987b2b83be9a735030545aa62c08112bb89", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767390154, "uuid": "0fd6f4ae-9640-41da-ac5d-3715e8989a27", "value": "T10136238F07382BC3D0160B71EDA2CDB38E73D83A6C0A4E89B1A48BC95765709795767D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767390154, "uuid": "3c32061d-3484-468b-ae00-b0eb9f8d7c50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767390154, "uuid": "50376707-250b-4b5b-a085-7e03fc820550", "value": "98304:FfmkkPn8sr/CucuQo+P+rpxOsLwwpaE1lVY3G5uSO8hzOElSaGV40f4Iwg:FHSir6pxEE1lBuSO8hSEcaF0QIwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767390154, "uuid": "fa988adf-ed54-4817-84c3-7c7b51d39ba0", "value": 5049344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767390154, "uuid": "04fbe796-0f65-460a-9431-57bf06f0c2fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767390154, "uuid": "8478958c-3e35-4e33-91ec-a7c4e6a1d13c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcd1d48-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385793, "uuid": "3ba90041-72d6-47cb-a47a-f71ab9db9188", "comment": "Malware payload (Adware.Neoreklami)", "value": "a0749bf6f92546b123aef8a706678fd3", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385793, "uuid": "603e8f33-532e-4622-811f-8a0a607ef5c3", "comment": "Malware payload (Adware.Neoreklami)", "value": "c7bb13129ae5d971ad13ed85741f27d2a21732852e4300eb391888711952a1a7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385793, "uuid": "485aaefe-2d6a-46d6-b648-df03864af277", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cfa05685d474c74ac6fe9fd7c393b1c5cb0768a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385793, "uuid": "262574d6-dd38-4f84-8336-f21583b6b43c", "comment": "Malware payload (Adware.Neoreklami)", "value": "be83592d87c969adac30feccc42b208834d0843d46b0acebbdaf55f1aa8d59e646b295446eecf72835976b27958f946f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385793, "uuid": "7ce48f6d-ba8e-4255-be81-079d523f61b5", "value": "T1397633217CD98078FFB64A3396412DCAC2C9A5151E729657AB48392D3F7B2C2C13973E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385793, "uuid": "1cc6f62f-0da7-4004-967b-685bd5f6a466", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385793, "uuid": "1da9e0c0-2177-44a9-8c4f-dc3f2de7ba99", "value": "196608:P1OkRa1OlEHgH37Eqt24czKUM/Var0/WIpvjx:tOXsP23KUMdaIuIp7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385793, "uuid": "33ff027f-d9cc-409a-8689-1055b69c7b29", "value": 7491482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385793, "uuid": "baa99e9a-b481-4eef-94ce-6d401d3ac06b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385793, "uuid": "1a44622a-fd84-4485-8d09-cc4c49d38d3d", "value": "a0749bf6f92546b123aef8a706678fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab40093-e82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767393361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393361, "uuid": "a30c8bea-d6d3-4768-84a9-cff29b33321f", "comment": "Malware payload (Mirai)", "value": "924bf64023d66ea6837e33971581e726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393361, "uuid": "0bf49af8-8da2-4800-a96d-442d99bc3ddb", "comment": "Malware payload (Mirai)", "value": "c82d6f868f9ba157f1409361872745284b93b785e732c24de76cc86042503156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393361, "uuid": "f72b8bff-4512-4c29-b38b-2d60fdb922af", "comment": "Malware payload (Mirai)", "value": "fa87fc2e1451ef95705710664a02096dbe84f8d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393361, "uuid": "8b11c0f5-3cf6-414b-b1f3-8fa53041a256", "comment": "Malware payload (Mirai)", "value": "fee68f0f04da00df69122d0960da2c7bb05d067795db703923dea2b002f473839548e8715c1a9bfae44263724eca31ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393361, "uuid": "adee1cbc-4134-4347-a665-34941b7f8bb2", "value": "T183E33B02B30D0947E2672EF43B3B27D193DFDA8125F4EA44251FAE4992B1D32558ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393361, "uuid": "822c2e63-5490-447c-9254-fcfc4bc9d3d8", "value": "1536:Gf32D5r8eiwPfVjm0cqfyCxe/nMwZ92xHB7kNzyE/SGfq+F7cuN+L0DltziqCWBV:GOD5rR9j5x7+yg5L/xNtz4WRAeFvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393361, "uuid": "2a054305-aec8-4852-b01d-08e6b68c9278", "value": 154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393361, "uuid": "731a4f4c-0dc7-4b79-9c12-71a9b4ad9afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393361, "uuid": "4bf95d75-0e2a-4f6c-a8a6-33069837cd7e", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ae7f43-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385513, "uuid": "356ee3d1-a0a5-4d5c-a9bc-7a6352790ee9", "comment": "Malware payload", "value": "4c0387067c82c31857b0f59bfdfed8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385513, "uuid": "f22a85b5-ef6e-4362-8ae2-434e5e70bafc", "comment": "Malware payload", "value": "c848248b438b191b948ebd7dc4f4f94ca69a55c36b5e3e0d1c6e846f3e13ea69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385513, "uuid": "0cb62fea-a895-48b3-bb45-f97d3025df6b", "comment": "Malware payload", "value": "e72147e34d712aef679e1701b82a2237692b7abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385513, "uuid": "eea37b1d-ca49-4b04-9ce9-3a7a7f106410", "comment": "Malware payload", "value": "cb3aad36e47012cc82b8443353ad18a072421cf7b9b05fcea9c2769ae6364afe3f912618f2b94ce5d4d95c27dcbc8fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385513, "uuid": "126c19e6-50fc-4636-83d9-712f3c812d73", "value": "T1530633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385513, "uuid": "1ecd1a3b-7375-425c-be18-bf6e429ebf88", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385513, "uuid": "97c6def4-6794-4d2c-ae44-e78058631810", "value": "98304:aXT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:w2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385513, "uuid": "af7e9a6c-2f8a-4d4b-aa62-4eaf853ab992", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385513, "uuid": "11862138-3cb4-4c96-a620-4df52e96cf84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385513, "uuid": "195d644b-8347-440c-ae11-302642259ca4", "value": "4c0387067c82c31857b0f59bfdfed8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb319068-e807-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378061, "uuid": "80fdea72-3b91-4b47-b26a-4bd827098222", "comment": "Malware payload (Mirai)", "value": "01a8c54e8c87cf937c92942a6a91b87c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378061, "uuid": "0cf0c0da-8aa0-4db1-bb94-6e263d7fcb29", "comment": "Malware payload (Mirai)", "value": "c8da0f63c2c57cfca93fcb1e2d520d8021ae0c80374abc73963cc09f06d71d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378061, "uuid": "3108f604-38d3-45c2-a816-fa5bebb9041f", "comment": "Malware payload (Mirai)", "value": "f6ef51b60b9e7a249f401ecf629f3e1973f4b4ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378061, "uuid": "dd216d0e-398b-4e73-882f-ff4d049ed5ce", "comment": "Malware payload (Mirai)", "value": "d53a621b2f687daf49765d0fa7ff59a90f0ac86644c6a838321482b21be84902a2f77c692febddd7c0bfc9fee4343e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378061, "uuid": "5d49ad5e-3310-4630-8bbf-5bf44635e745", "value": "T182630231327EE460D85120B1FB6D80BF1E1735A9B4BA32F7D299494C216A9C399F1BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378061, "uuid": "bbb959bf-6d61-4cc0-934b-a4331da38d36", "value": "1536:RMwTAnPr5uOaqZYDWrNt09B4UA4h6tUZShgGKrRLiCSLr:RMvPduOaq2DUNtg+UA1t2ShbIRsLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378061, "uuid": "fffb2c7c-12cf-42dd-935b-6b25ed8fbe26", "value": 70592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378061, "uuid": "63d6a070-339c-41c3-9337-40695e9ac5ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378061, "uuid": "3b7ef057-5035-4eda-ac4c-c9ebaf22419c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2718b048-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385947, "uuid": "6382b16d-e77a-48c5-add7-a16e7298dd52", "comment": "Malware payload (Adware.Neoreklami)", "value": "d13c7780b645c3445bb0706047c96144", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385947, "uuid": "4467f9e0-e2bd-4087-9e8c-befe21e64ed8", "comment": "Malware payload (Adware.Neoreklami)", "value": "c8efa0bf648569458d6868487e6034e91a79ef42f6eefe740097d30ac04f0c86", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385947, "uuid": "84f18910-dde1-4dc7-9b18-1b9f7e5ef0fe", "comment": "Malware payload (Adware.Neoreklami)", "value": "4f4c52c40fc8a14e9f58505216f1a4e4426309d9", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385947, "uuid": "b0a6c053-39d1-447c-a7d1-1657837d7066", "comment": "Malware payload (Adware.Neoreklami)", "value": "5b8bf8d54ad33a313497e7b272d8d1ea835932b4683e2c8d7e0bfbecbdd05007a26d9266d5e929807819e0c5bdd5af15", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385947, "uuid": "d1c8e228-b02a-4d05-82fe-7604ec181745", "value": "T1AA7633F579E5D93DC6462C70C9282F401BB597EACB01C1A317C580642EBE788AD7ACDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385947, "uuid": "ac7d1e15-c40f-4a0d-b86f-ea509245730c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385947, "uuid": "38a32d47-e547-4b6a-a4e0-93ab740b3317", "value": "196608:P1OFNSO9SNLjx/aTDY9ZkaFGeN09FktVZv4tdmOGp:tO7SOYLjdZ9V3W96t0tdrGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385947, "uuid": "fa84692e-0095-446c-a4c2-1b0e045d49ef", "value": 7516721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385947, "uuid": "de734e81-0e2d-4c10-8aec-3bcc73d14811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385947, "uuid": "6c5d44d7-05de-414b-afdd-8956dc345468", "value": "d13c7780b645c3445bb0706047c96144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5e2f3-e808-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767378246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378246, "uuid": "06ec072d-648e-449d-82ba-675b4c545b5a", "comment": "Malware payload (Mirai)", "value": "3d743b1d9cbc1dee379ce60bbd860564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378246, "uuid": "1959c9bb-352e-462d-a002-d0767bb26c3c", "comment": "Malware payload (Mirai)", "value": "c8fbb26f91fa7c560bb22fa744e1d2f81ea5281b262ca8be1d27a37252355eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378246, "uuid": "62ad6943-4171-45ed-b963-fff28bf53e7e", "comment": "Malware payload (Mirai)", "value": "a0c5b15bffe24e0986c76d4e521617a128a15ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767378246, "uuid": "65b9378c-c97a-430d-8583-0bd789d0b957", "comment": "Malware payload (Mirai)", "value": "6263bcefec02c597b70be949d660ee761552c3e3d2d552ad96a9262cd37a0d1d53bcefdd01a8c8418b418267b35014b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378246, "uuid": "c4cebf72-15f8-43ca-87f3-228978119fe5", "value": "T16214BEA3B70F24D1CC2506F80BCB5BAD2A2326039D6796E76C5F3A396E760CE59113D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378246, "uuid": "02c928de-1a5f-4f67-b2f4-e1e9a651d02f", "value": "3072:GKeX2dsDkylC+PHtqUTkSLPb7bXrPEll8q561Gg4CLTPaASsq:beTDkylCapHDHr8bP5u4CLTPWsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767378246, "uuid": "84cb704d-56ae-41d2-bd7f-e92d039c6299", "value": 190372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767378246, "uuid": "36e05fea-5dc3-4dfa-bdf4-7be0fe6fde98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767378246, "uuid": "22171a42-98cd-4dd2-9ec6-7391bafa9c4d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a75114c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385496, "uuid": "4d652165-e6a5-4527-b56a-b41d31651d9c", "comment": "Malware payload (Adware.Neoreklami)", "value": "472f84cadc1ceb82f4ddebf520dd779d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385496, "uuid": "4a704a85-863b-4f3a-8a8a-958bfc205311", "comment": "Malware payload (Adware.Neoreklami)", "value": "c95f0dc0320ddd641b44b0815396e12938ab6734f626e1d8f1d8c0d5ce97328f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385496, "uuid": "727e705f-d565-4962-aeac-5d4f900664a5", "comment": "Malware payload (Adware.Neoreklami)", "value": "9706af5aa2f95eabb885680c9fe47bd9dd3e1f1b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385496, "uuid": "3aa6d878-6eb2-4120-85d3-abb1b97bc95b", "comment": "Malware payload (Adware.Neoreklami)", "value": "66f8e27607e80c12a1805213f5a1c3a71e0ef424f466f5d0838cc56912fa6cc7650e62e9055aa0f828317b084657f1ab", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385496, "uuid": "7cca7245-75bc-4411-aa38-609318391e1f", "value": "T13B76333273F940B3C69A2871937977F798B1E5150EB35863EF68811E4F18D948B27AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385496, "uuid": "b8f5210a-1529-4700-8f5b-c66dcdae8c04", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385496, "uuid": "0db67608-a5d0-4116-add8-1079ed26a2c1", "value": "196608:P1Oq6gTbtM7l+xBal0vlyWNLEnA/68cySUYeMf:tOvSb0l+xB40DNLn6vySU/Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385496, "uuid": "7046c2d3-e43a-4ec3-b728-40c567c570f3", "value": 7573251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385496, "uuid": "b703ca64-0a09-454d-b62b-fa22de817ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385496, "uuid": "c4ad0b95-4d05-4fda-9f77-e05da63ee9d9", "value": "472f84cadc1ceb82f4ddebf520dd779d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533919fc-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386021, "uuid": "0ba2709d-e02a-45cf-8c7b-430ff800a731", "comment": "Malware payload", "value": "ee6b9c2b8f25ce2dffe54118b5d3f0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386021, "uuid": "f58bf50e-f596-4d91-8d83-6a63ccb57f81", "comment": "Malware payload", "value": "ca0fb882ece44b660c9deb0e67da29015231835f88ac3694c7253feb1d320fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386021, "uuid": "6abac075-2bb3-4ff5-942a-1723ab4d0a05", "comment": "Malware payload", "value": "b6756b54582913aa73e0ac6e09746773969499b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386021, "uuid": "9ce5390c-8741-47f3-b7dc-9b2cea2ff36d", "comment": "Malware payload", "value": "b6b73bd80593630b2c16282f007e6cd63ed5a11e1fa0abbca49a8d50b40ffb21f0a623ed1b659f21dfe7782691ab4a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386021, "uuid": "2ec4c2c1-e807-481f-8ebb-e2ac751086d8", "value": "T14C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386021, "uuid": "854eec17-de99-4cf1-b789-37ee9824f9db", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386021, "uuid": "bf9dd0d8-a268-415c-931c-0b93dd55b4c1", "value": "98304:aMT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:P2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386021, "uuid": "896713c1-27e6-4b84-ac4d-64ccc13ffeff", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386021, "uuid": "520d9a18-9bce-4ce8-bb5d-67bab437a41a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386021, "uuid": "97e5e438-69ea-460d-80a8-b5171ced44e9", "value": "ee6b9c2b8f25ce2dffe54118b5d3f0c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a144f9-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385379, "uuid": "c599b0b4-6eaf-4754-bca8-e78d4b9f06a4", "comment": "Malware payload (Adware.Neoreklami)", "value": "17050aaa57ec072ef52e4906968c15fd", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385379, "uuid": "f67e591f-f18d-45d6-9551-348353c5e3a1", "comment": "Malware payload (Adware.Neoreklami)", "value": "ca353569b60e5c983dfc4bf526364dee8aa6d0993226cee66957b65223e07362", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385379, "uuid": "718c4490-d3c6-4511-965a-70b495ddfea7", "comment": "Malware payload (Adware.Neoreklami)", "value": "2cb2d7d4dbdeb58b95259e52f1e8469bbd9e0a5b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385379, "uuid": "04c25b59-cbee-4206-b357-493e1ea40da8", "comment": "Malware payload (Adware.Neoreklami)", "value": "c948cad63999c6c807c1114cad0f2d96bff188b12c2222ccc2d7d7ece2a8464e7c773eab7c4681aa885482d70b91ea68", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385379, "uuid": "088c8df3-bb44-401c-af0b-9809226776cf", "value": "T10F7633233AE08AF6F6514230CE60AFC3E26CD33A15B469B7135D661E5D7CEB9C51821E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385379, "uuid": "f2b4a24a-33d7-4950-94b2-399dd0aff73f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385379, "uuid": "c631ec21-e881-4019-b211-de49d582281a", "value": "196608:P1ONHE4RRj+DGASfCPL4p8aOa+XHXJ9E5FRDAAKc4begfM:tONE4RRCrp0OaiDE5FRF9JgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385379, "uuid": "1e0b6941-8ef9-4c74-8998-e6cda60f9af8", "value": 7624684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385379, "uuid": "282eab2b-fddb-4913-aa6d-98d2264cdfdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385379, "uuid": "b78f520c-ea56-407d-9467-68d05457c4b7", "value": "17050aaa57ec072ef52e4906968c15fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ec51c7-e815-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767384039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384039, "uuid": "a6c9b2f2-0eef-4f3b-bf72-ea07de83a34f", "comment": "Malware payload (Mirai)", "value": "ea319807d8a90e5851241681c3131667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384039, "uuid": "1236a2eb-9d95-4026-86e9-041715a47125", "comment": "Malware payload (Mirai)", "value": "cba470e5b80d36c27f772951221e12492fdbbf61fb42695856db9b43eb14aeb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384039, "uuid": "96605af6-bda1-4158-8ed0-1959afc088e0", "comment": "Malware payload (Mirai)", "value": "9167f6fe2e6348c2fc7f1b60a43997b1fdb2096f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767384039, "uuid": "f25cb34a-2e5a-42b4-8e46-8f65e5c4e114", "comment": "Malware payload (Mirai)", "value": "738c25fa551ec500e7f6a2030762e1dfcab35181b630f5cb28e9a6c638d4c1d4521e0c6f673c97f62227562a0a77024e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384039, "uuid": "c9333526-4996-4102-ab91-23df6c2d7c0c", "value": "T1E793074AFC819B15D5E922BEFE1E018D33535BA8E3EE72029D105F15378A92B0F7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384039, "uuid": "e6b4ba59-2fc0-424a-9493-2ec0985c3f04", "value": "1536:gRn7+AGIXwhWswJpjJqlPrFsRISGHwe+caIxvcJUyyBi/8u4cfq/llLiiqwHRoh0:dKXswJpjolzF6gHwe+ecJU9Bi/8u4cS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767384039, "uuid": "7e94303c-5736-4a2b-b6d0-eb46b1ad1ae8", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767384039, "uuid": "f720971c-9762-4797-8597-0fe70b78cf31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767384039, "uuid": "acca1f9a-554e-4483-adc5-47bb80198b6c", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fdb3bc-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1767386071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386071, "uuid": "36585fdb-0570-479e-b641-519233588b7c", "comment": "Malware payload (GuLoader)", "value": "d1ddfba00d3dfb405c29575b2903d156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386071, "uuid": "8d397913-43d0-4d48-875b-10e127c5a7eb", "comment": "Malware payload (GuLoader)", "value": "cc43eab382b61385c874129270e17c76912eb94c2ea5158ba1175c6689bbec38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386071, "uuid": "335c348b-9d96-4770-b8fe-e015d5610c14", "comment": "Malware payload (GuLoader)", "value": "013d1dfd117f350632b68bdfdde45581dffea1cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386071, "uuid": "e9aebc0f-44ae-4834-9226-e6056e7584e2", "comment": "Malware payload (GuLoader)", "value": "41a88797de9f4b7577397bbdc29ee6d3794067c0912f9d04a73f8ebe07ff0de3c7b725a73df63c11b10de681238ef698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386071, "uuid": "b37cf4fa-7586-4a92-95fe-595fb956fb1f", "value": "T1F0A423513101D887C56C577458ABDA21EF7CEC90244913173B913FAB7EBB76AF88E241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386071, "uuid": "c8d63591-5fe9-4619-8e55-7e239a170966", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386071, "uuid": "cc12bc33-4f84-4aac-9cda-5f138c402b53", "value": "12288:MrMfyflXO6Ut9jeQ5UawozoPIPZ5JDe7ndedXFCF3yct7P31:kMfulXM7F5jzQIPZX9dXF+ikPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386071, "uuid": "9376e4ee-eff8-466b-8112-024e78b8eca6", "value": 463792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386071, "uuid": "e4eed919-02cf-4c60-9452-47c1e152232c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386071, "uuid": "a6c25c05-b114-4521-be8c-50377860d280", "value": "TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24347cd9-e7a3-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767334832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334832, "uuid": "5de4ba63-a6cc-41a7-a8d5-9b4a2fe43983", "comment": "Malware payload (SalatStealer)", "value": "0d96fff72632572705d4d5e431a663bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334832, "uuid": "31652748-05ae-45fc-bc95-0155213e93d7", "comment": "Malware payload (SalatStealer)", "value": "cc969e00b77444fe3babfbe708980c0789675f8cd376f362af8264b66f011f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334832, "uuid": "1ece049e-3bd8-4776-ab7c-cf87fef6bb3d", "comment": "Malware payload (SalatStealer)", "value": "40c94dd5efe78e82d8cbfbb3d4f22197b85b7fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334832, "uuid": "5c8fb129-528b-4071-8bfd-f943776f2795", "comment": "Malware payload (SalatStealer)", "value": "403237a522012b3f850763c59a38d3c9a141f297a879330533480b67c772d313cef6fbaafaadb726bc96ed0639f7608c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334832, "uuid": "63d392ca-abe7-4628-8892-9c38369e6898", "value": "T1FAC66B11FA8B94FAE9031835406BB23F63355E048B28DBD7FB543B6EFC776911926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334832, "uuid": "73e1b9cc-5c8f-41df-b6ef-117ca16188d3", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334832, "uuid": "224533cb-fca8-4ee8-a3d0-bf5eb1843202", "value": "49152:t6SKxxzMtXrWK2DLagXmtok2mko8l3phLSTjKoY6NW2NYw/FSrLzku+jmTzTxjYU:EHxdMv2ScdjgkP78mTzTbWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334832, "uuid": "76dbe914-a477-4647-b851-f2c0d3f0a23a", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334832, "uuid": "e4c45e7b-ee8b-4a8f-8277-3d60e4e719b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334832, "uuid": "174fd275-e01b-472a-a4fc-70a0fac7962c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce811f33-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385368, "uuid": "cc0cd701-34c4-4e1f-8107-c9dc6eda987c", "comment": "Malware payload", "value": "123458001e72c4394995b71af2f669b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385368, "uuid": "c1eb8cef-5dbd-4599-8080-f9f37c00d86c", "comment": "Malware payload", "value": "ccc9fc73db520b66b35f1a3241f64b2fee33368eb8f2ada8bfbb686658b72e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385368, "uuid": "4af91343-0466-4671-8851-9f3238dbba48", "comment": "Malware payload", "value": "50a812ceaabfe6aa0a104ef0a92c19e2b87047fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385368, "uuid": "7f67eff2-e41f-4684-b545-d171562b3315", "comment": "Malware payload", "value": "68c54fb3cdf29f38d624e40381e20319ca224eab3876003091c280d12d943b81331719ab0fa7ee47cb66cfde470657b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385368, "uuid": "be13613a-d153-4f38-ac57-381a9cd04c7e", "value": "T14B0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385368, "uuid": "556e99ce-c0b1-4c0e-9622-36e383c58553", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385368, "uuid": "6653fd4b-4fd4-4195-bf30-9c08aadd72a6", "value": "98304:abT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:s2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385368, "uuid": "e07a062c-d7e0-40f1-9ad4-3aeb7a3632f8", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385368, "uuid": "df10b391-9919-4d3c-8ac2-38be9d708d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385368, "uuid": "3722a802-6e66-4201-a8d3-218b3dd79307", "value": "123458001e72c4394995b71af2f669b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c978e8c-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767385687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385687, "uuid": "6fa0d6af-8a0f-45b3-af7c-42ff52ee71a1", "comment": "Malware payload (Vidar)", "value": "8591a981cf3c775d6291075f8826e6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385687, "uuid": "58e157a8-ea4f-46c4-b2cf-1c18744494f8", "comment": "Malware payload (Vidar)", "value": "ccd2fed09671aa21c5a867832dcff190ea19d62c4b8edef03ab7fc94fba780e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385687, "uuid": "918e6405-4730-4a02-840b-01688c7c66ab", "comment": "Malware payload (Vidar)", "value": "a6d649876167d5fadfb195fcf24982ef928c024a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385687, "uuid": "e00f6c5a-43f7-446f-b004-c77609495409", "comment": "Malware payload (Vidar)", "value": "07114227eeae4f6be53c6a9517727c686b8631e5d1ff8f0fefcf177c525b60d5d8618efe8bfc7a06e8fc98f2a40ca0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385687, "uuid": "4fe8e315-fbc0-4109-92b2-370922f9f3b6", "value": "T19AF423EB5B7F986BC3874374D3963E00A10ADE608A3E52D0712ADF0795651F12A1DED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385687, "uuid": "9d5b48af-d743-40dd-9b81-887421b9d4a0", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385687, "uuid": "aecbf1f2-7a2f-4e34-8ba2-16216fd6d41d", "value": "12288:LBhtPwNtN8OqiolRy69tLX+hgTR28fOzvFIu29lKiG5cE/IZe3OokT+J7YpbGKic:LBbY3ZcPRtLXd5f4Iu29lRG+kIZefsWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385687, "uuid": "d99ee5c1-98ef-4b2b-b8b0-549ced3d2207", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385687, "uuid": "dbe2aaaf-9f73-4ace-a64d-197aec68e15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385687, "uuid": "d15e896a-5b1d-4722-8a96-de98bed23f90", "value": "8591a981cf3c775d6291075f8826e6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7c6db4-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381609, "uuid": "848e702e-f8b1-4fac-ab6f-5db2603c5936", "comment": "Malware payload (Mirai)", "value": "6452a3b60fd33e0a58f0125b629f67d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381609, "uuid": "eccfad55-6b8f-4041-9346-e609041eed10", "comment": "Malware payload (Mirai)", "value": "cce6ddeee60542629dc1eb20a6e2960b252381ae1a88181dc07cdc16e99a5d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381609, "uuid": "80acce56-b8fe-433d-9885-3b7b8714494c", "comment": "Malware payload (Mirai)", "value": "a274e99e092c162712a1870e4eb25e085a9d926f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381609, "uuid": "73a615fc-c4ce-4ab5-ac35-2fc4a7bd1740", "comment": "Malware payload (Mirai)", "value": "e5233466dd5f8c4537efab72b8d90dbbd35362429ace2b86c7f7dca08f7541b28513b58ef52ea0505bdbf206ebcc7db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381609, "uuid": "35ab6211-7897-498b-94b5-860bc489863c", "value": "T17753F946FC818A06C5C513B6FA2E118D33136379E2DFB3129E106F6477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381609, "uuid": "737f69f3-1bb9-40cc-aa27-70f125764bd7", "value": "1536:85niAJdB9VT2SIjmENMeLWhQczKORk6V0SFiZoLJI8iwPZFZWhi:ydpxam8vLWOczKOTVX/PZFZWhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381609, "uuid": "e232511e-6e08-4037-9f7c-116d6342db2e", "value": 63180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381609, "uuid": "6642bead-2091-42a2-9b82-0b1b22ea933d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381609, "uuid": "c8297cef-ca1e-4811-8aa8-90c260f48dd0", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4787bab3-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767386001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386001, "uuid": "0933726c-72ab-478d-98ac-71fb099db70e", "comment": "Malware payload (Adware.Neoreklami)", "value": "e8995a011d0117b98c282aaa164aed88", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386001, "uuid": "68f1dd9f-9078-4839-b3f3-dcc6359ab8ee", "comment": "Malware payload (Adware.Neoreklami)", "value": "cd77bac58fe0338e7a9b5771331e71eb415873c20a6490714f489e628668db94", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386001, "uuid": "48252ab0-b69e-42c7-879f-f29b1e664c34", "comment": "Malware payload (Adware.Neoreklami)", "value": "d22b91914e181ff028a35f12bdc1a5bf92ee2151", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386001, "uuid": "f572357d-f2c9-463d-8324-4dde099ba2be", "comment": "Malware payload (Adware.Neoreklami)", "value": "5f524b9a70f4fc887857b5d84621c3fce0ec39c58e1493296ee4663eeb2ca1d63867f511af67f4e3389feefc102520a0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386001, "uuid": "7831e390-93f8-46b3-8290-e3e1b35c639b", "value": "T18B76334235E0CCF5F2D948F09A4DAB91E6E9931E1D36393BAB4DEA0D77183E95631203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386001, "uuid": "f7eb6a55-d9f7-4c91-ae9d-9c6be97cb1e2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386001, "uuid": "7cca9c21-e58d-4d27-a36c-bce8bdfe54e9", "value": "196608:P1O0cl3NUwJLj9fzna6XvW8iruwwNszJbVGQrtbLi3r20KXZ35Vj:tO3a6eZ8N+KQrtbLi3rBK1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386001, "uuid": "019f69d7-a1fc-47da-b00d-9b7633127533", "value": 7573954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386001, "uuid": "8a9778ce-9ab1-4e5c-80e0-c3ec79e9fbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386001, "uuid": "87d8d216-a549-4eef-9d40-7fa1b2003a2a", "value": "e8995a011d0117b98c282aaa164aed88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2615d451-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392387, "uuid": "9b7c5530-8636-4723-8281-92e7d1b1ebb4", "comment": "Malware payload (Mirai)", "value": "ada0f3031fc3ac3154b7612e2ff2436e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392387, "uuid": "58f7e650-cc91-4220-8ad2-4daf37ddae5e", "comment": "Malware payload (Mirai)", "value": "ce2cf1987090592419f64c5f1b51af9314bdcf609306b43501a3db39f9c56d9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392387, "uuid": "ba75ad48-7cf8-4264-8796-ced695bab290", "comment": "Malware payload (Mirai)", "value": "f91376a322a4e8aa2f5a93039c9700ffaf2f5d74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392387, "uuid": "311d5c3f-092f-45d1-8461-347288f62e86", "comment": "Malware payload (Mirai)", "value": "21ada6a2bcbc4e22e5ae228a7b869f832868a29859949574f6f8f8cb541e2a578852dfbd072bf88f61e8aed66910f36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392387, "uuid": "8e1f2d93-6ad0-41ac-8ae0-7bbd7d2dc0fc", "value": "T126732B94F890DA61C6E4257AFA5D528C33530B78D2DE7202DD24BB3537FB95A0F3A842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392387, "uuid": "18fe1dd6-6761-48a5-9e94-6d3860cd6576", "value": "1536:1yDU3/f0zKnIfQ94iRovjX9aCFOqKATwlhFDV64ijLD2GFOD9y1Ir:1ygosIf/wovoqKSiFDch3Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392387, "uuid": "7371eaf7-131f-45a9-9675-04ab5c7ccf71", "value": 75040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392387, "uuid": "a323758d-293a-4174-a5e6-3feff71e43cd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392387, "uuid": "8d65cf90-089a-4ca5-8e39-49c8608b38e8", "value": "catgirl.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c367775d-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385350, "uuid": "5d951468-0d03-4081-b54f-fb974afa11d5", "comment": "Malware payload", "value": "0815709e94b99682d5c1682530fa4eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385350, "uuid": "47a05311-c379-41b8-8a7c-e60a5a77aff3", "comment": "Malware payload", "value": "ce5e2c885f8ee3cdcec211cdf7fdfa733e7ec72cd8cb61987d5cdca356a9b455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385350, "uuid": "6ab0be6e-4378-4b83-8790-465eb702402a", "comment": "Malware payload", "value": "2eaf9c305e088150760804f81f8f8cf57f7f3c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385350, "uuid": "e2fdce0d-6bb7-414a-84d4-6b11aabe0239", "comment": "Malware payload", "value": "cccd6754c99a2e9e3dcd55a0b9565690966f0727fa7e1364babe30296f5c8eb0d529f28707115b1967986016c0288569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385350, "uuid": "b95977df-84bd-4290-b9a9-eabe4315822e", "value": "T1570633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385350, "uuid": "e639b486-10ae-4746-9009-26d03a846be1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385350, "uuid": "d51385bb-e50e-4297-8f9f-f5120ae47b30", "value": "98304:aHT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385350, "uuid": "a35b58ac-1e71-4b79-adae-f26e53a63c1d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385350, "uuid": "e4913458-1b7f-44b7-9b5b-f5d4069f5a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385350, "uuid": "dfc5472f-d278-4056-9e1c-13e82aa65851", "value": "0815709e94b99682d5c1682530fa4eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca6a4c0-e7af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767340241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340241, "uuid": "d404bb96-f536-4d55-bf73-316c3a622807", "comment": "Malware payload (Mirai)", "value": "2207ddb99d7dcff74a6682e2c6dee44f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340241, "uuid": "c049f602-6c06-4a1d-bf94-dfaf9c83415a", "comment": "Malware payload (Mirai)", "value": "cecd1212bb23e1b4ecefaa1b8880d4e80acd8dadc3bb08a2855a7c1d4229c1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340241, "uuid": "a06d89f3-685f-49d4-b3d5-c9ea8a073ff1", "comment": "Malware payload (Mirai)", "value": "a674ff28d0ec9fe0eb5e607950ba68314334948a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340241, "uuid": "8adc576e-20ac-4343-8507-db9ff7e3d972", "comment": "Malware payload (Mirai)", "value": "733fcd124d7571d050d1e49ef377ec54bb263cd256eb488c50686ded910a98d8eae1d42f619e89b1985c7a0fbeaf15b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340241, "uuid": "a591b459-2894-4dc8-b08f-d439bcaf840d", "value": "T135B36C4BE643F4B0D81A0031125EE3798935E9722426CD9FFBE53F31ECA5B129A1972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340241, "uuid": "4a165d67-fde8-4247-a1a9-028057a88f5a", "value": "1536:9IJ8ZZmh/wDuoRTo0hwou2dMCwlnJkQPvqFHyUY5/1H13MwoGMo2NabeDUd31w5U:9rZm2cDBPvwHyUY5/1H13qAO5qQYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340241, "uuid": "647486cd-c1f7-4efe-9820-c645caf8abe6", "value": 115448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340241, "uuid": "741f698d-f23c-406c-beff-749ce1f7517b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340241, "uuid": "5a35c614-3bf1-4c33-9023-7775d4890890", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1b98d0-e779-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316835, "uuid": "04a479b5-d798-443d-80e2-faca865d9a12", "comment": "Malware payload (Mirai)", "value": "b41722bfd6e8615f31c4bd83429fbec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316835, "uuid": "64d37f72-e5e7-4449-8134-c27516636761", "comment": "Malware payload (Mirai)", "value": "ceda6d2e025843f95166f011f322cc3726e4298a5652c58457dc28071bd5bcdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316835, "uuid": "c709b790-ed4a-459f-910e-1a4a2def5d8e", "comment": "Malware payload (Mirai)", "value": "e2a9a16b0e999b039be343f6bd33814b53255666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316835, "uuid": "a86b7023-9a20-4c31-a1b7-754c7f73994b", "comment": "Malware payload (Mirai)", "value": "27d5f3ba0726c60f345f8ee2674c07e6b9cdce7d7c10e3a29684361296ba75ab01586cb627070e43ef61eab0af280567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316835, "uuid": "22bd8eb1-c8ba-4418-bf71-bed168eed40d", "value": "T1AF73023592448615C768C1FC7A34DF226A324FE0A782CC03D696FB8FAA531AA3583775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316835, "uuid": "86496396-9297-4de6-88b9-042999cb4074", "value": "1536:buPWbU2ZjYmxBI1iwDcMrgkMkhsne+4NaYksHCuI0euLRpU2pLVJuW:CPWbUO0Fr8ysno6T8eSztLVQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316835, "uuid": "d89a13b5-6868-4512-95ad-d8564b2d593f", "value": 77220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316835, "uuid": "a7fe6284-24ef-4831-9589-420b209a6738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316835, "uuid": "9ba4c6d8-b41f-45f2-9eb6-6c10c0bca342", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5d589a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385477, "uuid": "bd660812-a967-4cbb-99fd-7901644bf675", "comment": "Malware payload (Adware.Neoreklami)", "value": "41580e081436ad5b29fa1f8da94fb891", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385477, "uuid": "a3c7a13f-4f05-4c91-9899-2f05c42b79ee", "comment": "Malware payload (Adware.Neoreklami)", "value": "cf41bd0551ecf94110b35ae64281a4316a5268854607185b0c7ae1595e0ffdbb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385477, "uuid": "7255ff86-c4d6-4d4c-ac3f-10b9c4aab31e", "comment": "Malware payload (Adware.Neoreklami)", "value": "01d9ca2bf9e093952193875840156fb0f0b44ce7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385477, "uuid": "b1ccc95c-863c-4080-8c05-ea8c8c63e9fb", "comment": "Malware payload (Adware.Neoreklami)", "value": "213ff6f5caa6e76093052ada3e1e8580aaf0add23d1b7cfa7f641af08ab3f12b6b887fe5f894c9f03870bbc686efc059", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385477, "uuid": "0196f3be-5bb0-46ea-8314-f84bbb0837aa", "value": "T1B6763341BDA54AF6E2870C35C8A806D7D5E6EB022E3144AFB38B0C1E793D6D247787D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385477, "uuid": "2b457bf1-b48e-4382-a963-37c06082aaf9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385477, "uuid": "8bb461b6-27a2-43de-925d-08a11d14a174", "value": "196608:P1Ok3zEUylhprXuI2Ch/IFJ6T++2h0pk70i/I3:tOeszXuI2CiS++5s/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385477, "uuid": "81323900-64b2-4cc5-8acb-d2c3c30275da", "value": 7550518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385477, "uuid": "a7798032-5b83-4d0b-a4c0-779e46f8ca77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385477, "uuid": "30a475ae-325d-49e3-b72f-073d4f243be9", "value": "41580e081436ad5b29fa1f8da94fb891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569b1472-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386026, "uuid": "01c03b7f-420b-4c21-b346-b5b6fd02e9e4", "comment": "Malware payload (GCleaner)", "value": "efafab3ffe1a88b74da9aff4ef632947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386026, "uuid": "11ac68f7-5a14-4a6b-9155-048006d6f87e", "comment": "Malware payload (GCleaner)", "value": "d0b44329fec0f42c9e45e7374bb90ca7349d83f62d0bd8304a1b42a5c6cd6298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386026, "uuid": "6ebd4458-9b25-4167-9d51-58f91d14134a", "comment": "Malware payload (GCleaner)", "value": "dbbacdb7d6cf9d2cd7e2e896ae9c72dcd60bf7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386026, "uuid": "d879bec1-a2df-48a5-8187-f4c43f6efe35", "comment": "Malware payload (GCleaner)", "value": "c30c76848e996de0e1de3d68eeb302199e55685fce4a092cd3690b147a81510012f748d3e8583056f39bdd60aca4d5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386026, "uuid": "29f2e33f-fbb2-4d45-921e-4cf360ba45c5", "value": "T1BB56D03FD3B04D2CC755CA796E6A53CC84BCFB03D91C4151A4A488B07762A72B27EA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386026, "uuid": "c4b2ef6b-4a63-4638-88e6-c2fcf9149a16", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386026, "uuid": "20add149-ba23-4d8a-a241-fa76ca41d07a", "value": "98304:7XAcTmCy0CUZ+Lts9PlJXKdDRoz/yDxzt7:766DZ+JGlJuNM/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386026, "uuid": "72501595-b17c-44f0-8ecd-02cf4bed3bfe", "value": 5908240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386026, "uuid": "9623f29c-f95d-491f-ae54-65373c6a812c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386026, "uuid": "09038bd2-301b-4f48-b9b8-f08b8c26b83d", "value": "efafab3ffe1a88b74da9aff4ef632947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c6ff15-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385485, "uuid": "6985907f-5b41-4c91-9610-bdf973dceab6", "comment": "Malware payload (Adware.Neoreklami)", "value": "440f648fa7a139e324e99ff21f4f14f1", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385485, "uuid": "22265ac9-42e0-4573-aa7f-2a311bce8c75", "comment": "Malware payload (Adware.Neoreklami)", "value": "d11357972fbe4b2a7aea00b9736c17331cab61e8d4edab8490c7988df66b0676", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385485, "uuid": "ebd68fb2-775f-4916-b52c-0957a00128e7", "comment": "Malware payload (Adware.Neoreklami)", "value": "de5f35cab34e90b03761c0eaa0611a6d20b74c84", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385485, "uuid": "e04ceb4f-6528-4676-827c-804f9b5d5970", "comment": "Malware payload (Adware.Neoreklami)", "value": "e92e9bbc285e4c66a95ab42afb8f1b91e46351d03b05b16900c339d87d04148b6a25f593cb3981b1bf27859c6cf57506", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385485, "uuid": "481d3296-997f-463e-8777-3bb5f0427082", "value": "T14476332139D8E1B5CFD083B1645D2B89B0AACB985C306C93276D160E6FBD352DC4E79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385485, "uuid": "46225439-eb2a-4f46-b74b-ac9fd75d4224", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385485, "uuid": "672ce481-8599-482f-8607-a5339b38a518", "value": "196608:P1O0wSiJLwAKtXMYJrH3eVY7M4HvO+v8CMoHWM:tO0UJOXM0W6MoHWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385485, "uuid": "d8e01d78-aa86-4c44-8fff-4da2395925eb", "value": 7559476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385485, "uuid": "53ab032c-7016-4f8f-8206-f2f9fdf21205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385485, "uuid": "642b7a34-eef5-4b30-8ae8-51d18ad764f8", "value": "440f648fa7a139e324e99ff21f4f14f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca89c37-e80f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767381393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381393, "uuid": "d0631a45-6719-4f73-8793-461508fe7093", "comment": "Malware payload", "value": "3483a6d77a46b458de05e7d5c83a8e5c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381393, "uuid": "9decda7d-6c68-4c52-b9ad-41d912fed563", "comment": "Malware payload", "value": "d14e619296afaf687a5b3e642f2f927e8ca138ec0442d3a1aa23b225911e8ea2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381393, "uuid": "c8c1fbca-fda3-455b-bf24-f484d640cd90", "comment": "Malware payload", "value": "4541653b9d9d6be682e989a55b62ee520fae3ccf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381393, "uuid": "9d6c32f6-b7cc-4c22-b29d-224e4f8cf516", "comment": "Malware payload", "value": "f523a178f613039193ca9a066a62ad37e787c183ebbd03c607e6a9b08bef886a37c31d427af1f9b7636948ee6e06ca61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381393, "uuid": "dfad15fa-8e0f-4c0b-a557-5cb596ff2d29", "value": "T18031D2C951B0245868EB5D25F43BDC40F0B6EA81BAC08F05FACC787AC18DE05B462FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381393, "uuid": "c061a064-824d-47ca-9f58-e1c1e9cf9d6a", "value": "48:9X+KX+FX+zX+kX+AaX+U/X+GX+pX+oX+5dX+aX+MX+XX+3PX+p/cX+BaX+C:9XXXOXCXHXJaXZXhX+XzXQXlXbXgXaXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381393, "uuid": "8b91ec55-5172-41d6-80b2-30ecee057c8a", "value": 1681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381393, "uuid": "d08e8445-72c2-46d7-aae3-08611fe66f90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381393, "uuid": "72fc77be-1081-4bdb-a028-d32389b25b7c", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869d3af6-e7a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335856, "uuid": "080b9973-806a-4c10-9e28-9cc7a4721907", "comment": "Malware payload (Mirai)", "value": "a02db63c48344ee8841367a4ee28d48c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335856, "uuid": "741075b1-9371-4189-a169-b439d005e865", "comment": "Malware payload (Mirai)", "value": "d15d56bb65aa3b89a319ee505debb7fed3cdfdf2d529afd3b5d565178f7c1927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335856, "uuid": "02c3bdbb-53d7-4c3d-968f-bbac25975111", "comment": "Malware payload (Mirai)", "value": "e1a8a7dff7795cf5080e0ed005ca18893134ea0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335856, "uuid": "f8a74aca-68cc-4611-9ade-021548e50d0b", "comment": "Malware payload (Mirai)", "value": "0389337b24345c3de366b891c2f14cbbbfd042fb5ea20cafac13ee0a6f5c13403004830a239ebd709bab1e402129cccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335856, "uuid": "5078592a-e987-4353-8cca-77e316bc6ce3", "value": "T1EF630134F1863E93D39605B674B6491156E326BCEA6B283478398058E2937FF12FDBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335856, "uuid": "8fac9f3a-57b3-440c-a5f0-7c07e799b912", "value": "1536:wJuklIwvhhUtK1TriyWCuqFYRyEUiIXU3KK3WxDsrqNxjusnzH:alIuutK1TOCRpU6KmxDhYsnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335856, "uuid": "266e3e9e-26ba-4b2b-926a-fc6b6e3102f4", "value": 71256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335856, "uuid": "a68f0775-5e10-48d5-9d67-41a7ce36c66c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335856, "uuid": "b479bfa4-8d9c-483d-8efc-3bb26956d9cc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455c8197-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385997, "uuid": "0d45bb42-9b15-4ce8-8264-900c2a97e91d", "comment": "Malware payload", "value": "e67d5776612cc0471034c3226c619fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385997, "uuid": "2a61d64e-2dc2-498c-b8c4-020cb52e276e", "comment": "Malware payload", "value": "d17b9adb0c87177c7cddc7cd7e8b7851ebe7d9fede2d62392df265ddfa47ba53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385997, "uuid": "dcca57e9-be5c-400c-ab88-964a12ca17b9", "comment": "Malware payload", "value": "474dbf481fa7f87cb17f25fe1c22267aae8dd020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385997, "uuid": "d171c2f1-54a3-4bce-beb2-935e592dba29", "comment": "Malware payload", "value": "ed184434acbbee49e8d66ce5fc40debfb55da91f9d182ed61ce92e2d4c4088b926cb1f6b5f75c0f479bfbccbc0085657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385997, "uuid": "2f27ae9b-a35b-4ee8-ba6e-f355a4349598", "value": "T1D10633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385997, "uuid": "c1d09ad9-550a-4693-8171-9599c4abbab2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385997, "uuid": "8e896634-2201-4a96-9ef4-56aa3cf215c6", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:e2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385997, "uuid": "fcf57fa5-e397-4462-b2a1-b3f30c72ae4c", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385997, "uuid": "e075997f-0dce-4ff5-b102-c1851ef40c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385997, "uuid": "f3a90c9a-c5ad-48f5-82e5-fd21c17ee56d", "value": "e67d5776612cc0471034c3226c619fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb235d8a-e7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334306, "uuid": "24d53317-e460-483f-919b-e3ff0c52b14d", "comment": "Malware payload (Mirai)", "value": "6e0ed02d159d528f8cd6ed53eb33ab3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334306, "uuid": "caaf70b7-dcf2-416f-93c2-488a6a7fc74d", "comment": "Malware payload (Mirai)", "value": "d1f17ff0bc570cb8331fe7b2c05f72a05cde5802a8f9b4392be05e99441accca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334306, "uuid": "246e8ed5-3123-4a69-a23d-6fa3abe1711e", "comment": "Malware payload (Mirai)", "value": "5997e74b2916655f5dac01097a78b5c316b34446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334306, "uuid": "793584be-9246-4e32-9a7c-3325637d728d", "comment": "Malware payload (Mirai)", "value": "c45d7bae52f95aa4c08956825dbe88276bb386e8eddc5d82aab9d015fbd6ba7fe3446b9077a94c16edd7f66fcf82384f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334306, "uuid": "5f43269b-304b-42bd-bb7e-6cfd6e59931d", "value": "T1A3F2E17963C23F71D9A22D38EE79C987231A374CB9EE727729543A9476C305600E83D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334306, "uuid": "9c1b035c-ae21-41ac-9aa8-6a30f6fab771", "value": "768:sQhm53Dxwr69uTE7DtLuHEdmZEkhp0Jdeqs3Uoz5+:sQhmAGzDtLuHtZVp0Onz5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334306, "uuid": "f6e63c1e-d429-4a42-a2d6-145b026a56b6", "value": 36700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334306, "uuid": "c9a30ec8-f287-48aa-965e-acb349e68b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334306, "uuid": "1e4e4441-f2ef-4051-81f9-bee513177c0a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb190a57-e7c5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767349768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349768, "uuid": "e6c4943a-2e84-4b71-84d2-1b0c4e70eb74", "comment": "Malware payload (AsyncRAT)", "value": "5eaee3a2dff9cb31f73ea93fc7dfd1d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349768, "uuid": "9ca40ab2-25a0-4ab6-b89b-1861cb060eae", "comment": "Malware payload (AsyncRAT)", "value": "d242269e6b4441985892388ad12f4a37a741d42d211f334ff7a8a5870eabd66f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349768, "uuid": "8e7d47e1-0e47-45a1-8dde-20b1aebbcfc2", "comment": "Malware payload (AsyncRAT)", "value": "53e42054935a68e39d8857870a51732de34394bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349768, "uuid": "5f3512dc-58bf-4e54-bee2-9fc88f658d86", "comment": "Malware payload (AsyncRAT)", "value": "74f60a74c26553a4f7ff8f05e84b3ff12514ec6289f0cf1e25c55a2be7d3f06b5f6fc16eaf24ade38a78e5d20b12e77b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349768, "uuid": "53e9d44a-5aef-4c54-a4e6-39d6472f2226", "value": "T100534A002798C925E1AD4AB4ACF2954006B5D9772112DB5EBCC804DFAB9FFC64A127FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349768, "uuid": "d31d7696-ddb2-48e5-89ae-ba1e85826d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349768, "uuid": "b6b9dc57-f348-4a8e-b9a9-68beccf361d7", "value": "768:V/QWtKdJiPp5+ih9JmzVQawORzkEKLi3P/1+dSCv7mqb2nspwH1o62Nn3Ldx8G9K:Vkdy/PO7/rGbbfwMnRuG4oJVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767349768, "uuid": "ebf3bd87-8834-4b62-b79d-90d0f1ecb783", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767349768, "uuid": "56c5aec5-e91a-46a2-8a7b-84f2bc0fbb39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349768, "uuid": "0a33b38b-5be9-432a-81be-f68e3e5dc8ba", "value": "VanguardEndpointApex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f795db-e776-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315586, "uuid": "580032fe-31f0-4168-9602-6010e58f2dc1", "comment": "Malware payload (Mirai)", "value": "03d9d6034d59d129d0f7bc8908b201fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315586, "uuid": "35480c15-f028-476e-86aa-628483afd72b", "comment": "Malware payload (Mirai)", "value": "d261f4042ad6fb0744e0cd12fc73bd41952a1f38d057a7ba10ad992702f7af55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315586, "uuid": "0645cb22-0868-4bcf-b6c4-b4643a6caad0", "comment": "Malware payload (Mirai)", "value": "5717b275e98d936c6d45314579c0be1210287fbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315586, "uuid": "20ead372-fd21-430b-869d-dbb9ec5b591c", "comment": "Malware payload (Mirai)", "value": "38b5c596ac8f49c6e90352454c61f21903231f4cafc4152d7881cf0a83ece17f0cff0184b8dda6ab0cab29d82ecbfb15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315586, "uuid": "7aa05c1c-7142-4459-8791-a38e4b4c654d", "value": "T1BDC312B6B37501388BBE12F54C104657909130FA718566D8EB4CBEDA8CE8717F2D163B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315586, "uuid": "1a5dd983-6818-4aeb-b621-bcc045a4c024", "value": "3072:AVmrDM+WhD9Vy9QZ2CxQujPtJNGPqSmjwZjj:AVN+W57y9QNQujlnGiUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315586, "uuid": "39ae5611-2def-44fd-a113-ba5f48ef3b0c", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315586, "uuid": "989d5fd1-03e2-4f44-87bc-f6fa673e3399", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315586, "uuid": "9150b627-f075-4efa-9b15-0d65d474cafb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a47a0d1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385522, "uuid": "39aff5a1-3c29-4148-9100-017a5c70e9a6", "comment": "Malware payload (Adware.Neoreklami)", "value": "50e14236cafd83890332c14a4791619c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385522, "uuid": "72952756-980b-4143-8e89-434236d233ef", "comment": "Malware payload (Adware.Neoreklami)", "value": "d297a2d08ad496746445cd5bb7c50e03f6e0a881dcd0e5ff3fffc3e6a6b60259", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385522, "uuid": "ad777d0c-8b4c-4da9-ac99-2a958b5909d9", "comment": "Malware payload (Adware.Neoreklami)", "value": "0fd1f839cc1bce77a0979b35be4073fe4c3dcfe8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385522, "uuid": "bc6e088f-f160-421f-936c-86842391630c", "comment": "Malware payload (Adware.Neoreklami)", "value": "7b0d3f3d3068cc3a4acf4f623ff6209d5d22ea77598196df087863866cc3e916be69f10ee40ecb00d9d6f3b9c99d11d9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385522, "uuid": "2f0f4178-9861-4900-822d-06c9b57e30cc", "value": "T1227633943FF884B3E0A94131ED65EFE0B07EE3275632568F37A4491DAA2C0C587B1796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385522, "uuid": "3dd7546d-94b3-450a-9639-4a23bd54e715", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385522, "uuid": "3d057aac-da8f-4831-b264-2106be8012f3", "value": "196608:P1Obib8WxmwiXDs7ntKuQraKyjVmB4crhpY0q/:tOub86jtvQRoarrY0q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385522, "uuid": "1cf04574-6011-4962-acaa-20b3e5dd0af3", "value": 7560776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385522, "uuid": "5461b0b1-d4b8-4a71-9b1a-daa53e75b306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385522, "uuid": "8bdcfad8-218f-4ff5-8b29-e22ae6b87e92", "value": "50e14236cafd83890332c14a4791619c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749f64f9-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385647, "uuid": "6f778be8-c46a-452e-aab3-ae337b519309", "comment": "Malware payload (Adware.Neoreklami)", "value": "7a6bb511ccefafb1222442fbc08463bc", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385647, "uuid": "3fdaa076-2b0e-44cb-a573-597d7d50a3f8", "comment": "Malware payload (Adware.Neoreklami)", "value": "d2a74f5d89afc8e03864a87d2032740c07f572c34062c9f1d0c8b315309c2056", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385647, "uuid": "ee3f31bd-5b66-4125-9f10-fee9c4cdbe87", "comment": "Malware payload (Adware.Neoreklami)", "value": "76834874a7f59a7260550a34d6fa6014d8791c47", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385647, "uuid": "358afb7b-184e-4046-8bdb-36c806c25abe", "comment": "Malware payload (Adware.Neoreklami)", "value": "643a9923a64ec57f3dcdef92bea0e4469112c83e1aca95222a5661716b39d836291dd1e2747e3307085cd8cec955033f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385647, "uuid": "1132e584-3f3a-49d6-bbf3-0698cd02fe58", "value": "T15476334675FAC4BED253667F8924A3EEB5E9D5280F31082B11A40C2DAF3C649E513D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385647, "uuid": "cbd72fe6-95e5-4466-ae87-469f84385bb7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385647, "uuid": "5016661f-6eb5-461d-905b-4a1589024eac", "value": "196608:P1O94gwNKehP8BKKDz6o5AnwmJmd0HLn4PjDwWAOYIq:tO94weh439+LCDol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385647, "uuid": "f641b4a5-d6c4-42fc-96ad-8be215bb0df3", "value": 7531788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385647, "uuid": "f6e0de04-4e66-4766-9cef-fb414a5aa33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385647, "uuid": "7b2a1222-a058-4a9c-8abf-31c933b7bffa", "value": "7a6bb511ccefafb1222442fbc08463bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3049d39a-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385533, "uuid": "78b23eb9-347a-42d3-b0a7-b22a7768477f", "comment": "Malware payload (Adware.Neoreklami)", "value": "5550c00beaa422aa184881e43d529be7", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385533, "uuid": "28865586-6820-4094-b1d6-27b73fd6f137", "comment": "Malware payload (Adware.Neoreklami)", "value": "d2bda161b7cbd7a7f72122ea5a2d6023918f4d3a2f3c6d3481572a7c7d0b6cdb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385533, "uuid": "736a111f-63eb-4dff-8d38-0ceb27ade153", "comment": "Malware payload (Adware.Neoreklami)", "value": "d3f81a79e7fdeb474ec843b4c6adb45b1a779a1e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385533, "uuid": "35fb6410-6836-4041-befb-a3f2c2afec82", "comment": "Malware payload (Adware.Neoreklami)", "value": "ecbedfa88a18a5ad9fc8bd4e9641f34efc21be76ec2bee25218d166547e78ba2aada8937100ac436ebd979f792896b0c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385533, "uuid": "b176c3e8-85b3-4dfb-b588-ff019c744bb2", "value": "T1E676332234A1C679E7A220B2CC356FC66BF9B5150E10906B63DD5BFE173DCC6681A39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385533, "uuid": "eca36a95-522a-4cd4-8e94-a004436d75dc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385533, "uuid": "ef9e911d-439e-49d2-9f54-074fb8561030", "value": "196608:P1OCqVKeIlJeZlb2HN30eXKlR2C5srw5jov9Szib:tOCS8aZpU0wKl75lE0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385533, "uuid": "543c5430-1f8a-4e76-a092-3a432062bf77", "value": 7518779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385533, "uuid": "03e32322-e63a-4c72-bcc6-98a9035d98fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385533, "uuid": "ddd0a39c-fcb8-4b21-976b-a645ba70428f", "value": "5550c00beaa422aa184881e43d529be7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf568159-e806-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767377612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377612, "uuid": "8c4f8a57-d23a-419f-9f69-66989665f9e6", "comment": "Malware payload (Mirai)", "value": "ba5ac686afbc695112fafebb4b31929b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377612, "uuid": "e259445c-3623-4c22-a3c6-0102c6196d84", "comment": "Malware payload (Mirai)", "value": "d30bae8c846316dfb6f943a1ec8b8384dba15ce1df4c2eca96708dcf5f797245", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377612, "uuid": "be8722cb-f483-476a-960e-a087cb0bf0ce", "comment": "Malware payload (Mirai)", "value": "a9def6377a903938a98adee9df8be873805abf39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767377612, "uuid": "38227fd0-8a27-4553-8860-c3ca69da62e1", "comment": "Malware payload (Mirai)", "value": "f073be94e694ca3eda80948c30d2cc68448ac4be73cfb649ecd647a635d3101cb6b7edde3e6b304ec2f937cd3698d3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377612, "uuid": "de28cfcf-d79f-418c-bac1-ecd659951029", "value": "T1DB6302329DE8FD70A1D3D572E331426502620BF851926B2C0ED8D2E45BED587DFB026B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377612, "uuid": "6dab4497-b012-4e07-9df7-9f7b85e4dfe8", "value": "1536:aIVyH0jC4PCTGZnQzG9EutWi8mmTef33WM3tRjPE7QkAAwWYZrz9:KUjC3KZQTutWi8FTC/RjPEhAAlYt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767377612, "uuid": "844686b6-fef0-48cd-9e3d-1faa75a3b5d7", "value": 72752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767377612, "uuid": "1e58cabf-99e0-48d0-a2a3-8c5d79400f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767377612, "uuid": "69943354-e4c7-4430-9773-c1a39acaf1fb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bb5846-e7c5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767349712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349712, "uuid": "64bc0c09-3a96-4912-87ed-c74f975c3521", "comment": "Malware payload (AsyncRAT)", "value": "51834f7dd2df98868dcf2bde54ae930c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349712, "uuid": "e526bb9a-4f25-4dbf-8c9d-7cfd059d3bb4", "comment": "Malware payload (AsyncRAT)", "value": "d315c290fc2318b317fb43bf0886c66eef588add7812f77e381bdfefe0370546", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349712, "uuid": "50457aab-f2be-4b9c-950f-d33503b2203b", "comment": "Malware payload (AsyncRAT)", "value": "6adef6078e95df73749190c4deaa74a536a01a72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767349712, "uuid": "b6cf1c84-5fd0-4d04-b543-18f8416bad39", "comment": "Malware payload (AsyncRAT)", "value": "bc2c1cb230e2900947a002096659f76356c9b8d11d31f51f6071e7d6b55a428c30accf6148e5ebc063d4bbc78cda9366", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349712, "uuid": "9aee55ae-5314-48c4-ac89-f13c729b9a32", "value": "T1E6535B002788C926E1AE4AF4ACF2554106B5D9772106DA5EBCC404DF6B9FFC64A227FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349712, "uuid": "9b6f11a1-9a22-415a-bb65-79942a05ff15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349712, "uuid": "eb9a47f5-1a23-43ac-ad47-1b9061ba23b8", "value": "768:jlKqYdqrXiP398iX9JaCcRZaHy/XFLrt11+XSCv7mqb2nnpwJ1oTYiC9uR8GlUhD:jlrQN2ZVtrDhGbb+wcM99GeOVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767349712, "uuid": "7a3c8516-1850-4247-ac55-83c695944fe5", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767349712, "uuid": "e9ca0f67-3ba5-4b22-ba91-2449b02d9d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767349712, "uuid": "0af00bd0-90b4-4073-bcb2-0882c722b163", "value": "VanguardCloudOverseer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba106100-e7aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767338090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338090, "uuid": "25b1f891-4abe-4039-88eb-0361c433fabf", "comment": "Malware payload", "value": "9d56d25db42090283043df49cd572d1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338090, "uuid": "e10aa655-ddf7-4962-bd70-17ca4b70a0a9", "comment": "Malware payload", "value": "d32490c081cb8818d50fb2a67ecb705677f8902bd4f140ff2dd6364b32f36c76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338090, "uuid": "113c63ad-d4a3-4af4-8a3d-fd098e26b97a", "comment": "Malware payload", "value": "84a60dac9b0c14535ed7012993424b7c521b7409", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767338090, "uuid": "4a5012ad-5352-498f-8c58-9540ffc81bb3", "comment": "Malware payload", "value": "9e4be58c4f9eea35203311a7a5f7d5864482aba8ce415b1f900756019ce047a3dbcb9b3217a14df943d2859e2348bcba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338090, "uuid": "ab023def-5448-4183-97d1-2b5c863aeb03", "value": "T1CAD0A7ED0CE4377317579C917C1845BF868B175F1D124422900C41B721B5F402E955FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338090, "uuid": "939b17d7-0926-4024-a590-65966353d111", "value": "6:+DORnszPHDH6ueVV1+kzjhBFaoOogEHvkqQTK3HvV:UORngP76uencMzaoaEHvJQkHvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767338090, "uuid": "a85a196a-6d06-441d-b20b-18a5a20240f3", "value": 233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767338090, "uuid": "3dc19c1f-0c3d-4b87-aab9-b0f793b35558", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767338090, "uuid": "e5992b7f-0ec6-4799-aae2-425ea6c8f590", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bf86a6-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316116, "uuid": "65746abe-e0fa-4df4-815b-bbe31b345ba7", "comment": "Malware payload (Mirai)", "value": "4f3c45ba92105eb4a29011cb59b0a9f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316116, "uuid": "31246e3d-3e21-4091-a659-340c6c0ab75a", "comment": "Malware payload (Mirai)", "value": "d34205706c4d4059e2e97d133425c8bc93cc56f1243383c9c473de7af5918acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316116, "uuid": "fe1ccd33-b81a-4f55-a896-a470e421a257", "comment": "Malware payload (Mirai)", "value": "50eaf1a6a4aa4554909a24d7e37748b4088a46c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316116, "uuid": "dc684b49-b793-464e-814a-00021014f708", "comment": "Malware payload (Mirai)", "value": "baebe2c2c98c129eee46af62f1d107ce1632b73c4d7036b68348dc5584fdce6c05e88ac3fb43c59def4a75c092261874", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316116, "uuid": "e238dab9-3e8a-4372-a4a4-eb3def262c6b", "value": "T1C7244AC7F800DDBDF80BE67A44230905B530B76250935B376257BD6BED361AA0A27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316116, "uuid": "fd709e2c-5187-44bc-96ab-a0b5d03c2bb8", "value": "3072:bG9qKFlfP7R7I+FEvWpyCOK3E/p8IVcnUZBhO++EVwjbiQLXq3Djot:49FlwOyCh3E/pPVcMw++JLXqfot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316116, "uuid": "bf395e4c-09f8-4f4f-9c35-431c880b5f6f", "value": 209472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316116, "uuid": "46df63fd-e10a-4407-be05-d1cd793c754a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316116, "uuid": "c8be3014-f94b-4ef6-8122-107f29872731", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85be685-e82a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767393116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393116, "uuid": "c58ee243-1d13-4285-b1ec-c66c41d3e2e1", "comment": "Malware payload", "value": "87d05d5062230efc6694da4236aca8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393116, "uuid": "b72dc4ca-e903-4613-a855-412c70b816fd", "comment": "Malware payload", "value": "d378fabc30fb2defa95124ca6220497dcdc0f95253afaf0f209810ba68db64a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393116, "uuid": "9355ca38-2eda-4c4a-baad-c82c7367aa73", "comment": "Malware payload", "value": "177b4756637c718d2a7c798316edd7704b1d4190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767393116, "uuid": "adf030f7-3b04-40a3-91e9-d9b7f945f00b", "comment": "Malware payload", "value": "270c888cb0123ece64e34eb4c37b20aa98c7807cd02920bb58fd3aed741e2549972ebeb668ca517a325dcc21e1f68dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393116, "uuid": "768b4411-4d8f-445b-acf9-c2c4190b9099", "value": "T1E1E533A095F8E6DFE03D42F2A67265224FC6DCF8283405711705F38F597126A78AFE26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393116, "uuid": "7203dab8-9915-44e6-b276-df8c71947528", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393116, "uuid": "8f30c190-9827-4ddb-83bd-027f2c9d0fb7", "value": "49152:uODw9sQ0lQmvUtZYZKR4NfB6VQJFjIzVmc4cb2b1VTRIE7M26ye/A45ImQHRSTJd:uODw9s05jRgfMSFIVmib2BnF7Mt/AEI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767393116, "uuid": "c968d3a2-8f88-44d6-a9b4-c14a42169683", "value": 3094976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767393116, "uuid": "0f9937ab-ca41-49d1-9bbd-99d5b51d64db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767393116, "uuid": "9c3e9ee6-ac17-4b31-ac29-7b7757da4b22", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3b5717-e7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767344747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767344747, "uuid": "5df9c224-fbbc-4738-8d25-247620947dd2", "comment": "Malware payload (Mirai)", "value": "cd6fe3fe0c3b9a9ea7303a3cc8abd2af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767344747, "uuid": "95bfb501-2d81-4421-a502-536d5c941da4", "comment": "Malware payload (Mirai)", "value": "d389f49dae1b63f053f1d29b8009b7fc68bcf57507e9a63f685798bc7c7710b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767344747, "uuid": "3822cb74-2314-4f14-ab3f-22f66c665b18", "comment": "Malware payload (Mirai)", "value": "406caba586e444562cba4590cd90e86a1fae8380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767344747, "uuid": "a6080582-680a-4958-8e87-a46eb9418266", "comment": "Malware payload (Mirai)", "value": "86e6ac34d159a45541c11a863dd8a5f69a431116ff4625ed13ce08919e47598247452a5444a8820b6087bc4267b9fc26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767344747, "uuid": "51b8107b-ef73-4390-a0a8-66c60bf1f5d6", "value": "T17E437109BF650EB7EC6FDD3709A91B4624CD651B21A87B3A7D34D81CF20B25B19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767344747, "uuid": "0d8bf389-7a94-41cf-a0a1-c5bece0dbe2a", "value": "768:oLWu89xw1IlGGIunNlFgdMR+e2KvDVub3w6h12pcS5+46kjU4Z/eT5tIne2el9e2:oLWu8fwgI2M0Lg9gzi9S16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767344747, "uuid": "2dc32d38-9655-4b34-8709-eb10b71d6a8f", "value": 58476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767344747, "uuid": "9d11bbf6-3133-4488-af91-fb056e302fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767344747, "uuid": "20e5381a-5fe2-4f88-9841-0d1428454d5e", "value": "mps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f56e64-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385676, "uuid": "913f93df-1464-4aeb-be9c-9345a3f8d6f7", "comment": "Malware payload (GCleaner)", "value": "81699d1e979a47afc44afdb70df6baf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385676, "uuid": "33c36524-dfb1-48ce-b62b-000678e742fb", "comment": "Malware payload (GCleaner)", "value": "d3fee135f931ee90ed8967e4b6a98ab3b00b9888af50baf67e300e458dd26983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385676, "uuid": "04d9cb89-f658-4f98-8d0b-1fe5f7ef7a68", "comment": "Malware payload (GCleaner)", "value": "4c956b6397983d87d21adeab372c0ed59c2d2cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385676, "uuid": "2b08798f-bbc9-4bed-b221-996dee303e20", "comment": "Malware payload (GCleaner)", "value": "bfd8dac114c91a9b93e8c54026177575c8000215eeb0ffeb2c5d18b1190252e112ef0c061330f7b6ac9cce477cd2a912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385676, "uuid": "a33d15ec-5e94-438d-9a16-0d285ea35600", "value": "T14026E032F1619D2AD13C0AF0A819B5F90C626821FED8C3B19995AD3A3C6EDE1F4541FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385676, "uuid": "bcd34705-a488-4388-973d-723b43f64d9a", "value": "fe8d258ea404faca233d63c206abc9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385676, "uuid": "a3b9bf96-0ed8-4c9f-a032-7bb6b8d01a2c", "value": "98304:HXAciKwXLXGea++EFwuNlrt26eBZyFRayI:H/wbXGea++8NlZMyFAyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385676, "uuid": "ea9c69fc-9714-4967-ac59-084ba55c0cb3", "value": 4752656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385676, "uuid": "dafb100f-e99c-4f2b-94ca-a60b0dcf0bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385676, "uuid": "e444e86f-b72a-4ae9-8786-9e44d298f108", "value": "81699d1e979a47afc44afdb70df6baf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4314d26-e7a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767334617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334617, "uuid": "577095a0-75f9-49f9-b360-4f8997807119", "comment": "Malware payload (Mirai)", "value": "ecfbc87d43e57e919398bcc6f27462ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334617, "uuid": "6c31430f-067b-4f87-be11-6b0e3ab442d5", "comment": "Malware payload (Mirai)", "value": "d483e6237a589fe31eb14a318e8547d71e9c741c822b1c0d31896fea8a79be2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334617, "uuid": "272f4918-2551-4f7a-adbd-41f822b04477", "comment": "Malware payload (Mirai)", "value": "33687fd895aff0b670769646c3d9d73ac64c52a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767334617, "uuid": "ee8da187-fd1f-429a-9bf6-5cc1628936f8", "comment": "Malware payload (Mirai)", "value": "1aafd5cf16f58c9a90ced18b97383aab8ee6ce4ae6043499e50edc6cd474e96eeabdb71cb2dd7fa9e92b2d08eb2688c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334617, "uuid": "e1195686-9479-4a5b-a8db-6a44509fef57", "value": "T148532A42BC429602C6D55277FF1E428D772B43A8E2EA32039D29AF2177CBD5A0F7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334617, "uuid": "420f2856-88d0-4006-8005-fdf33b94c3f3", "value": "1536:Rzlz3prxWs5LGEJjWoSoj5vlROjf77zQEQ:9ljVIyLn9WoSoZEzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767334617, "uuid": "f1d40b6d-ddaa-4aa0-8895-3d02bd2d0c6e", "value": 62076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767334617, "uuid": "f4d5e12c-12a3-4157-99bb-a0a15ddf9545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767334617, "uuid": "b98a9139-fe99-4631-8916-14e53ba1ae9b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b41e24d-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385900, "uuid": "11e79762-3691-4634-b99e-41e7e0f1d0c2", "comment": "Malware payload", "value": "c5e50a87785270ef016cbd8556e0f3a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385900, "uuid": "297dd6c5-7e1f-4413-a265-2dccea893089", "comment": "Malware payload", "value": "d4f10aa18edd016468938f3673cf54797ebdaa1915a9d003158f8be140c5a863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385900, "uuid": "a6a81045-3a55-4ff5-88a7-0edda8efdbe8", "comment": "Malware payload", "value": "410ad1ad00bf09f4bd03988990c432905789d890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385900, "uuid": "1d649342-8828-4220-9e21-b87148c515f9", "comment": "Malware payload", "value": "055a2fc688632bb32283ea77f56e7cf0630ab42ae7595e30ed88c999db1c50bb4ecee28744e3082b0201b4132315f076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385900, "uuid": "7dba3c41-2932-4dac-b603-2de1fd5cafd9", "value": "T1DF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385900, "uuid": "8dceb780-03d9-41bd-b7f7-1d800009b8b1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385900, "uuid": "9b3da60a-4bb4-4dc2-b17a-0f4745df1f3c", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:k2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385900, "uuid": "7d865764-4d14-4914-b4bb-659774cf0ff7", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385900, "uuid": "3a944364-58d7-4cb7-b3f4-68411048c617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385900, "uuid": "a61bb3b5-1400-40f2-b61e-9c983695700a", "value": "c5e50a87785270ef016cbd8556e0f3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af131212-e811-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767382309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382309, "uuid": "4b0397fa-8c3d-467f-aa85-a83c8ca05147", "comment": "Malware payload (Mirai)", "value": "b49a597df8ffab6118f70329eeefdc1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382309, "uuid": "5fe1c987-1504-4321-adaf-e7c289fe52ff", "comment": "Malware payload (Mirai)", "value": "d587e848c015bae379d6662de32e58c0304745878b37206dd9b910f1def87b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382309, "uuid": "86ab7353-cd54-49da-a99b-3332c7c74ff9", "comment": "Malware payload (Mirai)", "value": "975b88ecf2cdd761b4781492d812388f2a0216af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767382309, "uuid": "105bc0dd-9957-4153-a1df-647f3c391525", "comment": "Malware payload (Mirai)", "value": "0fab53c5db297dc5150c1b2394ed4e133b1d7859dcd15286887ec2c1cd85f5ae5a356779fde9b599f7d1d0904145348b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382309, "uuid": "142ace19-12d4-40e7-9661-585552148b72", "value": "T1A8433B52BC429A07C6D412B7FB1E428D371703B8E1EA32039D2AAF2177CB95B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382309, "uuid": "d44074df-8591-4759-90ba-38b3ae444265", "value": "1536:Y+KnN+lvyxADdEONanmW+bClg30eleOSYMZ0/bP:B8s94mW+bClHe4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767382309, "uuid": "72c706ad-82ca-4a61-9290-53e65ab737a7", "value": 57657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767382309, "uuid": "4799c172-6fd4-47ef-b2ea-9eee49ab15d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767382309, "uuid": "9a24471a-8731-483d-9e65-9de3fd735b85", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa763fe-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767386068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386068, "uuid": "4f0004c1-cbef-4169-90dc-06b40b090ad1", "comment": "Malware payload (AgentTesla)", "value": "0ec0e8b87fd8df1d998978690fb0bd94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386068, "uuid": "cfc77965-9b6d-428f-b7a9-3feb74c80ffa", "comment": "Malware payload (AgentTesla)", "value": "d5babecb69893652e905ecc54b4525526b22d2ad8ca726c81e69600d310ff886", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386068, "uuid": "b9ba6e2b-3a27-4214-afa1-df47bb26e58d", "comment": "Malware payload (AgentTesla)", "value": "b44e3e4f99c42624b0b369a4b82771edd0399ef8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386068, "uuid": "fc53233d-a198-4b1b-9c8c-7b911c8305af", "comment": "Malware payload (AgentTesla)", "value": "b017b9594d1cce06171b2a8e99a0918234ec532e0ae6f5c5483d4874f9eb6896124234ba1b70a802de91e9fc77dbd614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386068, "uuid": "babe3dc5-a505-4a52-806c-47e655d6a45d", "value": "T16E45BF0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386068, "uuid": "517c4915-bde9-4afe-ba47-0bdee1e23a56", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386068, "uuid": "89788367-fbc9-46b3-a461-bd7762518663", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAE2NK1r8DR8gfQhxm:LPVt/LZeJbInQRaAE2NK1ID2gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386068, "uuid": "fb252b2f-14b7-49ae-a942-eb36eeff97c2", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386068, "uuid": "24e5b354-729c-442f-9058-31720278981c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386068, "uuid": "945144a4-329b-4fd7-9933-2b50af147fda", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c70ad85-e7a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336080, "uuid": "2dfd5ba6-c6db-40cb-90ff-d60ddfba0751", "comment": "Malware payload (Mirai)", "value": "c2a16015c7073590b49e63f55078547b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336080, "uuid": "ea50f8d8-74df-414a-8c00-09c97816cd82", "comment": "Malware payload (Mirai)", "value": "d5d04d9e007b9d506f5e82f4401cb5c6beb738e2bbd3c9c1a0f42692f34b23f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336080, "uuid": "4b0ecfd6-812b-48f4-89f4-9f5a284979ab", "comment": "Malware payload (Mirai)", "value": "ddb84787b2fbc21773b4ae0f246b2fa78924f8a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336080, "uuid": "ecc04546-c496-47bf-b88d-15913486cb0f", "comment": "Malware payload (Mirai)", "value": "d7d4b3a81f7909a177533d33f5760d1121cb7f463d285c55fda253e1ed359016dd072057bc1c8b32a2133a3a25f2fef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336080, "uuid": "6524c4ed-5621-4e2e-a9b0-01c8720e1ab3", "value": "T15FE37DC5E743D0F5EC6605702137AB369A73E13A212EEE83C7B99A32EC51541C91B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336080, "uuid": "b653c4bd-fedf-4b33-95bb-ea4688afb178", "value": "3072:0s0f5B3XyghuTSx1iSSpzWhkjy4GlI9hO7DM3ocxaLO80Bd:wfv3XjhmyQSS5WhkjPxX3Ncq80Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336080, "uuid": "b90403af-b60e-4060-90b8-2279e0ab3b1b", "value": 155144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336080, "uuid": "bc0a98af-52fa-4e3c-ba55-2da4b26df742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336080, "uuid": "9278d104-a351-4c1e-9c65-3c99c6eda922", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759fecea-e7b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767340981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340981, "uuid": "31c6c46e-5af3-4b7a-b0e4-993736db5078", "comment": "Malware payload (Mirai)", "value": "a1784e53123b8afc3aadff658487c68a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340981, "uuid": "b4ee6695-5c7b-41f0-ac3b-a5ae12a670af", "comment": "Malware payload (Mirai)", "value": "d69985a93616f84f1b2df8db4643e4c10a4dd84b575b643310694e5dbab53fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340981, "uuid": "55168820-dcd2-4b0e-82be-0ed09e8aec61", "comment": "Malware payload (Mirai)", "value": "fe8a6df025dec0aa3de62316831dc85a95017c9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340981, "uuid": "85400cd2-c946-4c8d-9cad-f0566148dadc", "comment": "Malware payload (Mirai)", "value": "d6c4edd2ad783665eef934e23d77863e56c6925223a7e0537dc9dd4f51ba1f7aa6e71da69b61f87d21ff7fca4080c13d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340981, "uuid": "1e8f877a-a85f-4142-9827-e7a498cfb44d", "value": "T1CA437C62CC2A6D58E19489F5B034CFB98B63D41481875FFE167AC2796483F8CF18A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340981, "uuid": "6e8e0757-d39a-49b9-870c-691a4b81c4a8", "value": "1536:HocmIAKHB7tXwMDgTQAKFegP7m8pOCCzilB:HzmQhF//pOC9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340981, "uuid": "476307f7-62b6-435f-b906-f7a5c1c135f5", "value": 56952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340981, "uuid": "ad9a7ecd-b01c-40c6-9bb0-c9b2e63d2ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340981, "uuid": "ae4c0cba-914d-4108-bd30-64834f473134", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37130ff9-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385973, "uuid": "9013a2d3-1bf3-480a-9b45-53a176e0c707", "comment": "Malware payload (GCleaner)", "value": "dc55ad84a3b92637fb2fecdcc3c3d808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385973, "uuid": "e0aabd50-e763-4ba4-8365-96466617ae8d", "comment": "Malware payload (GCleaner)", "value": "d6a17f65ce8a24820e2d382a4d24edcaedaa3bb66fc0ec69dd6808aa1f986e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385973, "uuid": "511e8db3-89c0-4143-8451-099d759b9121", "comment": "Malware payload (GCleaner)", "value": "acbedd9070047fcd43686c35f2cf5082119ffdc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385973, "uuid": "ddc0e596-4792-4f3c-9b90-88be85e3e9b3", "comment": "Malware payload (GCleaner)", "value": "e27ac5a70c999bc380fdfe667a29a4ef338efd41ebcab0523537638acdc047ac5e41bfb7fd57383b9077ae0b6d1fd529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385973, "uuid": "2435bbb2-00a6-4390-9106-7e76c66558e7", "value": "T14226E0FDD780845AE7FB2F3875EB2284C536BC47D62CE2461A8CF592992427732049DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385973, "uuid": "f7e93ff6-831d-4851-9dc4-bd6d2b40d50d", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385973, "uuid": "e30198cf-77ff-4d21-9f86-b74f7b5113ad", "value": "49152:Zn+QZhMyqwoLsbY8TulBnUaVjVW2CkbeZjWbcq7FNNrG8OSNS+lUfCao0xcgjp4z:ZnUTsbWlrZxb3b97FNk8OSNSoYUqzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385973, "uuid": "db061a5a-65ce-439c-892b-88006ee99f02", "value": 4531472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385973, "uuid": "19463eef-ba21-42ce-898f-9c699e6b588e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385973, "uuid": "6c3a88a8-8b1c-4487-ba00-6f3233502967", "value": "dc55ad84a3b92637fb2fecdcc3c3d808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c461e1d3-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385352, "uuid": "9e0c9529-a170-48f3-9748-bb207f518c12", "comment": "Malware payload", "value": "08589d85b7dfbcf2274f75871aa40268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385352, "uuid": "d59dc091-4614-4ca3-b3d6-189d3e2991ab", "comment": "Malware payload", "value": "d6b255191f9b3858c7e9b7dd6651b6e4fdda27259f05452ec4b2eb28a3b3a6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385352, "uuid": "a69750b0-4373-4692-933b-853b9e8a8082", "comment": "Malware payload", "value": "c191cc92fa77e37d1a48fc351151d71c5ad5781f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385352, "uuid": "642b9f8e-4bc0-488a-a6f7-de519b99929b", "comment": "Malware payload", "value": "9aaf0def586c6c2eefca43756a6165d3919d52e5f92aaeb73662ee4e7f7a61cccbd691f1a35d2f85a33d59bd78523a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385352, "uuid": "15e3a390-ea8c-4df1-8c01-1a72b4b598a4", "value": "T11F0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385352, "uuid": "9b76bf36-1d47-4fab-8d74-e10c4d69cc7e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385352, "uuid": "6ad93dfc-de03-4d9b-bd79-0101742535e9", "value": "98304:a8T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:X2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385352, "uuid": "73a5020c-7233-42d7-80da-ba67b70101dd", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385352, "uuid": "efd6088e-cc9d-4c6d-bd2a-21633f8c6942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385352, "uuid": "3c5a8f5a-c26b-445c-9f0d-9e33e8fe1973", "value": "08589d85b7dfbcf2274f75871aa40268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256c5e79-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392386, "uuid": "bf07d126-4e67-4cbf-a69a-cdaafb3a1d9b", "comment": "Malware payload (Mirai)", "value": "4f45d32c95031d5a5f0b4a26ff39152a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392386, "uuid": "cd1d00cc-ea5f-4c39-8993-749d59ac84a2", "comment": "Malware payload (Mirai)", "value": "d795dedc639f2489cff919a209e5d924d9007c3448a34d3df9c170cfe458eb76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392386, "uuid": "d6af7e38-a6e1-4e12-b606-f90a24e0a299", "comment": "Malware payload (Mirai)", "value": "ffcb1216eeb7ccb07ca19a4f32a0b8b9cab37052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392386, "uuid": "76cd1e89-d70a-4b6b-bd39-fed51317df84", "comment": "Malware payload (Mirai)", "value": "685904bf883a6bfe3c21462fb91886eafdddf10e46c793339c415c7f3d78599488fb65b3c2882ea7626197dbe8541ee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392386, "uuid": "c838d0d9-921a-41e2-b627-53ec19575759", "value": "T1BE73F755F850DA62C6E4267AFA5E538C33130B78C2DD7102DD21BB3566FB95A0F3B882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392386, "uuid": "d090cd31-9944-43d4-9efc-459794d40b12", "value": "1536:HHt0fL/7VcAWvWacqmvX4SsOXBQesICnOABI0rqpnNxZsXQr8K:HM7SWrqcXBQesIXAMjKoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392386, "uuid": "c039cdc8-a01f-485b-8466-858931d19cca", "value": 75044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392386, "uuid": "2b71ea75-51f3-4a1b-822d-e8777de8d8e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392386, "uuid": "291e93fe-78a7-42b8-b466-03a791da5ff6", "value": "catgirl.armv7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c1f53-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767385634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385634, "uuid": "b1629871-8a6e-4f04-ada3-c5dac5fa8f4a", "comment": "Malware payload (Vidar)", "value": "7443ad113735ee5f21b3bc742fd4497e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385634, "uuid": "6ee7a370-08eb-491e-b4ca-d8e4570f0ed6", "comment": "Malware payload (Vidar)", "value": "d81a382328a3a5fa728058b06d4f01dde76fdd2f7dbeda728447b322ab8c1637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385634, "uuid": "f9e1f7c8-4641-48a0-b185-5cd90edd9ee3", "comment": "Malware payload (Vidar)", "value": "124612f0e2905f8c7e0bc783b236ed7061bb5785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385634, "uuid": "b8c3c0f3-8dab-4d37-8857-5c25cbc65db6", "comment": "Malware payload (Vidar)", "value": "95bc31789de140352cd9d61d4144ada2da953a458fddf977dea2b9117a8e7eb30d6729fc87e7c3318c7fb3fe1e894d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385634, "uuid": "17e0a9e6-3a9a-431d-9650-37190f7b67dd", "value": "T13FF3233A198C8B85DCD2A0378235E0DD425F932670759EB3FDA484F19A84F81F3657AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385634, "uuid": "75dcd21b-2b43-403e-a08d-e51c5e048bcc", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385634, "uuid": "bfc3a076-4a14-4c63-bd29-66d69349c64a", "value": "3072:1aoX2BuAeOqwOlRg+Qp58ShhMsblikLyyykNYgHSAZIPmj5o8iWeT5BYfajeS:goX2BPwrlRgx58SYilVLNjYZAZxjfeTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385634, "uuid": "5ff26353-cb80-44b7-9c4c-c796a2a4cbc4", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385634, "uuid": "4f33290f-b58e-44b0-ac56-972ebacbbb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385634, "uuid": "04e1d9af-483f-48cd-ab69-1c7e6ff955fd", "value": "7443ad113735ee5f21b3bc742fd4497e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a53f580-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385952, "uuid": "b796bba6-f828-47be-952c-23c230345449", "comment": "Malware payload", "value": "d31d2990000ccff0aee343899882dd24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385952, "uuid": "55568c2b-fa2b-47ea-8f4c-aa84134c5670", "comment": "Malware payload", "value": "d88d16a9d676c9e8575fb615b673faa6128baedee209916568c2ca8857d40fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385952, "uuid": "6ee0be75-7a36-49bd-a365-cf79fa251af7", "comment": "Malware payload", "value": "d9d1be2a06eb081e69e95eb67fee3ca6285b3afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385952, "uuid": "00ad2b22-0b14-4da5-8426-24d58d3e9707", "comment": "Malware payload", "value": "92210f5049bea8ff1aec195bf3c83163fdc3c641911c695d95892d4905dc69aa147377f63447948311cadfb6c8585564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385952, "uuid": "05971848-cc2f-4642-8bf4-444e5f4b954d", "value": "T1CF0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385952, "uuid": "7bb4ad29-ed8e-4f40-af46-b0d69d15b46f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385952, "uuid": "a19cc7d0-8461-486d-bb44-5cd853929c77", "value": "98304:aMT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:v2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385952, "uuid": "51673f50-f621-4843-9e6f-2b5baabd6017", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385952, "uuid": "fe0e1b11-c2de-4628-a8c0-191db058bad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385952, "uuid": "0515a747-4e98-418c-b55e-d4db7fa391aa", "value": "d31d2990000ccff0aee343899882dd24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2f4147-e818-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385396, "uuid": "91a2ce19-342b-43a2-a902-ba28585a849a", "comment": "Malware payload", "value": "1fcca13c0d2d08be9c9426c817ce972f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385396, "uuid": "cac594e3-27b7-4769-afe1-b48999e527cd", "comment": "Malware payload", "value": "d8b0eaae35f3f8c7083f38f03e33728413d45b62e03ba3887fb7fafe6f6bff23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385396, "uuid": "f21f52b0-023f-403f-817b-01c429f817e0", "comment": "Malware payload", "value": "7b5a493d5758429a9a5c3601f7c655ad1d589277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385396, "uuid": "d4b703df-246d-4e99-89f5-0daa1b097a0d", "comment": "Malware payload", "value": "8f70863270ca3102f7231eba93b765e5c33f47f09c4a93357acefc2a0b8f945421525f522c2c094d891ab4d512367e2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385396, "uuid": "f0495db7-7532-404c-8bbf-25ccc230b858", "value": "T1090633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385396, "uuid": "2c80d3f9-16ce-4e45-a80b-66f4e576f3c9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385396, "uuid": "cd41ba5e-a1af-4cea-8afb-00306b1eccfc", "value": "98304:adT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:e2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385396, "uuid": "de5bdc0a-7aec-422b-a399-9ab37232c21a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385396, "uuid": "7b481ac3-fa21-4379-a3b3-3da20159d58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385396, "uuid": "4b6bdeb6-71c9-4a26-915f-9769fc8ea55e", "value": "1fcca13c0d2d08be9c9426c817ce972f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bc4959-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385723, "uuid": "a5a2bb0c-1db3-49bb-997d-b7cd507fb4bb", "comment": "Malware payload (Adware.Neoreklami)", "value": "8c812f5c040b7bf0d5ba1a743153492d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385723, "uuid": "d5a66902-fc65-4180-b1c5-0dc9a1f207b6", "comment": "Malware payload (Adware.Neoreklami)", "value": "d8cd526ef87732d95ad359c9b64b49c1b05e2b9507fcf002b2cf0a83c5a1de20", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385723, "uuid": "ca9e0d51-e6e6-4e8f-bd54-ff51989bb6f5", "comment": "Malware payload (Adware.Neoreklami)", "value": "236195c3e1a3d4241e1b66846376d35703a3f68d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385723, "uuid": "5c9b04da-6c93-42ce-ac1e-74cdc5a3bd41", "comment": "Malware payload (Adware.Neoreklami)", "value": "f88d0861169cdb08b0bfb3c13ab36a998a73c784e2be078b652754acdd8a6ffaabd6fc2e67027125edb460bfad3a700d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385723, "uuid": "38976032-a9ee-4ab2-a85f-d9a9f418d831", "value": "T1BD7633327EE084BCE7B15132CABCFE9069D996356A3142273B8159BE272F510E3371D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385723, "uuid": "fb086080-fe5e-401f-ad83-b877f9268975", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385723, "uuid": "0f0a6fe1-4cb2-4af1-a75a-826811e53743", "value": "196608:P1OKa5AIJlwKhwg2qdFT7CvwdxmVZvgFDQTdmgs+B6:tOKl6+g2q/TmvwfmV8DMmg9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385723, "uuid": "a7093358-7749-40e9-b496-e77e7c9a13ab", "value": 7558928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385723, "uuid": "e8aa1b8b-cbbe-4d80-98a3-7e514260f898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385723, "uuid": "feb8f29c-5140-49a6-a2a8-1a65329000ac", "value": "8c812f5c040b7bf0d5ba1a743153492d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554480b1-e771-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313439, "uuid": "2ff1a038-975d-4385-a432-57a2550f5a76", "comment": "Malware payload (Mirai)", "value": "580ca93eba213fe0936b168ce78fe2c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313439, "uuid": "e3fd19a1-8ca8-40f6-850e-ee9e66cdd238", "comment": "Malware payload (Mirai)", "value": "d911815907ad7d3a868e20c4232d1ac10f966509a63e3c9fd7fd03b28401ee29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313439, "uuid": "8b046ab7-9c64-48c3-9e7e-f10a4a7bba42", "comment": "Malware payload (Mirai)", "value": "c54463f0712e631ef89388d9615f290f4015dcee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313439, "uuid": "29548031-6fae-4593-9c19-1267c3af963f", "comment": "Malware payload (Mirai)", "value": "d12718827c7563a0933243c1e0bee96760aa8402dfbbbf1219dc57c3f8d6cc68849baf0be34a6ac68187018732b24494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313439, "uuid": "bdc7a159-4508-4761-a428-362816f94351", "value": "T1EF536E4233184A57D1A64AB02D3F1BF183BE96A021F4B3C9B54FAB698575E331086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313439, "uuid": "721d2b64-ba2d-4fd6-b4d9-4eec33443c16", "value": "1536:4bFWUG6/mRupO25j8RjE2IqkKfezHTFHlu+7Rkn:MWTL2x8e20HTFFu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313439, "uuid": "d67597d8-d6bb-4d96-9f16-fb13f2b37193", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313439, "uuid": "5f5a77b4-f2d4-4b54-b11e-609a87862a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313439, "uuid": "8de8bc2d-dc49-47a6-9728-dc5a1b0cdab2", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505d3cbd-e7af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767340060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340060, "uuid": "ec2b2aeb-fa18-46c8-987a-9b1befed67f1", "comment": "Malware payload (Mirai)", "value": "67a6aec0f44130fd7a86ae2b738ff185", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340060, "uuid": "eedc0f01-163b-4600-a24d-37518c6113df", "comment": "Malware payload (Mirai)", "value": "d93ceb90c9bae61d7ccb541c3bab418407dd7d442d81d75c83bbbe0a9ce25009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340060, "uuid": "748d5701-2b4a-49fb-a7d0-2691d94b9c3f", "comment": "Malware payload (Mirai)", "value": "ca07d36fb9bc91b8aa952918fc64d9bf718e47ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767340060, "uuid": "f4d40b7d-faa1-44d9-8c70-2651a780594c", "comment": "Malware payload (Mirai)", "value": "3c04433cb7cb7a399c52cf8506af3f6a7ff790609b796954f95e90475763aa59437c8abd675586b991c922ac19c45492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340060, "uuid": "1467267a-35f4-4c1d-b9d9-1f241e3e21dc", "value": "T19EC30A45BD42DF12C6C315BBFB9F42893716BB98D7EE3203D9246FA4338749A0D2A215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340060, "uuid": "d7a6eb9e-6ed4-4ead-9687-131510edac24", "value": "3072:RvHw0VRPk4DQPQ2fP40L85BGjvTqyD/LWuLf3Hsh8TsnT4:xpVRPII2X40L85cD/LWuLf388Ts4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767340060, "uuid": "fd2c72a2-adef-4d9b-8618-433dc6e5d7f2", "value": 119364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767340060, "uuid": "18ebf261-857e-47f3-a8f0-c67f3a3bbcfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767340060, "uuid": "fe3b6e40-8c59-4695-a2a2-9e96ff5c6e00", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7d3cda-e7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1767369907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369907, "uuid": "bc5ca5f7-3676-40a0-8707-9b0c963b7e7e", "comment": "Malware payload (RemoteManipulator)", "value": "0c7969971105cd0de6ff880d5f3806f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369907, "uuid": "a5fd305f-9fff-486b-ab51-2380e39e044d", "comment": "Malware payload (RemoteManipulator)", "value": "d96be10c1294314468430ec904e15b0b6e311a816949fdc754b1ca0ec717862d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369907, "uuid": "2deed67a-df82-47b8-a87d-dabe91a3938f", "comment": "Malware payload (RemoteManipulator)", "value": "3dd9b3b0c48b7bfe45f8d20290b85840234b7b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767369907, "uuid": "0da10094-6644-410b-9211-bbc183bfb2b7", "comment": "Malware payload (RemoteManipulator)", "value": "f330d8ce471ef8e2ad8c2cda4fdc4ed4e9e53ae5d4bf548cf646dfc3645815f73a59b0350edff2033b6880a52f19d1e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369907, "uuid": "243515d3-610e-4cd3-8159-3504b396da0f", "value": "T13F270213B284663DD4AF0A3A483B6714993FBE613A1ACC9B57F41C4C8F356817E3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369907, "uuid": "2dcf9938-6444-485b-b904-f037eb4cdbb7", "value": "2724d5f07fd99afb612641e8d576bc4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369907, "uuid": "45c5e929-7f6e-4c4c-b667-4a8a164abadb", "value": "393216:U/4ViH0ywYMr2LOkZBrpndziJo9Qmo3mFLpIk1iQ1BkjYYGp6/:nyUkPfi3DIK4iKkrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767369907, "uuid": "a5c15583-6f79-4265-a8f0-435500aca72c", "value": 22139376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767369907, "uuid": "485c72d8-9fb5-4372-babf-58c729c77ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767369907, "uuid": "ce42c519-132b-4169-8990-5656349ea2f1", "value": "0c7969971105cd0de6ff880d5f3806f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c435ec-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385993, "uuid": "d674169f-1d3c-4a07-9454-c3f52cd6560a", "comment": "Malware payload (GCleaner)", "value": "e57a176ad727ede619a0eeaaff0860f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385993, "uuid": "6f41820f-b94c-4075-a5f6-382e20d8d443", "comment": "Malware payload (GCleaner)", "value": "d9771ed41d619fdbc0ba19843450b412be06629f7c5ad792333ff3d336c0c18c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385993, "uuid": "8a3ebeda-c56d-44b0-a2f4-e8f9b0788934", "comment": "Malware payload (GCleaner)", "value": "b3a8f31588ca1a6c8839bff5af99c088762a9918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385993, "uuid": "9dbac6c6-3dc9-4a31-8a24-b7b3c5378ca6", "comment": "Malware payload (GCleaner)", "value": "f614bddeeb27c47393420d759bb1e9ce671dcae230706521d27b74f211c4446ae031a91568beef046af2213c32d4d206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385993, "uuid": "0c1448ac-1872-4db9-bf12-6dca670209f6", "value": "T1C916CE82E39CAC61E07041BCDC1D9FBCD41A3E29F2B9F488B7F4585A1BD96BE1036552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385993, "uuid": "adc13267-373a-4f8e-8094-8cc29596134f", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385993, "uuid": "c2b97e27-49fd-42e4-8fc2-d64b7574e50e", "value": "98304:/ynRIHLEcp9sULMb+nMUDTKhPO/w7Y2exa:/ORIHLEUhdnBTwu2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385993, "uuid": "355f6778-b097-4bb2-952f-86308e924e02", "value": 4193040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385993, "uuid": "83e854bf-50e3-48f0-933a-2dbacac32828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385993, "uuid": "7c60aeae-d438-4700-bd6e-6052f740d2b3", "value": "e57a176ad727ede619a0eeaaff0860f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb3953b-e7d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767356324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356324, "uuid": "77f93bfc-2e84-41ec-8dea-9e3c49084e5b", "comment": "Malware payload (Mirai)", "value": "938d9f2ce48db5c31225947356e3ca74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356324, "uuid": "8dfd072e-ba59-4314-927c-ba7030823c95", "comment": "Malware payload (Mirai)", "value": "d9aca101aa5f96a252cdedd574d59c0c19fdade250991c105e5107807b71bae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356324, "uuid": "f6177202-5779-48b7-a377-d5f9f9ace986", "comment": "Malware payload (Mirai)", "value": "efdcb33a79daf9f7aed26465d1428205d9b2b854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767356324, "uuid": "181db98f-c716-4ad4-b074-0e8271e58c67", "comment": "Malware payload (Mirai)", "value": "55cb704ba90071c9ad798b05575b970bb4a6330bccb47bc576bd05ef660bfb5776992b99916c7ffd1ac63dfefb59a75f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356324, "uuid": "575b3b53-e2c4-459c-8ab7-c649c00bde04", "value": "T1D0F36C0177190543E2A76DB03E3F2BD1D3EE95D021F4A6483A5EAB4D9172E326187ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356324, "uuid": "c79a3315-e6b9-4e0c-8525-af8e05f723c4", "value": "3072:EbNCDv8TCBE2x5h9FbmLcudlf3xPJdyowyOVpiw5D65K6cmSu:0NS8TC7h9gcudZBHDwyOh5W5K67Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767356324, "uuid": "83db3d5a-aaba-4c9d-bc13-bec8147cf282", "value": 169348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767356324, "uuid": "175319fe-8dfb-4291-8343-1508cd161258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767356324, "uuid": "8e86da3b-482d-4e1a-8720-743d240f38de", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e5e873-e777-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767315942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315942, "uuid": "040b6d2a-f4b8-49d9-add8-b7dc65bf1bf5", "comment": "Malware payload (Mirai)", "value": "3b4f707eebf459f6663164b553e9f9dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315942, "uuid": "d21572f6-ef8c-49ca-88f2-4f91ef0baafe", "comment": "Malware payload (Mirai)", "value": "da2f1fc17268942f390bc837c7b7e47918eb53469fbecc3ddd9b5cd563ac6bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315942, "uuid": "aeaa3fab-f207-452e-9b77-91604f083dc2", "comment": "Malware payload (Mirai)", "value": "fd750046742f172a593900590191c17d5615282c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767315942, "uuid": "6dc51ddf-4d48-4e28-8b56-4be855bba1cc", "comment": "Malware payload (Mirai)", "value": "a8b2371a77010cc81ee89849c2a05ab59c6e4bd94ea812677c57c61eb77af307f9880cbb6eeee4f4e244016b6fc16f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315942, "uuid": "d2f0292d-d69f-4260-8406-36e59ecae670", "value": "T1C243974A3E229FAEF76C873587778B20D79423D627E08684D6ACF8055E7030DA45FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315942, "uuid": "8d09da22-4cdb-43db-9e31-73780f9dee7b", "value": "1536:w3iwkGbWUDfxymSTpYBizzzaxbfMzf2FzffgPjX7wSVXg4Bu+7RW:fhTecfW2jLwSVnBu+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767315942, "uuid": "b3907e44-350e-4bc5-8343-34f1bbbd997c", "value": 58208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767315942, "uuid": "a1371237-e067-4d6f-a933-6a9cafc5879f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767315942, "uuid": "66000ec6-95c0-4c41-b960-7d3fdfc153f3", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c52d34-e7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767335217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335217, "uuid": "e289dd38-efab-484c-93e0-557887973db5", "comment": "Malware payload (Mirai)", "value": "46c8eceea09927255bcef3234aa747ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335217, "uuid": "66df3998-c651-4451-9015-7bdacf2f4360", "comment": "Malware payload (Mirai)", "value": "da4d9e4faabb2a9bbb9aae1ec8042de1ccef68f8ce045b709a2b29d86ff299c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335217, "uuid": "e26ab83c-839c-4eba-85a9-6dd94e0e5d68", "comment": "Malware payload (Mirai)", "value": "cc112b4b4e18e9e555b2c43051a7e60eac1d3de3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767335217, "uuid": "c1311356-8fc1-4c63-9ecc-5462ad7ef175", "comment": "Malware payload (Mirai)", "value": "278e130d83f0dd102e90d57aa0cd5f16204ebf81c080d01ce65f84e0dbac76fc65bd6fa01a587b9493263d8c059d414c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335217, "uuid": "50210975-3d44-4545-9c9c-a82bfff4a753", "value": "T144631B22BE764D2BC4C4A47661F34735F2F6878624AC891E7EA10E8CBF6565032877F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335217, "uuid": "5839cfb2-88d2-4621-ad4b-04148d0786be", "value": "1536:Mzvs98NOUTWYhGhKn0z0v3rz8l3OkptR+YW55ptWf:sjIUT+c0ko/+YwWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767335217, "uuid": "641ee306-9db6-4687-9ca2-8f7a82a6ab88", "value": 68872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767335217, "uuid": "99bd5906-14ab-4bd2-ba2e-a58a44acbe6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767335217, "uuid": "fc94e20e-f67f-4eb1-88bb-f4658cbf14fe", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d63206b-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385930, "uuid": "124b52e9-486e-4f1d-9b0b-d9be32f7ffce", "comment": "Malware payload", "value": "cc43202193f0d609c69e673957650248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385930, "uuid": "939d756e-7bc5-4b4b-992b-ca1dc73b1216", "comment": "Malware payload", "value": "da6ef5988f39a3a4c42dfdb6ba288dcdafc6825ee165c4e5757ee41c0890a4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385930, "uuid": "35aa35e0-c072-42c8-b72e-7d93e676a1e0", "comment": "Malware payload", "value": "3233f81f9a6d4da7b2ae5cd0a137bb6f71063a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385930, "uuid": "5659a919-06a3-4429-b4a2-718a077dc172", "comment": "Malware payload", "value": "b62d43ea545e40d393b56d103866e3b858867ec4daa2dfc0244576f57bd6dff1f288a5144a9ef892b7d5e88b44dfdb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385930, "uuid": "68587142-e2bb-479d-938e-de029c63a739", "value": "T1720633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385930, "uuid": "ce403057-f12e-47fa-ab56-5c97c81aab9f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385930, "uuid": "96e830fc-3c5f-4527-b1c4-b1a9df6ebdf5", "value": "98304:aDT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:g2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385930, "uuid": "4fa49332-6876-48af-a9c9-8dc47170c8bc", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385930, "uuid": "3f701df2-6827-4cb1-b0c0-cff6e860fd36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385930, "uuid": "7c0fc389-cd3d-4530-8741-56109ed85f26", "value": "cc43202193f0d609c69e673957650248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3ba780-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385927, "uuid": "94a86f50-70fe-4896-be7b-6695728e9233", "comment": "Malware payload (Adware.Neoreklami)", "value": "cb4fc35353908e047201b76470239344", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385927, "uuid": "eb345af4-f0f4-4b01-8ce1-16bfd5a1fcb0", "comment": "Malware payload (Adware.Neoreklami)", "value": "da89142fa52cb9fff65161b60277f436ae7596be62b800e66267a6c82c505e36", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385927, "uuid": "32d18dda-c782-4dca-bbc8-978ffb1a2634", "comment": "Malware payload (Adware.Neoreklami)", "value": "804f0379d46ed476749fe3379f50d8d1e17bce4b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385927, "uuid": "e05518df-3ebb-4729-a6a9-1fc3906ace71", "comment": "Malware payload (Adware.Neoreklami)", "value": "87a2a32b754655ea575c768edd5a0599c98def182d6dae23ebc1ff0cc813e8c04400c9554fe1202c53ae08db812760f4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385927, "uuid": "6659535e-ea5a-493e-999f-190cfb1ad83b", "value": "T13676330136EB80F5DA6A07B0EF497FD6E192D7A04F05406B27A8C69A3E7FD518537B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385927, "uuid": "1414995c-6625-4c50-85b8-52286309c35b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385927, "uuid": "0f8adc10-c047-4bac-9780-de69a3c80d9c", "value": "196608:P1OR+/OsLMaitanWtSbHBbpSYVkOZqjEBuxbucErp3KQt4zHuQ7:tOA/Osn+rSbhbpSYVDVBCbucEd3ti7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385927, "uuid": "8a6082e3-04b4-4a25-8c3e-6168e8f8ef7f", "value": 7532672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385927, "uuid": "3ef8909a-6bcc-4452-a45f-5c4cc280ca8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385927, "uuid": "b8edc98c-6ff1-4e52-a538-42ff984994a8", "value": "cb4fc35353908e047201b76470239344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0be635-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386034, "uuid": "d5dd5ae8-743f-4389-81e8-44bd7c7290d8", "comment": "Malware payload (GCleaner)", "value": "f20a4bfcb57b5a39f7ea779b6398e178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386034, "uuid": "f67dc138-5079-4cf5-895b-7cc8e9b77095", "comment": "Malware payload (GCleaner)", "value": "da9d8128f55bee778ee192812d9381e084c6362dcfb505b4b440a51c5350376b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386034, "uuid": "019183b4-8469-4f2a-9d2a-d2be044c4544", "comment": "Malware payload (GCleaner)", "value": "6065909d846ccdbef390cf98bbd66e923220d3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386034, "uuid": "3cf648a6-a919-46b7-a089-89c606baadf2", "comment": "Malware payload (GCleaner)", "value": "2d945b000ba23797ff1d2c8bbb6f5347cb799eae4b2cb575de6c56ccf7c1b62fba676caad375bc75fb78b1b00534e4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386034, "uuid": "20348568-3915-4ee7-8809-734b8932b1a4", "value": "T17B26E0BEE0D1237AD14E5B744F1B2C747576691BFB60780B4FA03888BB569942A309CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386034, "uuid": "891407b2-5981-423d-9d2d-b85b83e17337", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386034, "uuid": "bb6d1fdd-c7df-4060-a9c6-92dfba4a68d5", "value": "98304:kyWao4kK9q9qFOXz7KsekvVD2vRaim05b+DI:kjaoUGqFOz7bekvVsaF0oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386034, "uuid": "0f7f0080-6805-43c5-8082-5e5172d1f57e", "value": 4641040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386034, "uuid": "408a9f13-7232-48bb-b3b9-37b464278fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386034, "uuid": "850a888c-eed6-4b22-909b-6486afb0e072", "value": "f20a4bfcb57b5a39f7ea779b6398e178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9629b4c-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381870, "uuid": "a8bc4137-fb6d-4c3f-b224-0836204472c9", "comment": "Malware payload (Mirai)", "value": "aa3c84f8a191498a0a31f92cf06cc8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381870, "uuid": "39e05db9-a7bf-451c-963e-d4216a750445", "comment": "Malware payload (Mirai)", "value": "dad7fbb0d7aa3121411cf8d48a1a62681d5155893c4dd536dc88bb11ce52b124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381870, "uuid": "e84c29d1-e5ba-4c5d-9666-ffe1f68c57e3", "comment": "Malware payload (Mirai)", "value": "a1cea4f1b7ac02f0985c5f74ddfda13ddcf40838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381870, "uuid": "a8c1cb8f-bb38-4d2e-86e6-5f4bdcb112aa", "comment": "Malware payload (Mirai)", "value": "f18c6db5d2a85c88fa9d34f243fe23ab6f8b8f35bd5aa88f0e04014d69b13e1903ef851d2b30777324f8dd8dbeaabdcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381870, "uuid": "0a9007de-5348-41d3-a596-ef670046d0fb", "value": "T1D253F2BB76AF874CD13FA4775EEFEC02880145AE963082AF7A9142390194D509F7CB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381870, "uuid": "e3c08742-9f9d-455d-94ad-a3fc82012de0", "value": "1536:QDcqMkML7zulbzFiiQ1uzg23ZVhsOUL59W7EKGngTnouy8HyR:k3czLimuzgSULTW7EKGgrout6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381870, "uuid": "0b460b1b-32f9-470a-bd77-1021cb3207fb", "value": 62060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381870, "uuid": "61dc9e85-1806-47fb-b704-37ba9d8f8747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381870, "uuid": "6a920dff-dc6e-479b-97fc-71161a1b569d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d86c3-e770-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767313250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313250, "uuid": "cbc1cee4-06f6-4e25-9b2f-362749e1d862", "comment": "Malware payload (Mirai)", "value": "a3ca3a02db7f14b1c74eba4a5c18b9c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313250, "uuid": "1a06f948-1a82-420b-98d0-9cd60473fefd", "comment": "Malware payload (Mirai)", "value": "daf33d50ca9054a4ba7120e127697c8acf619c41a077fb2cf84ee72eb24f35a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313250, "uuid": "4cb94f59-6dcf-4ed8-99b8-4fff1ecb2fa9", "comment": "Malware payload (Mirai)", "value": "feed357537905f308b4231fb1343fb2fc425e8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767313250, "uuid": "a5e64f1b-380e-409d-8015-7b4935119727", "comment": "Malware payload (Mirai)", "value": "2d258e41895ae15ce8a12bb6baf0985f6a452a25a4e048e72b2fe4d1fa706e78f41c3584bb182b3fec520e1f8f277d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313250, "uuid": "f5b05047-f3d7-46f5-a127-79645a342f19", "value": "T16D531A45B881D617C9D462BBFA5E42CC332653A8E2EF7307CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313250, "uuid": "1f78c832-eddb-462d-aab9-96c999cd385d", "value": "768:yIfDANwMqyEdxGKeNrLEoT1ywnRidZTl+PAj7d0h1uCPNyN+dvPz6suM7R:97eXqqLEU1PReb+PI+hUONXhuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767313250, "uuid": "eeb4edcb-9267-4f9f-8355-cc650bf4e441", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767313250, "uuid": "5fb7371d-7ab2-42f2-844f-e7485db0e4c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767313250, "uuid": "12ba0f4e-d937-4226-8e2d-b4d11e78e08b", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6693647-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385865, "uuid": "d0728f47-203b-45ab-92c2-1bf3b71ad5f0", "comment": "Malware payload (GCleaner)", "value": "bc75b37d239f98cf307f92336c5b0df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385865, "uuid": "752e7fe3-3de8-41bd-a472-2c3899ceb160", "comment": "Malware payload (GCleaner)", "value": "db095db691b218755e50c1e22af33e343a7113718009c26a1033475a3a5f71b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385865, "uuid": "ea7c2287-a854-47c8-9efa-d3c5749da2cf", "comment": "Malware payload (GCleaner)", "value": "a9a04cb92530619b5735341423c1ddc07b610218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385865, "uuid": "8174aa27-f4bc-40bd-9b52-d7a554a3d53b", "comment": "Malware payload (GCleaner)", "value": "6860442874561bc18d2bac4f0cb80a1636a483aa25d64f76dff2956cf80199e1a3b3a4b6d19945feaeb0b31192eacd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385865, "uuid": "8419e87b-c5b6-41d8-b0bb-e87494fd18dd", "value": "T1C126E0B3E2719139C14F257B8D1D04DAF637EE52EB62928DD7D014276BA82E37B21231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385865, "uuid": "7d940bed-8d70-4503-936c-2be528ef0c6f", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385865, "uuid": "010cdf1e-f5ed-4f12-864e-44d7a4d05908", "value": "98304:GrSW4XeTQ6nlipD29+CZtdJNjm1fEdXQhDr:WaWn41c+CZZNjm1ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385865, "uuid": "ec949299-8906-4d79-9767-d08f4efaf27f", "value": 4730640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385865, "uuid": "ca7ab751-efef-4671-b059-49435b36e313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385865, "uuid": "89af5aea-ce99-4f52-99a1-da4e8e4646dc", "value": "bc75b37d239f98cf307f92336c5b0df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23df606c-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385941, "uuid": "6d317d23-9e6e-4038-bf37-4ce6ea1e3a7f", "comment": "Malware payload (Adware.Neoreklami)", "value": "cebc3cd0dfd7c514177ba2934cbd1423", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385941, "uuid": "b631391f-65df-42b5-8c31-173f765fb871", "comment": "Malware payload (Adware.Neoreklami)", "value": "db0b0fb3d528af4deba7b02dc5919613cd381f039eebacd6275714e3b5c631e5", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385941, "uuid": "3cadd2c0-9e04-45e1-aec7-bc88908e5acc", "comment": "Malware payload (Adware.Neoreklami)", "value": "642525e9fb8abf0a08cf2ff69589c73d54293fa4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385941, "uuid": "b849ce1e-cefa-4dba-a87b-4135150003e6", "comment": "Malware payload (Adware.Neoreklami)", "value": "d418911a99e5f43c4084fab1ad2db8e22806ec6cb3c24ed01c8d94490b3552dc1dd2e7447b68b445e20b79e70a987db2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385941, "uuid": "4bd091a5-07ef-4193-8828-f6f3ebd07dce", "value": "T17376333337D9CCF5C7012A32DE54A5C170B6D9630A656E3313FF072A36744CA9A26A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385941, "uuid": "98fa95bd-b3bd-49aa-b93b-871f567433e5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385941, "uuid": "01f1fb90-1b56-4601-b0b7-16c6f92307a1", "value": "196608:P1Oai6nFyR3P4v55KS43boYMsTtz0Qz2iHOU3e:tOuFyR3wvOScoaRGiHOUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385941, "uuid": "f7999397-e4e2-40be-91cc-f7ab82dd8add", "value": 7621807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385941, "uuid": "e1311c37-fd2e-408b-acff-6b640f05b628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385941, "uuid": "35f04cc6-c9b0-4167-b1bb-da2a8e9aa1af", "value": "cebc3cd0dfd7c514177ba2934cbd1423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161af849-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385489, "uuid": "b1762014-3d30-43eb-a5a7-8d4788c5d971", "comment": "Malware payload (GCleaner)", "value": "45987b3fa320556db9a2cff2b16e6e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385489, "uuid": "371d3e7c-03e7-4caf-8f12-a7817edd2d79", "comment": "Malware payload (GCleaner)", "value": "dbb96c2af75854503c07ac82eac95b15914306120a5f2bd89e9594e760aaad4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385489, "uuid": "9a03cc90-6bb6-4f9f-928e-1be7cb07b9a6", "comment": "Malware payload (GCleaner)", "value": "6eac90d49d4e4a6f44555e809cd7dbc54f424f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385489, "uuid": "ed5aeda3-1cde-4abc-aa9c-e4a53c9a5338", "comment": "Malware payload (GCleaner)", "value": "f1d8af1cdec0e1c59470ca7e00b123a4ffa04edbdb54167171de67c989cf082d2f75f835bc09b2d51b170173e27da616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385489, "uuid": "4c3ddeab-2ed6-48fa-8df9-b05ce9f6a2c9", "value": "T19946D09AE93501E1D0DB2E742843E355582C7BA8C87D94036AD6FA8C5D33946EFFE207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385489, "uuid": "c18dfc35-779b-45ff-b94e-ab476928c137", "value": "c8b764d078e9c67525a39c4f86b79037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385489, "uuid": "de5e98a3-bd83-4ac9-a76f-f70aeec63b2b", "value": "98304:JnBM42Pr07Np5VILaJGDZUuDSqmnqG3LVxR1pM3Cy:JcPA7f5VIGJYZbDZmnqG7V5pCCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385489, "uuid": "a06ac254-9442-442a-af83-0dda52cec322", "value": 5720848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385489, "uuid": "b3cb5d7a-321c-425f-83d7-764d8ee752e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385489, "uuid": "41384ecf-20c4-4e97-a405-edeb664d1026", "value": "45987b3fa320556db9a2cff2b16e6e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea6b025-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385879, "uuid": "edf40364-a1a0-4c4a-8c24-bbba4c83cd8f", "comment": "Malware payload (Adware.Neoreklami)", "value": "c09b2e7b17713a81ad440f1a2d924a1b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385879, "uuid": "7e5b518f-1645-4152-8c0e-e11ae0df0e08", "comment": "Malware payload (Adware.Neoreklami)", "value": "dd2fc71a169d48a05be6e57bccb2ceefa4e9bd62ab7bc39f0574a2c95e409c21", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385879, "uuid": "f4ccb985-58ef-47ff-88fc-21c8059440a0", "comment": "Malware payload (Adware.Neoreklami)", "value": "ea44e2f0681276e9a90c1fb262938b8bda80eff6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385879, "uuid": "6f265969-28aa-4fff-8b38-69633025e985", "comment": "Malware payload (Adware.Neoreklami)", "value": "9cb40cc9a297f4800e837227f06e05a580cc91bb6be787f3ae0a1d9eda63cf163c4c9c502c7f603f8f61d2fd5adb3b72", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385879, "uuid": "91a68289-8d2f-44e6-a233-fb551342e458", "value": "T1867633503CDBCC72EA428871C82CAEE761E9D2241E2714726BDA1C6FEF791DDC41912D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385879, "uuid": "98d5c169-9e03-414f-8306-b53a240d74c5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385879, "uuid": "247f2874-6794-452b-aba2-254023f6a0d1", "value": "196608:P1Ok9EOJQKYFikWWpT5RTA09RCK9M/w3PA2jw1QXvPP77QcJhUznzg:tOk9E/bFikWMU0bCK9M/wuQv77Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385879, "uuid": "710776ef-b431-4ad1-9af2-be0e1b14412e", "value": 7529719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385879, "uuid": "d188267a-b652-407c-8697-294dbe4ba357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385879, "uuid": "fdd03086-6965-43f5-b7ed-cc967230be86", "value": "c09b2e7b17713a81ad440f1a2d924a1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63c5ee3-e778-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767316662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316662, "uuid": "2e367f1d-504d-4e06-9eab-d7f8aa023dc0", "comment": "Malware payload (Mirai)", "value": "7fc947edede6cc014c98d25956386f48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316662, "uuid": "39b36619-a0e0-4750-9684-5908cd6ef4df", "comment": "Malware payload (Mirai)", "value": "ddb9597338e218c841d069d4800422d78645af2934ac8a1f837b6f7058607d6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316662, "uuid": "29011158-9323-4e28-bf14-0c896833aeb7", "comment": "Malware payload (Mirai)", "value": "9e685dfc3be74a4a00578aab42b62f1e718cc247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767316662, "uuid": "fe934a22-cf39-4291-958f-3efa20043bdd", "comment": "Malware payload (Mirai)", "value": "43c3616e7896bd6545760df8ffcf0f2ceb9955e9c9b2010ba13b8666bd326dc8a752dec5a202b417fb95e20f97eb4c2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316662, "uuid": "75b55172-55f5-4766-a75d-117ab5027e32", "value": "T1AC7302C3DD8A6AB4D2CE6B3451520FE2CF8550B3975201BDDB5CA10C6C8714ED1BEABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316662, "uuid": "9672e9cb-abe2-4887-a820-30fc591f791c", "value": "1536:xtWBfqvAd5nJw4ylUIBBjC3IML1W73nk7Anq+VOkEbb+zEc72+PRGsn:HWR6AxEDCLsHnqO7EbSQ2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767316662, "uuid": "18d44c5e-1cd9-40c2-8f93-3f3cbfc2fb58", "value": 80564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767316662, "uuid": "6cb3fd26-9978-42bc-ae08-ff23817ba420", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767316662, "uuid": "b57a34d0-86f2-45ba-b41f-8f0e2815a619", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd3896f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385827, "uuid": "18706aa3-8062-4659-8da1-407d0503a131", "comment": "Malware payload (GCleaner)", "value": "ac1fbec98a78424e861df0f79db2f546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385827, "uuid": "f74b9925-d2c7-4775-9818-bcba9ec2ee16", "comment": "Malware payload (GCleaner)", "value": "ddc912229407e6693f9268954e6e33905fea21c76dfddde9f5bba2d267170855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385827, "uuid": "2bca3f3c-91ca-4b2b-a422-69d34cae96e4", "comment": "Malware payload (GCleaner)", "value": "9b52763b638e5541f0fc1d4250b916ed9ee12b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385827, "uuid": "eda275b0-5abe-4037-b670-f0bffbd59f43", "comment": "Malware payload (GCleaner)", "value": "d6e8be9722dcd6ffe44c8ce4bb83aecbc59a9e4eabe0d5adec2e7d6b360bf6c666f2f550d81570c855165d600380d9bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385827, "uuid": "d7159801-2e26-4fb4-a73d-a226a387a157", "value": "T18616D025E7D62213FC11F7FB588936A73E792892DA3DCBF74FD218092624274E91814E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385827, "uuid": "ffd5628e-0a7f-46b2-a86b-65a6fed62564", "value": "cde078e68994e408985ac985f5f0d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385827, "uuid": "29659e00-c03e-403e-8f30-a6fcb5c32323", "value": "98304:LkDk9JH7+gnnKf+nRRiMOTnd5cXpbETu0bhZjg9:Lkw7+OnSGUdCbET3FZjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385827, "uuid": "bc53bf48-cd18-40ee-948d-fa0933ccda1d", "value": 4403984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385827, "uuid": "757d1e6a-5e51-4fb9-ac9d-20eca0a23390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385827, "uuid": "6b14fbc0-8bd4-475e-8088-ca1762ef89e2", "value": "ac1fbec98a78424e861df0f79db2f546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c50396c-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385902, "uuid": "c1261228-9872-43b2-bd90-e4f72df92102", "comment": "Malware payload", "value": "c617ebfe5cc0ce558d1d534ca25410a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385902, "uuid": "def612f8-2ede-4f35-87db-a2f5079a7f0b", "comment": "Malware payload", "value": "ddd40d5ace2bc119dd58e1f7134d7f08c0724e0a8c92f8362da317d4cb587ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385902, "uuid": "74a8a690-b3d5-4d7c-820c-180da02d8c93", "comment": "Malware payload", "value": "4c10c74482701c88e1e290b92f6e94ebf1bd4bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385902, "uuid": "8ca53979-72e4-4d32-aeea-a27228bfde9f", "comment": "Malware payload", "value": "a9a04575d2fbb57347457adff5bf89d74a844d303fc5802d6d764ba63a41af88faa6d908b00308fe47195b8365b64973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385902, "uuid": "3549432b-1e23-442b-b052-4b39558794ab", "value": "T1F50633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385902, "uuid": "fd40dd76-a43f-4255-a49d-a08c9f487b90", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385902, "uuid": "9f42643e-0cbf-4e5d-95a7-d825a5184e53", "value": "98304:aLT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:42w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385902, "uuid": "f3b8dcdc-5efc-4089-b040-485fa8f6269e", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385902, "uuid": "685d2b09-482c-4c08-9803-4315834a1aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385902, "uuid": "2665a30c-002b-4a34-93d1-584684d402ea", "value": "c617ebfe5cc0ce558d1d534ca25410a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22b31b2-e773-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314508, "uuid": "f017907b-ffc5-4b5d-9770-3d13269e242d", "comment": "Malware payload (Mirai)", "value": "cbca385d060f44ee4aee1ee1885406a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314508, "uuid": "cb845a0e-d99f-45c4-8606-28280a54c80c", "comment": "Malware payload (Mirai)", "value": "de3c539e1a7d24380ac4e2bc34a8af8fb53d6efeb101e136b01b0174935d2f46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314508, "uuid": "e65cd534-748b-4658-855c-2909fe92ef75", "comment": "Malware payload (Mirai)", "value": "859d2d725c2103981db8d036e4a18af2da607648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314508, "uuid": "9653fddf-1765-4ad0-838e-cc240ff32016", "comment": "Malware payload (Mirai)", "value": "f2dda13d61b65da56893a5bf775cdced3fcd8d04bd6812f5cced9843dca4f27fd82a8086aa9b6814c0ea9483ee2e140f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314508, "uuid": "f19f63ac-a994-440a-911e-ac7e18cafe35", "value": "T1A2335CC59943E8F4DC1A057E2572F3325BB6F13A013DFAE7E798A926AC52740A5063CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314508, "uuid": "15692535-7147-4842-8824-414dcc9e532f", "value": "1536:HqHhYIAm2xdYY+zbjam1RvUi1MFG6t7RwfHKb2rXKZRO:HqBY1m2xqrjamnvUi1M46t7RiHIE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314508, "uuid": "8c8734df-415b-4f3a-b3b3-9b03a880d041", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314508, "uuid": "f4fb6b86-a7ec-4a28-bc80-96d488168b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314508, "uuid": "aaba0d6e-0a5b-4cc2-a11a-8115679c7af4", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de96d0f7-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385825, "uuid": "bb7eca29-50a2-4d8a-b425-1d8fcda96338", "comment": "Malware payload", "value": "abcc8c359138253d5790f4a29c470915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385825, "uuid": "8addd619-1e92-4997-868c-a5bce5e2ebd3", "comment": "Malware payload", "value": "decb3803380f5f7fab1a097ce4e74fdd94d7e37fab1091d6d0b2ed41b1b49ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385825, "uuid": "56371b77-e03c-4d6d-98fd-08f817b9950d", "comment": "Malware payload", "value": "adaa22eecf2dd8b2d8b17bd54731854d37b38139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385825, "uuid": "340cc4ba-e3fc-4d0e-96c1-bb772844208d", "comment": "Malware payload", "value": "8f7d0798a932bafdf16dd6e6eda2803fc5f4f30410581946059627559dcbeac33ad5856276bed3677858dffd7faffd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385825, "uuid": "f4272ccd-ba27-4b5d-a9ec-d1415f0b17c6", "value": "T1D00633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385825, "uuid": "bba67fb2-a13e-4d7b-852a-f395c06fece5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385825, "uuid": "ccdb22d3-2be1-4fe2-a88c-7241f2f497ba", "value": "98304:aiT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385825, "uuid": "c45ade44-bb2d-49cd-a073-cc958865196d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385825, "uuid": "d1c14ced-0183-4b0e-a7d3-5281f6054293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385825, "uuid": "eec537ea-ec81-4152-bd6e-0082c79fb15c", "value": "abcc8c359138253d5790f4a29c470915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e51fa1d-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381637, "uuid": "85ba46d3-abc6-422a-8ad0-6bafaeee651f", "comment": "Malware payload (Mirai)", "value": "7e1b8652884c256183c84c34e5bd7b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381637, "uuid": "181e6f6d-5b72-4aa1-bb90-485f87760218", "comment": "Malware payload (Mirai)", "value": "dedaa32e365a3dbe7e16e4f2b48c2d1bbadfeb9f2473b1478d085cbc151889a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381637, "uuid": "224aa42d-5ab0-4b75-afc8-bba9d7284c71", "comment": "Malware payload (Mirai)", "value": "86e2e6508a85d3f0bad835b2123d81ab751f9cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381637, "uuid": "c6bb38b7-3408-4dea-bc12-c2be15f4ab89", "comment": "Malware payload (Mirai)", "value": "af8e29c6b1515777c6e7f695518ad22ddda077e41f90ca620b64ba80ab9bdfdca91fbd75f03136959b7ae9a8d4c67f52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381637, "uuid": "110f1776-2af3-49c6-a0d6-487051b9ceb6", "value": "T129733A45BCC19A23C6D013BBFA6E41CD372623A8E2DB7203DD156F11738686F0EA7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381637, "uuid": "3b25167b-0d58-4054-ab78-1821684951ee", "value": "1536:+8GmsuBG9lvT1y0UphhAn4rdlPefo6KK5F+ssAl+LHCK/PI0GNCCbvM:+8Gmjise+dc8iKtSrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381637, "uuid": "024364bc-1324-4b8d-9885-77a21669964c", "value": 75860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381637, "uuid": "c33d0d2f-1993-45a4-8505-4a4e2faa51a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381637, "uuid": "31a3882d-d5a4-4695-9314-43809bf82e5a", "value": "meerkat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb5a87a-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385906, "uuid": "f6103858-6551-461d-9820-00c70f025d88", "comment": "Malware payload (Adware.Neoreklami)", "value": "c62c2b3f14628f36896441e341b95e8d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385906, "uuid": "d1dc66e6-7434-47fb-a9c1-c54e07af80d5", "comment": "Malware payload (Adware.Neoreklami)", "value": "df998f769f2187d7afae5d88b41acfe806f9e0342e30712b9312751a41cfebc6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385906, "uuid": "965b88ae-456c-4542-9513-847dec815dc9", "comment": "Malware payload (Adware.Neoreklami)", "value": "770b1097367900f92a05eea9e1991629bddd1985", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385906, "uuid": "40124c2f-96a6-4421-824a-e2d588ef4769", "comment": "Malware payload (Adware.Neoreklami)", "value": "89257f46f00b4df8bcff09a20ed8ac9460894c33c103d62412a7c17659ad968f213b6fb7677d729c3c8e0c77f5d2f9de", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385906, "uuid": "b29d7fbf-024c-4978-9fe5-e2b36eb542bd", "value": "T1947633123AD08CBED183507F873BAFBDD1759AA44F2908AF3B6109495EB818DD50E2F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385906, "uuid": "6d2d47bd-5866-48ef-b42e-628f920c18fe", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385906, "uuid": "7669df4b-cbf2-4954-b56b-fe2414a6245e", "value": "98304:P1O2N5Y7T8ADanAobXLaaT2NMjXKc7dWpQD6ogNoh5cY2bzV+lZ+InNQ1AHEm9kt:P1OCoJDUhLLTMya4GR+l7W2kmqnjNncw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385906, "uuid": "ba18dfd9-2c1c-458b-a3ee-8341b77ea0e5", "value": 7531272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385906, "uuid": "7cfa439a-17dd-460b-836b-f641fcf302c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385906, "uuid": "0319ef98-8f27-4db1-b312-4fd3d93db36d", "value": "c62c2b3f14628f36896441e341b95e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6a834f-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385719, "uuid": "d19642b5-c199-4ce9-8722-a2bf0566ecae", "comment": "Malware payload (Adware.Neoreklami)", "value": "8bde31c8e9ee8cb9a6435798d778879d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385719, "uuid": "e4c3c48c-4ed3-41cc-b447-10863c1cb1ad", "comment": "Malware payload (Adware.Neoreklami)", "value": "dfa19bd7415c459c34355c5440485a8b6471ee7c7cbab6e8229353752e74bb7e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385719, "uuid": "f720a105-fb32-4e42-b087-342305d4b9cf", "comment": "Malware payload (Adware.Neoreklami)", "value": "c0f769691ab1e8e76e0d1daeb3ff3a20d143e2a1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385719, "uuid": "f43189a5-9f79-488a-8278-6ee6fe15034e", "comment": "Malware payload (Adware.Neoreklami)", "value": "b11c7b0396758021af2837a67009cbec6fcbe983dc13fd0a88739d5391336754836f140e836d240fc6f82b10db6786ca", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385719, "uuid": "a3b8c956-e326-4ee6-bcdf-8ddb5eeb041a", "value": "T1EE7633013F94D6B6E34871358C057FEDB467F82CAA24425737E8469EBB78150EA3EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385719, "uuid": "2236dfa0-745f-48c8-ab95-4603198511e4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385719, "uuid": "c3d46dbf-68ba-4cf3-8c35-21008db79d92", "value": "196608:P1O9PrEoX1bRV7K/OLNBlCtGcvoNalcAyWxfGRe55pR:tO9PrzRVJNBlCIcAOcpWxfy8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385719, "uuid": "a73ea636-e6ad-485f-b58d-28ee51c8bee0", "value": 7558841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385719, "uuid": "69604dd8-e750-4898-a77e-a8b87447dc10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385719, "uuid": "adad61ed-6bc5-46cb-a2c4-d9ada2bf65c6", "value": "8bde31c8e9ee8cb9a6435798d778879d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091949bb-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385896, "uuid": "e9ca1642-abab-4bb7-aa32-9202c348ba14", "comment": "Malware payload (GCleaner)", "value": "c410e356e5b3b84432f9d7798225e977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385896, "uuid": "b6fb2cf1-6f98-40be-b8d7-d78a9238d59e", "comment": "Malware payload (GCleaner)", "value": "dfd0df717b78f4d897755d32f74f36e2a4040d2d599686ed5ed8ce202591c649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385896, "uuid": "f02f6f2a-24d4-48ab-96b4-4d27ed6e479b", "comment": "Malware payload (GCleaner)", "value": "370f35cd40620b224ad09c4c419b237cc30c4f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385896, "uuid": "d395967e-e9c2-4b5a-bcff-243e19e00c5f", "comment": "Malware payload (GCleaner)", "value": "f7933753a6064bfff2007c088f0517fc63c8a402e70efc0f8a082be3d7bd0e533092c8a0ec8a84cc33a68cc9bb89ed30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385896, "uuid": "24bf71fa-e657-42c0-9d8a-218bf056ca62", "value": "T1D806F137E7B08C11F282087ADD2F9EF3CF74A49526619843E9A55F085D21A85EB833DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385896, "uuid": "dabb5d50-3d04-428b-967c-ff3d0cca602f", "value": "229ea82d8ce3465f3083bcb663b250ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385896, "uuid": "661fbe32-049a-43fd-b5c8-93481d35c7d2", "value": "98304:xC1Np+x6M2lMowT4s33mdPDAov5piWM9ERdwe9PV98wA1:xg+B2lMowElPDvv5of9QdV98wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385896, "uuid": "ac76dc3b-2a4c-406d-842c-809293864868", "value": 3723536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385896, "uuid": "5b1dd344-231c-48fc-93a4-408e70f28fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385896, "uuid": "938fa981-0bdb-4cd0-bb11-a791de9c161c", "value": "c410e356e5b3b84432f9d7798225e977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dc2033-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385752, "uuid": "5f10e96e-a921-4951-953b-951f2d4c453e", "comment": "Malware payload (Adware.Neoreklami)", "value": "95892e378883aa34aa4daf189b511e81", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385752, "uuid": "922da754-4ca9-4d2c-86d0-479cdf52bf0d", "comment": "Malware payload (Adware.Neoreklami)", "value": "e0934a26c32ff1e57c1ef99f5d0667fe9c8cbf73e2fb9f3b3614ce48d2e8e2d9", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385752, "uuid": "1f95d50c-8008-4d3f-aebe-5168b4de18a0", "comment": "Malware payload (Adware.Neoreklami)", "value": "3ab5c7e4a2e2b5177be18ee653919ef9a63bc4d8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385752, "uuid": "911270b9-bcbc-4f5b-8cd4-9c207214301d", "comment": "Malware payload (Adware.Neoreklami)", "value": "3b03a378e380e01a0758ce49ac1e7355debf3453d4dac5e4f5da2e24b1593d56b6acd53372e3a9b4b9431da6b1484078", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385752, "uuid": "1258643d-d249-4770-9f23-336661541720", "value": "T1E17633017FFACEFEC56029B26A5D2F853193C9211DB048F3635685FCE4B6185A5A83CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385752, "uuid": "bec93e9d-64b2-4d12-89c9-ba476d4ef546", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385752, "uuid": "72d0ce72-b779-43ed-bd1f-6d584d86c60a", "value": "196608:P1OGoOfOlSxWAJCg18VUNrFBVzkyt7TCIlZXb8/:tOGotuhCgzrFBVwyRCF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385752, "uuid": "0d61882d-7e14-4da8-9c01-2dec6280d1d8", "value": 7509707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385752, "uuid": "838b2b09-dade-46f2-b69a-a2ecfb9d0f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385752, "uuid": "0956f01e-f50f-459b-bc9b-d3dffb3b8944", "value": "95892e378883aa34aa4daf189b511e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f6b4b2-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385695, "uuid": "4554f6dd-55ad-4942-ba19-00bd89363d2a", "comment": "Malware payload (Adware.Neoreklami)", "value": "86b0c7dd5e5915d5be28088001d3ca35", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385695, "uuid": "3d755916-c801-4353-b737-30edeadd4c58", "comment": "Malware payload (Adware.Neoreklami)", "value": "e0b55102912279f621e30c9dd759282b575c799cdd784176932fff13a3e0d4f6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385695, "uuid": "0436e617-d4c3-4dc3-a522-67a3987cce19", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab0e56e2d9059f82136ac1f747a5a0d338cc9768", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385695, "uuid": "331122aa-4db8-49e9-a874-9017fb3c060a", "comment": "Malware payload (Adware.Neoreklami)", "value": "9185c564049d4cac14f881fe9e3b6a7dbcfba0797a7be2e327fc55110b94c77b7e72825de76d1b6ff88c92fbea802922", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385695, "uuid": "af06e832-d23b-4463-90cf-26675881f8f8", "value": "T18E7633A0BCF685B6C94254329FDBAF8EC1F1BBA44B938473B3EC030D1C76A548656257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385695, "uuid": "5316efae-23a4-4a99-b820-32efa9be61b4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385695, "uuid": "0a3f9c7a-6f25-41fa-8f58-c1f1147f9b7e", "value": "196608:P1O5fASb71T1xi2YMXuXOLLwVNnfWxt1ZW9EN3RdPmtYqFsdO:tOJ1Vjd+Xau9E1ZW9Y6tjsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385695, "uuid": "8fd46888-e6d7-48dd-96bd-43d4c398d78a", "value": 7497479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385695, "uuid": "d943aeaa-324c-499c-b51a-2fbc8af1b4d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385695, "uuid": "847d6dfe-9ba2-49f9-9fe7-25df9354aa60", "value": "86b0c7dd5e5915d5be28088001d3ca35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382b3608-e7b4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767342167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767342167, "uuid": "c398f2d2-0f4a-4b18-a78d-fd123238ad48", "comment": "Malware payload", "value": "275ea0f898908fec797ab4fd136a7686", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767342167, "uuid": "cf8a61f7-bdc7-437e-9b62-9f346ca6845b", "comment": "Malware payload", "value": "e0f16a01cd0e42a8a24a4f0b4a9033c74121989efad06b606df2b61ace7c847e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767342167, "uuid": "89dab6e1-fa0a-4bd6-a42a-17476f4965f7", "comment": "Malware payload", "value": "2ec21b7eb57842b5dde6f556a1eb3352a9b87d2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767342167, "uuid": "8a296d06-1a6d-41e2-9208-3ff893c3552e", "comment": "Malware payload", "value": "c92729c6658e4f2f14fe861a1e23096ed509b5aa63dae1601f986c3e44a1593de503a9933d35d0eca9eb2cdf9bb200d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767342167, "uuid": "a3e38a4f-2a04-406d-931a-35a6558dabb0", "value": "T1F6F37E7BF6D16CDBC42281766C39E5301E0CA9A003A6D9D174EC73798E236897B4B6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767342167, "uuid": "210f88a5-b246-402e-9000-19a7366544b8", "value": "3072:nZ9kqB2Z5tXuhMK0LlebZDxjKoiNyotn5lFIc+2dHvvnjq:nfbQZn60+72o+XrdHve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767342167, "uuid": "6d6049ae-e2b5-4148-8d61-299de03f4697", "value": 168907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767342167, "uuid": "53067e13-e4ed-405c-b6f1-ab0e0578845b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767342167, "uuid": "40f6faf2-d2fa-460d-a6e2-a674eefe0c08", "value": "SecuriteInfo.com.ELF.Flooder-ABV.23267325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897e51e1-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385682, "uuid": "2184e629-f4d5-42cb-b32b-1c7d81365452", "comment": "Malware payload (Adware.Neoreklami)", "value": "8496f8e59fd594443c352d58535ca2c2", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385682, "uuid": "69e0e4c1-1ee8-4f45-9588-12c9d161bb31", "comment": "Malware payload (Adware.Neoreklami)", "value": "e14100d3f50a212072e12192f626e44c3a8c995c906a5625f00f579963be8ad4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385682, "uuid": "30d521cc-ecb2-477e-9415-7de3c0cc5406", "comment": "Malware payload (Adware.Neoreklami)", "value": "8a9d6669da54ce51656f62157d1d1ca2190cd6f6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385682, "uuid": "9c6b1811-c7bc-4e17-952f-6aea168d272f", "comment": "Malware payload (Adware.Neoreklami)", "value": "67a304e3e91b1319c3c120c1766ebcaaeaa11f6b1d578c1a93d374386137b8979690143064f4a9dc0d48ea7abc9087a8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385682, "uuid": "a4b9b7a5-e845-44f0-8100-6e8d7d049b41", "value": "T12B76331977F5CC7BE57710323F20AE4B5099DB4A0B706C3B779867992E6FDC18A20889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385682, "uuid": "54f20dc9-a559-4343-8241-c4f30d27de9f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385682, "uuid": "2bc377fe-229e-4eda-a083-2c02866d0cb6", "value": "196608:P1O4pZfv+LeS8rQhuI9/rl8rcKn1l9PxXbUp:tOYfv+Lt8rQhl5Juc25xXwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385682, "uuid": "8d96a42b-8020-4ea0-a49d-a7bb1413ce47", "value": 7547798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385682, "uuid": "af3b9fac-b18a-4741-88eb-f25fc51d2e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385682, "uuid": "90c068f7-2679-475e-a777-ae3892e5278f", "value": "8496f8e59fd594443c352d58535ca2c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa0711c-e7a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767336721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336721, "uuid": "76d10029-b559-4537-9acc-e72cf91ae69a", "comment": "Malware payload (Mirai)", "value": "fc9bab3820d0e67ef1ba0f114b59fccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336721, "uuid": "6138b6f2-ca4f-4cf5-9b5a-672a497a41d4", "comment": "Malware payload (Mirai)", "value": "e15363eda4f0bcb02a4419c5e6ce25964e39b49ccdeea86ada972c6bc17c4e8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336721, "uuid": "36cda2b3-0502-4633-8588-28883672d1b2", "comment": "Malware payload (Mirai)", "value": "1df4dc30e508bfbd4cd0954a85648690fd244cfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767336721, "uuid": "44542f49-70c0-4226-86e1-aa3f6d9b5204", "comment": "Malware payload (Mirai)", "value": "f0503f2bb7f35eeeaae52d57dc11cc8128d6e81c5726eb7ad46336c3361f173e05f3e8a00673799385a2df1ea8966b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336721, "uuid": "a194e6fd-22ec-4045-a6cf-f7e9ac172ae9", "value": "T12004AFE3B70B24D1CC2506F80BDB5B9D6A2321025D6B96E76C2F393A6E770DE19123D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336721, "uuid": "b3f891c3-4934-4ad2-9032-2c4ad41fcc6c", "value": "3072:LlWFxO6G2pTfsqs8SsaxgkI6tICxl3sqld5GgQCzvHnl4nq:hWi6G2msUrRIaV/lPQCzvHunq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767336721, "uuid": "23129a84-dab0-4e80-880e-ca3ebc0d5ada", "value": 182180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767336721, "uuid": "df1ccd35-c135-43fe-aba5-50babeaae65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767336721, "uuid": "12fdd926-37f0-4cee-b7ac-5268a894dbee", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba71415-e818-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767385444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385444, "uuid": "1cb5be54-2dc7-4171-9b38-1419f2945d07", "comment": "Malware payload (GCleaner)", "value": "2fa15b174faff13ab2ef0c4e774c2ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385444, "uuid": "be09a377-94e0-43ed-bb05-f098a6dd5f32", "comment": "Malware payload (GCleaner)", "value": "e171542fd98db9f220eb9189b477f51f5b0fe949355cc0b723a7e2f3aaf3c51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385444, "uuid": "e69b3906-92a4-43dd-bb87-0b3dc9e207de", "comment": "Malware payload (GCleaner)", "value": "8cfb509ea39a41a8b91bf8df4c5b0831b6d7a34a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385444, "uuid": "76f110fa-e982-4f53-a29f-edd11827e3bd", "comment": "Malware payload (GCleaner)", "value": "e9c5c8f718de4fa056978cc20ac4068f320bf591e101a056637add10e61267713b497246b7625eef866ff1f9eea72715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385444, "uuid": "544f2090-7205-44d5-8de2-9267cd918832", "value": "T11B46D0E0D76E101AF33EA434440ECD5E263938ADE421587657A79E9CDE20EB27531AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385444, "uuid": "5cf3c8fe-e355-4108-b990-ab42e696e862", "value": "1b75c88ba8dc5be89125ab3e1bf810bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385444, "uuid": "8b474c99-80fe-452c-9d20-c481f830e9cf", "value": "98304:5S/NFNAuTk6811E1CBwnmdnmQAma+ACky5pEQvll2+QzGlP:YV8uTQ6cBwmdnmQAHNC30z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385444, "uuid": "663b57a3-a309-471b-9b90-5c9fc1137425", "value": 5442320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385444, "uuid": "cbcae398-e7df-4e36-9fa5-7e975f9e5fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385444, "uuid": "6cddfa9c-893a-46c2-aa68-cc7022311883", "value": "2fa15b174faff13ab2ef0c4e774c2ed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f25d2d-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385893, "uuid": "5c8e6535-ebcb-4208-8faa-fc096cb7f7ce", "comment": "Malware payload", "value": "c3e208878e1e3e9238b72a3c6b2b744f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385893, "uuid": "8cd24a1d-5fe7-41b7-b24c-3b436ed7967e", "comment": "Malware payload", "value": "e1ea71880e21f80747050acb9c632ac75c1ef48ead0441555e3d0f3a5d00ef98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385893, "uuid": "d14eb41a-47f7-4162-b86e-b0c3cbe92050", "comment": "Malware payload", "value": "18c5c61d8bc786469d92067d61e9e3658526c106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385893, "uuid": "c5d31908-911a-4f98-87df-787168220212", "comment": "Malware payload", "value": "66df67353f39f781272629f77df238a7a3e4eb0788e228c9f714ac40141f0cb3f107bb655da9151f2a8b00a1eea4c444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385893, "uuid": "446295a9-071b-49d4-b97e-9078f740381d", "value": "T1F30633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385893, "uuid": "81c06cbb-3b13-480a-9ccf-720c30c27f45", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385893, "uuid": "4cd3d224-f438-437f-a0dc-b94dcf24cea3", "value": "98304:a7T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:o2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385893, "uuid": "0ed79077-b097-4019-a429-01c11fb681e6", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385893, "uuid": "515e085c-4c21-4bbc-932b-64d220a3f69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385893, "uuid": "e06b13d5-50b8-478c-83de-b2b240f1ba15", "value": "c3e208878e1e3e9238b72a3c6b2b744f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a811d4-e7d9-11f0-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1767358238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358238, "uuid": "055a465c-5836-46b0-be92-9421aab3f731", "comment": "Malware payload (SSHdKit)", "value": "71f0cf0eee358a7d8fc095873442a9cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358238, "uuid": "c107ad48-6896-4fcd-8639-d094be4182fb", "comment": "Malware payload (SSHdKit)", "value": "e23880e03defa88188e3f2e9bf39c529be3084fc23b891275a1b48f4428d4560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358238, "uuid": "459af299-f1c8-457f-aa47-9003ecc2763e", "comment": "Malware payload (SSHdKit)", "value": "d6d857699c586b08bd502446699a45b3ee6b5fb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767358238, "uuid": "b8169193-e802-462b-b14d-da9bce64e84b", "comment": "Malware payload (SSHdKit)", "value": "15a4b801275510c5089526659d428fc37db23d6965035181c6984c041f0618875050b0345d7eb72b89c4efbc52263c40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358238, "uuid": "bb8690ca-be3a-49e4-834d-d00944b18c29", "value": "T135356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358238, "uuid": "db33d29b-9623-40e4-aa09-96a4f11f6a9c", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIV97bLv:E8dbbsO38+TfgRinIVtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767358238, "uuid": "b730fafb-2889-4945-ae3a-1ead7b9a8fa5", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767358238, "uuid": "1aab87a0-e9b9-44c1-8565-14107e378d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767358238, "uuid": "f48e787d-9436-4061-ab50-a42a2a56cdce", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d6774d-e819-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1767385871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385871, "uuid": "5cf3a7f7-b85c-4b37-b35f-4788cd4c994e", "comment": "Malware payload (Adware.Neoreklami)", "value": "bdb4c393b590783b90a4b57705f219af", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385871, "uuid": "4b84caeb-c9a3-4ed7-a6b3-672623c7cad9", "comment": "Malware payload (Adware.Neoreklami)", "value": "e25fe397e952350792370f4c03f6a48082adf5e11dd00587fab944f73ef67910", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385871, "uuid": "6c0d3d1e-cf4f-4881-9eff-5de1f20e1cf6", "comment": "Malware payload (Adware.Neoreklami)", "value": "c5ee3a4fc85a6b485141829fcd98746cc9cd0024", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385871, "uuid": "a689438f-853b-4cd5-ad2a-ee310738483d", "comment": "Malware payload (Adware.Neoreklami)", "value": "2c3078dd92fa2bbe4d18d89ed7d8a472d7bf8fb678fe93f109856229f7fb281003cc34fa4626260ba0ba960772e7e5a4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385871, "uuid": "41b54a04-3c0c-4df8-a608-ba8efaac90f0", "value": "T18276335635C2DA7BEA82A5340E415BEC91D6C6254E0CCD23639B1C6DAEFCECD8323527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385871, "uuid": "a19d530a-01fd-41d0-a21b-20ee7274c487", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385871, "uuid": "949ef700-2480-4501-8eca-4f3f6699fc50", "value": "196608:P1OHNcedybRNPpTtVNyB5flxP+iEaePK3RkNIrRz1p:tOddydNVNelJ5EaeQ+yRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385871, "uuid": "9b47c2ea-e2b5-48e5-95d6-9a9b86b5b5ab", "value": 7527040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385871, "uuid": "8bff45a6-3276-462a-a9d3-757b93622aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385871, "uuid": "caeb7829-02f6-42f7-9da9-e26c275f18fb", "value": "bdb4c393b590783b90a4b57705f219af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67ffce6-e76f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767312716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312716, "uuid": "ea31902d-7374-4acf-8166-ef2f199c3e87", "comment": "Malware payload (Mirai)", "value": "aa21ada3dfda4e3d0f8d74dfac06a55b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312716, "uuid": "49e23e96-7e19-4833-a069-95aa8b7a0c5d", "comment": "Malware payload (Mirai)", "value": "e2731083fec04afa4f438e42bf51a896a7642de2e65a34c9363c90ea0f3fd15b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312716, "uuid": "8bd13768-747c-4301-806b-e5224bc14947", "comment": "Malware payload (Mirai)", "value": "de393b8bd7e68848a3ec11782886616a3c4c0f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767312716, "uuid": "bd0edb99-7382-460e-9dc1-c1f2d896b84d", "comment": "Malware payload (Mirai)", "value": "b183b9224fae0229443580b1938d8b7f9e5c6112815016e1283888bbb63a54cab7d78b1402433c1b91cd9b77aac97c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312716, "uuid": "3a03e2a3-6eb3-460f-a9b6-23995572cadb", "value": "T11073B61A2F269F6DF76C873547B78E209698239627E1C241D1ACF9019E6034E741FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312716, "uuid": "49af9215-ddc7-4544-9505-0c1499d890cd", "value": "1536:a6tWzrQaJ0oc6cf2YCdu4PuyzWxFENKnH07HGF7HHqP4niLz1uM7RC:14zrQaJdc6cf2lN3Z94niH1uMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767312716, "uuid": "a3de82f7-1334-4f82-8ea5-a6d3bd93b7bd", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767312716, "uuid": "4d7d25b1-f282-43e5-9818-f14a56638236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767312716, "uuid": "acd4dc62-0a48-4f5a-8741-89a3d5c09948", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2402f9c7-e829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767392384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392384, "uuid": "57296341-c2b6-4080-873a-b847ba5f4cc8", "comment": "Malware payload (Mirai)", "value": "f51646e07ff181dfcb3b0fdc2b62f5f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392384, "uuid": "0fbd0126-5d48-4406-892a-8a24eb29ceeb", "comment": "Malware payload (Mirai)", "value": "e29a700d69c4becf5087b7ac4ad31e72aa72361ffa7878d3dd1500184bbc99bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392384, "uuid": "3eabd739-bcb6-461d-880b-58ac21ac60a6", "comment": "Malware payload (Mirai)", "value": "ff2854d1f0d846b50570e900a592a1f64c6dfbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767392384, "uuid": "d4e5db27-dbe6-4ca8-8efe-99012a2a1fe7", "comment": "Malware payload (Mirai)", "value": "3511e0948a5b53b018cf3c814e201ac6dae6c965ab97f73d47f158021c19065d36c47100d7af06017c471f388b55e030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392384, "uuid": "de3261b8-ac63-463b-9476-ec0b0720de6e", "value": "T11024672A3A22DF6FF56C82304BB78920579D36D629E4D644F26CD34C1E3125E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392384, "uuid": "26575071-bb01-43aa-8736-e236b8decacd", "value": "3072:WDIK0C4ln6rXTNvz6wruahq4n4PbMgKX5qfZZoVo:Wvw6PNvz6854PYRcZoVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767392384, "uuid": "af5d5103-97d8-4419-90c0-135beb2a81aa", "value": 228648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767392384, "uuid": "b49abbc6-2c38-420b-879b-239756a54e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767392384, "uuid": "ee5d0e33-5677-487d-b1e5-a7536255c114", "value": "catgirl.mipsrl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54e8b70-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381863, "uuid": "850a4ff6-47c1-46a7-b1cf-79080c638033", "comment": "Malware payload (Mirai)", "value": "019dcc2537b6d059c0654ccd1d682ad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381863, "uuid": "4bec8b42-c726-48d9-854a-8de4e862f165", "comment": "Malware payload (Mirai)", "value": "e2c50572bd282ef02b714efe870007f73f99647055eae98591919d14c38db66a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381863, "uuid": "07238a08-f39d-4a44-892e-22e5dc212103", "comment": "Malware payload (Mirai)", "value": "0d4d3a1637126ac7f64528859545b4c79e5685eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381863, "uuid": "3adf4288-3e0f-468e-9519-256b3aad420f", "comment": "Malware payload (Mirai)", "value": "38aef7099a8e82f3439a044c73c813d2176894f83fdb7010793d52c94f0b0cb03a2f20e140b01c502dce25c943e64359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381863, "uuid": "c1eefaa7-6808-49ab-ace1-b4c50861a5e9", "value": "T15C83F707B711CF10E75ADA3046F78B562AAE16C227E29546F36CDD603E6434C682FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381863, "uuid": "3f4cdab6-ffc9-42b6-9a19-8f0566e42979", "value": "1536:z3yEAdcTzmAMgsUj733yZeAOul966JuC2+AY/+TrX/nkhYKTSJ4r:DVTyD8/yZRg+AYWvNKTSJ4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381863, "uuid": "fc2436dc-c057-47ed-abc3-14932132788c", "value": 84204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381863, "uuid": "beae805d-9a2e-48ba-89ac-f8289b9a1415", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381863, "uuid": "10888bfb-a5c8-484d-9481-02ab4d876e2a", "value": "colomamips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e238f1-e7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767362185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362185, "uuid": "ca83cec6-27a4-429a-8ea1-3de32f3117bb", "comment": "Malware payload (Mirai)", "value": "ec5731cec45e28f21703bcfa15d0da1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362185, "uuid": "45d516d0-df39-44aa-82e9-fe406cf79598", "comment": "Malware payload (Mirai)", "value": "e360243b109efc648829dd94007864f90b01fe4ae18bdfe67ad60c6c758116bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362185, "uuid": "3e75c52d-936d-4b0e-8167-a978d81baaa4", "comment": "Malware payload (Mirai)", "value": "fd4d5e232dd00f0fd8432d368e45637f7ff13042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767362185, "uuid": "f8581b9d-d043-4801-810c-9a3427dbae0c", "comment": "Malware payload (Mirai)", "value": "0459cf23b145217c03f0f8aabf676891f926984aea59ffbddebd4005e6e852bc3bc1cfca5456337faecbefc51fecdaba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362185, "uuid": "b6ddd154-313e-4748-acd1-b93af3cd3930", "value": "T1747302FB972FF7A4C4743B74A9A2534BF4632E015D256A29082427B8CE4DFA81638753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362185, "uuid": "3d0125b4-58d6-4525-87db-96ce3b4055f1", "value": "1536:Olbtgs8TjZ46+2icO/j5okl+rRuVI+KJNwfYgA1vi8YHVru:igsQjZBW/j+kl++QPwA5QHFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767362185, "uuid": "a4f83e4c-2398-457c-976a-be75cb403bed", "value": 74724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767362185, "uuid": "78cc8a07-e581-4b60-9837-70bb85b466c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767362185, "uuid": "e60f04d4-a120-46f4-8c07-e3cbc9052ced", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6520ab51-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767386051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386051, "uuid": "e552bf9c-7973-4317-b384-3d46d3ca0a89", "comment": "Malware payload (GCleaner)", "value": "f8103dadf38a8a44f0118388d7f6378b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386051, "uuid": "2342f3a9-e4c7-4dde-b8fa-4a0fb95968cd", "comment": "Malware payload (GCleaner)", "value": "e366bbf2c5a7d59ab3c0b28998a264def755d91cec6e4b0a0d3639cef3c5f7f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386051, "uuid": "575f8484-f7ca-4104-b106-43c9ea8f6dc4", "comment": "Malware payload (GCleaner)", "value": "009332c1ec71484fc345fb094055acc634032edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386051, "uuid": "3f7474b3-b4a0-4f61-a729-e90267c0c31c", "comment": "Malware payload (GCleaner)", "value": "d5e839d2547aa433658ddae628d3bc965e98077160c907c33e6a54f98e518007256423da69343e5ae93b1ee91ed75e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386051, "uuid": "afcc4e0c-f91c-42db-8b6b-fd7f3c15c118", "value": "T1BC66E08FD278EC2EE135093FF546395A0551A93FDC2F845D9AE88C062FA45F2BE61342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386051, "uuid": "547ea0de-82f2-48e5-8df4-9011d354a096", "value": "fe0d8e233d65dcb7c8a2a20abd3bffb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386051, "uuid": "4a4d1672-5b71-4680-b298-14ee0ca01861", "value": "49152:6rSWinwP3a4fWIqYniZEAO305fKOBoF85x6k7b1b+3wop8fADqkqIF6g0mU:6rSWnP3ayLsEt05fP6Y4Sw3w9tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386051, "uuid": "1fe62f3e-49e4-463d-bb24-4bc231ba3ce4", "value": 6630672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386051, "uuid": "a527e5ec-5022-424a-a729-895a9261a530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386051, "uuid": "db7146b7-05d0-4de4-8d45-059c4059a1ba", "value": "f8103dadf38a8a44f0118388d7f6378b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e2c50c-e773-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767314506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314506, "uuid": "81a4f720-5b40-46a5-9dac-a89b74d6e25d", "comment": "Malware payload (Mirai)", "value": "82693259c3619fc4c9eab3746433d6df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314506, "uuid": "71f5e801-957b-429b-9737-4126f1f006dd", "comment": "Malware payload (Mirai)", "value": "e3683aff719484772d49cc634589dc52c77dce885faf0bfb0cfb52284895541e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314506, "uuid": "ca004b44-165f-4ef6-a721-244e6523be1f", "comment": "Malware payload (Mirai)", "value": "7a4dbe1f790baca8f67121333f850cd352d4c655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767314506, "uuid": "1690fe92-e3ef-4314-a826-f6556d24cb3d", "comment": "Malware payload (Mirai)", "value": "96a6c453059f06b9eaa4aba650c4a420759d4484569fe9035112cc1ea2da8b062e387b3adf9727edc5a052f6ca863e3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314506, "uuid": "d7d813f7-ab71-4ebc-b776-0a038e9979f1", "value": "T136530945BC81D617C9D462BBFA5E42CC332653A8E2EF7207CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314506, "uuid": "a464709e-a91c-4b4b-8dd7-ec60340612c7", "value": "768:k5BzSXi2bMgSf+7AVF2MlLOZLYNz0th4RyRi0h3UM2J6yN+ThTm0iuM7R:6NSy2UF2eLOLwwtKRchk7J6JeuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767314506, "uuid": "ce84bc35-6a88-4f70-a345-055b12c6c7ab", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767314506, "uuid": "efbc2abe-e4b7-4aa6-9a16-9a4cd65c0c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767314506, "uuid": "2bf7529d-0a29-4a07-a48b-c89909a7e8b4", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1156582-e81a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767386259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386259, "uuid": "56d694f4-b088-4f3d-ab92-7b38ec98d67c", "comment": "Malware payload", "value": "ad31ba4810eff85eb704546de22957d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386259, "uuid": "3242474e-b5ce-4bc1-bbae-8429281967f7", "comment": "Malware payload", "value": "e3bc7aee9c7422cefd9134652afdaa9e9be25a2d6c1414069ebd6749db5b5e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386259, "uuid": "e8fd5cd2-2dc0-4098-895f-b6544e048375", "comment": "Malware payload", "value": "769bdc85f5b044a5c28be49579ee62a034d9d6b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767386259, "uuid": "b0514d07-1de5-449b-ab2f-3c20cb109a56", "comment": "Malware payload", "value": "57d452edbbc44f59f9cca89d71ebb1769b8c4e4e49caf6c1f58ad92658aeb41a5b0f96ae198289cc3c2856214b2e2ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386259, "uuid": "fa5df30f-91a5-4e32-ac75-cc894501eb46", "value": "T1F06517796551D256FE3880B940F2965DB220713286713BFB0164E267EE0B5F0EFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386259, "uuid": "22d62b30-c03a-40d3-ad49-7f0e715c2c50", "value": "6ca59c827892593e96aba0345b8b5e71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386259, "uuid": "81894233-4b59-4b0b-b300-b2592a2bfa50", "value": "24576:Corlh2WD00IEMjB0ekeqQNuMZZBmx4odqDF7KAPX7lHGZ4t/gqvV/oZMs5GgVkWD:CPL8e57NuWmx43+IHGZ8/gq9AZMs5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767386259, "uuid": "d3f880b4-c172-4b4f-a0d2-4b3ecb50b781", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767386259, "uuid": "a4c83682-e01e-4378-b178-5e215a2bb587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767386259, "uuid": "ed76a7e2-4a36-4fd9-9427-06c827737ed7", "value": "8591a981cf3c775d6291075f8826e6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083033cd-e810-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767381600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381600, "uuid": "1c3c9ea1-5a87-499c-8e8c-d7b6c522236b", "comment": "Malware payload (Mirai)", "value": "12dc5cb501b1277a16e62dc4197574d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381600, "uuid": "80581517-72b9-4eef-b44b-380eb8090ea6", "comment": "Malware payload (Mirai)", "value": "e406a3ef82c5cf5eac938d8050262d1838e4dae91665da402d8aa730f40f8a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381600, "uuid": "a735dd98-ee20-4f90-b636-e718faee7aaa", "comment": "Malware payload (Mirai)", "value": "c1cebc9d24d233e7fb8c5a2c9f9705098dcd4ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767381600, "uuid": "20222580-18d1-47ee-9c9f-c19e83ef3b9c", "comment": "Malware payload (Mirai)", "value": "c8f575e3b348c77228778628d360015c9e4b6bc904bf617fdde6b486ecb2f1937d6cbfeb739d721257780a90a08c5d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381600, "uuid": "722d3d31-03e1-486f-897b-24322e55f40d", "value": "T17773930ABF650FF7E86FDC3789E91B45248D641A21993B7A7D34D418B24B24F49E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381600, "uuid": "ba039d62-2963-418f-a519-ae3c386f41e6", "value": "1536:ZE2Vu+dSWjhZRcogB2E05jbhcTefCqNeh3x:ZrVu+dS4hrgB2V5Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767381600, "uuid": "f250e647-cfa4-4cd7-842c-5106065415a8", "value": 79884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767381600, "uuid": "f6daef7b-117c-4e83-8865-ce124e2906dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767381600, "uuid": "f084d7ca-8cc9-47be-bfb9-c76d57594971", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff42fba-e819-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767385854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385854, "uuid": "6fd49902-6c54-4e3d-b467-22162a724978", "comment": "Malware payload", "value": "b7c8022a96774d7b8214d48f9bcd9fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385854, "uuid": "3faf3975-812f-4c2a-982a-4da4b69c5ddc", "comment": "Malware payload", "value": "e424e627ab85d1d1f5d7d1fcc2cc8c2cd5aee290c33baed499882a3d3eefa372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385854, "uuid": "5a209bf0-c7ab-41c0-bd9e-e36b4c7356d2", "comment": "Malware payload", "value": "c80663f71ca36e51224d6ef4dfae9fb08cac1fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767385854, "uuid": "ea6e419d-9000-4f67-b09d-c3ba96476028", "comment": "Malware payload", "value": "f019e81ecec6175643fd3b930b5ee69221c83b9a67bb042ad5a535853d60bccc11c4bb1069636e9a00da1ab495b99ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385854, "uuid": "a4d13152-9c21-47ef-ad29-ae615008db27", "value": "T1560633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385854, "uuid": "16332e6b-39c0-4729-a3ab-a2028b4271a4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385854, "uuid": "3b145487-aee8-49ac-be78-76fc494fb1aa", "value": "98304:aJT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:u2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767385854, "uuid": "1cc9f42a-0606-4e0d-92d3-91717321d8f2", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767385854, "uuid": "ac3ace8f-38c3-4257-bb02-97c1c75e7c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767385854, "uuid": "60c4e380-99f8-4e47-9a44-dbeb7ca8f15c", "value": "b7c8022a96774d7b8214d48f9bcd9fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e430af-e7e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767363644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363644, "uuid": "0e0fa9f3-a48a-4366-9d3b-d9d9e38d2b0e", "comment": "Malware payload", "value": "8195f257e43eedb1bebb63e881c8b3b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767363644, "uuid": "2f8438d8-f5b1-4635-8bbd-010f50c5cc53", "comment": "Malware payload",