{ "Event": { "published": true, "date": "2026-02-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-13", "timestamp": 1771027382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5bda23a5-5ba5-4aee-93d0-7afacb48115e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d7392a-0910-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771009986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009986, "uuid": "cd01c68a-c99d-45bc-8537-5af1b6c7e669", "comment": "Malware payload", "value": "783a2609f5c1f889f52ca0aa9330cef0", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009986, "uuid": "cd39d7b5-5069-4503-8633-6b54b2d6590a", "comment": "Malware payload", "value": "00259b1b5c35acb938b834e7e20b030f875b4ad73480e6b18aa2b0bf92914948", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009986, "uuid": "e0916a0e-5585-44ff-a756-f406897763b6", "comment": "Malware payload", "value": "a86e22cc4f00fe8cd6d45b1e5567463e2db65ba6", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009986, "uuid": "8fbb8365-a3f3-4e16-8d12-9fe02d5333c6", "comment": "Malware payload", "value": "d0cea72b76a7c86d201fa7d85a2acb51b8807c7c62fb2d242daa537d4db06258aa266601959caf7b71eca37f2eeb88c6", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009986, "uuid": "593024ca-a12f-4c74-9948-3230a8419934", "value": "T104F733F4A1A5041C0C1B6E4A8200456EE72EF5A3A36644FED918B53BD6EF5F52FEC01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009986, "uuid": "e2828361-6460-412b-8dd4-9fe47744e07f", "value": "1572864:H645bHeMRN3AlPgllhAF3l311GkN2vlHM+AMNIXtDbsA/ukAEnw78biNj:H6q+JlPc8X1GvlIxlveEnww+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771009986, "uuid": "2aadc95f-ba56-41d2-9c81-7230097f446e", "value": 71876844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771009986, "uuid": "bd4aff99-4321-484b-9fa1-34370573551d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009986, "uuid": "46e7a412-95da-4c1b-97e7-e5ef496a04ac", "value": "NURSULTAN INSTALER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9941a708-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014527, "uuid": "a7fce70c-ed2f-410d-a167-d1c5064f99f3", "comment": "Malware payload (Mirai)", "value": "6cb8ecadbdc6e7d95ffba2e779f237b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014527, "uuid": "1ef0c88c-045c-4308-8a75-b7c5394acd4a", "comment": "Malware payload (Mirai)", "value": "00767955ed3f2a6dc3b63e3f37728499f33da32d719f68894a56a1495e7aaf6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014527, "uuid": "9df96cb0-a3f0-4d5b-ba19-9527e500ea38", "comment": "Malware payload (Mirai)", "value": "fcb9621c1a548e522adce0e6803f90cc788ba142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014527, "uuid": "04747aa9-cbf0-462e-8aff-f033e0bcb598", "comment": "Malware payload (Mirai)", "value": "46f088dcd9b10cb853bcdf9ca7af34cd8d2fb15f4332a223e77e9f9970157b91913a3bd40a7e5e9c59c74e87f39bceaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014527, "uuid": "270362dc-3c96-489e-b689-314ee694ef88", "value": "T1FCC39E87B78B14A0C4620AF017C71B9D6B53B211CE6FE8E3AC1D763F5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014527, "uuid": "c05ae931-4d97-4512-be1e-c04e140b0428", "value": "1536:U68QyAmkjsL3uK5Rv6+22rf52T+byXpGe6l0/GSoYnxP/4gEvE1/LWk:/YA7jk3ue6+22L5cYKwe6BSoYigdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014527, "uuid": "fa7a7c15-bd3c-450c-89f6-0d499a1a880e", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014527, "uuid": "9165cbc0-7584-4c26-b62a-61ef02e047f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014527, "uuid": "3c44c43b-6ea9-4d37-93c1-acf712dba5f3", "value": "Calix.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9389c9ab-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014517, "uuid": "abe68510-643e-46c7-a2b3-21183cd4054e", "comment": "Malware payload (Mirai)", "value": "2d5b7fa1125dcae460da30c721e34afe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014517, "uuid": "0a1e7ddd-d352-4335-98f9-d1612da80e12", "comment": "Malware payload (Mirai)", "value": "01f8d417c089234ae61ca9429f1a6a462e92fc471e583fe842b5b04f92b0d099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014517, "uuid": "d725ece9-c9d4-4797-9a46-c753981f3d1f", "comment": "Malware payload (Mirai)", "value": "11fb069857aa3b522838485a0691806db08ebfc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014517, "uuid": "b06f7dff-7b96-49d1-8c5e-2ba872c7ef73", "comment": "Malware payload (Mirai)", "value": "b727c905c578352caca9739e1f1deb5893a916c9952d04c62a0306733b03dfcbe14cc8d7c31ffcd1b3992a7d2600b4a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014517, "uuid": "3d3af5c9-f375-4bed-8462-b3ced1bdfb78", "value": "T1D413F1EEB3E57FE4D4618E76DE3D46027F5C02A8A02B735244A90729B7D2C9245F6C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014517, "uuid": "6e84db31-97fe-4425-9df9-9864eb3a74a5", "value": "768:3YJ8dDDUXaSIMVZi5WEpAlZiKKYqg9ejwNu6SIs5NSlkj66LxgkF4z9q3UELfr:3kkyIMHi5WWAlFKYp9N8IoN4kGaVRLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014517, "uuid": "83927451-7a1b-467b-bba4-54207ea6c7b7", "value": 43704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014517, "uuid": "2f142546-3d0e-4362-9829-f744be8c9962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014517, "uuid": "9d1dc1c1-5145-4aaf-b7be-c710bea9ecf7", "value": "Calix.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7151c371-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011453, "uuid": "cb8b85ad-f7e6-4ce5-b24f-5e214ed88c2a", "comment": "Malware payload (Gafgyt)", "value": "168036e68ea46fd5dd2be5f70e248d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011453, "uuid": "9b244277-d121-461b-b79d-5c56186c32c3", "comment": "Malware payload (Gafgyt)", "value": "024211f201408eb4047d40baab9c3ff4cb0a9958c52a40f4076126005726908a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011453, "uuid": "da44f9d3-36ee-436d-b0c1-f14ab78a48f4", "comment": "Malware payload (Gafgyt)", "value": "85120c70b7e50eef31d39b6766bcc3eebdcd7d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011453, "uuid": "63c92f39-81b1-414a-8830-19292c9a6bf2", "comment": "Malware payload (Gafgyt)", "value": "07e84911fc268a537059f4fa02cfbc516a86c6cf8333a9ca154cf812781c5fd3fce17836cd8678f0609aadbd7f5af2c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011453, "uuid": "2d2cf66b-6de8-4a5a-abbd-06d33246866b", "value": "T1D664943E3922AB7FF168867107F79E718B9921D323E1D386E26CD7181E7124D184EB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011453, "uuid": "f12a2104-232d-47cb-98ef-46b58fe1f6b6", "value": "6144:v6ceWpw0YRFWQ5h+YvDg/vQc64mylXYgt6iPFhn+f:SVKQ5h+Y8/vQc64mylXYgt6iPFhn+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011453, "uuid": "b5d6b54f-6f57-4f09-8dfa-8d96424a70f9", "value": 320878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011453, "uuid": "6a2f70e8-c506-449c-835a-1b67d540f406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011453, "uuid": "b6060db1-301e-4479-a9ba-de66fca14c19", "value": "cock", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5808f5-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974030, "uuid": "e4d44426-9b1c-4e6c-b112-c4b33e808560", "comment": "Malware payload (Mirai)", "value": "3c773d1ecf7eaefffdef115d88cb6a47", "object_relation": "md5", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974030, "uuid": "0e4c63cf-6207-4467-855f-4a5aeeb7c84d", "comment": "Malware payload (Mirai)", "value": "02bb70f6e6de56dde0b0267d5e4062b0e0b8180d9850648aa5b54e4f7be09cd3", "object_relation": "sha256", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974030, "uuid": "701ad4be-3ae0-4da3-ae2a-3a357546771e", "comment": "Malware payload (Mirai)", "value": "47f1c20653f1f40465ca01883276c4a252b41249", "object_relation": "sha1", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974030, "uuid": "4e9224d5-1820-431e-b1c9-2841c7cef55b", "comment": "Malware payload (Mirai)", "value": "2f231908ef6bda02a6a8b0fed028abfd4c8433d13ab71f6c7ec412ee351cc0bb49bb114bde39509010e11b60b85b6803", "object_relation": "sha3-384", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974030, "uuid": "6aab6449-45e6-4629-ac38-adefa7cdaf02", "value": "T1B043194AFDA18D57C5C86776AB5E119D3322A3E8C2CA3302CD14473956CE99D0E7AEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974030, "uuid": "bd9f36d1-6e3c-4666-841f-d1017f165555", "value": "1536:2/fpA0kkbwXYAmsjT3Q/w4dWV9LWx/JwjD51ROSuq:kfpA0k5XzT3Q44QhR51ROSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974030, "uuid": "8b269747-9966-4dbc-b59d-3c0e66aa2255", "value": 58828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974030, "uuid": "404a2a95-2283-408a-82eb-40b84d8f541b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974030, "uuid": "29c66b9e-fb37-4c21-afa9-452b7945f56f", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ede1ba1-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985679, "uuid": "8b0544ff-05b7-4afc-b9f2-014059b02250", "comment": "Malware payload", "value": "3099b18451cabae9363ba0c02fc1d909", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985679, "uuid": "3494c321-70d2-4ece-83b8-481d28ccdb8a", "comment": "Malware payload", "value": "03ea093bf6bb44e9b98545a7730e7d6c007335fe0a240d17e17a1e958644c2be", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985679, "uuid": "1da6df2c-c8f0-4a6e-8d45-a8cddc7f4535", "comment": "Malware payload", "value": "9b6a051e3aa338f77ab4fee6826d8bd1152bb35c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985679, "uuid": "b62aeba7-4f23-4141-bf8a-46063f4c8a18", "comment": "Malware payload", "value": "a7b3feded23b7a9b66e84e105b1edbd1ed00039e68107d4cc68d38d545a9acbcef817a11aa208a5245c742ed4bc3c176", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985679, "uuid": "72517e61-54fe-489a-a615-64055759cc20", "value": "T12056121276C6C636C57E02B01939C79A41AEBE244B7184DB53EC4E2E1FB31C35636F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985679, "uuid": "09e0e6b6-617b-41b0-83a7-ca6329c37be2", "value": "98304:NYt2AMBqwWyqU67Q6+3XCVpeyAdIqPLqd7cNbr/kQ8:bFWK6UCV4yUPG2br/N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985679, "uuid": "29447509-2d6e-4e71-a792-c1d4f6e772d0", "value": 6149632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985679, "uuid": "abf6223e-621e-43e4-8532-c42b90aabc37", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985679, "uuid": "de437a4f-5c3b-4b32-a3ea-f79d4940f87f", "value": "66ce9a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8913d94-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015545, "uuid": "d01b311f-da4e-40c0-b625-7e03b6667f4c", "comment": "Malware payload (Mirai)", "value": "717e65195d6536f05d93f10612921adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015545, "uuid": "d6564dcc-7722-4269-8826-c5df42e6b33d", "comment": "Malware payload (Mirai)", "value": "0444a04b5e4123809d2fcbdd1fe0d6425c2a9e6ab050ec31548186dbc62c129e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015545, "uuid": "2da75d1b-4985-4e05-afa5-e910c4ad98d5", "comment": "Malware payload (Mirai)", "value": "5e68f979100b0174657e2f0d19a38628b59fe6b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015545, "uuid": "7b8fbcec-e9fc-4178-8590-a7d0421c037a", "comment": "Malware payload (Mirai)", "value": "f5d98074b14360785458dafefdce9c1309c55564507e430d0790466c368a5ec0e985981c3b72e6594e44e6a0a23fa310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015545, "uuid": "f9ebb14f-0f94-424b-9600-209967fce638", "value": "T1EF630A55B8818E26C5D5027EF92D118E371227E9E3DFB2239E205F203BC662B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015545, "uuid": "9e0c77ff-f5ff-4f51-940f-033877b5e288", "value": "1536:Ctnd2AJB+M4D79hoxy1yE//LIPtUykycdI7iuKG30Fcc:FoB34lhs8zyKG30Fcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015545, "uuid": "e0f80759-5425-49c9-bb60-5c9a13cea93c", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015545, "uuid": "ea2bc9a3-78d8-4eda-989c-7a0a2564b9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015545, "uuid": "600d276b-a761-4291-acf1-af02740cf0a6", "value": "SecuriteInfo.com.Linux.Mirai.9816.920.29084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab409835-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999524, "uuid": "7d744d29-f252-4cf1-9664-b85f890fbe85", "comment": "Malware payload", "value": "2d6007b4b08f761fda87343939c504d6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999524, "uuid": "a985014f-5404-43dc-87ab-3e8938f587cc", "comment": "Malware payload", "value": "045d0760080d8c655dda2c4332f8d23e3d5084e8d48a118cb9cd0c1ae1fade8a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999524, "uuid": "61f9fa6c-0e81-4734-a961-2a961851bd98", "comment": "Malware payload", "value": "821da7fae646ee102612046527fba41280e9ab5e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999524, "uuid": "1126620b-ac83-419c-a994-0a2d73aee996", "comment": "Malware payload", "value": "f270673e74ac001c2b0e287088efd640ba7e4396d2d4041658f3ea6c8a8e6fd9580dd40acd5fda7eadea04a08966e9f4", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999524, "uuid": "5cd86999-c5f1-4045-b609-77d99d4bd68a", "value": "T179462331AE84286BC5E48730B12F3A117E7D76038B8DA5D7A4BCE2833B56BC1563F855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999524, "uuid": "afe0cfb2-a889-4fdd-a978-8e4cc2acbd5a", "value": "49152:/LAVncQ9jORDTDS6OpdwjHRIgpp9MI59KY1PgkVeCJlyl7M:eRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999524, "uuid": "c82a2d28-a381-4dae-ac7c-66ae9e3fa2e1", "value": 5634048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999524, "uuid": "56ff1ca2-7b56-4856-abaf-4ce2fc2b1d1f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999524, "uuid": "642346d5-3e72-49f4-a447-270dabfa7e1a", "value": "Cnslt2M63QX_2090NRVLKQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815e372f-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001602, "uuid": "d797e9bd-37d9-41c1-9002-54b8f9e63dbf", "comment": "Malware payload", "value": "04feaad0b1d46c95bd19796e4f17b31a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001602, "uuid": "ae502eb6-b221-4a07-8c7c-af3e842b4faa", "comment": "Malware payload", "value": "046dffe23ed4259e949ba9116a3426dceb23aad9bd6bd22d44060e8b280bc551", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001602, "uuid": "55abd6c2-3912-4794-9a1d-0dacc087575b", "comment": "Malware payload", "value": "e54058ec73e9387fc23a54323670120f3521fc93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001602, "uuid": "ff855853-a6a7-401a-9590-8a8c81b22d90", "comment": "Malware payload", "value": "877586c1b41115db7224978de7ffbd74e5508ac7d81dc43ca11c8d7ff2eb5ac75427b1c517a7de007d87fbdcf5a032e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001602, "uuid": "e871f1ba-4480-4576-9e22-6b40c7d59496", "value": "T147262902A8A042B1C169E134ACF913907B31749943B737C7396F54B62FE9BD8692F36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001602, "uuid": "9f864f05-35fa-4601-ae7e-13bd6e24b7b6", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001602, "uuid": "03e4b8fe-7ca4-4c14-8524-0ccefca39dc1", "value": "98304:rjL7TVJf+7y7P6tR9E6XVdHZ7vDFiek8h0SI1uw:XL7TVJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001602, "uuid": "3f91fe13-ebca-4deb-9e31-e6b73a9a35c8", "value": 4627398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001602, "uuid": "ba94a6ee-e516-472f-8922-8389773f89bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001602, "uuid": "b0308a65-ada8-45a4-8494-54dfcd226fc9", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f74f34e-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971936, "uuid": "68c290c8-2e22-4bfb-adb7-27b50e179680", "comment": "Malware payload", "value": "e2fbcd5945d6e22ec92d66785f7eccf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971936, "uuid": "3ff6c8c3-420b-43dd-9245-c2b5f43fb000", "comment": "Malware payload", "value": "0485cca308250bb28357fa29577530f950ab386cf2781848328a1256f2127ebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971936, "uuid": "8875d51b-355d-4999-9689-38e0b0b184a1", "comment": "Malware payload", "value": "798aba1dfffe155512d3113ad5b3cf4bae54df17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971936, "uuid": "bbd90918-ac16-4191-8428-815b5e8d9e2d", "comment": "Malware payload", "value": "23a082ea6c9629354bfe288f877d61b35535078d29d849ef299b6872a5b786a87b0a7ff3ae194c5bba9ca2ad84eb6737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971936, "uuid": "9bef323e-cc23-41f1-825b-bdd3f8ba399b", "value": "T1EF14C709AB510FFBD86FDE3702EA070539CC655722A43B3A3674D528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971936, "uuid": "5ff794ff-a3bf-439e-a228-dd598f7c186c", "value": "3072:n4JEtYZW0/NtKoEgO8Ge50spzd8osbV+hD:n4CtYZlMoEgO8Ge50I+p+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971936, "uuid": "0b1b0035-20db-4a66-9c07-853507378ca7", "value": 200448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971936, "uuid": "ee03a2fb-4ad0-4468-9b67-f8f5c2f1cb3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971936, "uuid": "d7308f1e-a45d-4376-be9e-239b357392e7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dfab15-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025815, "uuid": "a05d0f1f-5310-4973-880f-0d5f336b0697", "comment": "Malware payload", "value": "cbd074ff6b986e7df05359cbcb500925", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025815, "uuid": "382467f7-c3f1-4f5a-ae26-eb7db20946eb", "comment": "Malware payload", "value": "04985511313ae0de50c5abc70209faa63bb86ea03fc9cb0b31e6fc03eca2f386", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025815, "uuid": "ded54257-5135-44b2-8aa5-d3a01c560a48", "comment": "Malware payload", "value": "2f1860fc6cbda26cd2c85d21bad2762c0bc9f918", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025815, "uuid": "0fdc8ebd-9e74-4d77-893c-c648da8b9bee", "comment": "Malware payload", "value": "3d1d98e9d6e52191804b100fd6406151d4db2ab7d7b7bc478375e0ab9b75882ae05d11a4e360a9fd0fa674ebd72f98af", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025815, "uuid": "4c09b157-de36-4164-9e13-2a8bc1a93a3c", "value": "T188262336BB205D9AC94043B6783F39396F3D221349CD90E06D9DE6532BD7AD2863F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025815, "uuid": "262e14ff-0f58-4651-a3cb-b72b0bcc2965", "value": "49152:CcjW8HoRBk1av9HIVNPzW5UesVHUk12i+47TwBXJNTWTZjgwew61Ngv6OkZPmrHV:mCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025815, "uuid": "ad2f4199-d875-421c-9d8c-2ef64603bac3", "value": 4573184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025815, "uuid": "9a33af4d-fcb3-4002-9d6c-ee68f506c41b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025815, "uuid": "9ee43d86-2b11-4eff-a1f7-5bd3c94e330f", "value": "Nta-CrK6TZ_596537CRCZFV6BC7.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9187dc-0918-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013485, "uuid": "d415036b-ca28-4630-b70c-69aca812913a", "comment": "Malware payload", "value": "3642e43fd382d8aaadb0831972b44c93", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013485, "uuid": "0bb75e31-0da1-49d3-a4a1-ec1b999b759e", "comment": "Malware payload", "value": "055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013485, "uuid": "b183aba7-4522-47bd-9b20-75c0c887ac14", "comment": "Malware payload", "value": "45be9d3edc35c2130023e389da3bd1ab587ce731", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013485, "uuid": "ffe3b2dc-464e-48bc-8eb7-77286a0fcf81", "comment": "Malware payload", "value": "28572ebd27bb508c6b2a8099d4c9e9f31dfbbf5a4a5bf4ecdcb8b4bc9f48d2a43aa90b074bb3a428879992ef604a6919", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013485, "uuid": "bec7f638-5e94-41a1-8e08-ab841e6108c6", "value": "T1064160E615914A342CDD985FB3BA940430D4E0965BC95F8F1ADC3CE80D8EDC5B8C9BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013485, "uuid": "c0bbd2d8-4197-42f1-a419-69a5bba46de3", "value": "48:vbUyanbUpbUNbUJbUhbUgKbUVbUtbUTlbUAR9R4RFBrbUtbUZbUC:vQyanQpQNQJQhQgKQVQtQJQA/C/BrQty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013485, "uuid": "ddbed198-3f51-49fa-88be-a5848938dd6f", "value": 2007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013485, "uuid": "219c9fb7-a083-461c-99aa-7f59ac24bdfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013485, "uuid": "64f733a8-1d93-4097-81f4-9428f4d758e8", "value": "dick.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449807e4-08e9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770993339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993339, "uuid": "d80b42cb-ebf4-405a-bd5a-de1a14533944", "comment": "Malware payload", "value": "d35d335b61f79f0ef463c52fc3880da4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993339, "uuid": "cb2c5388-a0fe-4fd1-b1df-aa9e036cfb70", "comment": "Malware payload", "value": "0590bcf46064f75a3383dbb84c3f1365b5684f414e0dd0de4504034aaeedf088", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993339, "uuid": "c487c892-aa8b-45bf-95ba-6234e9aca1d2", "comment": "Malware payload", "value": "8e34165a109279d4f414ad08e79e9d7fc6f34da1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993339, "uuid": "751c2143-08b9-4a07-9c1a-75ef21c2a22f", "comment": "Malware payload", "value": "8b50520cb398c21bbe5655fc31997df8ac19f6814348fad09513de72baa0af83bfda856aa6c204e081be61c120519e86", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993339, "uuid": "92a509de-a735-4b43-ab25-9a4dae29311d", "value": "T140F301264DC41FB9CFB8191940FF149673E99B8A5066388DA723BE0EAFDF64405C78C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993339, "uuid": "76b67f68-280d-483b-b169-863a9b266c8b", "value": "3072:DLcncu23+IZljmOzlBk4Q/vdlL/L3srMSoKXJ8YXKu:Ec33/ljmJt/vdlLj3GqWKYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770993339, "uuid": "58251ab9-4381-43e1-a888-58ad4ce9ca8d", "value": 167877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770993339, "uuid": "30cce717-3a9d-4dd8-aca3-34faa306da96", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993339, "uuid": "2eb95974-014e-427b-abbd-0ce9d6c39ed1", "value": "TOWELL ENGINEEERING GROUP-SAS-C3100000365 -2026 -SME-005.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8fce00-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010314, "uuid": "6f5c24e8-eaef-4f12-bb7c-309866444490", "comment": "Malware payload (Mirai)", "value": "f1d09731153ad06e9e75ede8fb04e830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010314, "uuid": "c2dbcb4d-a09a-426c-a8f2-23468eb19eb3", "comment": "Malware payload (Mirai)", "value": "063f6bbaf9345b12b9ac38c782dc2a46874dcbfbd124a9ae74d1a98068289df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010314, "uuid": "eaefb693-eb5c-4960-a910-9ea9dc22407b", "comment": "Malware payload (Mirai)", "value": "c7c677dd17d165a5e51c69b1d3cfbd87fcd27573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010314, "uuid": "d3ccf3b7-486b-4010-bada-2dfe086b1879", "comment": "Malware payload (Mirai)", "value": "96875f7aa545b93474f4d1266c0f7c4e90994e0f7451d2632407c1600c045dc74d1f750f19616a48f03ac3d51f0c2181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010314, "uuid": "e174958c-598c-461b-99aa-2ccdab68abab", "value": "T13CF34C05EA408A53C4D717BBFAAF0149333297D5A3DB730689285FB43F86A5F0D67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010314, "uuid": "058e2701-6def-48df-92bf-f3ce81f3cd65", "value": "3072:srNqRVlZpvHnWq4gLOXo0szuCGTJQb/55v4nrj8T5M/99QVeE3C:srNqRVlZpv2q4y3ZuCGTJQb5ynrjgM/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010314, "uuid": "4fcaad6b-94d9-40ff-a100-fac0951a8775", "value": 169349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010314, "uuid": "88f5511c-6a98-4cbb-8d72-2930cc543ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010314, "uuid": "bb4d4c9c-2f76-4b83-8c15-34db5bb7a8d1", "value": "SecuriteInfo.com.Linux.Mirai.9816.8721.21102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a643c05c-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770995221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995221, "uuid": "bcbf2f9f-0e52-44e6-9599-84ac50f0e562", "comment": "Malware payload", "value": "156414d915e062a574bc45a2045969dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995221, "uuid": "ddfc8094-82d0-4a4b-a363-09f597ab5c7d", "comment": "Malware payload", "value": "0688790625edef4500d4a4a9401b9d760578e7ff588a720196db322c702aa0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995221, "uuid": "e76a2b3e-48ed-4b7c-8ac9-692297d2e69a", "comment": "Malware payload", "value": "97f31bc10caa6c1cdc2f0ca9031b9228af7c46e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995221, "uuid": "bead9aa1-3410-4a2a-b00a-2da7f49cf761", "comment": "Malware payload", "value": "8cc8d5b636c0a65853a8c04cc20086d72ab3d431d486706c7c559038fc7f3c82a71b9813158d1416756ebd1fd931bf19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995221, "uuid": "105b48bc-5b3b-4bd4-9b5f-139a56796231", "value": "T1BF36F652A862C566C17EE1387CF112183A72386943727FC31A5B36763DF97E8263E319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995221, "uuid": "6ac9daa8-8520-433a-b78d-530171a25627", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995221, "uuid": "766c4707-e1bf-426d-a9b5-9a56f191b884", "value": "49152:78rMoK1OONtGffWgD8l+VUxDVG2kExVa2d3TI5o1WcbtSfTN80LWPx2+ZZMomAYe:QKBngJTMIvA0c3oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995221, "uuid": "af6046bc-ff08-41e2-a08c-8ea03633b7a7", "value": 5345916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995221, "uuid": "57d443f3-7015-4a3a-bb5d-d8e3890683fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995221, "uuid": "81eb0e7e-aa8a-4efd-ba50-559aa47962ed", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36240d5-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770995216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995216, "uuid": "2a4ac04d-7152-4d13-a081-ca86d025ec0e", "comment": "Malware payload", "value": "948ceb088a376bf4bed54f9bc0a78228", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995216, "uuid": "65809229-79c0-4c6d-a9dd-d409e348abc1", "comment": "Malware payload", "value": "079a957840f3033c0db1b010e18516f66fbbc788f87d1a441623e492d55bdd66", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995216, "uuid": "5ba3ff0e-2b60-424a-a7e1-bd4b1c89bb8e", "comment": "Malware payload", "value": "fdce0f1038b5bb24cc254ec3f0392b4490c762e5", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995216, "uuid": "32b948a3-7f59-4841-abe0-d146503bb208", "comment": "Malware payload", "value": "1a366c41d7213b80bf36dec8626f5c46497ef85b2ce1ef904b639692c2f0ebbb8a23d3568d896ebcb0061972f8aaf958", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995216, "uuid": "6f4cbab6-5040-4da5-924f-a70e3c1d03ad", "value": "T174463348D897499AE70AFDBBAD711003F5C0D6D469F0ECDA42B2F29028BD3D22D4A579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995216, "uuid": "0eaa2332-b5d2-44e0-af69-7bc7578c72c4", "value": "98304:0zxbSkW1KGdTNXFGJQEI1uO80XScGIufzAIKVq9IpUZ9c0y6Hg7yLx7BkGv0X5TO:gkkW1LdOJ28YIdzAIKVqipufXg7G7BkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995216, "uuid": "bf2704fc-ed77-4d30-8d3e-2bb38b70d671", "value": 5873912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995216, "uuid": "7b30f249-724b-4853-a990-3112272ec296", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995216, "uuid": "085d7f20-04fd-4f09-a9bd-22378a5cee7b", "value": "\u0412\u043e\u043etsta\u0440\u0440\u0435\u0433\u0443\u043es.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a14270d-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949164, "uuid": "99fc44de-93e3-40bb-ae35-f2ad1140d3d3", "comment": "Malware payload (Mirai)", "value": "95cc675e1f5234dfe2f647af76062674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949164, "uuid": "df5eefce-6f9d-456d-9cc4-7f01738127ff", "comment": "Malware payload (Mirai)", "value": "07ba10c49743ef9d2a9abd263c6d0db8a12dee14c7f41b9ea0611c14eb367fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949164, "uuid": "f98c23c7-dc12-42a1-af2e-347ac59c707c", "comment": "Malware payload (Mirai)", "value": "8dee8d4264beb06d41380ef23cec8de3ddeb2f3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949164, "uuid": "5661941c-12e3-4d2f-9baf-d819983f6841", "comment": "Malware payload (Mirai)", "value": "a65cdccc5f651efff6d2178655b9630053180322498fa78d36552d2652d817de5c02aea270082739a84532d480e2cd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949164, "uuid": "c8d05cf5-88ca-4311-94a7-5154a95bfe23", "value": "T1D9730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949164, "uuid": "6d257763-78c8-4eb6-949b-1d85f6fbbeed", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAnI:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949164, "uuid": "9cfb2ed7-3341-46c4-877e-02c893bbd0a0", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949164, "uuid": "a3ad414f-6162-44f4-9a5a-243fb7f8d1ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949164, "uuid": "3b05d3d6-7999-4711-bad1-acfeb21b60b8", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550116a2-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949129, "uuid": "310f764e-cb40-46ec-ae2f-8c6d373f6709", "comment": "Malware payload (Mirai)", "value": "e1c77947c43abca6ecfb7fbc1bde16e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949129, "uuid": "d835e9dc-a8c7-443b-aa4e-0f16853622db", "comment": "Malware payload (Mirai)", "value": "08372182c45ee717be17a1d4cf696ebc7e909e5f6ea23ca519480591e1d2b440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949129, "uuid": "26b979f5-6515-4123-990c-859f20dd50b1", "comment": "Malware payload (Mirai)", "value": "49d7ac9b83c23e5c5dbf8293293d3ab06b223397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949129, "uuid": "9ba1bd46-fd77-47ab-ac96-c5d1c317cab3", "comment": "Malware payload (Mirai)", "value": "7414d1961849bcc381d7b37cc66721799a3265338a37e1f79307e10fd6b34b084ac0dcf07d9190dd8f2311309459b06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949129, "uuid": "b6dbd841-f41b-4579-ad1b-508ca14c4a55", "value": "T170538D75D11DAEA8C0414AB4A9598E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949129, "uuid": "2b8bf0d1-147d-44e5-853d-44c0f90faf60", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949129, "uuid": "5779dd5b-4c5c-4a77-83a6-9f62a105efa6", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949129, "uuid": "f1451a13-acef-4d53-b4c1-df3222b0cceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949129, "uuid": "c0df4c23-1e2b-4539-9ec3-766e1f76d65c", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455ccf74-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1770975302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975302, "uuid": "e6ca0f1e-ee07-4163-9e15-a5dd4dcad01f", "comment": "Malware payload (Cobalt Strike)", "value": "008c738fbdde3cd16ce287613164049e", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975302, "uuid": "f17959fb-2e7e-49d8-ab40-2c1ba2455f08", "comment": "Malware payload (Cobalt Strike)", "value": "085ce06c03268912d651fe4448871a40736abcae49889a207c6a42879b664b8d", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975302, "uuid": "7ed67931-486b-4cf0-8911-d9a4293f9949", "comment": "Malware payload (Cobalt Strike)", "value": "4fa345b2a2fd96700e7a2399a0d085e33185afd2", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975302, "uuid": "d817229e-88ca-4ac6-969d-b21ba798047f", "comment": "Malware payload (Cobalt Strike)", "value": "77ac1c8b7b76ee65e6183ca0cb147299d25304907b6c375af194429145aa6c45251633e6c1903a3e7f4c8947df33109d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975302, "uuid": "50938212-6b89-44d0-8847-20505bdf4701", "value": "T199520D74E63CAC806A1D7BCC4A223D81B474AE73DE758D68C922F8957454E48EF373A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975302, "uuid": "53a8888d-8c3e-4b87-bf15-218739fd3a8b", "value": "192:MlqrUPLWXXzAmHXvXhjyhhgSMueiGHys9ZSmiTewVIwR4Z:M4YyXXzAGXhjyhqA54yoZZiTeWIwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975302, "uuid": "00767c39-095b-46bd-87d6-346c18bbeff7", "value": 13515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975302, "uuid": "05ebf90c-87b6-4fe9-afe6-22ce56c88699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975302, "uuid": "1c21be7f-b24f-4366-bf78-e2cf6f0ce9cd", "value": "RoyalFlush3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a579be-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014576, "uuid": "c29f7b6c-bbc7-434e-8fef-0670615814c4", "comment": "Malware payload (Mirai)", "value": "c4b56cc9e7af22ad39a2e496fe41990e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014576, "uuid": "1e91a3ac-7b04-4f12-9fdb-9a31e09b1b01", "comment": "Malware payload (Mirai)", "value": "0959e2626452a6f865aaaf534035aa04bfbc9cc687051f6a71ba56b9e9c68214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014576, "uuid": "fd01dc23-41d2-4669-9788-7fe25bb82261", "comment": "Malware payload (Mirai)", "value": "7f46be6d005112efe2390bf1644effe0a82d60b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014576, "uuid": "cebcfc03-b172-45c2-829f-d79fddc40c20", "comment": "Malware payload (Mirai)", "value": "bde8ed18bf81b95e54ef957008ae9364c00e1494b3b900ec2fb5cc5e15b5a4a236554f20143ae2e9f3414fdea634b8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014576, "uuid": "5f1d097b-ccdc-4b30-9087-c11ef18969c0", "value": "T19B33F791FC82869AC5C057B2A72E568A73A263E5D2DF3353CC584F1037C661F8E67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014576, "uuid": "754feb02-095c-45a0-bc22-3830a82448c6", "value": "768:POMoXBSl8/kCFL5qY//S0j5Q7lJ94vvFqstPSpp0iRe9OoKQMxrRN2E0n3z:zi/fFLMC9tQ7lJ94vvxPSpp0P9PTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014576, "uuid": "a9a258af-6de7-4a98-a955-e43eb08dda12", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014576, "uuid": "2a273249-3e1b-4439-a46e-54db1d8607ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014576, "uuid": "9e3d54aa-370a-4f76-9d6c-1b9bae76481c", "value": "Calix.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e140ed-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770972543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972543, "uuid": "0a5bf737-f2e8-4273-8ab8-70cbf6cf3cb8", "comment": "Malware payload", "value": "71b11a0e51956cfae732ff2cf3cfeab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972543, "uuid": "9676ba9c-0c00-4e78-9301-068f4324259f", "comment": "Malware payload", "value": "0965d07e60fbd4832a86ea203bf972142b92c1bb61084272a8b8d870c3666d1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972543, "uuid": "02d82db8-7fa0-4488-9710-7d91e3748944", "comment": "Malware payload", "value": "d2994ace45f200c14a35be58360fda7910b95592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972543, "uuid": "02e35d05-8dcb-455f-bd13-547ffddcb5b1", "comment": "Malware payload", "value": "f13aa6cbfa2884f1cd1962d2abf26839acb672a473fb8db567e2ea37c8f4cc040b7f581423367270ee89fb5f45864e13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972543, "uuid": "3bdfb5c8-4342-40ac-9572-a528ca553c41", "value": "T10EF30946B8819B55D5D216BEFF0E128E33231B7CE3EE73029D245B317B8A86B0E36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972543, "uuid": "16945079-bfd2-4d90-b13e-1b70ebf89792", "value": "3072:2Y4VsU3FUUyaAkEfM+amh7KZ6WxxQNW0sOsZCBD2/P:B4VKp0EffamZKZ1QEaCCBa/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972543, "uuid": "39d6f2ab-f557-4199-be51-91fe32a57e31", "value": 160476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972543, "uuid": "55ec71b2-4c43-462a-bc41-38b98db800f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972543, "uuid": "261a0b55-7ce5-4772-bb42-c13a4369153e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d900c9ed-08fb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001319, "uuid": "7bed05d0-07b7-4077-b6cf-c5010fae953b", "comment": "Malware payload", "value": "50bcd3e63b1e09fa676c2135ae3cbed5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001319, "uuid": "7b637f5e-d221-4196-9961-ba67521496bd", "comment": "Malware payload", "value": "0aab0d10bf0592fbe2c7bd7867fac31d44228a8321bddf00d9e67031f2db162d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001319, "uuid": "4d2fb2e1-6dd6-4453-952b-c5c8d188f12a", "comment": "Malware payload", "value": "a5626c040430f5cf01534d5307a949ebce5f60f3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001319, "uuid": "0d01dd34-ab22-41a1-a972-c66ece8c2c27", "comment": "Malware payload", "value": "eae2955d5eb6607bdc9393221b902efdca65f164074b69013318abc628a252c4668f208439c07f95505c3e5cd8eef2ea", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001319, "uuid": "e9b5b26b-bd94-4cc6-bb42-327fd5eddd21", "value": "T16A0733F864F88202ECCC297616158AAA00615BB3FF774435F81B5F791AE1077F34A5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001319, "uuid": "31911042-d2f4-4801-9671-11eb354c8106", "value": "393216:S7KBlzt7kuvtRuaJxKXLiZVMs4za8TZg/KoHnJHaPS2Dj+Zu:9zzt7k6aL+VwzHg662+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001319, "uuid": "cb20b3ff-1eb1-4840-9874-829e5d7b28a5", "value": 17463296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001319, "uuid": "229af350-8b70-4670-b460-49e2bdb9a7f6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001319, "uuid": "f42a5652-2ace-444c-993c-7a0c0cd6ee24", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e55e4-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973145, "uuid": "a9fab197-7e34-4b8b-aa47-f2fc524afad6", "comment": "Malware payload (Mirai)", "value": "387ee0fa9590095b8ab9d97779e35abe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973145, "uuid": "1a6e97f5-e685-4bfc-9d1c-d163654874af", "comment": "Malware payload (Mirai)", "value": "0b12182a0f247bc245535b7ca29e7f899effd65167ce39eb88b80c50a8cdc639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973145, "uuid": "3f3c305c-8673-4881-9f8a-9ad88da35701", "comment": "Malware payload (Mirai)", "value": "ad3a3d22a6abce0781ce4279c3a3e75bb615e92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973145, "uuid": "a627deb4-5731-4d6f-85ba-482283dacf25", "comment": "Malware payload (Mirai)", "value": "5427e6fac73806b6fbb6af353c942b66ab00fd04dc52cf8e06ebd0ec72166dad335deacc82f7929c76337b2a1f8c8440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973145, "uuid": "89d00bb6-ead6-447c-9bf1-a2da69b0098a", "value": "T118630116DE5643B7F2A944F10801EABFDAF64535E107988B2C0DFE0F088567B66D2B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973145, "uuid": "11411143-b63f-4f1f-bd3e-4cbccfb4a2ce", "value": "1536:z0c+sbA4CaXKRYnitoiOkSnDXfcqVlwaKO8Y7Qb5SrxERyLnNzSN3RzG:zosbJJK2n6rSnz0q/qY7jrWgoN3Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973145, "uuid": "8ae1eb0a-9481-44d2-a79e-2f10c66399a3", "value": 69040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973145, "uuid": "5de01255-30c0-4263-aa24-ff530cace277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973145, "uuid": "27afb764-8011-451b-aff9-184d3233a424", "value": "sys_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ee9c91-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007973, "uuid": "c68afe04-8f4f-47e7-a9fb-ccd4ceecce6b", "comment": "Malware payload (Mirai)", "value": "10e400dc5919ac5845de3410f9c20ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007973, "uuid": "be28d628-6708-4f59-b819-0123d3b0dde0", "comment": "Malware payload (Mirai)", "value": "0bb4e71c71e7bc5c2ad380e5e05dd296c815ecf462e27191abf5697bc35fba4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007973, "uuid": "fd2bf319-4a48-434a-9b65-ecb171234664", "comment": "Malware payload (Mirai)", "value": "7865e8a30a774fa677ca13838fdef115d90be93b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007973, "uuid": "50e7c21b-e393-4eee-87eb-8e4c5043dd19", "comment": "Malware payload (Mirai)", "value": "9a86cf2f430bd27a0541ef68dd30d84289a3cb54ce251b1e6185b22f15bd180e2f2b0be8f42fae5d295f6cf6281f030b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007973, "uuid": "93f28242-b0b2-4fad-b4f7-b8ccedebcc8a", "value": "T1C7431981F44F81F2C44B497050A6F63FDF31D9AE42B1D62EEF99AF32DA675429101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007973, "uuid": "494d4031-f9a1-4d2f-92ac-445a8f0639dd", "value": "768:SfYcj17BglTIJ/sITKUEPgK+4CaS7HA691CO1zBAx3/9S2BxmlhcTqmq16US0su:6DgIJ/sITaoECaCzuahYqmG6R5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007973, "uuid": "b1584a75-1780-4765-9c29-903d4cdd194b", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007973, "uuid": "c3151248-fd5a-4004-bef2-caa7726373e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007973, "uuid": "925e5ae2-ec09-40cf-b89a-7c176e546358", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8f8016-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770975288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975288, "uuid": "9a1b4c48-1054-4d61-ae4e-9be678944219", "comment": "Malware payload (GoToResolve)", "value": "aa790934734277afa852001c07882b06", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975288, "uuid": "cc9fa768-28cf-4b0e-9780-c1843fb056f7", "comment": "Malware payload (GoToResolve)", "value": "0c2f38574675c37a10c9c6a57f7fff72e473c04541694d17113bc09d823486ff", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975288, "uuid": "2b83f861-71d9-4133-aa16-ae3c51ccdd7a", "comment": "Malware payload (GoToResolve)", "value": "84cba8dc8d1f7759e1168699d532648122344db3", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975288, "uuid": "045e8c39-b061-49d5-b309-8b4b81442290", "comment": "Malware payload (GoToResolve)", "value": "e6385655f98331abfe91ac067c1dfe50988dec992ac9fbbf4f05a71680b165bd08a63300510b54095553bb0253bebbfc", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975288, "uuid": "707815ea-8f4c-42d1-9212-1a2da28de12f", "value": "T14B37333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975288, "uuid": "398e1e9f-ec49-4ac0-88df-a75948828ebd", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975288, "uuid": "ad46e1dd-79e4-4f27-9385-168d02e29ecf", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975288, "uuid": "20fc2e9a-182c-4da9-9365-4627d2652dd0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975288, "uuid": "b082a4df-51f8-4b79-a5f6-9a85badda3a4", "value": "RSVP_ANNIVERSARY_2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf27226f-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026643, "uuid": "62199eab-71f0-474c-90ad-0fa87b4013cd", "comment": "Malware payload (Mirai)", "value": "3467490cae40eb9ac89aea59f65c63b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026643, "uuid": "ed670873-a5ca-439f-b178-ecc34ab53340", "comment": "Malware payload (Mirai)", "value": "0c3ef2e2be3d68fae28e25f2ed7673cb30192f707f21fe9f4307769c06e3c6ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026643, "uuid": "5023a33c-d806-4edc-b029-541104f6763a", "comment": "Malware payload (Mirai)", "value": "266826f253d4e260658b3d8533ba397991147c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026643, "uuid": "cc9d187d-1ee2-4426-aa74-41c81c535de8", "comment": "Malware payload (Mirai)", "value": "2ad6d9b374891531a548e52929d5fc876b8889a0732674d1a4cff2c812d741ab6f6ca52b041ddb9fecac5e7733436e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026643, "uuid": "d2c6da20-31e6-45fa-a36b-417773d19c9e", "value": "T1A543025A44B272A783B031353E78BDB92D2A7BF0876FB5D611B6818019E76B106FC613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026643, "uuid": "8e9706a7-de6f-4898-9b08-7f12ee282c1d", "value": "1536:TB6aa+LilYrGgop9ZGusJaQpYQk6TLGtioUy4DFHT:TB6aa+ilYrrofFsIgBVLA14xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026643, "uuid": "d46c8a50-ebaf-4f79-ad4e-c3ac09fb9eda", "value": 60292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026643, "uuid": "04bc48f6-a7c2-402e-911c-2d2c0437d66f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026643, "uuid": "74152597-4aa0-4556-b18c-2e9ef820168f", "value": "amsarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2f9e50-0926-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771019635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019635, "uuid": "6a9346db-a262-4d04-90e2-47bfcbe23597", "comment": "Malware payload", "value": "4a6a8c436ea8f5d9878c641f40fd4d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019635, "uuid": "4c75cd05-fd37-4110-89d4-2883273ad212", "comment": "Malware payload", "value": "0cbf1bd21fc38de48e857bca7f3c1ffdc4f30b8592c94733edebcfc0df1eb11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019635, "uuid": "e2c49ef9-ba07-46db-a9d9-de670883a9a5", "comment": "Malware payload", "value": "d734d776d686d3ef3915a899acfbab05e7f72f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019635, "uuid": "041ea86d-97f7-4628-92cc-73d078557cd1", "comment": "Malware payload", "value": "d8f808a26a67f0177bf8f9775d322a9a22a4ad1523065c4d35b63c8d0dc90a5d2c24429a72f83fe7844e96cf1596a850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019635, "uuid": "107c787a-2f5a-43d4-be64-f1dc75ad8655", "value": "T1D3A37D12B4C18472F5B619314974C9715A7CFDF30E659EAF6398123A0FA41C0EA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019635, "uuid": "ea8ea9cb-58ad-4d88-af85-d297ed955ae6", "value": "5fd7af94a11c6cef784169e5722f7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019635, "uuid": "12d50c69-93ed-4ed9-bf16-7c8e2c516fb1", "value": "1536:cxR2u0fMfJtzA2YKYwpgwqjkQglxyFkNj042nP9fHxYJmTsW2cd7dk/AVaM:Jf2JtjkwihjkJxyFkZcnXsChWAVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019635, "uuid": "69ffdda4-a250-46a3-b4e0-9928f0076ba2", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019635, "uuid": "a57a176c-302c-4eb4-92e1-67a085a1db7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019635, "uuid": "9094f47a-f218-4548-96be-033b9b70ac77", "value": "260211emit1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2daa53-08dd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770988226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988226, "uuid": "1e2265f4-9d76-4a7e-a3b7-160ad647a63d", "comment": "Malware payload", "value": "7f23f114c075ab88b2cb96dfabbad0fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988226, "uuid": "54121a1a-e009-43b7-9452-a9c6015a0cf6", "comment": "Malware payload", "value": "0cc28b365684e98f32130ee0cdae1ba6b8f3b8dea974b810758668aebb07c945", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988226, "uuid": "fadd241a-4f3c-4620-8e7b-93b86b80e860", "comment": "Malware payload", "value": "55783dce43438e70d4ede5471c9f2b949f521b87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988226, "uuid": "81bbf450-6e62-47a8-9f85-d3d2c391cfc3", "comment": "Malware payload", "value": "c92f6beb1cf184330cc07ed54e8fca668f1c0f887f9f1e01c073036c6ddae4ec46c9c37c8f7333051ab23c60f83ac9ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988226, "uuid": "33a68dea-19a4-485b-b0bf-d084a7ea56e9", "value": "T1A7F27B1271DF860870B346894BBF06B40B6F7A6F1E7E4189448DE68A8FE35159C973B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988226, "uuid": "6aa0c2c9-8498-4118-8ff5-53d2e10e0762", "value": "384:o6lKidWaFPhEeF3oFflASTk6zOKEzEzEU/8E:o6lKidrFPhEsoFflA+EzEzEUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770988226, "uuid": "b5ec3682-d029-4a30-9faa-13aef624e38e", "value": 37246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770988226, "uuid": "f9e42b02-4b2b-4e47-90ef-624db2ef5390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988226, "uuid": "c4cdd3d7-3764-4a34-8c5c-8a041823f409", "value": "79197527.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c20f74f-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007982, "uuid": "49b18df6-de6e-49fb-86ca-3a81e39a6eaf", "comment": "Malware payload (Mirai)", "value": "d08cc6a1c3eed31e2187715b9ace375a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007982, "uuid": "4c74f23c-cd22-49a2-8d26-ada21d07ffea", "comment": "Malware payload (Mirai)", "value": "0dc723a6f8b25fe799ce071ddfa68da4dc3e6448947f3913996e9ced1c9aec7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007982, "uuid": "f971a995-1d71-454f-904e-1bb9929eb35f", "comment": "Malware payload (Mirai)", "value": "7aa17d2725f52310f8a4ecdbba57f5de7c9d7d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007982, "uuid": "51c8e1bb-a5bd-4155-b24b-b42d526afa4e", "comment": "Malware payload (Mirai)", "value": "344cbcca393f5814ceb059d2830f58ebd5ff0487da5a1719492038be1c92353aa91b698932f7e1331bddbe27d974aefb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007982, "uuid": "e8d98af6-d579-4707-8bef-9354e5ff9de8", "value": "T10D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007982, "uuid": "f21123dd-79e0-4471-ba6d-20ec7ebcce80", "value": "1536:zJPEBmW5iNWqcGTXLwnXHZ84OqdZerEStR:zJPEB8NWq9zkqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007982, "uuid": "dce44dd9-b505-4dce-8a7f-833343b5b9c4", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007982, "uuid": "2e2ce6fb-c663-407e-83f9-2dfad9363d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007982, "uuid": "99db6bdf-cfcc-4e71-9919-4cb251e71afc", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca56876-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985595, "uuid": "91fa62c5-c2e8-4250-91a9-3799cb6b3057", "comment": "Malware payload (Gh0stRAT)", "value": "97638d8c03cbac486e612da8c9d98a50", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985595, "uuid": "925646fd-ea2b-47aa-8808-41ad44128ba2", "comment": "Malware payload (Gh0stRAT)", "value": "0e395624851500f9f17f428d2fca254bdcaa2d284a1540e9fdca49bbdc1b68d6", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985595, "uuid": "19a95c7f-084a-4721-bd39-edefe271771b", "comment": "Malware payload (Gh0stRAT)", "value": "0e7141ece37074a93c83a0a6cb4ff55c55de672e", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985595, "uuid": "017277ef-716b-4b0a-a3f1-3dd865ef1d11", "comment": "Malware payload (Gh0stRAT)", "value": "0326d6bb154a21c2663d716ae3124903c4008604e394f9da15da3023b1b56d6e542f0553cb6e79c7ff95a7804298bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985595, "uuid": "e7a30dbf-a456-45e6-a549-d569a3d05331", "value": "T1F5F6231233C6C13ADA7F89316975DB2910BE7AA05F7888DB53D8592F4EB10C24672F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985595, "uuid": "07e2098b-26c4-4a0d-86a6-c18efd36fe55", "value": "393216:edfHWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/+:elHWrTOjnO9KrNMJ+Mu0oX2q4lji3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985595, "uuid": "47b2c4ae-bdc2-4410-9b93-87f2f07f6849", "value": 15408640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985595, "uuid": "9e18f4ce-a753-4a1e-abe7-5a57b5a2cb60", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985595, "uuid": "5edef1e3-26c0-47d2-8492-d1184df2f009", "value": "42637b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1cc054-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013295, "uuid": "0aedf63d-4f68-4bf7-b8e2-5075de2d41ec", "comment": "Malware payload", "value": "e467ab8432f9a6ded107524b85d7ba84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013295, "uuid": "6271e8fa-15a9-46c3-a5f4-3d876075c97e", "comment": "Malware payload", "value": "0eb3e37a0bfc43a81bdbdbb5d58a8f8773957c5113de652ccb9038af2a271fb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013295, "uuid": "403e7d26-8efb-40ce-a6fc-0c513ab6c23e", "comment": "Malware payload", "value": "ef3f0607262b17ff74e073834cd0b25852046f85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013295, "uuid": "b6c32bf4-5462-4cc5-94e9-d79ee27bf7ee", "comment": "Malware payload", "value": "9b7be7ff521edece1e7a2cdc985821115c46f5e908a7a1e8c0eceb51b93798a202e6a73845d995cece5e7f96c8a6b38c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013295, "uuid": "d60597b1-3a8c-4081-b14b-53bba11d76ca", "value": "T1E8B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013295, "uuid": "50d958aa-795e-49b8-a4f8-f626ade6f6c1", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCx0:1zPqF41OUBljSIxecUtCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013295, "uuid": "5623d06c-4305-47a7-a205-c5b1ca59b5ff", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013295, "uuid": "c9f770fa-c794-4fd4-a96c-797cd65c2f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013295, "uuid": "0a9f0204-32b4-465c-822f-a9e305634dc8", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30f1018-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026703, "uuid": "b60af1ea-db08-4f4d-ad1f-059362fe6a0f", "comment": "Malware payload (Mirai)", "value": "028959ea3263e206e65057a439ae9d9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026703, "uuid": "d079ac3f-ec21-47fd-89fb-ce8da6ffd456", "comment": "Malware payload (Mirai)", "value": "0ed2ab4b6e5e8b07795c8e67e62b8b6dce8e61e4197da632ddafaa78cc9aea81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026703, "uuid": "7bc6282a-2b4a-4538-96e5-f456d6907138", "comment": "Malware payload (Mirai)", "value": "dfa8ec97e95748eb72f6e20aadb193529a4d0c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026703, "uuid": "a86d5edf-ef57-4a9c-a9ec-6ba4fd28458c", "comment": "Malware payload (Mirai)", "value": "87794d3e5698419bdca1984456831696932af5fd61c9cae1ba70166aae0da8d5e9a3cd00c8078034ab6b7cff70a3d0b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026703, "uuid": "5dc70034-0d9b-4d91-80ff-401147c1e5d5", "value": "T153536BC4AA47D8F6ED1A06755133E7338A32F4371129DFD7CB68D932AC52A00EA5729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026703, "uuid": "09d0313f-4b12-44b7-8aac-0e2a7a9a03c1", "value": "1536:fxW5M8rY9ptvKBERa7uv2p/+qh1vef8QZnORkazMCegCQOdKSjXb:pW5FkjtvKiz24qVQVOWaznrCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026703, "uuid": "fb3a9a4d-e749-4847-9f73-b8a67b12624d", "value": 62960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026703, "uuid": "cefcd7d9-288c-4bb4-adf6-450754387052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026703, "uuid": "273c5ff6-6d8e-4ca8-99e8-20dc18a6ca11", "value": "amsx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff8f74a-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985332, "uuid": "7ba69ea1-4169-4638-b4fc-5fd8bab96d25", "comment": "Malware payload", "value": "5dc02188e15ce461369095d1955f4627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985332, "uuid": "28fa47fb-0ccb-401e-878d-de05e8bf8cee", "comment": "Malware payload", "value": "0ed84454cb44ba5ed297f8f2609f6b2f3b8725bf11c57680217c35bfeb34ced0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985332, "uuid": "743d913f-3056-4ae2-b510-b25df7d3bd34", "comment": "Malware payload", "value": "0896c1be914c5ee19dc6d0b448bf86803836c44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985332, "uuid": "3c662c8d-d484-48f4-ab34-209df710eaf9", "comment": "Malware payload", "value": "e770ec10f5040dc386d6650d66ec9384855946ce20612962c3e8b801e3c8303b074154a504080cbc1fe5e102c6b04e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985332, "uuid": "da2a7036-da90-4653-93b9-67239eced994", "value": "T1F5F35A23D683CB77F2510630C8E5A205A93FBE5546A24B3EE9C17CD8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985332, "uuid": "aa2e9d6e-d0d6-4ed5-ba41-2014c79d7889", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985332, "uuid": "6b6bf2d6-40ea-45c7-a69d-6ede9c4b7022", "value": "3072:gFDVESApLltNnQUHcXR0Lcc/xiKMvAMqk:gFJESAFNnQecBqcc/f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985332, "uuid": "94f8ba4b-3c10-4075-a43c-3d51398e356d", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985332, "uuid": "a7d5df39-4a97-4c06-adc5-6f24e49d87ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985332, "uuid": "e00005b3-94b1-4266-bc25-24a60cb75b4b", "value": "Giblet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ff5e8d-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986906, "uuid": "3c572777-bf05-4342-a713-616b0ab1b57e", "comment": "Malware payload (Mirai)", "value": "e024417bca3b360f7223762307bed51c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986906, "uuid": "05e141c9-bcf8-4e02-9b3c-77618bc9201c", "comment": "Malware payload (Mirai)", "value": "0f1b581c455163aa0331d7690876d248973768527ef8d5b82309b7f3e3238736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986906, "uuid": "4601ac0c-ed05-405a-ac03-67c89befe967", "comment": "Malware payload (Mirai)", "value": "0389ebe116fc08167243538663fce77cbd4b41f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986906, "uuid": "2ce2507f-809c-42b1-add2-34158efe737f", "comment": "Malware payload (Mirai)", "value": "09d1243f2386ea918da0fa803a4ac9489e2d32653cf8f7baec00c1f2a343f740f7ee90a6dac412934268722ad3d3f1f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986906, "uuid": "50ba33dc-3725-4821-b6b6-48d3bf2a67ad", "value": "T174B2D095B142FBA1D874CC31E6B6838A72650FB4C5BBB0BD525205244C8356BADF8A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986906, "uuid": "2e0b5ca5-4e42-42f7-a98e-2aaf087d2b97", "value": "384:TdQ3hvvpspU89wdmTmzbmknyPF/Yar9fKrreFqE24XJZUwxjfYMOhymdGUop5hXB:TESpU89wgmzbmo4r9fKHe/20UwZQMOsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986906, "uuid": "c1b09c98-e3e8-4b74-b880-a9b5a8991d4c", "value": 23660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986906, "uuid": "b1c50c0f-0119-45ce-abdb-7b12f2349862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986906, "uuid": "5af199c2-7bd6-4b9f-aea4-c52e61544266", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3466e018-0918-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013498, "uuid": "d024595d-31a2-4769-adec-726c8451ad9b", "comment": "Malware payload", "value": "621e679d51f49c27a0cca1e9a5961ee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013498, "uuid": "43f03b84-d4cc-4d73-b1ae-867e55e4ceed", "comment": "Malware payload", "value": "0fd0434d337188f1ccc4babaa0889494948ebbf59545eb67e1767f2430e66e4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013498, "uuid": "fdf6013d-425c-43e1-ade0-2ca53f07be7b", "comment": "Malware payload", "value": "69086b7875ce42e062f41c5c83303c6fa810d9e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013498, "uuid": "65f3a3d1-c870-4efb-92de-3af448b8376c", "comment": "Malware payload", "value": "10ce5a3c68f133a0b1f52f081b7c46ae9f1d7ce923be213d15cb3f9b7394d747959cf56b99375f3ec490a43bb7c28763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013498, "uuid": "ab00d0c3-3ac5-450a-a3ec-1524baec765e", "value": "T17C041B45F9145B57C6C22BBAF78F42D93B326B1897DB3301AA356EB02F8679C1E29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013498, "uuid": "a2b1e650-fa55-4b60-b0fd-813fc08a54ad", "value": "3072:TRXUlW7JsG4jDCjHTRY1wVNgfFadi9DY2tg9Dt80hJL47ahdOLWMlMz/KrtmbjlP:HXL47CdOHlU/K69pFvNGLZxYZkrTN55q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013498, "uuid": "53c5e031-2fa1-402b-828a-95e9c07f0fe5", "value": 185179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013498, "uuid": "63c31a6d-0da6-47a7-a775-cc7222000d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013498, "uuid": "c17f7173-e387-4e67-91ff-3014c17ae1a6", "value": "a-r.m-5.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5777191c-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973184, "uuid": "94d35602-22b8-4c91-8abb-a94c2c457551", "comment": "Malware payload (Mirai)", "value": "42f63c1c93f3e0e7a1362f4983b650ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973184, "uuid": "394a51ec-92da-44bb-b008-c614bfe33b0d", "comment": "Malware payload (Mirai)", "value": "103282466d3b3f70988c9f0f7489d7d6dec0a5f0157fa86a88b4804811988e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973184, "uuid": "0ae5710c-b1e3-4d9c-81d8-6fc58d5abc96", "comment": "Malware payload (Mirai)", "value": "46ced75199a44cd5c70d67fcb91bdf8d3cc55bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973184, "uuid": "853ad582-307c-4468-a8ab-f52861c1402a", "comment": "Malware payload (Mirai)", "value": "c703ee69bcd9d3ca002902ae914a645406a1c0d0cdd0c72829c00d8d31228baf6ef5701479c17067731c5173f0f55c14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973184, "uuid": "3fb84c87-b4e1-427f-902c-43a2d85ebf62", "value": "T152830806BA819F01D4D721FAFAAE525933536F78D3FA3101DD206FA523869DB0F72612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973184, "uuid": "b5f42589-6659-4977-ad2c-91b3b64d97ab", "value": "1536:zbnRuqMxxyCsMfbFossXcaHhk0JDnh79ZqPPlUeHi1oizPauYFhfP:RcvsmBosAcaBk0JDnzABkoizPauAfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973184, "uuid": "c82590fe-72f6-4f3f-9427-75106d4bc1a8", "value": 88048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973184, "uuid": "6e6e5f98-c900-43cc-8c0f-34339d0e5c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973184, "uuid": "0663fd17-a168-4676-94f7-299ef545c86c", "value": "sys_armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcd7f19-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972554, "uuid": "142a801e-5e7e-4491-81d0-56822194cd1d", "comment": "Malware payload (Mirai)", "value": "6c5ce1ac6f9e7c2d6979f37cf4d820b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972554, "uuid": "05aff86d-a4db-4a03-8701-f5945a0f51ad", "comment": "Malware payload (Mirai)", "value": "106e399026a0642741bfdd3ffb6e1fd469f33ad600285e88d4822ce89ff9768f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972554, "uuid": "68564aa3-f03d-4376-8ddb-501a72bde65c", "comment": "Malware payload (Mirai)", "value": "671719f7632423b5edbc7bbe992b6d0eec0e4cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972554, "uuid": "0eb5e53b-c574-4679-b3e0-224a5d69dfae", "comment": "Malware payload (Mirai)", "value": "8bc8a9e208270a831d85f89df5fbf79eedabda31b97d48602fb469b228b30183d1f90ca18e899f3c9bc48f0b93cee909", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972554, "uuid": "a6f51a95-bb31-4d74-96cd-a1155ae02b67", "value": "T1C9E31945FD509B26C6D322BBFB4E428D372B1768D3EE320399255F21378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972554, "uuid": "86c995cc-c5a3-4b6c-945b-022a9c04afc2", "value": "1536:ooWWGnDyRBfSv+GWVevEDrNqNZRlbAZnBnADnUPT68thYfNO5Z5I0niJ+hzlF9wa:ohTDmBfS26/lb4AwPbtiG5diJ+EkbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972554, "uuid": "5bff8775-f4bb-4e99-a641-72a69132c7bf", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972554, "uuid": "0c4fff76-283f-4a5a-99ee-49d87a8414f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972554, "uuid": "46304e65-fcaf-48b7-82e7-941d451efa43", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef57f038-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986754, "uuid": "c5164357-1e46-4281-b343-4f7c517281b6", "comment": "Malware payload (Mirai)", "value": "e0375d471fe49a6111f522957dc767b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986754, "uuid": "6e5a82ea-c7a9-43b2-acbe-76676c01347e", "comment": "Malware payload (Mirai)", "value": "108119f070df4cd434847ad9e7b059cff372f58e32d6b616bbfc9fe49dc8309d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986754, "uuid": "6fc4585e-ee04-4097-8aa3-7742788a05ad", "comment": "Malware payload (Mirai)", "value": "c22ae15ae286020cfb00659dc36f80f4bb1082ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986754, "uuid": "6b72c05a-cb73-4a98-a89c-172d894dcf27", "comment": "Malware payload (Mirai)", "value": "c5fda859531d1e719deb38a2a0358cccfd2f7df77fffbe9099f9bb6a1d4692ba1a33bb2bf37b693f6c1639c16b645948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986754, "uuid": "c23401c9-8ca3-494d-b9cc-8dfbfd38234b", "value": "T19CD2E16D01E1BCDACADE49FC62E9423D1750929173CFB76C2225ECC6330990A791E5F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986754, "uuid": "f498244c-9add-452d-8a64-646652c49bac", "value": "768:XF1z99kCHYClzxvfIelfMIJLmxTnxEqa+buBWU3:XFzHYClzxvfIIMaLiGqa+bG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986754, "uuid": "e963151a-0749-464e-adb2-3ff05bbf3d50", "value": 30468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986754, "uuid": "e6e12772-5be4-4890-b2fb-f63cda64a1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986754, "uuid": "7b1d7b68-a48b-4860-a853-5105fcda318e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81c7168-08ee-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770995680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995680, "uuid": "b2ca7e4a-7534-478f-b0df-81cf295b2276", "comment": "Malware payload (Mirai)", "value": "cb14b78be59c3c1f06270a2c40aa7632", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995680, "uuid": "58712e40-6dee-47dd-a65b-989216d07227", "comment": "Malware payload (Mirai)", "value": "108fa7b169d94d5a45707412d5c2ccd74131a1f09773c32dd2e28885ff1e8fd2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995680, "uuid": "5082be81-fcc9-4a11-9ad3-c49bc8fd7164", "comment": "Malware payload (Mirai)", "value": "de474a6526ef15ade85929701e86404b713fff41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995680, "uuid": "84ef29de-b4c8-440b-853d-6ccc38bd8294", "comment": "Malware payload (Mirai)", "value": "fb393db292ea8c6db99f7a297d67139a33f4a18323f91348374cca381f2be737f2126244a9fe1efdafc5059012d1a838", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995680, "uuid": "49936d4f-c4aa-477e-b6db-d4a4c4bea30b", "value": "T1B2933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995680, "uuid": "65a547c7-1ece-435a-91b6-3fb31b6e30ce", "value": "1536:kQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8tlmumXxVqDrstKfz9e:k97vk51RcG7ATlmumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995680, "uuid": "37d914cf-6bc6-4984-8891-364b9a9dfc3d", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995680, "uuid": "be769004-37dc-4878-9821-3079b0b0d986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995680, "uuid": "3569f2cf-3b2d-4cc4-9166-b400b1cd1722", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55965d3d-08b2-11f1-a129-42010a9c0007", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1770969745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969745, "uuid": "04f040e4-b831-4de8-aa95-25f01d891a04", "comment": "Malware payload (CrimsonRAT)", "value": "5b4a48815446cd40d8e141cbf8582296", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969745, "uuid": "d67f27ef-7439-493b-af9e-ca0f19a62c15", "comment": "Malware payload (CrimsonRAT)", "value": "1092761df305e910f806834fb774dfb09dc64a4d399d578a0d1bf1dd5daf0f98", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969745, "uuid": "16c2780d-d538-4a8a-88b9-f8e32bd1c68b", "comment": "Malware payload (CrimsonRAT)", "value": "ec1ec6f05e99958c85626623534ced6753541927", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969745, "uuid": "4e1cb210-4d5e-4f1a-a278-46283c84999c", "comment": "Malware payload (CrimsonRAT)", "value": "898d305edf6ca3bbcfee4cc95d404399cf6394a9c8e9b9c487a4efb75e72de6ca54e3715cc66e9a8f95d429c787f0287", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "crimson", "colour": "#045326", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969745, "uuid": "20b47f09-d33a-431d-9446-70628b2e27d1", "value": "T113775D3DECF61C3936C0227220F49AA9F1B9D8C4ED6A3D5FB8CC9459369289D54306DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969745, "uuid": "6707951f-b697-4a67-be1e-6098991b3b29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969745, "uuid": "bdc6fd0b-58af-444b-b671-86cdfb0d6b5b", "value": "24576:BmB+cmB+X+mB+ZmB+cmB+X+mB+V+mB+cmB+X+mB+/mB+cmB+X+mB+ZmB+cmB+X+p:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770969745, "uuid": "c20181d1-2497-45c8-b210-32ff3044e1e2", "value": 34864640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770969745, "uuid": "82f86a7a-81ac-4516-9b3e-b6e32f1f798b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969745, "uuid": "a2f63663-2625-4302-a99a-ad9f09c6c159", "value": "1092761df305e910f806834fb774dfb09dc64a4d399d578a0d1bf1dd5daf0f98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6f605c-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972550, "uuid": "5c9a94ed-e948-425e-afb3-e45b71684a1b", "comment": "Malware payload (Mirai)", "value": "6cb1ed56ec761c9a213a4225229bb8d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972550, "uuid": "81d0e8af-3666-4209-8333-37b4d2b910fb", "comment": "Malware payload (Mirai)", "value": "10b27c0767a74d2674e8f1b3fe230dbb984939f809c908c7fa913e4696d4be22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972550, "uuid": "3728e8a9-9a5f-4aef-a001-4661d1e21402", "comment": "Malware payload (Mirai)", "value": "84c21247250fcb36963761042fa5d8f1a9a0aa6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972550, "uuid": "28dcea12-4722-4171-8166-7aeaa89ebfb3", "comment": "Malware payload (Mirai)", "value": "12dd36afcc0ad21293201d177939bad03045cd187b24cd9ce727b7b43c1b61c08dca9fd4105efbbc8a1f9c87be1fbd8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972550, "uuid": "860f3fb9-1782-45ea-93f2-74343fcc8237", "value": "T16BE34B06B5C088FEC495C1744FEBE63AD972F41D5238B16F27D4AB626E8EF201B5DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972550, "uuid": "9e8436ed-f732-41da-8961-fc63db33c1ce", "value": "3072:Jb76vFXKtOiRzXsTDT7zG+NwhvSM3CkIQAT:ROKLSDl8vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972550, "uuid": "cf04c37a-3ca4-4a11-bf02-16bd9aa4a9e5", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972550, "uuid": "75c83605-b749-474c-822a-f68534230078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972550, "uuid": "315936dd-5e56-4eb6-9b2b-eef063fae338", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae3ceb-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975579, "uuid": "ee0068c1-ac15-487a-a012-8cefab2a1358", "comment": "Malware payload (Mirai)", "value": "a82c848e65f69e3898f6e7a7e8bc581d", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975579, "uuid": "dd39b497-8351-451a-9c43-bd0ddc604878", "comment": "Malware payload (Mirai)", "value": "1106da5f68947b8bb1573fb11022e6460ea8d91e6702cd09b5a679d9446bfeb9", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975579, "uuid": "f001f3b0-edeb-42c2-97de-fea39b98da29", "comment": "Malware payload (Mirai)", "value": "697cb38d087e06246ed40ac3b25c05a7802aaf3f", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975579, "uuid": "6267c9d2-4eed-4178-b3f1-2dfbb892590f", "comment": "Malware payload (Mirai)", "value": "a36d91b39ee9dcbfa6d0148f240e0a1b30c341ca2d5fb718c13d46b1bac5429cd495ebf58c4eeb8d31c6e6c02b37e53d", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975579, "uuid": "7b074e6e-cf2e-43c3-9f3c-82fad6badf5d", "value": "T108130999BC829A2BC2E027BAFA6E518C336963ECC1CF3217CC155B15778651F0E67B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975579, "uuid": "f8cb6df8-73ae-4e5b-b56e-7451bca38bd1", "value": "768:p4A/Ft8CfbH1QwgtwqTKTeYgo43f05rW4Ss0oMnaTcSPAt5KWvNv:pbxfT1lgtf0I4FqaTcaAt5Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975579, "uuid": "39f838c8-6b98-488b-af36-2bb63515af58", "value": 44256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975579, "uuid": "0230e360-eba3-4cd4-b2c2-b97180c32a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975579, "uuid": "62b1b283-e607-4a54-93f8-574f55e9ad28", "value": "StormStresser.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356e4ab7-0906-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771005769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005769, "uuid": "1d90a506-b2d6-41ba-8cd0-d0a27ec84823", "comment": "Malware payload", "value": "0fd610f3c79e2d667fa2d3202b133bd3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005769, "uuid": "5e269c6d-a1ae-4117-af1d-576690d0773a", "comment": "Malware payload", "value": "1135931c7f2b6ee8235729ec08c57247445f9115867cb750af63be6485b62441", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005769, "uuid": "09a7c10e-6cfa-4f81-967b-d3fcf97a9bdb", "comment": "Malware payload", "value": "0cf0c9b3f33d3eb0447ce35e169feb0039cd8447", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005769, "uuid": "ee366001-1af2-43ff-8416-90a49f300a09", "comment": "Malware payload", "value": "8a003f06501bf9ad63b4bdfe95889c8d8c6e3cb8265e993794af42530ebf0c0318f375563ff4aec4f9dcde9403e7aea8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005769, "uuid": "465b7861-df8a-443b-92d9-24a6396b2bca", "value": "T1CD4633519554DDBDF4FA2EF4E122E8E4E2B84C0DC6279803B35A7FD33DB0EA6A150609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005769, "uuid": "20f517b0-9e26-4585-a47a-2820430cb187", "value": "98304:hvo0gzKEsxIupIYNfDvmnqyKxEu3KajuDDaWNsiyKq7eEES614A9KZ:VXgWEa1BmqyKxWDu7iBq7nY14XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771005769, "uuid": "fe2936a4-e9d2-43b3-b7d1-f76dbc12c7ee", "value": 5668864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771005769, "uuid": "58f5c132-9d51-49ef-b179-903177817727", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005769, "uuid": "368b007d-fb4d-4130-9dd8-be44c01ba32d", "value": "WZOVINHP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fbc466-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007968, "uuid": "9abaae3d-1a05-431c-95d9-2ee3fda5bc32", "comment": "Malware payload (Mirai)", "value": "3d8b96216fb4e5dc06c3979b9c5b7572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007968, "uuid": "61088caa-72b2-4bb8-a40b-2af4c7b0fa6f", "comment": "Malware payload (Mirai)", "value": "1206b3fe24bada226b1a680fe17bd7d226566df86554fbfb5cd3d1547a92e665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007968, "uuid": "79a95f9a-4466-4a16-ad72-e6a359dea19a", "comment": "Malware payload (Mirai)", "value": "c822db4b4c0880e5a6171ca4c1ced925e4caa708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007968, "uuid": "0391970e-b50c-4759-b1b3-86712d575bfe", "comment": "Malware payload (Mirai)", "value": "675f57dc422e3c7a83ae974ee286b440c673dc8a4cac3ac2976088a6fd2aab237ec26ccdc40a96a4d0fb31ff638ffc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007968, "uuid": "832e00a2-e579-47a5-aec3-e78e38b3ece3", "value": "T1FDF34C05EA414A53C0D617BBFAAF014A3332D7D5A3DB730689285FB43F86A5F0D67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007968, "uuid": "8a8440b0-8d65-4a36-a17b-bec921332c82", "value": "3072:yAR0Ne5hqkCoidAl2OXDcK0edJhTJ/lkBcmQyrzNjM/9EiGueE3C:yAR0Ne5hqkAdAwk8edJhTJ/WBGyrzJMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007968, "uuid": "283dc4e6-5d44-4e13-ac95-c0f8b012a478", "value": 169325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007968, "uuid": "90a4e093-f114-4274-ba61-5649b3c0b186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007968, "uuid": "ff0f1a73-4b39-4e59-81cb-8ae5dff8c29e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f4ce95-08be-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770975009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975009, "uuid": "974d0ce5-10bb-4b7f-96c5-6368d1734af7", "comment": "Malware payload (RemcosRAT)", "value": "03311dda7d1a8e9745c74ab898eec814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975009, "uuid": "a288bf5e-2ea9-4a3f-a2ff-caf4c61ff7af", "comment": "Malware payload (RemcosRAT)", "value": "121c058c756297ff8e8dd3f69587c590ebbfe6858e896a8730f711f9f742d10f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975009, "uuid": "b0afdf31-6b35-4406-9085-b6b4bafcab52", "comment": "Malware payload (RemcosRAT)", "value": "7e0ccf5535cd88141a0e82210089c9fd1db5066c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975009, "uuid": "a82fd57f-ecde-4f6c-be05-8285c7e4a545", "comment": "Malware payload (RemcosRAT)", "value": "ec6ba2223cf5b2204bf2bffd8af66df0143fb830c5963833c26bf19d375265798f766282c53d3a3612bbbfd9b6d4ffb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975009, "uuid": "66fdbc5a-45c0-4e36-b348-901d0be4b4e0", "value": "T1BE6401153BE4DCA7D47306708AEBC3B155B6B9B06566570B23D0BE3DBDA2AC0CD0D286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975009, "uuid": "08dc13c5-cb99-4d6e-b180-cd385b38acc0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975009, "uuid": "504d38bc-c5be-4ed8-aaa9-c92350588d64", "value": "6144:R+MvoJXYsbLSeE3DEGaUI6/oJlugOpKrr6oHzUYqYGyPMZEI9qLqZTZHg2apDKQn:R+FHbLSznZgGgVrr6oHzzqWkaIKYTGlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975009, "uuid": "ba89fd97-5791-4042-be29-2a2ca5a9e8b6", "value": 325200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975009, "uuid": "bd58cbbb-b0e9-4cb7-9eca-3e99b5c4c8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975009, "uuid": "0ab33553-7974-4c0d-9ad0-316c49d24367", "value": "Bulk Sales Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371a9609-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007919, "uuid": "1a8629b5-91a5-4723-8c5e-84060507594a", "comment": "Malware payload (Mirai)", "value": "f6995a1e65e1254c29f16db3bfe10d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007919, "uuid": "dfb64803-3077-4073-84dc-3409f9dde3c8", "comment": "Malware payload (Mirai)", "value": "130a3f90cb7ef34c65efb346e89ff707d8054d291d1d6f40acb5656bf002281d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007919, "uuid": "b7c001a6-cc6e-4336-a7b8-3f5b2b71ece4", "comment": "Malware payload (Mirai)", "value": "f87dcf4670dd526e9d4749eac0dd454c53d897ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007919, "uuid": "40fafef6-e3a3-4e68-8157-824211d6c39a", "comment": "Malware payload (Mirai)", "value": "70ef320b42560bd170553bda0aec4b7cb28f0d5db75e74f4aada725038356bd6c621669d82bcea08d51e3fed275c7883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007919, "uuid": "c5b956e6-3318-445e-a9e7-2851b1c13e99", "value": "T117B2BFDDA4883404CD9E2CBD27DE47314F2962E1B1CE9F9DD3218DE895EED4AB4080B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007919, "uuid": "ac244de1-744b-4c2d-b286-80a23dc14f4d", "value": "768:cfrQlS07dEv0UXqUhvQE+CXjygJl0zFDFGZqCWvQ:oQlS07FUXqIYSX+gJl0zzKqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007919, "uuid": "fdb8b5b8-4079-4422-9a67-da273815a9e5", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007919, "uuid": "f6d48493-dc19-40f6-b2d5-6dc2022d3dbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007919, "uuid": "a44d139b-014a-474f-ba01-5d8b68b035d2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525c3d46-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974035, "uuid": "caa15121-bb31-49a6-a4d8-262ef13187ea", "comment": "Malware payload (Mirai)", "value": "e1e1a43d725212ab012393989fbecc3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gnueabihf", "colour": "#2EFB0A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974035, "uuid": "b2d5eba0-9c6b-4b0a-910f-348abafd8e66", "comment": "Malware payload (Mirai)", "value": "130d74dfdd3861c365c68425ec70acd4282da5d98a91b396ad659cfb14493fb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gnueabihf", "colour": "#2EFB0A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974035, "uuid": "5b9cef8d-c8d6-4a8b-9e3f-4daa643c95cd", "comment": "Malware payload (Mirai)", "value": "6ec1d3a134f119b73ddfa3f7fd1c0d0053274757", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gnueabihf", "colour": "#2EFB0A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974035, "uuid": "8062c5e2-089e-4128-a804-e3b8df49de72", "comment": "Malware payload (Mirai)", "value": "91cbbdfa12fe77f972781807ad0a1265494ac8874ac275e4eece84eed0eb4eba8710f3e102a1d2bc95980625331b2f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gnueabihf", "colour": "#2EFB0A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974035, "uuid": "e20474a5-d343-4041-aad9-d58b0c54dc95", "value": "T16784D08AF7562D83C5EBC5340886C645575AE19723F3834A3A476A7B3C193B78F2C389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974035, "uuid": "a5ef6aa9-2814-4c57-93c9-e35fbd69cd1f", "value": "6144:G5e9gio4ixnOlO152n000uv03PWw/kjXpG1WmZgpjmnN:yeujtZOlUYI/OXpG1xgpjmnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974035, "uuid": "033f6d88-52df-4b91-88d4-2f18e29e31c6", "value": 377940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974035, "uuid": "38ff3bba-3fdb-486c-b785-92f12ed66e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974035, "uuid": "b82f60cb-3541-4d05-aa22-8243851f04cd", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9571b39-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771002152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002152, "uuid": "30f2490d-8c88-40ac-8e6e-9e4b392b31e2", "comment": "Malware payload", "value": "5e7fb0ee6e041857cc5f9ccef7ab288c", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002152, "uuid": "9046530f-3904-4046-a2fe-0bed76cb636a", "comment": "Malware payload", "value": "136531524a20b90959f31378ec77b68d729c28098ccfb402bf8d63e119432ae9", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002152, "uuid": "5a050412-b763-4ebd-8510-fb527345dc94", "comment": "Malware payload", "value": "e64eced14423bde6ed256b0aef28371f4cb2ce1d", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002152, "uuid": "bd432563-3471-4781-bef2-3bd34b6fe0de", "comment": "Malware payload", "value": "b7c27afd948b67d051d06ea57d40f714bd86fd86d5ea0a1eb902d114f1e8d95d44e8121d76d2c9a2c2eb15b6987511e2", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002152, "uuid": "b333a8a1-e9c8-443f-81ea-6d2b5e81a092", "value": "T16926331DF2063792E8DCC5B804F10C7883E97D36153A0BCA22B9764F5963F6DA639939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002152, "uuid": "3b9068f6-9dc0-455e-8771-8fbb7b323c89", "value": "98304:2FGjKyLNoPLwRzn+VNbIqRYFbndFPH89+rmR2+lmWORNeERcBzuzjZhDz2A:2JODZibIcSndFPH8+rk2cORIE+w9lzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771002152, "uuid": "c2266d06-bb90-4bf5-93d9-8304e8566531", "value": 4436855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771002152, "uuid": "19ca5922-ca28-49ec-9b73-2269fe690857", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002152, "uuid": "8944121c-6a43-4413-ac89-ab0e1ec83b69", "value": "NexFileCoreP4561404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3302b8-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955503, "uuid": "cbd620c8-7a2c-452a-8b51-f0f8b90e2a06", "comment": "Malware payload (Mirai)", "value": "f1ae4a984a56ae14652d5c3657a3836c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955503, "uuid": "d3351e60-28db-443e-a079-da2b85720b0c", "comment": "Malware payload (Mirai)", "value": "1376a587c9d978ffa44c1ba679a5dba7be6ddddb3b3fbaf4c45d2fdf8f418ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955503, "uuid": "56bbb6ba-c961-4d4e-bf8b-e165b6786802", "comment": "Malware payload (Mirai)", "value": "277c4e4c226286fd8ab8f27908fb704cf8d8e427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955503, "uuid": "9b2bebb7-c495-43c9-82e2-22b991b98ddd", "comment": "Malware payload (Mirai)", "value": "85a5101c14f5971b03d897cfa8e5a2187abfb984b5ad1dbc61da0bfad8823b878318ace79182c9e65b7aa1537c91cbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955503, "uuid": "543a7db9-2978-4dd0-a67f-af115063604d", "value": "T1AE935B22F979193BC8C4A87762F34321F2F6434B24AC9A1E7D720D8DAF6465022977F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955503, "uuid": "ae0d26fe-361b-486f-8d30-c095df29438d", "value": "1536:DrvLAI74OQqxeK2gfXrM1Tr996Iyt9bm0jq5YbpSA/xatuSN3:HNFugU8bbmC6YbI/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955503, "uuid": "354d1315-99c1-43e1-82ef-42d70ada6b4f", "value": 95112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955503, "uuid": "0356122d-b5dc-490a-b325-7d0847d91ea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955503, "uuid": "b5d6338c-2343-48eb-b2a2-6b069ed94b8e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192b9ede-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985106, "uuid": "214fab38-b02a-445d-95ea-dbe5531cba1f", "comment": "Malware payload", "value": "2a1b0b5213664ae055e0e29e0592c8d8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985106, "uuid": "7e0a1014-5de3-4ebd-9cd9-970041f3e924", "comment": "Malware payload", "value": "14270df7f98777d0c23e0ec2f082eba5e6f7de361574420634edcdbae491f83a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985106, "uuid": "e9b3dc38-9586-437a-952d-f5240643b7f7", "comment": "Malware payload", "value": "bc4164c6efb3f799d1118d948bd2405d8c90feff", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985106, "uuid": "446d7b01-da1f-4d94-9adb-afa9f72ae8f4", "comment": "Malware payload", "value": "24b1787b879d38a8346990a96e07b0875b84eaca29ca8fd9e36227747c1ff2238b778e3819091ffb068db14e6c507522", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985106, "uuid": "bf47183e-7844-4d2a-85d6-d5ac537765d3", "value": "T15AE6332232C6C035D6BF06311939DB5A016E7E608F7494DB53DC6D2E5FB21C25A32FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985106, "uuid": "54acc851-f04c-40ff-804f-9acc66a1a72c", "value": "393216:NA9HWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/n:N2HWrTOjnO9KrNMJ+Mu0oX2q4ljiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985106, "uuid": "82ad1df2-56dc-434e-a825-19ae44966094", "value": 14777344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985106, "uuid": "3c20a0ea-e6f7-4a23-8b8d-582987da6345", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985106, "uuid": "4877599a-ebc0-4436-8775-c4620237ae18", "value": "C__Users_user_AppData_Local_Temp_lpgobwx4.i5o_AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4ce4b6-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999389, "uuid": "e360077f-8753-4370-bf5d-85d4e4ee49c6", "comment": "Malware payload", "value": "de6b000a5e0612e57d05734eb466290e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999389, "uuid": "ce86ad52-05ad-4c79-af38-987e57611d04", "comment": "Malware payload", "value": "146290819f56a68f9b05ce1a00cac6da27853d52ab43c738a852aa324fb76ef0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999389, "uuid": "3e5c7613-03ec-4e08-ac5e-c625381dcb4b", "comment": "Malware payload", "value": "023852015d349e0ed23b4bc15028039afb3e0b92", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999389, "uuid": "db708d54-f6c9-4766-a031-76a9a9c891de", "comment": "Malware payload", "value": "22e006812ee6d3a09fba3d545ba2e77785fdd1dda26027da19079c376aa47800a23a736e77348019d04316cd1ee1d71c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999389, "uuid": "5d98ed29-cf0f-46c4-a9f4-bb2e26d6118b", "value": "T150162332A651846BC69146BFB0EE5F223E2DA1434BC895E3F49CAA563747FC4963F0D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999389, "uuid": "f770d7be-bb5e-46f7-9505-11d53f4be1ec", "value": "49152:6Yk4jy8lzt+/s16w2ghC8fQlIjf/Fl33ZjMgDoy4CnTQpsyWX+t:2syWXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999389, "uuid": "99670464-8a10-4874-9f3d-dd490a3cd66e", "value": 4360192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999389, "uuid": "9d65bb3e-c7fe-4859-a603-e7383b3918a2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999389, "uuid": "51352d90-b220-4f8f-9722-f85a2eefd21e", "value": "CitGQ6S3S87183BVPMM_Lib063686.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715c1ffa-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971939, "uuid": "88108f89-2631-4b5c-8d48-5f8453482a45", "comment": "Malware payload", "value": "2895483c88619024debc577264c30f60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971939, "uuid": "a70a6ac5-6282-48ae-8be1-9b453cd7c70f", "comment": "Malware payload", "value": "1497644e68596e708c587684454e595dab840d375d9141a280862afe2b60c2bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971939, "uuid": "14e61623-fdf5-4959-b465-52e3e1a941ba", "comment": "Malware payload", "value": "52435df26df43c37b32cb4d9c70a2f9158be95a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971939, "uuid": "f9dad25d-4a14-47cd-a1ec-eb222a76cd71", "comment": "Malware payload", "value": "5d70fa6bd62fe201457ce2f571cf8d07677ceecb88bd6951641d687f826be62496ae57986b9ecf7c2620dd4b00ea63f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971939, "uuid": "dd3194f8-1b47-4bcc-95db-681169193a76", "value": "T1BDE04FE504548EA0BCC069CF34A58A133423D25E18C56F96EFDC25F6449CC04B852B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971939, "uuid": "b7339a78-be2e-4911-80e3-2206e07754e9", "value": "3:QnQNFn8Na2ZQII5eEdcgbSoOjVxi8LUTidaSSE8qa4aYeeHnQNFn8Na2ZQIIQ1dd:lswzI9Edcg2EOt4swzIddcg2xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971939, "uuid": "b3f9671a-dadd-437b-a1f1-f450022890c6", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971939, "uuid": "f1fa1491-29b8-42f7-ae7f-13642d80e22d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971939, "uuid": "1f426e52-a987-4696-a865-297e0b928820", "value": "goahead.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89dae24-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011626, "uuid": "91c55a70-846e-4100-8615-7d49c0d1c9c6", "comment": "Malware payload (Mirai)", "value": "5747b41df21c8ec5c5c9542bb713335b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011626, "uuid": "a6456ec1-9ba0-4e68-9297-c5ee4697eaeb", "comment": "Malware payload (Mirai)", "value": "14f8d2783e73987392a7ecb5eb9e5a565608fefb1a6191df1b3ceb340a1a24b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011626, "uuid": "79dd3a3e-e3a8-481d-b9d9-9a31d001ddea", "comment": "Malware payload (Mirai)", "value": "8c463ce952cba882fcadef3f2f74a80cd2310210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011626, "uuid": "3a916a37-5cb9-4bfd-9248-c9d1f3fbe86b", "comment": "Malware payload (Mirai)", "value": "b21236343f12cb54e9ee9a2a8db2297cf3f97720e7035335d1e1f4d868e7c4f1ff3599dfd538bc85856f03a63ce0c35d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011626, "uuid": "309f687a-9445-4b1c-8681-0ed2e11eeba9", "value": "T128032A86BC4399ABC5E413BAAA6E118D3321B7E8C1CB3317DD215B25BBC551F0D73A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011626, "uuid": "c434626b-b615-46df-a4de-ae3b9fcec676", "value": "768:PuUCidJazz4cfDY8jQwlescJyKoxFb29AsMwKPNZQD5dQD5SM:GURJSz7fmVJySSsMwnD5qD5SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011626, "uuid": "b5e4ff4d-812a-431a-934d-4af05649204b", "value": 40392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011626, "uuid": "5fef0fe9-5287-4544-ad36-bb6ea16e4d03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011626, "uuid": "1e560c8c-bafc-44a1-847b-6a5f62fe1b27", "value": "boota.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eff822-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010307, "uuid": "c943460e-e56a-49b6-9450-1671ff7186ed", "comment": "Malware payload (Mirai)", "value": "6ea21bbc63ed4f3113c690f89d40007e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010307, "uuid": "3ce46bc0-8512-4746-893d-4f49a3405c35", "comment": "Malware payload (Mirai)", "value": "150e26a8e5272f761c79af02e7bcf4f8f5f13084cab56c7a99d36676251b6925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010307, "uuid": "1d0b9bf6-034c-449a-8f5a-4c7b216d86fa", "comment": "Malware payload (Mirai)", "value": "96acd4b15974ea5ad01e847027bd52da0733d698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010307, "uuid": "de15efad-5eb5-4e3a-88c2-6c6927fe5ee3", "comment": "Malware payload (Mirai)", "value": "6d8bb952a268631ac1e4cdf35085c36a5c77820bf2c98258c1df8e0f1d7f6766c6bb7b45c6695788897603eed86a782d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010307, "uuid": "f2b17648-e02c-4227-b1cf-5c5db69378b2", "value": "T168630955F8818E26C5D5027EF92D128E371227E9E2DFB2239E205F203BC652B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010307, "uuid": "0ccda44c-8aa1-441a-ac69-f9d4d41ec3a8", "value": "1536:CtnN9Q3BEW4ZHlhKgt1qxdefmzr9u8c4IWiJz1r0crh:++Bv4Dh/DGPSz1r0crh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010307, "uuid": "cf1c4212-6b09-4e14-af62-5d002a06d960", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010307, "uuid": "b5017f2e-7e41-4cf0-a39e-6e6fd0b4ad8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010307, "uuid": "5b58b7a8-374f-455a-a05f-5e475f92fc61", "value": "SecuriteInfo.com.Linux.Mirai.9816.3330.15148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43da53e-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013310, "uuid": "2fec6faa-b073-49d7-92d3-69f957a7a2dd", "comment": "Malware payload", "value": "dbc1adef4b52a9a3c312dd67d576d129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013310, "uuid": "ccb24bf4-aebf-487f-8580-187523c0fee1", "comment": "Malware payload", "value": "15d91619e057771f5b006fdfa9ec842a213fa1022d5a2060813b81c200b24012", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013310, "uuid": "eb95e2d0-8615-4713-9610-b5d41c8ca623", "comment": "Malware payload", "value": "8ccf2ed54464d2213f206e8098502ff47d9171ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013310, "uuid": "22b37776-c566-41f3-953d-f928b4290d77", "comment": "Malware payload", "value": "df2c922c1f993d1917849602b938f1ef3267ada1e0e1ee470bce8713dc5d2774ab6fa8c3b01cd8d0c88aee1dc5e033d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013310, "uuid": "e33cfda3-5a63-4969-8627-a7bcbfced07c", "value": "T1CA930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013310, "uuid": "a9535380-2377-4590-a9fc-5349fd677133", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yon:C8NUv5nTacgzafVAwe4BNRIbT2gXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013310, "uuid": "c9ff7ee1-3b9b-46e5-8745-62bfbf9e1a18", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013310, "uuid": "e1d3eb9b-30c8-4a07-a62f-4a1e1366c0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013310, "uuid": "28ea4f8a-29d6-4b75-bd65-0b20b2b3ceec", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3802f5cb-088d-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770953804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953804, "uuid": "29978ca4-0722-44bc-9635-50c8978584ab", "comment": "Malware payload (Joker)", "value": "b1585f0b0a432970f35f5c79ae1aedae", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953804, "uuid": "b8818d97-d8ec-4fd7-aec9-9883c55ba59b", "comment": "Malware payload (Joker)", "value": "16051f38c4a7c666dc80c05f83d197d6285b480c80299282caa747f54d8dc837", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953804, "uuid": "f1e855d8-f80b-4c25-bf1d-4f0cb045a76a", "comment": "Malware payload (Joker)", "value": "40316cbce2d87a981991838f2ec2fa0c053936ce", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953804, "uuid": "93d7d82b-44fc-45ea-b52d-5c62b7f50935", "comment": "Malware payload (Joker)", "value": "94f58e659b0b429d0cd1401bc4e304c8b467801dfb6b448e80f70fdd0cac45acb06ec08b70daa197d619157dde5845ca", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953804, "uuid": "e91d497a-fd86-4d24-a0c3-9ff77c98adfe", "value": "T1FD77C05DE64CEC3BDDC7B4FC8D4509E2622B79945720C39A2913850DEE837E40A69FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953804, "uuid": "b6e23056-d60e-4ae9-aaff-94391ad2a983", "value": "786432:WNNNND4Vk+Y1WbBy6TLlqYHl4JRUe37ijkti7Te4oIA:Afnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770953804, "uuid": "3de3b3f1-ce5b-4e6a-ac9c-a3d202506750", "value": 33792698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770953804, "uuid": "02479274-067b-41bb-b087-cee2a636b428", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953804, "uuid": "ba89f596-489f-43c3-a4d3-01ca63a797c0", "value": "com.reintegrate.pump.titanate_3.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf9b60a-0917-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013296, "uuid": "cb2f547e-5387-42d2-a9db-7ef18032d7e8", "comment": "Malware payload (Mirai)", "value": "505419a7a5880165b1021d9b4db73b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013296, "uuid": "442fd277-61dd-45e3-8f80-9c4c054b01b8", "comment": "Malware payload (Mirai)", "value": "17846b832e7d7017a7530ebbd975b986139bf34c28bfaad62817b3318e1268ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013296, "uuid": "9adb8d75-2f8e-4421-9cfd-c2c7e50ed6ba", "comment": "Malware payload (Mirai)", "value": "8a38708b9150cacb8a4e621dd285a12a93c410a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013296, "uuid": "507bae5e-3159-46f5-987b-9fa1ddf01101", "comment": "Malware payload (Mirai)", "value": "29a4e22241ccfa72688ab3accc890e52f4c99d2ae87d06e18120f6eb626428a96e728fa698306f8e5764f9255c5c1cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013296, "uuid": "db153183-ea29-40f2-80b9-83b2957c71f9", "value": "T1A5A328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013296, "uuid": "1973c888-797b-49f1-ab1a-d1a06fe4407f", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAk:wbU2RC4kPCtSzWu3/3L1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013296, "uuid": "70d61abe-4dc5-44f0-92c6-78e8c14d6328", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013296, "uuid": "7f8c37b0-6a62-47f4-baaf-2f48c66926e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013296, "uuid": "c78ee840-e928-4e54-bfc6-5f6a48540a63", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59270ccc-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955578, "uuid": "615d39e7-5b19-4f08-bb8c-10b5e68875ae", "comment": "Malware payload (Mirai)", "value": "ae22bd6380135fee423c42023d2229fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955578, "uuid": "840ed6cb-f7b3-483a-b8f2-c761c08f73d5", "comment": "Malware payload (Mirai)", "value": "18b90d8c58f2e17f20d0b766c0af1e9d998cb9c99dec7db221328ca04e0214cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955578, "uuid": "2d527622-f6f7-44d3-b7cf-f8fe423d014e", "comment": "Malware payload (Mirai)", "value": "8155c529599a2d1279fd5e9965592634a8e30c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955578, "uuid": "cfeda06e-c25e-4b54-bee1-2f36f0772fc9", "comment": "Malware payload (Mirai)", "value": "91aa4c7a3bd1e3c33450a5945fa2bf5a0f1ce3b31401b70018dc6c0d166f6de1ca23a969d6e1c1d3d3b6084d23a32dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955578, "uuid": "19748940-7c81-49c1-a0d4-8f9ee73b0f34", "value": "T1B6C3F809EB610EFBE86FDC370ABD0B0525CC651712A87B7A7574D828F64A24B49F3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955578, "uuid": "efd251fb-9ae2-4825-94bd-1188d2a478e2", "value": "1536:5uVukiJoTO8ePxR0hV3uDMigHm2a1un+pkwQF0pZLkml08Kl+nonHYtxBKDVhV:EVukiJoGR0SxuwQypmdWjihV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955578, "uuid": "06f6ae59-9da2-4247-b962-3bb05a2f0285", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955578, "uuid": "eef483cf-d1e3-4f47-8467-1121cd7f6a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955578, "uuid": "c1476c6e-e222-4334-ba5f-0f8138520a14", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b721ae-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007912, "uuid": "16b7ceda-3fe8-4c83-a0a9-960beb7a4f22", "comment": "Malware payload (Mirai)", "value": "a8e9c20328f668490a6368b305d7d149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007912, "uuid": "70212608-4462-4889-9d1d-d55a9be6d401", "comment": "Malware payload (Mirai)", "value": "191851f7fde0071323cb4b8841e55f5dec173b308e0ee184e632ba6d0e9d1e48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007912, "uuid": "f1a8db4b-f4ad-46a3-9ca7-6af9d6ac40a3", "comment": "Malware payload (Mirai)", "value": "94a48ee73a9514b492989dbada7619467d6ead00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007912, "uuid": "c7ec4fcb-aca9-4226-90c2-16807acfa7dc", "comment": "Malware payload (Mirai)", "value": "7b0b5a4dcc8cc93067e163146039638501c6abb4dd7d2490a484f772f162141e2566c4317047d4171286b6ea1d81e7eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007912, "uuid": "4acea353-ea6a-4bf8-9cb4-ea5dc2ef281d", "value": "T19DC2E021562EA8B4E7704CB4557D4237AA058AFED0FBF571214C07E42AE174E7B8A0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007912, "uuid": "e8ac53d5-aa97-4010-89c2-562157f884e6", "value": "768:DeFzIGBncjvZcMIn3Fs27elo0xPCPmKiWXR9q3UELud:oAvJm3Fs2Mo0xjNWXEL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007912, "uuid": "b2856664-932e-4c62-a555-d74f9b9c6df7", "value": 27308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007912, "uuid": "11a2d91c-d892-4a32-92ee-db8df09a8181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007912, "uuid": "45d63667-344a-4728-b812-5b30030c920d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d77f9d-08e5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770991702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991702, "uuid": "17978b7e-19f2-4dc5-8c20-190a4ecad3ca", "comment": "Malware payload", "value": "d248313a2ea148702ffe2de0bccb1c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991702, "uuid": "5f7b93bc-1ee0-4192-a31a-7b4b7bebd2d1", "comment": "Malware payload", "value": "192369a2ed9ca8c9c3c4c9685d619678ef0d6f0dc7e2629ebc9a840e92cd699b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991702, "uuid": "400153c2-2d86-44da-920e-0f62f8839880", "comment": "Malware payload", "value": "1611b478b5886e1074590c02deaab3fddf1bfdc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991702, "uuid": "dc1f7129-8aa1-4afa-883a-4996f542e303", "comment": "Malware payload", "value": "1d4ae9458bb346a3501e1fba9202267c78c790358c1cb8915dbeb3b4ffc6257a07596c1caea240ec9b53ec3cac06c655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991702, "uuid": "9986b5b5-68dc-4c76-98e2-9ff55da2926a", "value": "T1E453B8D8FFC2B2240682B5732CAF50A6E96F5DC4390CA005C39F7E59BA6471CD83965E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991702, "uuid": "97c22cd6-8f23-4f30-9589-4209829c353f", "value": "1536:w6tusq9AlUfwI1x0TXzdGv5XAXcQo+TBj//TrxE:6sBUw0xYJGVA1Bj//nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770991702, "uuid": "998995b9-1ad4-46ac-90d6-ad19d51a5da6", "value": 62201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770991702, "uuid": "3c416e66-fd04-433c-97e0-ae519af84104", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991702, "uuid": "666356ce-0f19-4296-8b04-daa826cdd102", "value": "RFQ-SM10022609.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da348d4f-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770972545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972545, "uuid": "82d6eb78-33d3-406a-89a7-62863bc936ef", "comment": "Malware payload", "value": "91ff5564be871758ad25c3061f6e3fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972545, "uuid": "802c6070-afa9-430a-9a96-cfb31eec8a28", "comment": "Malware payload", "value": "1a26e62115a4b0298f1fcf423e8067e5fe45a1ac6912e9975a6c3844b17062cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972545, "uuid": "f90d64f1-5f72-4317-b125-8817032cb467", "comment": "Malware payload", "value": "d6c13d3e0f622833f590b279389ce4f67a69b594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972545, "uuid": "43b6dc7a-3a3a-4d05-b7f2-18fc07bf80cb", "comment": "Malware payload", "value": "3fd462893ef4f105da6a7d487ed1f9491ccace9786635fed8e98c2a234ca18750d2eafab1f538cc928fbc59c1b233dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972545, "uuid": "31992416-4cb6-43a0-8e5c-f8db2949d2ac", "value": "T17714C819AB910FBBD86FDE3702EA070539CC551722A43B3A3674D528F54A94F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972545, "uuid": "aeadf882-b984-4a5e-97ba-313a5970b1bf", "value": "1536:9r/p5l+k+livqTKgu18T+jG5EIlcDY2lUuX3+a8ZMfI7Om7Z2FzvsTxYg7+5uk+l:Wk+lXu1FGv1sIr7TxuYMsgLCbI18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972545, "uuid": "52240c94-1c34-43a9-9995-d2f15f665b62", "value": 201288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972545, "uuid": "6a491eb8-42ab-4bd3-8ab7-4b667f9cc36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972545, "uuid": "295421a4-803d-483f-8ce3-722efe11b090", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5274be61-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973176, "uuid": "9d7db93f-b5c4-45de-b10f-d19a357cad8e", "comment": "Malware payload (Mirai)", "value": "a7ed9396a7f1e27220e0182513a38d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973176, "uuid": "cce32b87-125e-42d6-a9cf-3d75ddfde740", "comment": "Malware payload (Mirai)", "value": "1a328e8291696efcaface329d42891a79cbcb1923991214da1c9c9217ff07a5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973176, "uuid": "f80a8ce2-c21a-4ec1-9b94-4573f326dd98", "comment": "Malware payload (Mirai)", "value": "094362cd1c6f6757a1a5ffd6158d5bde7c94938d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973176, "uuid": "86508fda-8d36-4b78-8212-74b6d9915421", "comment": "Malware payload (Mirai)", "value": "7db35cb393f762b295e9b2398171406248535f0b341edc994067af973860ea47c5d82e4fefc92be5a7206e85bf6af9d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973176, "uuid": "d44b6317-9d6f-471f-b0f1-efdb5be68348", "value": "T179E30A06A9918F12C5C211B9FF5E524937137F78D3EE32029D24AFA0774A8FB0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973176, "uuid": "c09a6f87-ecad-4181-99cb-3ee4c4f6f14d", "value": "3072:AzywjHL+IXataFaE+88jG93nMnqUC4EPR+uy:Azy+HxXwaFaxRjGW5dEp+uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973176, "uuid": "e76803e6-5622-4919-a851-5aea767d2d98", "value": 147296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973176, "uuid": "2e610ecf-9e32-4ab9-89e7-a91305fdc9a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973176, "uuid": "00d8df80-e0a1-48ab-bbeb-a8dc2d021459", "value": "sys_armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08385ffd-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985507, "uuid": "72ff9c09-88a7-4bdd-a95b-1385199eda17", "comment": "Malware payload", "value": "8364abf517c34aefabb4fff805d855a8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985507, "uuid": "64f94074-e9a7-469f-87db-d2ffd7dae679", "comment": "Malware payload", "value": "1aa499177ee2ccd2b79846f634d5846cf972331cb0dd6f82b34da4f6e6b77618", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985507, "uuid": "967a075b-b8cd-45a4-a701-f9875da82f90", "comment": "Malware payload", "value": "b15f6af52fa1819d65809503dc89edc1f2defe99", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985507, "uuid": "7b1c6cb7-6246-4f8f-9e97-397b66f367b8", "comment": "Malware payload", "value": "e3a2f544fdcc608a5d45c23ec680f353f439c3c0b7e51506e742175144e38c70cf1249927a2979238410eeb91cb91b95", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985507, "uuid": "a1fa0746-6e62-484a-ba43-edbb5dab1193", "value": "T1CDC733513CD3CE33D99D4CB6087696B044E93C198B349CDB40A87D2E8AB77C316B6EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985507, "uuid": "1a5f70a6-6d7b-4e14-9371-ffea06cf5ccb", "value": "1572864:TVQ8sGRm9liP5k2BR0DDL4p2yHX+pHlgWzteDgoCXj3TbDd:JQ8sGRuliP5k2B6DDL4p2y3+pHlgWzEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985507, "uuid": "28795f65-ec18-4288-aa47-067ca81c3ebb", "value": 53957632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985507, "uuid": "5bab88d8-cbe4-43ae-9b54-5e291aea202c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985507, "uuid": "f2f430eb-3635-4627-a6ca-5f38d850927b", "value": "AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f221285a-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770972155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972155, "uuid": "aec20f31-03a2-41b6-a311-6a34a2521f4f", "comment": "Malware payload (RemcosRAT)", "value": "df59224661eae61b32242c395572be8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972155, "uuid": "42350661-38fb-46d4-b504-16a8080879f3", "comment": "Malware payload (RemcosRAT)", "value": "1ae0ea0b093ec70869d063af5cef9255c6857e3b43e7f910bc2174cf05ee2ac3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972155, "uuid": "e460b6a2-2eef-4d8f-b888-331d30893fbe", "comment": "Malware payload (RemcosRAT)", "value": "0c953f5f96f77e18950c744bb5500b5130c87e69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972155, "uuid": "36ad7e91-6589-4df2-9410-d54095bc7dd3", "comment": "Malware payload (RemcosRAT)", "value": "198135ab8bad5b1ba5d9a129578559f6ea878cae3e6034ae2056f3d4199599feac446dbe82efdbd8513ef8362612a530", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972155, "uuid": "f635895a-952d-478f-9c5b-598b30ab764f", "value": "T18946095127D5E0337323ABAD563ADE70990A58032AC5CB05709CEB2AB15DD07F768BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972155, "uuid": "0d5213e0-1d88-4264-8f7e-4a5c3a37be8f", "value": "98304:g7aYEs57TsmtqOQycHy+CS65YLI22UBi5Z44YOPcnSYsvau0xKmb2B0qQ3OCq6Sj:guYz57ImtqhhSzbhjrd6xZ/q6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972155, "uuid": "38df5c59-e738-4e80-aa01-cd9e90dd489a", "value": 5362632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972155, "uuid": "b82836de-fe0e-4157-9ef2-d9a1b65b120b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972155, "uuid": "3745f7ee-7926-4696-b0e3-a33c29783c60", "value": "QUOTATION.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a6376f-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014571, "uuid": "dc7bf99a-600d-4df4-a623-2caa68452c16", "comment": "Malware payload (Mirai)", "value": "733158ee32f1ccc74600365b5ff47f67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014571, "uuid": "82b0f01f-3767-47ad-a458-1ded83f7f42f", "comment": "Malware payload (Mirai)", "value": "1ae334b98a0a6c97e00f1953afe8985b01356c487f49353a4b81919a08893442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014571, "uuid": "53fd0a87-eeb7-4fd1-b301-2489c6cd95d7", "comment": "Malware payload (Mirai)", "value": "313b2fe94abc0cec22774d1f2ffcfcc67bf7f312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014571, "uuid": "13d9cb54-94f0-404a-b293-b4fde41777a8", "comment": "Malware payload (Mirai)", "value": "fd8d6cb9d51108341a82d4145f8b5d0cfaa29a34b7dfcb0c5c5b117406ba08f9780d7a19856b353b213bd2a7cd817262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014571, "uuid": "d9833762-719e-4827-ac7a-e101287b2d38", "value": "T1CFB3C85E7E218F7DF7A8863047B34B21A35923D626E1D685E26CD9041F7038E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014571, "uuid": "e8ecd0cc-0fcd-4abe-b658-41c07bce2736", "value": "1536:pTtgJlCSYhqbLLqDridBiYJVKCNrx39W/RGpYTKGNeRL1HDJ7ABH0:EJ8Ob6DUVKCNrx3qRG6LOt7S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014571, "uuid": "193f7404-f612-4ffd-92cd-249889b17064", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014571, "uuid": "cc4d9dd7-2244-4a4f-b9d4-407f3fe6a4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014571, "uuid": "cd10650c-3e02-4684-be2e-3b0d663ff471", "value": "Calix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c81fc1-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025800, "uuid": "a1b63631-e78f-48ac-90e4-29ea6ea9be98", "comment": "Malware payload", "value": "b09e6e3346f6ff0ae3914fc65b8dea94", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025800, "uuid": "bc76b8aa-c7c3-45b8-a35a-6321895b9ea8", "comment": "Malware payload", "value": "1b69dc805a77f4b299ad6346a918e919be5c72863ffe8fc189f588e51e224594", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025800, "uuid": "7c2d4baf-b15e-4526-b183-8b1c161dc107", "comment": "Malware payload", "value": "0123cab30531c0ad3059f76f6a213187b6a2f0f8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025800, "uuid": "574c6081-68b2-4a14-a9ce-88a19ee4deb4", "comment": "Malware payload", "value": "56a21b845eef233beb2f1c08a7a566b2d25ef7138a41e9a38ffff89782ebd48740c43efd767e4ca03cbc7366bc6713e4", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025800, "uuid": "cf0671d0-e510-403a-b39d-d5c58633aa08", "value": "T1CD462331BAD66C63C6C44B76B20F2F117E2C2B434B4DC5A3B8BD59823B86F416D6E485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025800, "uuid": "c102d7de-bac8-4a87-9a3b-b77620721cd9", "value": "49152:HP+TFOdPAiePucdhkL+rpa7/7n464S/P0L14uspNc0z2MihiFk4wiuDEx5vnssts:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025800, "uuid": "e6e1caab-a400-41fc-b863-fc91278a6f27", "value": 5355520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025800, "uuid": "74ca9bb9-c606-423b-8b19-bf587e6fbdd7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025800, "uuid": "7a35add6-3de5-4a1e-ace9-bbda8b3e2fb4", "value": "Nta-CrKHBK_57561XEDURQ04G4Y.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f832669-0892-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770955964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955964, "uuid": "d40baffa-5946-4b1d-bf2f-510f71c08c5c", "comment": "Malware payload (Stealc)", "value": "8bf3a38cc4a832614374a3366d5af198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955964, "uuid": "f750f699-01b0-486a-9cf7-0072d7baaadf", "comment": "Malware payload (Stealc)", "value": "1bc53f714339ceb8af3f5779e3c764f7db74cf77a44b5243deb95d6c7c5ea6d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955964, "uuid": "32138a7d-6fe9-4a60-84ff-84e4c0fb659b", "comment": "Malware payload (Stealc)", "value": "cd91ce035175bae24455e666d8d5d296aed2fe2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955964, "uuid": "eaa1103b-f213-443b-87bd-ec5dd4e4fe2d", "comment": "Malware payload (Stealc)", "value": "b08e22eee243c23be3dd5b1b76c1ba8c27beef8d73ba45be0c7669847db70bacf1efce7a13b520cf9a4d845d0a79e5a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955964, "uuid": "71234c1a-6522-40c9-9e60-44b4849d4bfa", "value": "T17BF48D5AE7A602F9D0BBC178CE424553EBB2B8155770978F03E14AA61F372A05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955964, "uuid": "6956b6ed-d5fe-43c5-a205-cbff6948c4a6", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955964, "uuid": "0d03f276-4f59-458e-a991-4e319f35ab90", "value": "12288:zU8VHX4ZPBuvzkOkW7UE+YTRqwJ4oiK6ALSQTbAK4lVA:XVH6BuvbkW7xXVVmoiKzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955964, "uuid": "ba975d54-57fb-4151-8479-a83be2134ab0", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955964, "uuid": "46a0a8bb-512e-4ccc-a099-04b5afd4675c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955964, "uuid": "3eaa6b16-ef2b-4cb1-b4af-e1d6bbb8118e", "value": "x1bc53f714339ceb8af3f5779e3c764f7db74cf77a44b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477bbb78-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963279, "uuid": "786507ee-2e65-4cdc-b02e-d25aab5710c3", "comment": "Malware payload (Mirai)", "value": "804d38dcd5f69d8e051fae4c3b13b410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963279, "uuid": "6acfbaff-2d2b-4fe8-9f45-0b4c49e8b373", "comment": "Malware payload (Mirai)", "value": "1cecd53eeb10a5a1e94772cd49966335ca01bf43e6bd3f6eaec4be06d0c06368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963279, "uuid": "9065cc7f-3eed-46db-ba80-6bffcab1e6ae", "comment": "Malware payload (Mirai)", "value": "db6ed0fb3b8345a6c12af306bca9f1715d74adc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963279, "uuid": "aa92fdde-ea1d-4fbb-93f7-9a5d9de3d975", "comment": "Malware payload (Mirai)", "value": "e31a8dbbcebaaf31a6b6be8d4c515fc2429f562aec8eb81d954b474cdb00d055abf4ab26d8ae301f8c3726782fe0513d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963279, "uuid": "6ed8f9ea-cead-43a3-b665-8a3cd8293e13", "value": "T1A0B3E70ABB650EFBDCAFCD3346E9070525CC655A22B93B367574C828F54B24B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963279, "uuid": "1e98b2cb-79e4-4102-8601-3b4ef4181aa4", "value": "1536:V4w4zW/h4SZsqEzXcDgiDSAPLfO4jaXbzjZjCfPNXm/iRK0UgSSW9:OxW/rZsq8cLfHjarzjD+XW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963279, "uuid": "fe39b0ba-813e-4d64-b441-ef8b892430d2", "value": 114212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963279, "uuid": "2145320b-1c1a-4ea3-8572-c97683763e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963279, "uuid": "85df6a7e-1c45-4aa4-bc08-75738aab9aaf", "value": "herios.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7233dfe4-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011455, "uuid": "1b535182-dcec-4b4a-afd1-b0211a62dd01", "comment": "Malware payload (Gafgyt)", "value": "cae4326cb21a35eacb8ace5288c2c918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011455, "uuid": "cd7d1ab1-f5d6-4f41-a8e6-daddc2d87f3d", "comment": "Malware payload (Gafgyt)", "value": "1cff15b6d42a26ed38f6074dd15215891577704f25caad95bab9cb04629a8022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011455, "uuid": "cffb17fc-84df-4183-8304-55d235447954", "comment": "Malware payload (Gafgyt)", "value": "69814e065dcb57f52993ddee348d0ad9d26df48d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011455, "uuid": "952edc36-f61f-4fea-8c63-289e9c8afabd", "comment": "Malware payload (Gafgyt)", "value": "a1f81905828fea2cff0f08cd604ad0856e75bc952ac06738f9b4b795f7ab384a093d4da0e55271fb3d651703eb3a5633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011455, "uuid": "36c43e51-29f4-40ab-8252-bae9a299ab3a", "value": "T19D44F711E8044B53C3D327FAA79E479D3F365B9653D773019A38AEB02FC6BA92D29410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011455, "uuid": "ff4804f3-038d-4d7f-81d8-96656da4f6e5", "value": "6144:+7h6BR44t7gaAKGt8v5hGpvXDujnJDyuSFZnhvdWk4y2Qu:Mc44cKJ5hGhDujnJDyuSFlhvdWk4y2Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011455, "uuid": "e501e17d-0545-43dd-83b3-9323c35332fe", "value": 261396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011455, "uuid": "7dbe4224-aa89-433f-8739-caa90f8cf0ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011455, "uuid": "4364de36-2dae-4baa-83aa-f788480e9976", "value": "ballnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bb70d3-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025775, "uuid": "7646c208-ff3a-4166-8877-bd05d0dbc6c5", "comment": "Malware payload", "value": "8b39a50e1082078a8831a03c617aece5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025775, "uuid": "0ea8b96b-b560-4761-a598-c898e58e0306", "comment": "Malware payload", "value": "1d40b145725a4f9a4820aec0a05693cda3021fa2dc08d484d504b233d7c492ee", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025775, "uuid": "cbb2b0da-292f-43c6-9164-5af6bdf68e78", "comment": "Malware payload", "value": "35facc17a3b4334d95dcaf51361b38dcc3a03775", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025775, "uuid": "b375d469-8d69-43be-8516-b39624a9bf71", "comment": "Malware payload", "value": "8ae01f143d19c37b2d2193a34458e678443e6fa9ded69b6b3820f386d96907125162e1ab7eb5f0d9358b7ce99a2c807b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025775, "uuid": "76ab815c-31fd-4e0c-b465-cec3e9df89ae", "value": "T139562331EA519CEFCAC087F5B0AB7E256F6C6D43438DA5D2302C61867F4BF948A27464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025775, "uuid": "43abcfaf-8e1d-414b-bd92-b8be903b7173", "value": "49152:AWCkvLfsX2VN7JBmSeu7AjM3PquFXF3ryeKOhMhuXJADPYCxi0QmG7u/JBSpajQK:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025775, "uuid": "e7b2879c-e5fd-4278-9f2b-9b4cc91415ff", "value": 6139904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025775, "uuid": "c4a78aa3-f352-46eb-a8e6-99a032665bfe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025775, "uuid": "c082ada3-bb39-40a8-8cc0-fc8e2c186439", "value": "O0DSZLJUAOG_Acr4492-QTRH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554efcd3-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770971033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971033, "uuid": "158ba382-0f3c-4131-b1e8-fff22a8fd609", "comment": "Malware payload (Formbook)", "value": "530cf9cefcf05758dd2cded2adaac0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971033, "uuid": "3c6b9a79-392e-4e39-982b-dfdae394dc97", "comment": "Malware payload (Formbook)", "value": "1d6e99ea99f0550a917044d809c101f28f350056aca406713f11fdd86234b367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971033, "uuid": "ec7d5197-7fcd-4db2-8166-f82f52287268", "comment": "Malware payload (Formbook)", "value": "8cd3d8f293740cf7cb60ace1234bf6178753fb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971033, "uuid": "88cc7042-8d92-45c2-8ddb-9d1a2367dce3", "comment": "Malware payload (Formbook)", "value": "c53bbc3e21d811e7becc18e4a62257b2e1a0915479f4805099f0092b13b1bbf38a2813df9adc439e79c9a33da6b206a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971033, "uuid": "65b8b7ab-dfc9-4218-ac21-5877c97b0ef2", "value": "T1FF05F19C7615F8DFC887D4B18954EE7466602CAA9706C21386E71CDFF90DE87AF180E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971033, "uuid": "aa50c46a-84b6-4b86-b3e2-f6275dbbde42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971033, "uuid": "d465e1ca-aa0d-406e-9aca-8926f2d6b661", "value": "12288:yedYVgxbPdgd2SAm10ZPEAshU8RSSBv2HJSEf9LVdGSovjJRzCS:yedYCIdLAm25EA4U8tBupSEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971033, "uuid": "c1e92759-fbc4-4fdf-bec8-8e854a842df0", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971033, "uuid": "bcb1d2c3-72e3-4a22-b04a-c28a3bcc918d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971033, "uuid": "d2f0e8e8-c791-4395-af4b-4dff5026f766", "value": "SecuriteInfo.com.Win32.MalwareX-gen.86576971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978db0c7-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025691, "uuid": "447aff11-a3d9-4e32-95a1-e28e5b236e54", "comment": "Malware payload", "value": "593b861fb4faf661fa1f863cda4c6956", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025691, "uuid": "97804bc4-c3c6-4c51-bd41-425a08d1908a", "comment": "Malware payload", "value": "1d9f38a02a8ec4d714c2f8789515c2b6e4fd9d6d834b030436c15772dde29d97", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025691, "uuid": "98932ea5-b9bc-4c69-abe9-41be3525e033", "comment": "Malware payload", "value": "e4e6316cb24f74c1a7c65ad0845ac13a8bce8670", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025691, "uuid": "fa305495-406d-4566-8988-9dc88eab9c51", "comment": "Malware payload", "value": "407ced6b1926e74dee99548deb25d107d1de0866b0350b18cf75fff4138d9fce47d2081642417e396458f51483b4670d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025691, "uuid": "7f9f1df4-0ef2-494d-ae1b-ba60b7454416", "value": "T185663332BE506C67C290C7BA746F7F386E3D35034ACD95E2A4EC72823B425D6263D895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025691, "uuid": "67409697-a7c5-4d83-bbf8-bd4dab3b7efb", "value": "49152:RXJEFbHzDu4Yx91ryQhQaIUbs8jOsUC7HMyoy6K8eKpccUxKta0YZ1WOuGWg1VHg:An", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025691, "uuid": "7a4c911c-0875-41ca-b52e-f1e6faba753d", "value": 6711296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025691, "uuid": "1215f9e3-ad63-4618-afcc-3a27fcc037e2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025691, "uuid": "7772d6f0-69f7-43f5-a7cc-3bd48b27557b", "value": "NmclUSCG6290698_VJNFY.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f902a6c-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986969, "uuid": "3486f771-f69e-40c7-8c2e-97484a4ed4e2", "comment": "Malware payload (Mirai)", "value": "940417db770e0cee04711fe6ccbd18f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986969, "uuid": "0a650624-4c8e-43e1-8724-b77f3e79fc25", "comment": "Malware payload (Mirai)", "value": "1e7b3f35b3b47365cf285505e68ebb621ed98e488c9bf7a5cff688dfdbdbf56c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986969, "uuid": "f702984d-c6d4-41bc-95ad-9e34973b0520", "comment": "Malware payload (Mirai)", "value": "9801a6614e0a4af74f16b07fe173ac80faba1a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986969, "uuid": "7bc7ff09-ceba-4503-9d54-1c4173b471a4", "comment": "Malware payload (Mirai)", "value": "81b3de598b467a6a2fad0c6332236a0c23c8a1fbfdba87350bae4ed8309ff9c8103248061e5043d6d83beeca68beb0d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986969, "uuid": "b783e3af-9ed8-41ef-86ba-cda21267f687", "value": "T110333A91FC825A2AC1D107BAB56E698D3B2173E8E2CF3213CD644F2076C561F1D7AE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986969, "uuid": "35004440-dc2f-44d7-9dd2-5cea8d453824", "value": "768:YkG5mK9hWlK013yb5K92xXGk5i3ahLkPUNI9te6AVjOaSp3TILdKA2sDci0GAO1L:Yh9Uo0RyI9eGyi3SLqTeDcTIdUJSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986969, "uuid": "2c52e456-9c44-4916-a4db-4845b3b706aa", "value": 52096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986969, "uuid": "e791b647-cbe6-474c-b164-adb24e407c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986969, "uuid": "704620c8-b7c9-46c8-b0da-c2b142f822fc", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b6ef86-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013495, "uuid": "7347fa56-d934-4f93-b420-e72815deaa92", "comment": "Malware payload (Mirai)", "value": "10ee9c24c03c009f4398b56e990f9325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013495, "uuid": "ada1728f-48b0-4bbd-b4b1-2d96ec9ada80", "comment": "Malware payload (Mirai)", "value": "1ec4349dc3a07ecfc1d86980b30bd00f5fa978748d6fa8e2c5e1deb2c86adfc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013495, "uuid": "f0f44c97-c21a-4d25-bb0a-f263f9515f3b", "comment": "Malware payload (Mirai)", "value": "aad8b38ebfe9c4e13de9b8d572591f102c25af3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013495, "uuid": "2a905a42-1d87-4dc7-b88a-a14b7572098a", "comment": "Malware payload (Mirai)", "value": "1e8576fbb42f40f34287c7d3d62e5b79755afcd3226cccdcc31a4bf375929eda4ccd2f9e0f6dcc3d2565b3d75e25b22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013495, "uuid": "4a88c361-1375-40ae-b53c-8f5a816308d7", "value": "T1AB041983B905DEF6F40EE73204D307257231BB654A535A36B31B7979AA3A2C4382BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013495, "uuid": "87344844-9ba6-4ac5-874e-d73dd86e551c", "value": "3072:NtuZCTKkGmy8C8Vr7o2lt3qluv7GWXhLi3l0bN8IWvtGLAxHZ3eFIJTKCTD:NtJ2my8NVr7o2TqlqLJjWvtGLAxHZ3e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013495, "uuid": "6da64d46-6b18-47f3-b4d9-eccd9a2034a2", "value": 190087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013495, "uuid": "65bc0af9-5fe4-4aec-8f27-7850d95cf08c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013495, "uuid": "3f85b905-3d7d-4aee-834e-2c5d0207beb9", "value": "i-5.8-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b9ce7b-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011464, "uuid": "185ea2a3-b43a-477f-bc91-560da02aae56", "comment": "Malware payload (Mirai)", "value": "1c27bcee3bc86c8ae04bf3486daad48f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011464, "uuid": "b1cef8ac-1870-437a-be55-a0f24d3b72ee", "comment": "Malware payload (Mirai)", "value": "1ec5940d8e31c709b529940d1f52457b8a9fc8f4c396d1c2e70b6e4898e0a601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011464, "uuid": "068041e5-9ee8-4cb4-bdd1-2ed6f8d9d9e6", "comment": "Malware payload (Mirai)", "value": "3b71515be7f0df1990a2f88c37e3f6c11b4dd103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011464, "uuid": "cb5a9eae-4ad4-4d4d-9ee3-57079a753c32", "comment": "Malware payload (Mirai)", "value": "53bbb6894e4250c12fc68f26d6a7f60aa7c9ca5c9cf478f5baa74ac1a64eb4fb2933de969b33d28a9d0c871bfad3680c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011464, "uuid": "436a9c3d-6db7-4323-b30f-b8042d729417", "value": "T18C438DC5E543E8F9EC064AB57176EB32CB72E53A1026EAD3D358E636D892B00D74724C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011464, "uuid": "fe1366af-ac0e-4322-918c-6803d6cd96c6", "value": "1536:az4aeCEtQM83+n6utu5nf5WZPuMdXvN2u5SLD5oD5T:az4jCE/n6utuNB6f/Yuw5Q5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011464, "uuid": "3daf6818-2f00-4891-bccd-be184d72e6be", "value": 55952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011464, "uuid": "d0925b22-6cd9-4644-90b7-c435cc077060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011464, "uuid": "8b7b7c6e-df4b-43dc-906f-9f95290db15a", "value": "boota.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608b148b-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770995963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995963, "uuid": "9ac5b259-f174-4423-ba3a-d379438b8b12", "comment": "Malware payload", "value": "83d325afc799bbb08f6667ff6bc0211a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995963, "uuid": "c462ba27-3042-4fa9-ad00-b2070e7da4ec", "comment": "Malware payload", "value": "1f38edc70b75c281ca7b5aa264c68d7fab8c4ef0be6e727d700f42837d832232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995963, "uuid": "90fee660-ae92-4bde-812c-aca075a8d721", "comment": "Malware payload", "value": "445630c8fa4b69ef7b1089189fecaa3424e75a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995963, "uuid": "9264f91f-be3f-4fac-bcdf-dfa434d3880f", "comment": "Malware payload", "value": "eb3a8bf79776691e0410f436a1f23a7716db4b28743cf984ba9253bc0772681f58f7c8c7e635eed1f1705731db77d9a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995963, "uuid": "4c06a182-5333-42d5-90c2-9c19d881b45a", "value": "T1ECD623FD06E012B081E25600B28B939AB5C1669D55FC1C1D3DE72C42276DCAF664EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995963, "uuid": "4a516660-7740-4817-84a8-faa6a836a66e", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995963, "uuid": "04e18bc6-5ee7-47de-a634-70c38a0e77d8", "value": "196608:fpqHTKTe3DDqezbuYKm41OyFUGWwJG1Zwg8GYGOTxJ7MAVfHbaoz7mdxoF:fpqNDDqezqYhyG/wk1Z+GLFAZ74x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995963, "uuid": "f9c12f32-b04e-43e8-8378-20042c15fb8d", "value": 12614656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995963, "uuid": "cc3d46a0-c4d3-4989-bbd1-182a54316312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995963, "uuid": "57e7ed8c-c335-40d6-825b-ae4a61c65597", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5639d43d-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949131, "uuid": "216ed275-eedd-4009-a758-dabcee7a50cb", "comment": "Malware payload (Mirai)", "value": "a9121ab7fc4ab88de69676d49bf34cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949131, "uuid": "23a24c92-ada1-4388-b36b-725bb24f8d02", "comment": "Malware payload (Mirai)", "value": "1f665b2445471f294e4fbe1aad7437525eb84c574879723893b14037cae29315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949131, "uuid": "6b18d07c-d795-496e-ae93-5a2ef653c64f", "comment": "Malware payload (Mirai)", "value": "509dbb9b8d472dd9265e7a4757f86ef684301590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949131, "uuid": "13d1cffb-19fa-4e5a-a414-c8145d770e82", "comment": "Malware payload (Mirai)", "value": "de81a88d4c77d7b4529ada539eb0e2d39aa09d942c7b4bdb88a515ab32c8a80b79d294ceebbfcd9d4feb545ee6d9e8b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949131, "uuid": "7d95e424-2d1f-4b7b-82da-097f84ef88b2", "value": "T1A0533B99F4029E3DF88FE9BA84160E05B93023D212931B2767AFFDE37D321659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949131, "uuid": "d3e1cc1f-6382-4246-95fc-f006193b3bfe", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozgym:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949131, "uuid": "80768f7a-c773-4e6c-92ca-1f20de432e94", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949131, "uuid": "e619d162-7917-41f4-b31f-e70a00453658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949131, "uuid": "a61816a7-7577-4ac4-9f12-6578ab7705bf", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e597c-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770970998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970998, "uuid": "6003e626-b859-4ad5-bb61-50dce18f051d", "comment": "Malware payload (Formbook)", "value": "d14287e6fdf8ee68d1396297af6fa18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970998, "uuid": "ae04e198-146b-4c21-9a42-a711daae9a78", "comment": "Malware payload (Formbook)", "value": "1fdf67e858d1b4e3f81b62dd89548abcf386d18cfbdc44a1309320b7a8fed218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970998, "uuid": "150c9678-b751-4877-b6f4-ddba01e2c72d", "comment": "Malware payload (Formbook)", "value": "ac16efee1d5b10477fffeb165f82c97778113cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970998, "uuid": "695dcbbf-a7fc-40ae-b2bc-516c1e3ba043", "comment": "Malware payload (Formbook)", "value": "ca5e3672e19854c2ef1a6024d8a2157280e8da5a1923bd04ec2397f2c5b75d092768c3b40fdcb5910e0f45fc42ef608b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970998, "uuid": "b3edbcb2-a650-470f-ad94-08bf2cac21d3", "value": "T1E7F41295AB0EDD12D5C60E700EB5E3B262388D99DA10D6039FFEBDDFB46AD16385C240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970998, "uuid": "499d2506-92b9-4ee0-a03b-69804ca7acf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970998, "uuid": "14d83d83-099f-4bb5-a47a-0b0d995544ed", "value": "12288:bOCF77zV2eqBQ0rzzKtAiQrKWYZg7id38zbH6APB43EgDqHsNgO03fiKUPcmsQ+U:bHF7XV2vB6A+IY38zbH6APB4UgDqH+U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970998, "uuid": "e89ae607-f799-495f-b0f1-4072adec9b33", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970998, "uuid": "9d8c45bf-7054-4fa9-9287-e57d708c4894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970998, "uuid": "41dcc7d8-ebb7-4efc-b0f8-6dfbedc9557f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.51628529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c4d88b-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025740, "uuid": "6d9430d7-6db5-44ba-8615-ae5063a9edc0", "comment": "Malware payload", "value": "a915776a19ade5fdfea64ee62156fb8f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025740, "uuid": "2747f3ed-0d7f-4c5c-ae63-c9e5dd9c35eb", "comment": "Malware payload", "value": "20307dda5941796d20eeaaae747615316cc3d2c87d2c43c7f0d732ee21ed37f9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025740, "uuid": "0f79b4f5-054b-4714-891a-6e6c4e8dd29e", "comment": "Malware payload", "value": "967aa0955569e73cd6a507961a50142801c3afad", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025740, "uuid": "c37d5133-5228-4cd6-8d9a-55939e73fc53", "comment": "Malware payload", "value": "ee0e22d512b597b80a595d0659800c2d1d64898423a306ec003362cbc7b4a8b9a297cfaa65df924d165f7e3e6a07c28c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025740, "uuid": "945a4cd2-eada-46d2-bba4-d9ad66eb1064", "value": "T18A562331F9423826C1848772B62F2B362D7C3747898D94A1D8ECA392FB47EE6513F855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025740, "uuid": "349b973e-a783-4ca9-8c1e-6f8abb804e55", "value": "49152:ChZyz+kTL0nkZ+gnbMwHOdpRxtRjVgNNkpf9dwBxa1DqWW48GgR1xfIT0baDMaoH:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025740, "uuid": "202bdecf-0eef-4ba1-83ae-b642991516da", "value": 5990400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025740, "uuid": "5d36b6e4-e359-44c3-9e43-be2af0fef89f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025740, "uuid": "2bd1e5ab-64aa-414b-8a23-6154c98fe201", "value": "N55NPExtr_119062ZUAMXVR83JG.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0393120b-0927-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771019859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019859, "uuid": "e25861a4-6e43-46a7-8503-29260c7ed9c2", "comment": "Malware payload", "value": "d2ec42da5bd30344bff6d58f381eb4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019859, "uuid": "ec3d1d7a-4eac-4ea7-8980-fb3056dd0ccb", "comment": "Malware payload", "value": "209aab8495025a101cf5184bf7e6ab2fdb83aca59b1971a46269f1d2469a44dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019859, "uuid": "cdc08213-b79e-4f86-8609-8bb241e0cac1", "comment": "Malware payload", "value": "d8f82b0226da982691a5fca1cfad6ace9f3720d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019859, "uuid": "b3e75b5f-1334-48e1-92c2-1b697b7def33", "comment": "Malware payload", "value": "f0759c8c6d062726ae6ba97b30b5dc3510f9d38d35497b0358c082d42ad15b9fd91dbf12d62895f31b5f5603c50cdc2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019859, "uuid": "f4bca35e-35f2-4851-839b-1125fb53d5ed", "value": "T14DA6338553D104F2E9A7A13D56A29492C273B5256F32D8AF0BA4835E3F673F24D3BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019859, "uuid": "cc3fc9ba-b70a-4048-a121-142c244a421c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019859, "uuid": "822abc24-1111-44ef-8e61-03384f30e5cf", "value": "196608:chsqlGN6pbRStbW897GDr/x7eovq5XMP6PzFcsWpHsoqrUbRjMF+:PqhRS1yNdq1B7LWpHsoqwbpi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019859, "uuid": "796d4470-cf3f-4839-8063-92d722c11f7e", "value": 10293035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019859, "uuid": "9b3e23c2-7593-47e1-a70b-eeefaa9cd30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019859, "uuid": "4376529a-1496-4d1f-9cdf-3edb7d722cc8", "value": "WinDataOptimizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756c98a3-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011460, "uuid": "b71cef75-1641-43b3-8639-ea1ef75e9883", "comment": "Malware payload (Mirai)", "value": "0dd95d201924d823b3b963468f68b2e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011460, "uuid": "59ff0186-2d09-4f18-bae5-3153a9537e3f", "comment": "Malware payload (Mirai)", "value": "20ad4293dd82bf5055ff400b364d45d9f87eea182f1c2443347c8390af93048f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011460, "uuid": "7a7d0e00-e2df-49d2-8609-ae44cc1d8d4c", "comment": "Malware payload (Mirai)", "value": "ed9384b86fa5958e4fc79af08cf864a06948d77a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011460, "uuid": "414b8420-a139-4393-8e56-1a6e26074e95", "comment": "Malware payload (Mirai)", "value": "fd8e7326bfe931f3b2ff3fb05bcb57d09dbb4fc841733e9983fc9c249d3b0029bbb737500b9ce264e0e9e30c875adc98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011460, "uuid": "5582f182-1f03-40fe-94d8-265c9c0940c3", "value": "T13C83E709BF610FB7EC6FDD370AA9170535CC550A22A87B3A7934D928F64F24B16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011460, "uuid": "18dbd54f-930a-4f79-81f7-94bb86e6e066", "value": "1536:wFwUqNJVZZoF9/niBIWSg3kqmX9f/aSApxwZwiRcpIEE1D51D5SSg:wFMhoF9/niBIvaSAnwWI9J5J5SSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011460, "uuid": "aac0eb40-da37-4194-b33a-e9332ed257e3", "value": 84852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011460, "uuid": "8318d5e0-9f4c-41d8-af2c-369e5d60abc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011460, "uuid": "a4a1e46a-1bc4-47dc-a63f-8601a2cc022a", "value": "boota.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a0c75d-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015534, "uuid": "149918a0-ea90-4685-bd04-d3b713681fcb", "comment": "Malware payload (Mirai)", "value": "9cb7a043b32598b9bfc1abcaf632bf81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015534, "uuid": "2ef06caa-81af-4a20-87fc-75199b1e8acc", "comment": "Malware payload (Mirai)", "value": "230b093d4c3b509f07a9b021e98fb794bce00eb129715a2693198c51428f1097", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015534, "uuid": "4d3adc5a-ac05-493a-8523-9ecb8fef0783", "comment": "Malware payload (Mirai)", "value": "6b166e2d2fd1172329e3da146d0e92efb805bb60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015534, "uuid": "c98c686f-7721-4e5c-b37d-d6d13509c0eb", "comment": "Malware payload (Mirai)", "value": "a9154ae3a970aea8165fc259dcd1acf54f406dfa4bbabf21a09a7e0630f18b2238de7aaf493c46fcca26999433b81234", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015534, "uuid": "e448218d-1d75-43ac-ac5c-ede2121db43b", "value": "T1AC33EA07F84281FDC156C17407BBBA3AE83671EE133CB6A777E4BB266841E624D09D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015534, "uuid": "2a14d0b0-8531-4174-83f8-9bdd60ec45d9", "value": "768:Wu6t/kgKLN5aKlVPTKVv1XWFPWCX2IAsJYTvT0FCAiT0OTuD9sHngg:et/kgoN5aKlVLGv1mFPWmqr0YgOTuDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015534, "uuid": "1ecd8506-598c-4fd2-9096-a688e92ed655", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015534, "uuid": "01b2bb9b-fb7c-4b9b-8ed3-a22a29f25ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015534, "uuid": "013f182c-6cb6-407d-aa52-8721734575d5", "value": "SecuriteInfo.com.Linux.Mirai.9816.7834.5513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6d5e68-0909-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771007390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007390, "uuid": "507b4c5b-beee-40e2-9b10-0c1cb55a9015", "comment": "Malware payload", "value": "1fc26b69c17be4aa5dc0a5bc4a86a340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007390, "uuid": "89d8a371-6b54-48a3-a4c7-fec98cf050bd", "comment": "Malware payload", "value": "234f87e3aa262b72fd2c7aa4a7f96b054ce1c41eaa264abb385a8a6ab203f76b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007390, "uuid": "fc8627a8-2ef5-41c6-bbfc-c7fed0364ba8", "comment": "Malware payload", "value": "0b8bfaf8404e8a4c711034b850963edf86301ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007390, "uuid": "5ff5841d-fb20-4a53-abcb-0523d0cc1ddb", "comment": "Malware payload", "value": "f00b194e36c5dc5ebba5068cb71487b0a319e8942cf1fa8114ffc71b5fc305fc4fca56583faf5113f412097fef3ef3ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007390, "uuid": "c428c2e1-d122-4006-b259-374d3a888866", "value": "T1DE28E01663E112A6D577D138C79BA203EB72B40713309BDF729C03652F63AE45EBA760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007390, "uuid": "283950f7-4da4-41a2-a5de-fe9c75beeff8", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007390, "uuid": "cdb9ec73-02d0-4e5a-9c99-b4da808557f4", "value": "1572864:lVDG5MiP2aVxUX/xW62hGTVJB7gP1eZHJDudhakxTJ:lVDG5NVypW624B7gP1ld1pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007390, "uuid": "b04a9037-70e0-46be-95dd-e9b0eedbbe87", "value": 95885176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007390, "uuid": "bce8ebae-a75a-491e-8580-cb40ae5f16ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007390, "uuid": "587840fa-ffc6-4c35-a133-349b9bffb9e1", "value": "Schedule I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7635441f-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011461, "uuid": "83b7f9ee-ea77-47a8-a70d-12519ed6814f", "comment": "Malware payload (Mirai)", "value": "1ce7a5f92ae15c818b15f5565cd1b46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011461, "uuid": "f048641b-9e82-4c3f-a0ee-118701da49dd", "comment": "Malware payload (Mirai)", "value": "235900815d3dc050cd16af3d823e7e8bc536d6e7234ed5b97a540991e2ba5643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011461, "uuid": "9c7d0731-3070-4f4d-902c-eb5903417f9f", "comment": "Malware payload (Mirai)", "value": "97c6b4554e50b8a5fd76f0e198c8b72e709823ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011461, "uuid": "309b8f9c-a133-4d24-8e46-8fab6d436ead", "comment": "Malware payload (Mirai)", "value": "70a0d1e69fedee946f1d0828497f49bc755f4b5d786b3d8c3c0acd55c72a26e6afe95438e6d164adf1ed6feb5665e929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011461, "uuid": "1a31d163-361b-4e71-a9d7-9bf946e2f259", "value": "T13143AE77C92C6DA4E18C45B1B8758FB82713E640D2171EFB066AC6298047EECF6093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011461, "uuid": "1f5ea4a2-edbe-4401-9306-2a6210985043", "value": "1536:O7azvwtIbubfWqebQ2MKXV2MntzfCgLuQzD5kD5Sw:O7gLbuSqehTXjtzfHf5c5Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011461, "uuid": "49dc425c-3b02-4dfb-b4be-8d08b44e379d", "value": 56620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011461, "uuid": "a03b85b8-26ab-42f1-863f-95641a8612aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011461, "uuid": "45ba04db-f61f-46f6-b64a-8d6692e83417", "value": "boota.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0c574-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973126, "uuid": "a1d7262c-baac-4f37-9c7c-b898303fcddc", "comment": "Malware payload (Mirai)", "value": "75c8b56d1977380fc147bc0188a1b176", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973126, "uuid": "e402efc5-c5d8-4f7e-a9a7-a28a35912bb0", "comment": "Malware payload (Mirai)", "value": "235edc3a61ad464d12d212e1faa48c59632b5b108db152bca5a9a8b8ecfa22f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973126, "uuid": "70df8bd9-21e5-4162-a720-c99f17fb2132", "comment": "Malware payload (Mirai)", "value": "c41587934a3a7576f3fa5ff89b55f78b2750e3de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973126, "uuid": "d88afb6d-4599-4b6b-a4da-f9934218df77", "comment": "Malware payload (Mirai)", "value": "e97b859ceed5e55c639a7f20eedb87313cc9e51bdba352c9d52c343667441548f8f8b7b6552018761b6c797732f07d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973126, "uuid": "1bfdc6e4-22f2-476e-89d8-9ed67c5e118e", "value": "T10B630253BA09F896F0FEF7A2FE7A802312D596D751327D4A434742FF00959269C296F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973126, "uuid": "927a6719-b4e6-4152-9db1-2d1069854920", "value": "1536:SKqDP4LfBzDUWfNaBIlLvnCCJCDFvJz8ofQRo+8oI3ZGQr+M:ShAdbuItCCJCD/zYRFIJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973126, "uuid": "76df5af0-054d-4cf7-807b-9b80b2c03886", "value": 67796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973126, "uuid": "b10f8e5a-b455-4bca-acf2-b4297d5b4a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973126, "uuid": "cd9e3c0b-827d-42cc-9369-4b1cc4fe204a", "value": "sys_armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97dcc1a-0917-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013292, "uuid": "99bbd9e1-e343-4607-a317-27c9deeb7c87", "comment": "Malware payload (Mirai)", "value": "835899a56d9d6937eb359510461d87d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013292, "uuid": "814d6742-4f02-44f6-90da-8d5e9ae318c5", "comment": "Malware payload (Mirai)", "value": "23c28e6c4298a47cc6605acbf8a9476f7f9861413f6f811a7cda546b1a0cfad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013292, "uuid": "60747374-a954-4f06-8232-6e91cde615de", "comment": "Malware payload (Mirai)", "value": "ee1a53739083421459c4dabc016e3b18104740c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013292, "uuid": "8869ef74-59e6-405e-a069-c7c4a1d6aa39", "comment": "Malware payload (Mirai)", "value": "9682313a67dcb41b826f9f2e53f7911acae248fd3ff81725f9acc4bafb458b953b69acb7090b689e00ace41d19230100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013292, "uuid": "ba1c56a9-3d33-4512-8aaa-0a44cc0ee4d7", "value": "T13323F1F6D257E1BCC4B094B3428EA1D6D96678029725370F07E231AAFD2B3682D557C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013292, "uuid": "e19549e5-3a40-4d90-b2cf-4fe8b0a4d9e3", "value": "768:hdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b8BOa0ks4G:mwkgI6YONsLsjwVwimoLzxuOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013292, "uuid": "79c95590-2ecb-4b05-a3fc-3b8ef252e82f", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013292, "uuid": "e1b3484e-ecd1-4095-9b44-97864f3a01b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013292, "uuid": "52470e5b-35bf-4384-b732-c44bfe4320eb", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1604ed5-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001763, "uuid": "3378d7fc-efa9-4485-95bf-3779d42e1a49", "comment": "Malware payload", "value": "bc34c2b8c6208f39df74b771b0118345", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001763, "uuid": "a2eb2284-ca68-45c5-98f9-be155c35ae77", "comment": "Malware payload", "value": "243015ae7b5bb4f088f4acab741e2619e7ae9ecd9e908fe26d16cac26f3808b2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001763, "uuid": "0c9bb622-e51a-4b9c-9446-14557d4de22c", "comment": "Malware payload", "value": "8e3a1687484f8238053e2b19211767eb2f6d93e8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001763, "uuid": "a502de92-4377-4e59-9fe9-4b69b9189415", "comment": "Malware payload", "value": "f67a05b54a547a67e99be0db18bfa578378f3cbc8182a7bed4e2319547d6d30cba0c896425da458547a25b7d0ce733f0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001763, "uuid": "a093059e-2f3e-47a5-b5e3-025bfd048d75", "value": "T125E6AE23F2B640B8E8EEC4B0D77A45325A2D3C096B7092EF19943DD42D706D1B7B9B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001763, "uuid": "231c7ac1-4390-4bb3-8247-c7557c7e2a71", "value": "41c32693477d1b5435c0e09bb2654b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001763, "uuid": "b3b31244-173b-4c9a-b56c-26699a0756ba", "value": "98304:En+Y+vybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6Qj2rNrUqkaTDYknCACauGeDQAB:EnavuhTSSIc+YewNoYFqLNAPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001763, "uuid": "fb1325c5-0749-4b3e-9712-446610640cfe", "value": 14546648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001763, "uuid": "148fcb13-5559-423e-9f28-17d9a4405693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001763, "uuid": "c4f7de00-cdbc-4185-9b3f-adf984848a23", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b15e50-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986768, "uuid": "9f8d532c-93e9-4ccc-b6a6-0766a22e37b6", "comment": "Malware payload (Mirai)", "value": "5fc9d06863116ab0b32567370bbda397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986768, "uuid": "5d0e9f18-bd9f-4e43-adb7-40b9e00df902", "comment": "Malware payload (Mirai)", "value": "24ad62ac3e11d117e7d33c35a9642e101efe56feb900914857b3fe457a8f694e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986768, "uuid": "2964fc28-557e-4e59-b920-c94a9dfa6556", "comment": "Malware payload (Mirai)", "value": "f341ea69cd173c37609cd126803eb692c5467e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986768, "uuid": "19131451-20c5-4d2b-8563-c4aff735e3bd", "comment": "Malware payload (Mirai)", "value": "b84ffce3e4ceb1165e883a2b6eb141acaff6ef96ae9838e729aad84f2118066276fbd453675a1b5cdc92861c3b7d406d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986768, "uuid": "651929f7-611e-4a08-bd61-6c4ef3c5cab1", "value": "T143434B9AB4029D7CF94FAABA44164E09FD21B7D311830B2767BBFDA36CB20655D13C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986768, "uuid": "da510adf-6be2-4dce-88c8-0aa5a7d3e683", "value": "1536:sx6IC1i6dxGVdBNVRZsgC2N8AW1WIO4XP0w2fV:FxGTVRZflMtjPzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986768, "uuid": "611cffe9-48c1-492a-b13b-e05e4cd27673", "value": 60632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986768, "uuid": "898def1f-1521-4ad1-8253-ef32be6b835b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986768, "uuid": "1be355d1-46bf-428f-a4d6-efc9fdebfa3f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1553db4-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026647, "uuid": "e798e9e9-1f99-4b84-a4a1-312313e23139", "comment": "Malware payload (Mirai)", "value": "4d3e3a0601934c078e4e180388eb4516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026647, "uuid": "8dfe33c9-9696-4437-885b-0e0b032e0aea", "comment": "Malware payload (Mirai)", "value": "24f683925e0f90507855e4d4a141466eaff0b142488f406e7ad9e329588a266c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026647, "uuid": "f068b1c3-d5e0-493c-963b-42ecc4ea2ef4", "comment": "Malware payload (Mirai)", "value": "63348b483565baaf73b4b3e234038857d72953a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026647, "uuid": "242b22f6-c46a-49f2-a41f-bc2d7ba7789c", "comment": "Malware payload (Mirai)", "value": "05d9720cd461405b7fca387181b9629190906d3eb74b35aaed2f5e4ebd2cfbed73746dcd3e5d5511834e4b37fa1fc827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026647, "uuid": "263ce535-1039-4f42-9f99-6ff0becf80c9", "value": "T183734B22BA751D27C4D0A87A21F30721F2F2479A25ECCA1A3DA20D4EBF7565036477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026647, "uuid": "7fff7c6a-85e3-4f7f-9b0d-9e2833f2cf3c", "value": "1536:baNH1SoZ+49V8cNB3JjSlP5PiQntAOTNM5zAaDYbUHztYN/Xv:mNUWz1WVKYN8zAgriv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026647, "uuid": "4e6ab48e-4d7f-44a9-b392-9e78218f94aa", "value": 78984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026647, "uuid": "60dcf11c-c5bb-4b64-80fa-38794520e37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026647, "uuid": "a8268525-5053-4abe-bd1c-def2fe3b242f", "value": "amsspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0756a7-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999470, "uuid": "b0ea9147-a471-4fad-84d2-aa18a77389f3", "comment": "Malware payload", "value": "7ce3e5554389b85209989bb3a8881279", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999470, "uuid": "a402e59c-813e-47ae-aa6f-4c14fceb0ba1", "comment": "Malware payload", "value": "269a2a72f7f64d9977d1ed418c7f2fe362819b556b33a2cfd7ca0cd5c716f4ef", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999470, "uuid": "2d0b5e9d-efdb-49b3-8a33-869fdc611eeb", "comment": "Malware payload", "value": "3f9bc3b0086695f9c16c8efadcd0def6777e2c89", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999470, "uuid": "c6329886-b8e5-4fa8-8fe3-794105ed3383", "comment": "Malware payload", "value": "6ef4fc26b0dd4405ff71260fe073f7c53ed53e61ccc5bb546c139880a9945c2bc74a9cbb77937fae816ee1f7ada7afcf", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999470, "uuid": "0d72bc6e-f34c-4f82-b7c4-e05bee14486c", "value": "T1A3863331FE816C73D2604B36B47F3E383F7C360349CDA0D168AC6A87678AA92496F555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999470, "uuid": "92f74a6f-46b3-4f80-aada-6854b4c78d57", "value": "49152:AGZj3ah2zz3ToUtfLEA6TtdsAvj0mhh7cBt8DplfvHADhP39+TrwgLbQKQP60r0W:Z1UKOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999470, "uuid": "6cdb04d7-9dec-4746-b007-c4780ac3ac1f", "value": 8577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999470, "uuid": "14f4d1e3-302c-456f-879f-736e080119ee", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999470, "uuid": "f369bdc6-764d-4e38-81c1-b2cc074466bd", "value": "CnvnTCNO7434-M8E1MPGXGK.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee2deb7-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026696, "uuid": "52683f42-bd81-4fac-8fd0-06ae2392275b", "comment": "Malware payload (Mirai)", "value": "d92dc1887ad6387e63863e0bab4ccdac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026696, "uuid": "163632bd-e3a3-4ca4-aa22-3c8dc579b782", "comment": "Malware payload (Mirai)", "value": "27660c6b654cf8fbdd258374e2af013c30b1373612e7b96b26a1e043be674fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026696, "uuid": "9d1e4bee-9143-4e26-b677-e69145ef736c", "comment": "Malware payload (Mirai)", "value": "2404cf78664fbd57e261df5d57ea1175bc3a7d55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026696, "uuid": "c3ad53f0-ff70-48d5-8aed-f4a5f3301e85", "comment": "Malware payload (Mirai)", "value": "419fd29dcaa91d04e46ec199c5125c023c399840f4084d20cb1e86ee786524bad27f222a5ee4e95ec5ab89e94f0d459e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026696, "uuid": "2249f77a-ec90-4346-956d-69fa631bc6ab", "value": "T1F2830995F8818B12C5D512BAFA1E118E3313177CE3EE73129D206F24778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026696, "uuid": "daab71ab-c3ee-433a-884d-4e722e39efe6", "value": "1536:e7ntU6eKa2Vy6RsrTMGn2vGaC7CuS8IQkMyiJTyghYsHn7Wd5BGYr9/g:SGKxVxhI2vGaC2uHTyghYsHnKdjGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026696, "uuid": "c7dbbd9b-f3ab-4986-a9fd-ed64a1a312da", "value": 83612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026696, "uuid": "564e6647-6bd7-423a-b7ad-85146099149f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026696, "uuid": "67d6729b-e1ff-4587-9309-72559c3b7b48", "value": "amsarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffbdd45-091a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771014511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014511, "uuid": "b55f3ce2-de5e-4f64-9566-8aa04242415b", "comment": "Malware payload", "value": "4245d78b466117c3ddc83d9d900e0e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014511, "uuid": "8a5b489b-04d2-4ff6-928c-24520602ad31", "comment": "Malware payload", "value": "276acd08d9d5ec35b23ce8b46c53bb85fc0bb59036e90652aec95ea2edec59e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014511, "uuid": "c0ca9916-2d39-44ef-9898-e112ba96b178", "comment": "Malware payload", "value": "c5a34526364d6b79b3b6037e517ffe3252091764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014511, "uuid": "282d5ff7-7f34-430f-888e-4fb605129ee8", "comment": "Malware payload", "value": "4068c3d54b124bcb385ce8a6feddb51a1dce83843151883f9b435693a48a005ea08b3af8b49b6b905c4da1d21fed6b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014511, "uuid": "3ff65859-31f7-4124-8ef3-ff33264b3519", "value": "T16503E1D4D22B0F71DFBFE8D78D90CB443B212F851212F6A2F45A5B05DAC36B662164E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014511, "uuid": "7468519f-2eda-4e27-937e-0efeba81002c", "value": "768:9u2+G+99ITOiBiKx4/PxoR/s62lGsEAoiyoyf4uVcqgw0IR:zy99sTBzwxW/s6gGsef4u+qgw0IR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014511, "uuid": "a0c540e9-deaa-477c-909d-0bc7ac37e6b5", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014511, "uuid": "cb5f60b7-7482-4796-92dc-33c2fb02487d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014511, "uuid": "97f6bd2d-5eff-4868-bac2-459605c568c3", "value": "Calix.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de927074-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972552, "uuid": "c720ebed-c5b2-44bd-b4c7-8f0061bf4ead", "comment": "Malware payload (Mirai)", "value": "d086abc0add469370fc61be6e1f6a206", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972552, "uuid": "e214a5a2-c103-4c3c-9897-64b09dfc284f", "comment": "Malware payload (Mirai)", "value": "27e87e858d601e1d901b2085f448ff226d194d9cabf28aa0c61dc09c3c0cb93e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972552, "uuid": "81811efe-5e7f-4759-a814-037bd789171f", "comment": "Malware payload (Mirai)", "value": "4898d06ca3da26939fc4212230a6a401455f65ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972552, "uuid": "5a672745-7882-4db1-a318-a676513c1e25", "comment": "Malware payload (Mirai)", "value": "830d0aef0d9077aa8d0cfc29515929e720658a0a6dfb1c613c5cdf79e53558613378b783bfc7971ee47d862c9da4fb16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972552, "uuid": "09380191-7125-4aee-85e1-0a574513cbc1", "value": "T10E115196416242336CDE9D6FB2B2C058E494F3C5EE95400BEA94ADB6993841C7CDBA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972552, "uuid": "17cc1bf8-fea2-483d-9c59-d2c98e33e18d", "value": "24:kh5tR6/1M9GuH8J4UYFxuwHU7VmRUWblUpc:k98/1YGucJ94sw07VmGWbKpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972552, "uuid": "58ca0099-e3f2-4fa6-b7b8-601da338f4b2", "value": 978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972552, "uuid": "249eccf2-bd24-402c-a7cc-346d59f4cbbd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972552, "uuid": "0c658fb8-e6a5-4aca-955e-fe149ca84864", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3365a2b1-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "9beb6fe0-f776-4897-ac25-46248454f74d", "comment": "Malware payload (Mirai)", "value": "24ded3b3489958b1fb466940aea68aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "fce342df-3028-4f5b-8eb2-dd812efd5328", "comment": "Malware payload (Mirai)", "value": "28085fdf2aff7163530e53464c19771537f677c439414a05581732371e7ed6f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "214801f2-23fa-4df7-85de-f3baccfe8555", "comment": "Malware payload (Mirai)", "value": "5a090a4b21d678759c133a43d5f4a125d88f9b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "aa64d2fb-37ef-4204-ba55-758d2bf81098", "comment": "Malware payload (Mirai)", "value": "496a72344b332823e596b9d9dd07bccce3d3b2303e6f3b3e4fc854139c6506f22b8922f0045e297bc0721ed7480845f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "1c8eab1e-f8eb-4ee7-b4e0-38e8a152a2ab", "value": "T14CA2E0F7F8F50C4FCC96D23A918E54CE646D592613FB03912BC714B29E42818FC38950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "4969ccca-a94b-4b78-bc63-1ec92933da4f", "value": "384:MEcDqRfKUWFH39z+/492wMMM8PIdSpiEGCVqHkFpAQjM0DBi+v1RpP:VMkKJFH39CTwMyI8E5CYHWGCbdpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007913, "uuid": "87987746-c0c1-4c1d-a363-2ac0ed902a6b", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007913, "uuid": "7f737085-bbd3-4d4a-88c2-9c6a311b576a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "f639bd28-22d2-4450-98db-c92c8ad17f64", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270bc0f2-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955494, "uuid": "c26dd3fd-c2df-497d-8a7c-34222f50323c", "comment": "Malware payload (Mirai)", "value": "4371a6753583a77256a1cbda9eae93f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955494, "uuid": "4909a8a8-555c-4095-989d-decc44b7709d", "comment": "Malware payload (Mirai)", "value": "285a125797c5a9a895e1510cedc3632312cd142e32e7c2650cd6dceccb387e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955494, "uuid": "222fc7a0-5ec4-4d26-b531-d2b2dd59775e", "comment": "Malware payload (Mirai)", "value": "a867bfce92232e1ad6a16449a943ef0d504a7856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955494, "uuid": "a89235ed-2713-450b-a9e1-b0aa9aef4c8f", "comment": "Malware payload (Mirai)", "value": "1b9815c3849319cddff0d00c75bf9bdc0435fa2f2a59e16b665a5b392dce19bdffb0b9e7e05a847b28e065b982ed574d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955494, "uuid": "3d8134e4-6d94-494a-ac18-0f2d718a683d", "value": "T10F83AD73C86A0D28D44844F070A4AF3597A3E011C59B2FF6989ACA79D08BEDCF6463F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955494, "uuid": "86f6e33d-d236-45a4-80aa-e7d9c791ce6a", "value": "1536:uUJrLx2Pg46AQGb7oqvWK+BuDI2IieCnsF/cZepn:u0LxvWb7Jp+B2IielRcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955494, "uuid": "10c82118-c9bc-4d60-8edc-b705ca383de1", "value": 81184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955494, "uuid": "dc8f3e93-35b9-423e-9452-df4bb3079be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955494, "uuid": "ea813384-7c2d-4410-aca1-d5585f4987d0", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d775dd26-0877-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770944623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944623, "uuid": "2f37c30f-0085-4333-9eb2-46dd0f1fe39a", "comment": "Malware payload", "value": "7d94c541ce5120c9bbc6dd955657b294", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944623, "uuid": "6266b734-4380-42ae-b528-54e02f21ae20", "comment": "Malware payload", "value": "2adc604d1cd274db8855842e3140e4086eeb50bf54cc1d3b5b73d1a69459a3d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944623, "uuid": "9ddf7cb9-d3a8-4e85-b3d0-2174699c7945", "comment": "Malware payload", "value": "33696f221f52147eb184a5a9129d3932f350c173", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944623, "uuid": "d687a76b-ab62-4ebf-8201-10100f6e2b13", "comment": "Malware payload", "value": "17a2b17cca52eb77d3c11d1e3d6eec577509e842016ca57b47e82c726ab9ed51727296f674be019dca0704f12bb29753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944623, "uuid": "a9109324-3f81-4738-8e61-fe917fecc8be", "value": "T143D423AAD001FEF3F2D56AE66B46C25C4195DB6D6C343216FC7C2CD2430C6B64E1AEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944623, "uuid": "0e4961ef-0c71-40e7-9213-79fb95f533b9", "value": "12288:Txk7p6cy0w9RAohiTORUVa7uMyYDFu4fScQelvXyVgHd54HU3iS:Nk7O08RA+UVa7uMC4q1wf/4Hyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770944623, "uuid": "8b241077-d593-41b2-810d-c476b4928e4b", "value": 600747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770944623, "uuid": "0b650552-4ba2-42e8-97a1-2a27ebde7ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944623, "uuid": "2b189d8e-2d9c-4d18-b99e-2fc5cd5dbb44", "value": "bizy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1adbec4-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770996207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996207, "uuid": "f42e818b-af83-4937-ba38-f724d069dc2c", "comment": "Malware payload (SalatStealer)", "value": "86ea721e0c4e3e35a4e37fb5cb3feb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996207, "uuid": "797327ce-cd84-4651-ab0d-6c10b2861efb", "comment": "Malware payload (SalatStealer)", "value": "2b4ad62c7af8c5f1dbb3178e673f7a66c7855f31b85bc14999e4fb7c5ade9892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996207, "uuid": "fddfaa6b-f087-44ce-866a-576cd39046b6", "comment": "Malware payload (SalatStealer)", "value": "82d647791d63a65b179ca63c8afa4c2541167a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996207, "uuid": "37d68468-da7a-4022-89f9-1af532defbb1", "comment": "Malware payload (SalatStealer)", "value": "5ea85efef1865ad1443fcb565e2f01c3864b47ef749d8d7c8a6fc8733d2451c2230a63f6e6de77db9529a15358006089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996207, "uuid": "706ed50f-5783-4519-930f-942c91010f35", "value": "T160C66B01FA8B98F5E9031835416BB23F63355D048B28DBEBFB543F6AFC7B6811966205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996207, "uuid": "21ce6411-e801-4695-ae70-b8bae6a94767", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996207, "uuid": "957669d9-c00e-4e57-8c4d-256da8dc6798", "value": "49152:+2h3b7TfAa67WCqEQRI0aLXFcVBxVjyTzACZqL/XNdajA59RGLndzrp5om93cIzI:1Fb7TkW0d/qL/ajyIXXOYl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996207, "uuid": "9228ad11-87cf-465c-aaf8-e897eb4f20e4", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996207, "uuid": "9d78ad62-d375-4b32-9aaf-bdc714677d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996207, "uuid": "8281c5ef-39ef-48a8-8ae1-b4089edb7259", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4142c59e-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973147, "uuid": "b8c617d8-a52b-4e49-9af8-ae7462741e5f", "comment": "Malware payload (Mirai)", "value": "3c0f3cef473ce26564a7224c5e92f21e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973147, "uuid": "d8efcdcb-e31e-4ab6-ba77-b20d48502854", "comment": "Malware payload (Mirai)", "value": "2b8d3c0b9d9d686b5a5f9d137e1f3e58f045cd9434a11ff7a2ce40f0f15ce13e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973147, "uuid": "f6d2f029-af70-4aa6-a207-3fd6c2a5a32d", "comment": "Malware payload (Mirai)", "value": "fe7a812f4754b65e15d3f7ff0f73e11552df2d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973147, "uuid": "d5ec926f-16d1-4755-aec8-a5d9f07c1a9d", "comment": "Malware payload (Mirai)", "value": "ff59cb59e9d077eee5211ce02a7dc10beaab50c9d20db06898162680835933476717d8f0a88c7a72ce6057c2e8b21d24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973147, "uuid": "1e4e5f1c-88b7-4c97-9654-333c7c2a387c", "value": "T16E531722BF224E17C4C675F622F34720B5F5AB5B2CB84A56BC616EC86F186C032567F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973147, "uuid": "9b56ebf2-8f77-4553-9cee-b44617d43af5", "value": "768:Q/uYxGjr9aoIeOCVXTzSKr/zbOeO+E5V7hGju22tzx1tagwIh:QWYxkrpVXTzSKrHdE5KotagwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973147, "uuid": "b6759216-d27d-46c2-aea2-6f4aef21df39", "value": 65284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973147, "uuid": "3fa6f14a-fba8-4282-8f5d-597d8b73ff49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973147, "uuid": "f96dcb27-8404-41a9-a239-14cd1a48da46", "value": "sys_sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80139d45-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977977, "uuid": "6a849a77-2715-4dff-93a1-e97990a44bbb", "comment": "Malware payload", "value": "1f2b11d84917000954a92de4226453b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977977, "uuid": "c2b8c694-a8bd-4547-b88c-0bc689abe885", "comment": "Malware payload", "value": "2bbd7a1a1c2094a8a7836beafc7ff4450841de62987b69fb6e50e2c90e8049c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977977, "uuid": "224cf541-175d-4916-a530-b14e66184ad6", "comment": "Malware payload", "value": "2c8af63f6eb4bb329b4bb0aec4bcd584d8bd8221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977977, "uuid": "80562b70-dfc6-4ffd-9569-d6a65b318f7e", "comment": "Malware payload", "value": "a172db95629037c451a0d651432d8477a08321b8832eb108f6e3063697b4fc4253b36d3df6fe0df3faf6cc832dadd484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977977, "uuid": "f02bbea1-4cd0-4bc2-8dcc-a596068eefa0", "value": "T1F93422BDE7345B729912B9BEF122DC7810731ADC73DCB7406FD801ABAC9E10A8445E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977977, "uuid": "1f120ead-a06b-4a61-992d-3bd65775f0d3", "value": "6144:JbnvGhoqRFijWE6VCkEscTzv+2UgNFpZ0GAwywrLXYZ75J:ZvGhhFijuVCUKm2UgNTukLXc75J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977977, "uuid": "b824a6bd-b163-46d1-a444-1f32cffb30e1", "value": 243392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977977, "uuid": "9aee221b-ad48-4cbf-9a7c-9a468447b211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977977, "uuid": "da82fc4a-e56a-4aed-93e6-53e0965a5b92", "value": "dlr.POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36db58d9-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770975277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975277, "uuid": "5e2d7c3f-244c-4d09-ab44-2bd3b21398af", "comment": "Malware payload (GoToResolve)", "value": "72d1b2dcf227b276a4b2e3de0d7dfbf3", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975277, "uuid": "8ad5c6f6-3fe2-4635-a929-de148c132adc", "comment": "Malware payload (GoToResolve)", "value": "2c2f8a174c26f3c5c1974864d064eef1775f33c7c99963807925476cc6a06e50", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975277, "uuid": "231cca79-edf7-4f62-9b05-75c73eda6d7c", "comment": "Malware payload (GoToResolve)", "value": "55717892a02fd71515a446d4e7362bb5cbfa906a", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975277, "uuid": "2b33031a-65bb-4de1-8116-36b80357ead0", "comment": "Malware payload (GoToResolve)", "value": "8918a6dbdd9cb1e57a399b2dfecd20a68c58fc50aea911e837d8cf86a7d75b5dbb075d8e075ff5f86d9a0a76e3d4ab97", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975277, "uuid": "abc212ff-7c41-4362-a6a3-eb400d6dd059", "value": "T11137333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975277, "uuid": "7b982700-9695-4c2f-9407-20f8b720d284", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975277, "uuid": "c36f1891-8867-4d79-a5ae-24cbeb81be8e", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975277, "uuid": "8e41b0f8-9777-4028-899e-8127c07b97ec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975277, "uuid": "98497b11-95e6-4bc1-8b9c-4b1c27e2bdfd", "value": "Approval3546.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0124b8-0914-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011771, "uuid": "c8eaa204-0cf5-4afa-8479-43c6d5d52b4c", "comment": "Malware payload (Mirai)", "value": "c6ac8035dc6f0368cfe1ac460b1f5bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011771, "uuid": "217a293e-7d96-43d6-a9aa-787a6db00025", "comment": "Malware payload (Mirai)", "value": "2cbec155d28de3c4b1557807ffdc2d62a6965dff8a22308a6a3365725913b238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011771, "uuid": "8f8f9453-b28c-40e6-af2f-81d1aa5c6097", "comment": "Malware payload (Mirai)", "value": "0653610f05016a82d4ad2e388dc0d43eb604fc51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011771, "uuid": "8e7a5f29-9a00-49c1-9333-9ddd73d7c1e9", "comment": "Malware payload (Mirai)", "value": "08d42b681ed25e1b22745e3575712b4be4bd0a8f7c566f20aa80afd77a44ecbf44e623f08d0c7737eb75b1bfc81223d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011771, "uuid": "6c17b06f-6337-4d13-a216-764eb0375091", "value": "T140D34A22753A1E2BC4D0987E22F74761F1F167DA25A8C90E7EB30D4FEF252206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011771, "uuid": "df3a62c9-b140-4f6a-a395-48c7d78835d7", "value": "3072:cBldhO3+cB9BT+iLgXxm/4b30p0U8bl8Dwnpi:aldh2FB9AzmonbmDWpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011771, "uuid": "d4e48b49-d1e6-433c-b53c-51056f8bfb80", "value": 140152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011771, "uuid": "28c9a697-c22b-4947-9005-6413e3844de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011771, "uuid": "138089af-bf2f-469d-8874-5cfd8c44616f", "value": "systemx64.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d103fc59-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770972100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972100, "uuid": "0c65b749-0ff0-412f-9149-48909cc84e81", "comment": "Malware payload (DarkTortilla)", "value": "52f701f80353a1d6af46b8af77bceca8", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972100, "uuid": "4e023978-276f-45d5-9867-415dd3b907a9", "comment": "Malware payload (DarkTortilla)", "value": "2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972100, "uuid": "08e5885c-e5a5-404c-bbd7-d11498fc030d", "comment": "Malware payload (DarkTortilla)", "value": "5e53acf67dc5784627ec5e2f4b08c4f8654f222a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972100, "uuid": "3715c9bf-7cd6-414f-a2b2-bb356edcbe63", "comment": "Malware payload (DarkTortilla)", "value": "873fbd7721aa05526cbbe52065606da6def9b112cb2e73af02c672cdad827d9d6068c8f107428f540f098f49e2c1cd30", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972100, "uuid": "61fa8092-e20c-474e-9c32-c186646dd22e", "value": "T17805CF0723D44A6CE5BD9779846A44D147FFBB42AB32EB0DAD0A50EB1D26B51CF40B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972100, "uuid": "dc063aac-fcd5-40e9-aea4-d0ffb9eb49d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972100, "uuid": "db019382-8e3e-4882-9e3f-4a9c927407ac", "value": "12288:vYs8r5p3hWg0fN8w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+LlzumHx3RuollU:z8fZNC8ZHKJCX0fI8mVS7lKiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972100, "uuid": "4dd07bfd-47b7-4a53-9e8d-1c351579306c", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972100, "uuid": "33e60ad6-dfde-43f1-a8df-882420b89aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972100, "uuid": "50f30264-68b8-4b46-98f9-95919e6c7989", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9db33c5-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770975470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975470, "uuid": "80438ae4-44c7-4400-8dcf-169af40ca1b6", "comment": "Malware payload (ConnectWise)", "value": "c53bb6bfd3e4f583f9d97be63fbff915", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975470, "uuid": "6325e15b-6df7-490a-9776-92c2e36516dd", "comment": "Malware payload (ConnectWise)", "value": "2de00f5e3e7da2169ce7232ff9f3768a22316da245a97cbbcccc6b5c12abe9ed", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975470, "uuid": "fc151fff-a2df-4861-a37a-58721be983ca", "comment": "Malware payload (ConnectWise)", "value": "b51ed4365fa12ad94f34de2491f77c69b47d3620", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975470, "uuid": "f57f2a6d-a0fd-4ea3-a009-99d64d267c19", "comment": "Malware payload (ConnectWise)", "value": "60d88585f1019c5952d8fa3c9a50d9fff6994a3f73868df3cc1c5ca1230810e656ef1d9202ed56acf520c6d1595496e4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975470, "uuid": "f521f1ae-c057-4de9-bc30-9fa114040074", "value": "T108A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975470, "uuid": "c939dabb-d904-4b43-b8ae-c23a6ba3dbe0", "value": "196608:qKaLNkbgzi4QGKaLNkbgRKaLNkbg1KaLNkbg:8WgziHoWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975470, "uuid": "9ec5496f-0f35-4f0e-9468-d9d5acb8d57b", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975470, "uuid": "8b95bd50-ab64-4fa6-b73f-c121b16ec6e8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975470, "uuid": "dff30675-6025-4885-9361-87aa44d3a541", "value": "ZoomWorkspaceinstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a74abf2-08aa-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770966425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770966425, "uuid": "66a084a8-13c2-43c6-8c8a-dfb797e0b1fd", "comment": "Malware payload (DCRat)", "value": "005003c6302572b47d22bf5afcdd1ab7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770966425, "uuid": "33301e0c-661e-4526-ab00-a0eda418b311", "comment": "Malware payload (DCRat)", "value": "2df3ac66595a4db6baf7e318174ffb258cbd6f376866825e95c91f119fd05063", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770966425, "uuid": "d51f481a-9bf6-4a3a-9ac7-be613e5e8c79", "comment": "Malware payload (DCRat)", "value": "01081349eacbe5109d3e1aba7a3617f82a3a2efa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770966425, "uuid": "5597815a-7794-4da7-a92f-95e4e91b264c", "comment": "Malware payload (DCRat)", "value": "b333c2158bd1d2055c0e00968451306542da0f9abd8f08d2cd7c87d5f6e9829e5640991460ae77580f137155f0354aa1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770966425, "uuid": "3a03ec62-9641-4ed6-9033-bb8f8221d658", "value": "T19995AE027E40C951F0091633C3EF45885BB4ED20AAA6E71B7DBA3B6D55123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770966425, "uuid": "c1e0e33c-8f1e-4a92-b2be-83997533570f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770966425, "uuid": "fd788d8f-e868-4d3b-b4e8-c4f0464b0492", "value": "49152:UbA30jk7JsYzKaj44a8cSh3aYNsuFi45zlTAEGQgg5fqoPR:UbfaqYzKaj46VNsyicNVGQggdqop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770966425, "uuid": "31142a70-d4a3-4dd3-a1db-42d66d439de8", "value": 2050280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770966425, "uuid": "c673b3b8-625e-4869-be87-cedaa93d03bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770966425, "uuid": "4000f8d9-eeaf-4d35-ae82-cc86093c25cd", "value": "123.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aecf899-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007979, "uuid": "f608a83d-11ac-40ea-be03-5067479e5e87", "comment": "Malware payload (Mirai)", "value": "9a79bb604465bcad2ca5d4d7ee13689f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007979, "uuid": "40543325-487d-4722-8d66-fda8682357ec", "comment": "Malware payload (Mirai)", "value": "2e0fd8a11f0d40d88d2562f384ee38fb65b448db76cbff699add9f3b9c910a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007979, "uuid": "a6152b94-c3b8-4696-8493-9e2361f05307", "comment": "Malware payload (Mirai)", "value": "ebfcf4d0398145191beeb1e6b2f6aba782a5a02e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007979, "uuid": "a0614ce9-84e6-4521-9ef4-1d8d7a5bac79", "comment": "Malware payload (Mirai)", "value": "2ac68a357648107e1bd95e62094c0dd6d22d8edfce5bd784a2556243c011837f85d336b99573f5acec8352f7a5e2513f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007979, "uuid": "ea1b45b1-182a-4296-89d0-1ddd81b525ac", "value": "T1B363951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007979, "uuid": "a16b7b5b-4db6-45f5-adf5-f33279ae4f9c", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAg:UnN4ZH2SyOyuIq8LMpIUq+cvtpvXzgL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007979, "uuid": "599bdb68-fe14-4dd5-9be1-0dfb26f18ab2", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007979, "uuid": "69ee7349-f93e-48d9-bbc9-4d6b073f6f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007979, "uuid": "984bc385-403e-4df8-9ab0-7889a0c3aa6e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cff4e8-08c0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975624, "uuid": "3284017d-aa3f-475c-8dbb-4be142ad9215", "comment": "Malware payload (Mirai)", "value": "103be6a29f160ad53631b220d04e89f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975624, "uuid": "f75b4b1d-d5fc-4504-b89b-d320bd0f930b", "comment": "Malware payload (Mirai)", "value": "2e4c66d75b546ca6b090ed4cad558a20b61b78a177e058118dcf0488dc8d33eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975624, "uuid": "bd89ebbd-bc50-4aed-ade8-f9db239f9992", "comment": "Malware payload (Mirai)", "value": "1eb39dbc252628e5f5ad83c25a8c25cc40ee6c30", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975624, "uuid": "61859d5c-99e9-40c0-bce3-ca30d1b90295", "comment": "Malware payload (Mirai)", "value": "996664cb26b3454fe4fb8e264bc279aec49dac09add5594b9fa87c473ec5ac1b0284a3b5ddaae826fcbc054d21c096f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975624, "uuid": "093fd25e-984a-457e-8ed3-9cff8946b897", "value": "T1C7D42335A74F81CCE7DFA43CA2E3199ACC1A111BB9940CA70F047BD7E905B197B9E158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975624, "uuid": "790af828-101c-406b-8414-3b59cec902c8", "value": "12288:k+Rh/ysdevkih94u2gDURJ5ysdeVkQHXS72gt:ZRxysUZhCujIRPysU1HC7jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975624, "uuid": "48226cc7-391c-4836-b093-1c26f66a6148", "value": 635048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975624, "uuid": "990fe280-f9d2-4cc3-a102-df36595717e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975624, "uuid": "42a243c9-a016-4596-814f-0249aaf301c2", "value": "all.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e852367-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949171, "uuid": "a692f8cb-c601-4445-9f05-40ad1a66df79", "comment": "Malware payload (Mirai)", "value": "0fb056fdf591723f1ba8682b0e81f724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949171, "uuid": "788c40ca-0ebb-4868-bf5e-3c82237b4a85", "comment": "Malware payload (Mirai)", "value": "2f3b881b2f735de74f8c003fe0091e24c14d44d51d0e7512e5056de9ddc8e892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949171, "uuid": "8e9a627d-0a9d-4814-b777-51c5f17bdfb7", "comment": "Malware payload (Mirai)", "value": "e999b9a0aee95dcdeb2693c8a03aac4a235c0e46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949171, "uuid": "16349521-9db8-4ee4-83f2-1ca02603354a", "comment": "Malware payload (Mirai)", "value": "990e0f9aadf385d3757f6663a8d28870524ace4f1d1ba0adc6eb81f086e573e0f61b2d541a909c32501376e63d35be7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949171, "uuid": "02f8980d-7af8-4825-a4b3-325eb0ed9ea0", "value": "T1F9630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949171, "uuid": "709d62e3-c8c2-413d-9d09-8d4ab0d59f3c", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949171, "uuid": "0d89af16-75d0-4a79-b580-882e1bbee6cf", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949171, "uuid": "fbc2a541-c4c5-415a-a6c9-da42e3b6f477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949171, "uuid": "a200ba14-9c07-4e74-8a08-decf291659a2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46198f4d-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999355, "uuid": "ad1c68c9-f5f1-4c96-83e2-8c17932ea13e", "comment": "Malware payload", "value": "f8a9ed0447e8ee517e092ebf0f7d325d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999355, "uuid": "a2b0d62e-6152-4210-9897-d26c0bbd52af", "comment": "Malware payload", "value": "2fb691095c3ab9ea46760d9c6b596e2f6a62d9d07fcbeffaff6a15b91465ce91", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999355, "uuid": "b3b2cf0f-4886-49f5-8270-e78c7a2bbaa6", "comment": "Malware payload", "value": "62b2047724f9cbd33b55b58dfc9f07477b8f0e1b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999355, "uuid": "33a95c7e-5c30-4c8c-80e4-f59df3bc6989", "comment": "Malware payload", "value": "0e30daf07583ad23a5c3d415aa114867e30931c0e17bd64f13cb5df5318b1b4f41ca7ae34d2eae0fbd2cb2bc6abb239a", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999355, "uuid": "e6526b7f-e35b-4dc2-a078-6eb9d18a2052", "value": "T1E1462332B9112C63C5A04B76F22F3B301D2D72074B4E96E7A8A9B1877B86DC7673D815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999355, "uuid": "7dc125b3-b108-4fc0-94eb-8a192d9b3ef3", "value": "49152:YHiM7Ssfo95jwB/P5WUry2kGT4oUkbfYgGfkG5MNqKm/5rD462/g9EjQPor:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999355, "uuid": "6ce62bdf-03b4-43ad-96dd-7c66f397ed4c", "value": 5730304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999355, "uuid": "8bf7e110-12de-48f6-b5a7-fe5343d9a0ef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999355, "uuid": "d45cf468-cccf-4427-b9d1-9f8c2dcd6b5b", "value": "CJIUJTrf-31474198YM5DMJYP51801zcup.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d36a9d-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014524, "uuid": "591121aa-4a8f-4b67-9ee3-ed180a8ce733", "comment": "Malware payload (Mirai)", "value": "fb38100190f77eaa7368ad59af3df543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014524, "uuid": "6f502cbc-338c-4fbf-95d3-3482981365cb", "comment": "Malware payload (Mirai)", "value": "2fd0105c664b4f47e23f9afee86457842cafef81d348b33bd9f4e087cc1b1052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014524, "uuid": "df9417cb-03c6-4482-996d-b57c12e80bb2", "comment": "Malware payload (Mirai)", "value": "2ae9560467796486b7ac2351b8aaca1fbeaece29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014524, "uuid": "79591b30-1783-4932-9875-887324e7aeda", "comment": "Malware payload (Mirai)", "value": "cb1894996cfc63de88e9cb65db8fada078acd729accb3fd892a35d63168a65363ec8fbc6d58fb7db5d9f56fc88794d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014524, "uuid": "2e16b77a-d0d7-4d2c-9a06-80b5055a67bc", "value": "T1D703F111A7B53E5012600C3EDE914DC367C1AAB246C978721EC44ABDD0BE84BED3B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014524, "uuid": "0a604a2c-9711-44e7-bf89-9541a95c5217", "value": "768:PK4lJPdZxsD/+qVyQqg10B5FsgUnyqlrtvj01Si7s3Uozw:BSBVcBDPUnzwmzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014524, "uuid": "275a6d84-95d5-4b71-b258-5c35d083ab6d", "value": 40900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014524, "uuid": "ecd2746e-4fc8-47d5-ab87-5aef56da0b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014524, "uuid": "644c5a38-512a-4379-bb15-7e1978eedb34", "value": "Calix.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b9e9f1-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770975295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975295, "uuid": "6041e00f-fc25-4a07-8e91-4a6f571b0354", "comment": "Malware payload (GoToResolve)", "value": "76289139dcf0815c109bcea8bbc3661f", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975295, "uuid": "a7bdf23d-bfdc-43c7-90c8-6b3fdfd2c7b8", "comment": "Malware payload (GoToResolve)", "value": "315c250649f6679a3c0f7b0a45f2a8782566765b2f40be26dd3e52381406bdff", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975295, "uuid": "8a26a620-001f-49c9-b65c-b7238b85445f", "comment": "Malware payload (GoToResolve)", "value": "4be4a38656c38a93a686250ec8c4267deb30852f", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975295, "uuid": "b3e6adf2-87f1-4ab7-8cd3-683bd1130592", "comment": "Malware payload (GoToResolve)", "value": "eb6f8e530c30431a5d661827c428b1abc54c5542e2a202cd2a42c8f26603bbbd60f1adbb5c48466a961fca22f5baa1c8", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975295, "uuid": "5a3094e0-eb16-4036-8729-0ddb87df1774", "value": "T14737333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975295, "uuid": "0eb8ceea-2695-43b9-90e4-9b5be1b38d71", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975295, "uuid": "7b49dd96-dae4-4ce0-9632-cadcb206f612", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975295, "uuid": "ea341615-3923-419d-bcf0-cf334163fbf0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975295, "uuid": "71a73d80-a1af-47d8-b78d-26d43491b13b", "value": "Re45766712.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed6d3dd-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014590, "uuid": "1e92f660-21a3-4e95-92c0-f0cd46819fa2", "comment": "Malware payload (Mirai)", "value": "82985b972b8763621c9982242d6e23d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014590, "uuid": "d9a77a30-4fd5-4260-bc3f-f9eb6c099795", "comment": "Malware payload (Mirai)", "value": "31711f710fc519c66f958dac5d9f547b825944ad768d6df297215f57528324e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014590, "uuid": "1534b9ab-5600-461b-b2a6-d0bc4658e9f2", "comment": "Malware payload (Mirai)", "value": "d9760e600fb4e8ab78d61cf219e8f8f181e68862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014590, "uuid": "141f8e58-3bb7-4e61-b517-385d3a0946af", "comment": "Malware payload (Mirai)", "value": "5aa19d85b97bf5325dfc3cd4e2db09e59b4e4482af4a663f359e8f468b04b9e767db8322eb89a12ae50debd2d1487794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014590, "uuid": "5c377298-49fb-49cc-81d1-162af22e41da", "value": "T156C3F709EB610EFBE86FDC370ABD070525CC651722A83B7A7574D828F64A24B49F3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014590, "uuid": "3148c4f4-97a3-4efb-bdfd-e62cdc4d1b3f", "value": "1536:5umOnCpYPqcePxR0h1YjogaAHGF6ujHepM6gl6cZeWrEUcqlu1fkYdRJBDi:EmOnCpYOR0yvO6gscNH43i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014590, "uuid": "2f1969c5-0d89-497c-a7ee-89fc4a6fd1a7", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014590, "uuid": "63cceae1-3286-4d00-9499-da710585b3aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014590, "uuid": "b10396fc-689f-4747-a596-83d932d9f853", "value": "Calix.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f49fba-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974063, "uuid": "fdf97207-2e6e-4c38-aacd-f3765971659d", "comment": "Malware payload (Mirai)", "value": "7bb0a864688d34cb68e502d9ca6df6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974063, "uuid": "37114bf9-192f-4281-af58-602ffdfbc682", "comment": "Malware payload (Mirai)", "value": "31d66a38ecf2740b1111be291aa0e56b78cabbcfd1226d26a40e5e60b9c9eaa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974063, "uuid": "5dbc3340-9e53-4d15-a0b1-1ff60b9c620f", "comment": "Malware payload (Mirai)", "value": "ad5c74a3eeb93c1666ba8efefe1bea6d760e82c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974063, "uuid": "4305c2b4-70d9-460e-9ec6-5ced5c24a905", "comment": "Malware payload (Mirai)", "value": "d8376e7b588f61507d7a15656db16b0dd201b62eb61a2cb005967b423df20885308d6331b477b1b40342e0bbd0a70f1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974063, "uuid": "04a47a7a-1b0d-4ac9-84cb-b08ff8763963", "value": "T14DF47D2AA2F3B1BCC117C03047DBDAB25532F47516306E7B16C4DA353E6ADE02729B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974063, "uuid": "8e38e207-6ec6-4320-9cd5-a168dfae2d53", "value": "12288:nia8WRugqbOyI/TeGObgN2Q1yVNgnxDnjdzHD6dQ6h/4KoRDS2CayU4zHX:ia8WRugqiyI/TeGKQoVNgnh4R4KoRDSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974063, "uuid": "f9d454aa-d3c0-4bb1-b2ad-a02327bf7e24", "value": 771672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974063, "uuid": "e26f51ed-f0a9-4110-9507-2dfb04d5f8e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974063, "uuid": "130eb92c-bef8-4005-99ef-4a4944489afb", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829c2871-089c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770960372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960372, "uuid": "a93cd88c-92d0-4239-87d7-334af8c2784e", "comment": "Malware payload", "value": "3f60d64788f25811610e3c5f92e37891", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960372, "uuid": "b9e741c1-6444-430a-9240-e29b75cb0ef0", "comment": "Malware payload", "value": "320c8de9d2249f4e50aaacbb3e30b4fdc48b038a92e087122552f35f6353e0b7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960372, "uuid": "c0ed67d1-6f77-484f-9ae8-9c123b94a248", "comment": "Malware payload", "value": "283dc3ea944fcd91578a0ec144a600c8dd595a17", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960372, "uuid": "964aae4e-7c97-443f-a036-d80d104e6e18", "comment": "Malware payload", "value": "6a0a9b4612d052834d68c084298d7869b55d395691e321922d8c3c49b5011c117104711a849abc8e2025e7cf5ca48154", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960372, "uuid": "49d7f92b-1ef8-4f93-a847-b18e70aefb1c", "value": "T1F7455E23B6C67D3EE05B0A368A73E158D83F7361671A4C5687F0184CCF295A12E3EA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960372, "uuid": "36d61adb-a0a0-4c78-93b3-09c707278a79", "value": "39c61d6731c29eaaec79b77e3082cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960372, "uuid": "fac1f648-d341-4a45-9b17-4de29907ce64", "value": "12288:cmE/bX6eP3jAe7IgNNHpGXUfBFmUTgW+adegB/kp2Nw4s0W:cd/ueP3jAYn9GXUfB4mgRadePCw4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770960372, "uuid": "398712b9-b1a5-434b-ba29-29640e4c370d", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770960372, "uuid": "57103960-09a4-4156-82b9-ff08a1f2f223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960372, "uuid": "47b93337-3f9c-4aa6-9cd1-d1ae4b5c603b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76bf2e3-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975600, "uuid": "586c7809-5d5e-40b1-a9f8-460e9d3fc242", "comment": "Malware payload (Mirai)", "value": "3a31d391daec3c0cc915d5f76b298881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975600, "uuid": "c87b87ba-a3ad-4531-ab51-3477343cb89a", "comment": "Malware payload (Mirai)", "value": "3248d8503d5742ecffadc4739878835719fbf76f91c4e8b6d4f3cc304655fe7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975600, "uuid": "f8b5e235-e524-44b4-a0f7-fd72cce7ddfa", "comment": "Malware payload (Mirai)", "value": "5b85db4dd59232916d265bbcb3ed903d411daace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975600, "uuid": "1b6f38ae-e578-4e5b-8624-79ca810f0351", "comment": "Malware payload (Mirai)", "value": "ddeeb81e07c6e174508e18da0053773a15fee08db5fabe7c75c6b91a685dc5c27f459d930dcd8610ee0e9867253cc761", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975600, "uuid": "a960161e-5084-49b2-93c3-b146b498eaf2", "value": "T164233B02722C0A47E1525AF0353F17E093BEEAA021E4F688690FDB5A8675E771186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975600, "uuid": "f5586887-e7aa-4a8b-81e6-0ffead375818", "value": "768:WUz+TTPyCCKRMbBJsZFRHX8gGZ/vSUXSbI3KBd:nqTLfC8FRHXpGZRXSbI67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975600, "uuid": "ff43a25d-ec80-4ebd-a3f3-2cd483548917", "value": 48324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975600, "uuid": "205759ab-7014-4b63-898c-695f4fc24f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975600, "uuid": "8ca60f18-c311-4f21-8a86-8b5952e06c0a", "value": "StormStresser.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f650f941-0898-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770958848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958848, "uuid": "7cca05a7-6b4e-47a5-ad45-8b6edccd1e58", "comment": "Malware payload", "value": "57001ee59f55365cca0f26b6a5a2280c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958848, "uuid": "aee94bdf-dddb-4bdc-94af-f78b50bc1e5a", "comment": "Malware payload", "value": "32f8ef122fe29ab7a4cb40a75aef68314c37cbca96b3bf63032170db1d9cb9c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958848, "uuid": "74b5f11a-1946-450c-9250-be9cf0ae9e4c", "comment": "Malware payload", "value": "c0206e83b996fc2ae730d1f559e9396bee796af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958848, "uuid": "931a8a3a-a98f-4269-9b31-839a7bbae71a", "comment": "Malware payload", "value": "9d513c70b08efe644d4a34324c17f043da66807081139c2971517184a6d5eb65966fc0e7a65258b301913cf88f3ed5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sae", "colour": "#93E1B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958848, "uuid": "e98179ec-ca37-4061-87e4-fc33ba5b1ff2", "value": "T142A68C5663B400E8D5B7C078C9579A27E7F1BC5507709BDB02E0AA6A2F33AE15E3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958848, "uuid": "c917c3db-e7f1-4153-afb6-c141b5030e53", "value": "f4e0dc560d30fc3b66cc1490cde613ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958848, "uuid": "98e61454-3801-43ed-9603-13024d3dab5e", "value": "196608:EyOC8DfUVniOwv/cPmYVITagrniGW60pXsET/1Q8kb:EAniOwv/tYcaMniGW60p9T2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770958848, "uuid": "80da787b-9a08-40b8-83a1-a5694f0f01e5", "value": 9619456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770958848, "uuid": "ec0c24c9-8126-4a7c-a47c-ed4aaa062af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958848, "uuid": "02a13630-e274-466e-9c2b-01b40f33ae8a", "value": "LetsVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e5e360-08a4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963834, "uuid": "8c61a2e7-4215-4051-b03e-e90c365afb29", "comment": "Malware payload (Mirai)", "value": "de4832a62cc816eb37dd7a14e2f6c3e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963834, "uuid": "a0cc85b0-c403-4e38-9070-c2f4e936c404", "comment": "Malware payload (Mirai)", "value": "356f94b7b79257fd9dbc61e7509e7c42c6aede5591a39bf167c599f1ff109878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963834, "uuid": "04aedc5c-c5bd-4eb2-b299-17ab5788db9f", "comment": "Malware payload (Mirai)", "value": "36f8623fa0297c0e28f055f0f6a6dd31fc960ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963834, "uuid": "ac711d67-f712-42c3-ac65-266db350174f", "comment": "Malware payload (Mirai)", "value": "f94e4e1c7d7383d381de07332854218ef5d6aa27de7ae5da53005a5efc3c244ee06ef972ac238f39bdec36059e963102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963834, "uuid": "fa4e4ed0-e586-439b-a29c-21116fa44add", "value": "T1C9632A0BF1525BBCC4C7D4308A9FD923A930F4E55230653F7B84637A2DE3B69092AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963834, "uuid": "ef7eed6f-3e0e-49b1-9974-525fb232d767", "value": "1536:2W3S2YNUgezsIw1M+VAXheATns3sY9goJKVuTgMFDKD:2b2YNUguFw1M+VAXheFs/ooVog3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963834, "uuid": "df1ebb94-19e0-41ef-84c8-756a31ed537f", "value": 67752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963834, "uuid": "9c83c14e-01f9-4998-a0e2-4122b3bb1466", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963834, "uuid": "574c8722-d33c-49fa-9e95-7ebd94513fe7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3881bdd8-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007922, "uuid": "612f6215-06ce-4326-a177-5907ecd0d5e0", "comment": "Malware payload (Mirai)", "value": "7353d033789dc271508bcf9b8b0c2c42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007922, "uuid": "ed027f69-6d95-436e-867b-e290542c50b2", "comment": "Malware payload (Mirai)", "value": "35a4a4040009b63b913e03b90e63b890ba3cf70e01de275bf5e85a521427ec8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007922, "uuid": "694dfbd7-0121-472d-8a73-668706517ac9", "comment": "Malware payload (Mirai)", "value": "004567a290975c9181a7e715a70d17526fe8e827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007922, "uuid": "451340e4-e011-4208-a27f-1af3127d433a", "comment": "Malware payload (Mirai)", "value": "152c5fccefc14bf94dfe8b4b30aea14bfb96dbc4675d15326ee59e5bc2049ec7db607d7b3f831bcfa5b89acd52ba2c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007922, "uuid": "dcf76fdc-de9d-47bd-994f-b35a582e42fe", "value": "T1D1A2E07AF6C250CDC447827C34A18BE76677D8A25354030EBA84ECC706E38E9D138E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007922, "uuid": "77978b88-7596-490f-a38d-7def186aaeb2", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbXxMhEux/9pCBxnMd+VNMZa339xTbtM8An:TDZ5Dw7RjFjcU+O24sDxcx/9pCHnMdyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007922, "uuid": "4b938fa3-7bce-463e-be58-9f71704dc99f", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007922, "uuid": "881068f5-8664-4ac6-a84b-7c732c999ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007922, "uuid": "7c551c34-f3f4-4aaa-b0c2-41efdda86e7b", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dbe8aa-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001713, "uuid": "6be9f10c-530d-4d52-9e0c-b6fb8b5912a6", "comment": "Malware payload", "value": "987bdc96df65439456556bc5b57979ff", "object_relation": "md5", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001713, "uuid": "9da0bb27-26cf-483c-ad37-b63dd7744e58", "comment": "Malware payload", "value": "35f95f16045dce9b1b1f65a46e9649146b9fa2bd1da568a0c4a2d12529b44a0a", "object_relation": "sha256", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001713, "uuid": "7e3a28d7-1e1f-4306-8120-906cd63741f9", "comment": "Malware payload", "value": "1956965a322350528f7b01d6729867d0e36955bc", "object_relation": "sha1", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001713, "uuid": "e4f4b23a-a472-4b25-a2ac-6acb4830ba59", "comment": "Malware payload", "value": "80e5344888579fca4485fc48cc67dfa8a611960e1930865b29201cddb8c15b58bc3c6d76af10b6bc0cbf3e5edea03b6c", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001713, "uuid": "dd36dd29-6da9-452d-b0af-e3696815b483", "value": "T1D62733D3E32008BDD589BB3970980221FC758964F2703A8F960166E5A9E7FD545E2F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001713, "uuid": "59f0e656-b742-4b30-8444-075c2e39fe18", "value": "393216:rYDNSbjEf5wTn+PulWkKNPrac8g/b3ygsdQJX5qQjBVxCXS32VDd:rYD6EOx2zp/bCgsdQJXRVVxm62Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001713, "uuid": "2ac76d6e-c92b-4c06-9875-201e2601f92d", "value": 21112195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001713, "uuid": "065c2f78-6ed0-4d09-b7af-7692265c7518", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001713, "uuid": "8b2274bb-2801-4117-bfa1-ae4072453ddd", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e990d0e-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977975, "uuid": "4a12955d-5010-4324-98f8-b8fb53e180aa", "comment": "Malware payload", "value": "576c9dcc0706fa6da2a0efaadcf0ebfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977975, "uuid": "9cde3235-9c5a-42b4-bcef-ff0cf28d0f16", "comment": "Malware payload", "value": "36547bb010ff2c2b7dee684cabccc7dea121786bdccfafb847e849b8adfd4506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977975, "uuid": "82cef802-8ed2-4906-94d5-98f70c0858f3", "comment": "Malware payload", "value": "b102c60aa145652f8871b4edfb0fd08036ad15b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977975, "uuid": "721fae80-86b3-4e87-a726-2491b84958d8", "comment": "Malware payload", "value": "74343c89426e131f4c5cd77a97df568baa7a7c3a98a29446a68c0f4e0f1c6889661e766127892f1e2887f8399958164b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977975, "uuid": "659edbe0-fb38-4692-9303-a2ea60c50262", "value": "T1B994C1A3F5705FC1C4164AB018E9D2380B59D6A213D33A95F5FDCA04384762BBE6EB39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977975, "uuid": "5fac20fa-55ef-44b0-9f5c-a92ddb75594e", "value": "12288:AqBZNZDaYzse4RMOnhKkUUKeQpPc+x3X:lFaYfWM7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977975, "uuid": "3f3891e9-45ea-4a8b-a53c-e3f77b78da5f", "value": 426444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977975, "uuid": "cb563b04-9552-4091-b481-b87961076427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977975, "uuid": "c30e80f4-20e2-427c-93e9-eaf6c5836e16", "value": "dlr.SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46fd7af-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025846, "uuid": "5ca783e1-2bc1-400a-99be-4e73c848b3ea", "comment": "Malware payload", "value": "112b50a0f9be8a60ebb57d63b29248ca", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025846, "uuid": "001bc484-5bfb-4abe-8b43-026c9620455f", "comment": "Malware payload", "value": "36b06c9a4275ff51fa32aa9d6077898fceac5908835d817062481716352256fc", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025846, "uuid": "5dd7cd1f-8f51-4d5b-8f9e-ad72f3961d9e", "comment": "Malware payload", "value": "beebf58977038d27a1f7ad65192db2b388ab88b7", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025846, "uuid": "844e41d7-cb41-4c97-9ffe-0be7480a8679", "comment": "Malware payload", "value": "e48d9cc78eafd5743616e156a897ffedd322b1f0d911d0bf2e17ff441cf6583457bb794962aacf153c8a6a0c89d1b7e1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025846, "uuid": "23dc69dc-b048-4c9d-91ad-4f0217058c7f", "value": "T148662333FDA42D6FC148C375B11B3E182E2C6547CACCE9E170EC6E873B46A92596D05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025846, "uuid": "d070c76e-6981-4281-887a-539687fee20d", "value": "49152:mj1OUYSdvFphsf0NQOwpzTlfl0F7/efZO93awGmpVO+LtAGRjr47huP+Cv1IbZc9:+UvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025846, "uuid": "802062f0-78b8-40ee-87dc-e792e53e4967", "value": 6791168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025846, "uuid": "eb7fec8a-21f3-49ff-9695-85090f933955", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025846, "uuid": "5ed2d9ab-443e-4208-a1f9-1487f298d5bb", "value": "Not-Ar612239TZ261ENONUYE4744.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3662e601-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770973129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973129, "uuid": "d2695b1d-5ed1-46b9-ae83-4e61cba78368", "comment": "Malware payload", "value": "d83a83965d141a0676ea6daaf259518e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973129, "uuid": "6500080b-bfbc-4f75-a823-b19739188f8f", "comment": "Malware payload", "value": "37519eb21f118335babdd250c584fa6bfabec67bcbe05b4059449f454ea60d05", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973129, "uuid": "f6be3d6d-4e7d-4790-b407-9ace4eaff8f6", "comment": "Malware payload", "value": "e8fb8985217a1d113a9ae5bba9a184835faccc0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973129, "uuid": "22fb7106-10b0-470f-b96e-10205cda75fd", "comment": "Malware payload", "value": "3cab456f6bf75a396be029742a91d13b8e10255bdc21b315c16715e087692aad950c94d4136c67654876fe715fdc1ad8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973129, "uuid": "e09e0e61-611f-46cf-9f2b-d1553d64c2a2", "value": "T1FD2167E6D1608CF16E8D4507B9D970505A83812FCA04AD7AF4ED299C2F38CA77171F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973129, "uuid": "da2c33c2-155e-4dce-94ca-74009f2508bf", "value": "24:AkPtGqLZE0ZGekjIg3e3TzmHTn2DOIRwOthxeTluMtI17KGPyHJZ:AGtGWESrkZ3gMjCO1Oth0J+RKGPGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973129, "uuid": "eacee1a9-1ab3-4d7c-8157-8b1bff9bf95e", "value": 1222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973129, "uuid": "8a5b4897-fdf8-470e-8a6e-ad18e4675c8f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973129, "uuid": "83bb9ebd-e1b3-4c26-82be-e42cfaa5dff7", "value": "smart.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe5a311-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025839, "uuid": "875bd1ca-1e6a-4bbc-9439-a07a0b90ad0d", "comment": "Malware payload", "value": "dc533989223f8b7c656c97d05f4ab174", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025839, "uuid": "2135a030-957d-42e8-ac07-7cf996f99aeb", "comment": "Malware payload", "value": "379be6efeb32ee12ed2e82a0cd540c0322c9f664f386b4d3a883ae63e13381cd", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025839, "uuid": "069146d9-6ae0-40cb-ae3d-610559af94af", "comment": "Malware payload", "value": "2fc80543eab281bef5fd58ec6bf54754560a8ef2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025839, "uuid": "e9fb41ac-0bf0-4f87-bd03-a8c21b573f3e", "comment": "Malware payload", "value": "367ee6c1c08e2b401ac56ae039b7b0caac23a9bbc68d16298595947218cc5c51e7b2d6a5dea83a5318fbc6c0acac456d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025839, "uuid": "19d07ba4-5e42-487b-a857-7c98fa05c7a5", "value": "T1E2262332FE42586BC6944B35F16F3B313E7C21174B8DA5D2F4AC72167B86AD64A3E042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025839, "uuid": "3229533f-16ae-42ca-ba39-95e61f39aa79", "value": "49152:Zbg6vZ7yDFqigGmGruorq7Xpiqov8Q/eeSmYi686nYvczhpBXHLoD8zmQCnSE:inSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025839, "uuid": "96d18f0d-4caf-42f6-8e39-b35f476937a9", "value": 4503552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025839, "uuid": "c854836b-fc02-4f92-beec-3a4e9b49fe3d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025839, "uuid": "39fedafc-5b6e-42b1-a548-4a0aed281ea6", "value": "Not-Ar8300VQV343TUSPF647678.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54df6ae9-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999379, "uuid": "2a06d55e-40ba-4fb9-b753-f11702c2a2e7", "comment": "Malware payload", "value": "e505dddc914830ecb66506f3dee40c76", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999379, "uuid": "a406066f-7dfc-4570-93cf-3e36d3497381", "comment": "Malware payload", "value": "38ac107adcb8b79667ed0e33643abc3883792a4d8eed88c7f8c151d70a996bfe", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999379, "uuid": "a62aab84-b2da-4974-8cad-5ef800e8ba78", "comment": "Malware payload", "value": "7fa64d31349c1a22122aabf1e9343044dd71e6c1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999379, "uuid": "e1a88bd7-73b7-4991-8647-913f1e325bdd", "comment": "Malware payload", "value": "7588befeeaa128a53e7f3f9b899affc24e03381a7d42e0e631e5426e40e20a138888d4f417d387f2cffe6cce5e4900cb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999379, "uuid": "39271d05-f4f6-42ab-88f5-b9264474c25f", "value": "T167362335BAA24C67C6614B76B02F37312D3C7A43178C85A2786CB6867B43FD2E63E445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999379, "uuid": "961ee5dd-7ed6-446a-bda3-a44015e70154", "value": "49152:sIWwCZALW5cwzEPl/SVjstWJ30Y0J4s0rJYSBWLEFkKbC7bvx:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999379, "uuid": "599c40e3-ecf8-43e6-842c-6df8627fe130", "value": 5246976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999379, "uuid": "f0c28828-2ccf-4387-bc6e-83b7d41e3e27", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999379, "uuid": "3c398d35-0559-47f0-b678-714fbb3c915f", "value": "CitM9K003984113OTIJX_Lib24996.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504961a4-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941390, "uuid": "9511a72e-1b04-49d8-ba78-0a5880101d8d", "comment": "Malware payload (Mirai)", "value": "4947527555ceff693d7a11820fb6ae72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941390, "uuid": "8f8debb5-58ba-4b9d-90aa-5c12c9bda50d", "comment": "Malware payload (Mirai)", "value": "39826aaef71a256b7f220273335c9c36ca7382023f110045b718f98107987f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941390, "uuid": "8f150c79-63a5-467a-91cd-b476e100572a", "comment": "Malware payload (Mirai)", "value": "1567f3ea0ad833df675ae15efed7d7ec2bc08928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941390, "uuid": "3dd6de0a-71cf-49ca-822e-99744e42a06c", "comment": "Malware payload (Mirai)", "value": "7031eefade452e4be252db04e619c5379ff2cfe6073a43d9aa3b01aefc52fb2963132c170bf51a59897b6205ab221d48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941390, "uuid": "18e3df51-25df-4db8-8d33-8734d11613af", "value": "T13AC3F745A9428B01D4DB31FAFB9F429933576FA8D3F97201D9205F6127CA9CB0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941390, "uuid": "b729595b-344f-4fdc-8a14-701c511121f2", "value": "3072:H69TgnWn9OaWFlO45TvvadK5ZPkyc4En6ARuLhqH:Hy0vFlrJvvadK5ZPkyvrAsLhqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941390, "uuid": "86a21e86-27a8-48b2-a9f3-633d0ac7d0e6", "value": 125936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941390, "uuid": "0dc8e308-91f0-4d2c-b8af-fc627b7efbbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941390, "uuid": "8f6eb4bd-44fd-47ab-af99-7ec84ad208dd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de203666-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985436, "uuid": "9a11c7fe-2dff-4a9f-952f-3af384c5ed71", "comment": "Malware payload (Gh0stRAT)", "value": "9fc0a0645f58862618b1de14948ad151", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985436, "uuid": "1dd3fbb5-58af-4897-a374-8de216ea68a5", "comment": "Malware payload (Gh0stRAT)", "value": "39a0f2685b1fe8396f5b58b5eebe092fa23a4a647aabb3bad23d345637180eb8", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985436, "uuid": "033d5d16-31cb-4a42-aa6e-4790b3ca4ed8", "comment": "Malware payload (Gh0stRAT)", "value": "5444eff54fe45032c58ad19b68e468b7c73b757a", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985436, "uuid": "50f1ec4a-2dd8-4e4b-820d-4b3bb67f1c3b", "comment": "Malware payload (Gh0stRAT)", "value": "c045ed03d1efd0830113a22502c18fd3ab3eeffac7b494176baf43d8241719c1f041da0c549ae494b0895de85ec8529b", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985436, "uuid": "798403f4-ea2b-471b-b0da-5df88a727db4", "value": "T1FBD7335138D6CE36D69D4CB6493696B004E93C198B34D8CB40E87C2B8AB77C325B7EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985436, "uuid": "42757639-3ff0-4008-970f-880458f6f64a", "value": "1572864:ETGKO9KrNMYMlfIqXuXUQDHomV78QtJimKJpmh5DQCsVwmmalZQyVXGysD:oGtwJMYMdIqXuXjDHomV780JimKJpmvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985436, "uuid": "38241034-891e-4099-9dc9-c0f113cf6e0f", "value": 61685760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985436, "uuid": "9fd4f208-630a-40de-b1d7-9874b2c77ea1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985436, "uuid": "b57f8f23-c0fc-4ee4-ae11-8779faf4b83c", "value": "AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0b1bd8-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974075, "uuid": "a164df75-43fc-4467-826c-b6d9e2e7f570", "comment": "Malware payload (Mirai)", "value": "e26e7ff001fe93c4b8082b08a182c97a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974075, "uuid": "3cf289ee-7721-4e25-ae75-dcf25efb3321", "comment": "Malware payload (Mirai)", "value": "39a0f2b4da353c5bf9e6dc8ab9b00b4732aab0e6ccca208ad0ded2d6cbe134bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974075, "uuid": "81d24c4d-d1f6-4248-a643-94b81734aeaa", "comment": "Malware payload (Mirai)", "value": "e5e0b442737a225c2e388ea5d58fe644ecf246de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974075, "uuid": "cf0f42d5-7aa4-4d91-9960-e48f1e5d18b8", "comment": "Malware payload (Mirai)", "value": "f8d97d1e44d31339cf0ae9ad57d23e484b773488d52559c75da3aa8193ea2e03aaf36ea604342d851852d77fbfe26463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974075, "uuid": "ae725a65-069f-427a-8101-83d4625928bc", "value": "T1033318D6B401AE7DF95BEFBAC0224909FA31620151930B3B23BBFD936C322658D52D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974075, "uuid": "0f167b40-a965-4680-ae1d-5cbab2a692a9", "value": "1536:Wlrztlv7LlNvi2hoHDrECHTnJ1/iVB539j8o:q7lFizrEATMB5tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974075, "uuid": "7f6900ac-ca4f-4ac1-a2fb-fe237e081226", "value": 52492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974075, "uuid": "e7902d97-037a-4b6a-ae25-8f989a6b6595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974075, "uuid": "bd028620-ec63-40eb-b0fa-759ae46a6c41", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52979bd1-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941394, "uuid": "07daec62-fa22-492c-acde-9749d2bc0462", "comment": "Malware payload (Mirai)", "value": "92a85d9425d7b11f615b231ff23990da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941394, "uuid": "576947ab-8348-489f-b9d0-d2c17a198f68", "comment": "Malware payload (Mirai)", "value": "39ea5c77595791f225804dfe8ad36c485a391191dc31326dc08f4527bf18577f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941394, "uuid": "d046bf9f-cc6e-4a4a-831f-84fe2a32b62e", "comment": "Malware payload (Mirai)", "value": "bbdf3fa03725a2c1fe6b744eeb8b9bc3c1eca969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941394, "uuid": "6cc2ac69-7549-46cb-8d73-f8b17d879ef8", "comment": "Malware payload (Mirai)", "value": "d5e56e7c63ed47bf6e4089699591bdaca16e66978f2432ebe92b83733b764763c7d5374bd76eda2243afc410beb22c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941394, "uuid": "fb793f5b-6112-42cc-9ac8-48d8e82c9745", "value": "T1A914B71E6E228F7EF67CC77047B78A34976923D623E1D644E1ACC1145F2029E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941394, "uuid": "555ac448-3d2b-4f16-8919-68dbc2ed9ad1", "value": "3072:0gKt7JCUcQQBiKO/L0eYs4ar3MfvVKzz4DWZsH/:0gKt9CUNQHO/AVsvrWVe4DQsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941394, "uuid": "ba388ded-bc18-43be-a884-30ee4bd10e25", "value": 197408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941394, "uuid": "e0487e70-de87-4386-afa3-eb46f2e96cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941394, "uuid": "1fcd1531-8b39-471d-83b4-59eb5b9f0ee6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318de82a-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955511, "uuid": "d55baa06-749d-4ab6-894d-6caaa31c0940", "comment": "Malware payload (Mirai)", "value": "ba795e1f5a97b73fc4ff70c8b38790f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955511, "uuid": "61eefb1e-35f2-4efc-826c-9c15fa2c3675", "comment": "Malware payload (Mirai)", "value": "39fd5cfbce09d5bd29fb5f2fbe0f7285971357f4eb4661e248f8ae88248975b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955511, "uuid": "0dd5a3e0-ce67-40fb-9bb5-42c330349c49", "comment": "Malware payload (Mirai)", "value": "888e26e2991191404129e08ef07f682481f6c3b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955511, "uuid": "585f8dc6-3a95-4b71-a89b-e585e12f7ae9", "comment": "Malware payload (Mirai)", "value": "6ce358c43de18c811f378ec1dcc1342d73e3774dccb88d7d2c131a8328d38544cfe6cea3aa3d4c224d8c228c5897c189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955511, "uuid": "63481b5f-392c-4237-89b5-fdc4d608033f", "value": "T1EB13F176A913780AC6E02074EA579A42FF9F0EF864F2517639A528F532D6A0E64F0083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955511, "uuid": "779e4a36-4eaf-4429-b7a5-ef138bf0b9dc", "value": "768:Gio5FVHEkxO+gWkNfZgUP9REE6Exw45K5b3R4fwlLzGPF1imc39q3UELrYN:QH7xpgxNhp6Exw45kB4fwlLaPF1vLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955511, "uuid": "cfa10991-8580-4d4f-8c1d-1e71d3256833", "value": 43800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955511, "uuid": "a945c979-8769-4f2f-95d2-62a2d6e93a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955511, "uuid": "07841bbf-d985-4363-823b-e8b2ea437c4b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967431cc-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014522, "uuid": "09979615-f9e4-4138-80ea-4ff661b47bb3", "comment": "Malware payload (Mirai)", "value": "a1a74c85e16a7e79480a01f3e777b96e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014522, "uuid": "36135804-3c46-4b67-9191-aae15b497eea", "comment": "Malware payload (Mirai)", "value": "3a36412746d1b8edca830360fdf90b341d7cab6c669789fff8f7407ef124b788", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014522, "uuid": "395a0eed-47fc-43eb-befa-70f0ca279f36", "comment": "Malware payload (Mirai)", "value": "07a983a6bb22b15b07d5318b8b9ef47ede8ef6cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014522, "uuid": "dfea4e81-f40d-4b57-89c5-353fbb2f2d36", "comment": "Malware payload (Mirai)", "value": "d49afe3b4c5292766ad3d00a62d521d2b5aba31297569c0edc06254c18f51c604b4edc9e97434addc41d219da9c643cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014522, "uuid": "caac67df-88d0-4a4d-a1e0-925ec4cc9597", "value": "T1C713E1AEA1983CCCEC8C0C3AC0461631AE155182B35FAFC75F224D9CBC5A667F557592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014522, "uuid": "9c9dfa62-1d26-4e09-bea4-13eb71533d00", "value": "768:xcVxu1KGgb+Jw1PRIgyAY6ivJSRW3UA55NycgVOnM3qhROxGJS5OWg:OY4GXw1PSVVbvJSroKIjekS5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014522, "uuid": "28351325-bb88-4e39-b04c-47405049e75d", "value": 44108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014522, "uuid": "03b1018b-454d-4e61-b777-f8c91c8b6e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014522, "uuid": "d377ee5a-793b-472c-b2e8-e6a3573ed9a5", "value": "Calix.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec25ccf5-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026691, "uuid": "0258ff77-bc1b-4100-b84e-89e56894adca", "comment": "Malware payload (Mirai)", "value": "f538c6299bec349c0bd1546e48ece58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026691, "uuid": "f30c6cce-be0d-4dc3-a082-25ddb04b21ed", "comment": "Malware payload (Mirai)", "value": "3a77295a69e396109fb9cfda75828fd2db16dc7daa881730298ff77f5801395e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026691, "uuid": "386e7cbc-722c-4fc8-899f-de8fe4c7f0fb", "comment": "Malware payload (Mirai)", "value": "34736bed8a697de578c41fbb780999c7de012cc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026691, "uuid": "cc499899-820b-409b-81bf-13629ab94f99", "comment": "Malware payload (Mirai)", "value": "f284fa997115f095ea17bd3d72ebdaa2e3acfeacabc5131dde112687e9aec53ea4b1aafbe63dc846245ebeb2fa990174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026691, "uuid": "e5016b7c-69d7-46e4-ad17-aa1aa99f8a2e", "value": "T10A93C81E6E218FBDF769823047B78A21A75833D637E1D685E15CD6005F6038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026691, "uuid": "bf6fab3d-2558-44fd-8880-7aeae2cecd0a", "value": "1536:nNLVLruN6Mq9Xm7UFPbp9u/Ml3DeX6B/st9/VKG:hVLrs6LpbFPF9uytshH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026691, "uuid": "e5166db7-7e19-45eb-9307-913a52786dc2", "value": 97644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026691, "uuid": "349a9df3-9efa-49c5-a914-d75ee6d8714f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026691, "uuid": "eca11fab-0bf5-4e36-8ebb-0ede78105818", "value": "amsmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac920fb-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999443, "uuid": "5d0b3b15-75cf-4d99-aef8-f63a2b8e6850", "comment": "Malware payload", "value": "34297b897e835898fc94c68a141d7fa1", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999443, "uuid": "cb622f79-0360-40a0-b5e8-5cb4f464fbc5", "comment": "Malware payload", "value": "3a98e28a5edf8d9ff02f88e2d3eca1d888843f591f4ed6ab4176030cf6eafb5e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999443, "uuid": "d3694d07-f8a4-49ac-a09f-0a3e6865386a", "comment": "Malware payload", "value": "d1865fac63607568f274870e65324f49a2192915", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999443, "uuid": "3af16763-ea3a-4758-b0db-aad0d592bdee", "comment": "Malware payload", "value": "560fe64e02b1714aea042b013f8ab2c18e3e6ae023760d51a0c403922b7ee0f090d66a2a8f70a4bcebabaa7ec327cacf", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999443, "uuid": "096dddc1-ded2-4b6f-bc1e-98c884e92ef9", "value": "T1923623327E965C27C2940779B06F3A257E2C26434B8DE1E2F4BC25C23B87EB0D579496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999443, "uuid": "3afb74d7-1a47-464b-8870-4704e8dcd0fe", "value": "49152:4NNrwcc7jnlX9EicnQPUvhd/N0aPTUog4+5IZHxNYwE/pRwsrZWu7kBgKkQWCufz:iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999443, "uuid": "f99bc6da-7ded-4a1b-86a9-08ffc07db528", "value": 5232640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999443, "uuid": "3de21bd7-2fdc-48e2-b30d-1f5bcd6ad6bb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999443, "uuid": "5b10da37-b613-4973-8fe5-17ceacf681da", "value": "Cobr_5901AIGT30SZ21083-De.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9632f6-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026694, "uuid": "e64e1b3c-4ea0-4103-8920-6eef7d22daf6", "comment": "Malware payload (Mirai)", "value": "488fa9a88f9505fb4b27b2f32627a1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026694, "uuid": "37331f25-c42c-47f5-9920-d2f6bbeb2d99", "comment": "Malware payload (Mirai)", "value": "3aa47e85cf3d878255cdb97866d5a3c15f67959d2ba7e43333d04f5cbe1e4d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026694, "uuid": "e0f78e38-7b0e-41a0-8377-55049dd8e121", "comment": "Malware payload (Mirai)", "value": "673ea39d87815fa465d9b72310c3d717a2881247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026694, "uuid": "f36f51c0-a32f-435e-806a-5992141a1ae1", "comment": "Malware payload (Mirai)", "value": "bf9c70eb735f2005267f0deb19c70a1719ef7e9f12cd71d6c766020dc2f6d90261f7634be6d60a6410b5fefba2a2fc49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026694, "uuid": "897ec212-131b-426b-ba01-2e86566e979b", "value": "T15E030891B8C24AA7C2E023BBE66E518E336573A8D2CF7357D8115B007BCA91F5D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026694, "uuid": "d28dfdbe-8efe-48d4-9ced-333a2f8179fd", "value": "768:/EAUGJBX44EXqlGdi55dKako2GWoKsJ+mDvMpB9/1bkUA8:CkX8XkGU52Gh5D89/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026694, "uuid": "c3ec1139-20a4-4fbc-9084-e13e93f0b9d0", "value": 39624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026694, "uuid": "3d9d440f-28eb-4b23-b34c-41241a903c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026694, "uuid": "e719ce6e-2d6f-434e-be83-d41da0f44dd4", "value": "amsarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25b6471-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013307, "uuid": "895ed91e-a6a9-4065-898b-cb6b67f6fe57", "comment": "Malware payload", "value": "07238d5a51f4ef63d1cb46a069099279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013307, "uuid": "a5ad888d-0f01-4277-ac0b-a6b52b3c6c3f", "comment": "Malware payload", "value": "3ad3f065e272304507e83465cdcf5b1db94af12b21b27aad4829eee58d843d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013307, "uuid": "d715eacb-3672-4b26-a30f-cb5ed0004d22", "comment": "Malware payload", "value": "688516b7115ef9bb567bb6780ef3134e0ee7537b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013307, "uuid": "827cb985-6364-4199-9b90-3cc2f46c1e82", "comment": "Malware payload", "value": "e6c64771a233b55f4aa7defb731adc0b20eb7e9d3f855344532e5beb0dc936b51c42803c73f7bd7a2e558ceb87da3add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013307, "uuid": "14ad836f-5bee-4a07-9379-edbdedcc93ae", "value": "T14114C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013307, "uuid": "66e65fc7-4548-4835-97bf-3d235fe1748c", "value": "6144:456eQCbeoufx4ydf2dp06GtCqjYW8nY1j20WI:Dely4ydfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013307, "uuid": "d60d0ad5-b4ab-474d-a9c8-e16681ce3c21", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013307, "uuid": "a3e1e5a0-bd19-4ec0-87ba-e0420614f878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013307, "uuid": "719e7b3c-07f5-44f9-baeb-740ec6a8575e", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5554482-091a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771014574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014574, "uuid": "e858b647-591d-4504-85f2-205e1e605e11", "comment": "Malware payload", "value": "f07f88b5977a373d19b97c469830454a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014574, "uuid": "9b0a3fce-de3b-493f-b9f8-f16026b5c48a", "comment": "Malware payload", "value": "3b5df7a1971c71c34c4438ddece7db3c1ec94aa9dcd4e675ff2b4f159b1ffa56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014574, "uuid": "4b855d2b-177a-4a72-bae8-38a7728c9d78", "comment": "Malware payload", "value": "5db47208b38ba73438eb2f3881fa151515977492", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014574, "uuid": "4912210d-c7eb-4765-969d-1660c81cca2d", "comment": "Malware payload", "value": "26d575792b9d4c093d5d066f5cc382a93c6d53bac95ab135622a5ce6fa746beefc267718cb3e4f2e164b79c2ca5ba3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014574, "uuid": "d8d8fe71-6e36-4c80-b35b-cf8064477f6c", "value": "T14C934C02B70C0E47E1531DB02A3F27D1D3EF9EA120F4F685691EBA8591B5E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014574, "uuid": "15bf7533-cb7d-4997-a281-414c49276383", "value": "1536:Y99B9pQg6CdhImTrmr6HPRKyiGmF5LDoYyYIO2781+lt3dVLZOK86uAmA2xpfvKu:YfzpSK9TngDN516TZI6h2Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014574, "uuid": "5927a9d3-6487-40fa-a8cf-bccbb803123c", "value": 89448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014574, "uuid": "885a1891-3c57-4bd1-8c11-097ff6427ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014574, "uuid": "a4b2a5c0-df7e-417a-8823-6b0642af72f7", "value": "Calix.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee53835e-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986752, "uuid": "727a7009-f603-48db-8548-2e800b9a76a4", "comment": "Malware payload (Mirai)", "value": "fda8b04c51156cdc1b3a68ae968e579c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986752, "uuid": "155d22b2-c933-4a75-8a4b-9c2a09cd388e", "comment": "Malware payload (Mirai)", "value": "3bb7448b67b364814ec177328e224a8f93045b570cc4405efa6737f0f8518b9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986752, "uuid": "bd497f7c-45f7-4fca-9146-d6b761e6b33e", "comment": "Malware payload (Mirai)", "value": "f4ffd1d215350e54b0eb69079472b20b6f749858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986752, "uuid": "bd7ac15b-f2e8-4a39-8821-75900155c6f9", "comment": "Malware payload (Mirai)", "value": "5c8d44a8e198baabc475e880460f85ecb0576140b0d90fea62b2dc6d17dd51f45f09ce5fe707e83f122fa2e4567eb9b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986752, "uuid": "dc65d99a-60a5-4392-bc04-c207c0f8e59b", "value": "T121E2E16072D77912F771AAB3AD8A4C970B1D2FF9E0E87D53B24C4A2554B15033A4F6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986752, "uuid": "0dd6f126-a65d-4a63-898d-04e745361219", "value": "768:o7X9IYVIZIeQgQe2UoqUj7qVK1ZdvDl9Ea9q3UELfB:2iYVICeXh2UHUj7qoDRDl9cLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986752, "uuid": "851fb199-48d5-492e-b23c-4fa67130b3ed", "value": 32216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986752, "uuid": "cf162e86-f22f-450c-bbc6-f85110bdd7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986752, "uuid": "578f681e-c45f-4671-9bfa-1e312fc32ec1", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5775bade-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949133, "uuid": "d902eced-ad5a-4b1d-a04f-118c83be914c", "comment": "Malware payload (Mirai)", "value": "a6dfc4c77089813fa7abf29cf127b055", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949133, "uuid": "8a1fc1fe-cc5a-4924-a389-1de9425fa9fd", "comment": "Malware payload (Mirai)", "value": "3bf2f2d003e0f21eb027f87c247b7e030156aace2d2b24fd29f4ee484c8972cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949133, "uuid": "b822788b-8fb2-4ede-9054-d16304e3d8cd", "comment": "Malware payload (Mirai)", "value": "96b6bf19628f97a5d4efc0d99a6ec158da996488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949133, "uuid": "54001161-ed3c-497e-aadb-43af9bfc41c9", "comment": "Malware payload (Mirai)", "value": "96838235d7a04d14a03833d16962556d884e297e412806a0184f035078cbe2eedfdaee711e5210f12b167da8f3eecaaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949133, "uuid": "14bd458d-329f-4164-bb23-d339e1bec341", "value": "T1A2732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949133, "uuid": "97683e07-3a23-44f7-a637-319f1f7424d9", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WH:927jqCt8v3GI/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949133, "uuid": "89950607-ba5b-4517-abd7-c7ba82f9c662", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949133, "uuid": "6b34163e-e22a-4248-9864-6de0b4dd1980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949133, "uuid": "1613e0d3-1a67-4abe-bca4-566506ac02fc", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708a123e-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974086, "uuid": "88f52343-da1c-4c8b-8724-2d7741ce3656", "comment": "Malware payload (Mirai)", "value": "e6efd795bcf5b04454927a3ba320a805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974086, "uuid": "981fe169-0d1f-4d66-93ce-f2c6f1ba01a3", "comment": "Malware payload (Mirai)", "value": "3c1a277e16d004b7d9b3b60650553b8f67b4df70dbf94b1d523db0b33ad2a69c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974086, "uuid": "a2565a90-8937-4060-aedd-2bb44cc209bb", "comment": "Malware payload (Mirai)", "value": "7b585302991eca8067e07aec7a8fb09a3b3be2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974086, "uuid": "294d2a5c-71d2-45dc-8201-f1575fa66e1d", "comment": "Malware payload (Mirai)", "value": "5e658c59ac319d3fb5f96bc68116020af3d496def668f27658727c1d010e14325afc993deefcef5b88fb1344dc616ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974086, "uuid": "fb41a76d-068d-4ef4-9dac-99c4750d41b2", "value": "T13CE44A41FB1C0563CA431DF0697F8395F325BA4241F98239331EAB573621E3B9A8779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974086, "uuid": "fa93f714-1f93-4c91-8af4-aecdcbc70d14", "value": "12288:kk2lfEIer77Po+vkMU3Zs9jGYXDV2ipROQ1eN:nJ77o+vkxJuSYzVb1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974086, "uuid": "6358900d-45a2-4965-9b73-4d14c2bfedd3", "value": 660020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974086, "uuid": "600e3549-f407-42c8-8174-2db602547853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974086, "uuid": "49c03c52-3396-476d-b39d-9966ee052409", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c8f721-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013494, "uuid": "9fe4124a-4c8c-4558-b401-f7f85bf4193c", "comment": "Malware payload (Mirai)", "value": "7d80585b6581ca57b16d8c78da3a8cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013494, "uuid": "fbb7c0b7-541c-489c-8b55-52f6d9975e9d", "comment": "Malware payload (Mirai)", "value": "3c924ae8905ee297be06c3eb02fd6340d22b902e1f8e34a831996c71d3b6231a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013494, "uuid": "20b75124-e248-4af9-9391-f657dc68e7fd", "comment": "Malware payload (Mirai)", "value": "c2c7bc313932e8f776567e8f7acee34a40accc8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013494, "uuid": "5f568899-7319-4f3a-bd64-8c536db081b7", "comment": "Malware payload (Mirai)", "value": "a9e0f94b6b2fc749cb9cc5b8fd1252dc8287583428a4d7305a3ebf99d5bbac14262109dbe90b132f16744bbcbe755b21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013494, "uuid": "0ca14c6c-31d9-44be-85c8-4c4f488137ef", "value": "T12D34C716BB919EF7C89BCD3306E6860120CDF45722946B2BB6B4D61CFB0A94F49D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013494, "uuid": "79160c78-8b7c-4cb5-a1fd-9b5d29be0a68", "value": "6144:3he6zMTV+0l4BTivf69LBlI4XpsZsKyN0:xeXg08ivf69LBlI4XpsZsKyN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013494, "uuid": "be624af2-b835-4303-83ac-8b97b55fb76a", "value": 238913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013494, "uuid": "7b920442-3e62-4a24-bbe7-94a77862b98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013494, "uuid": "cffaf6ef-5426-4faf-a2f2-968e7ba62803", "value": "m-p.s-l.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09d632c-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015452, "uuid": "5200b4b0-dd77-48fe-bf64-454d67272230", "comment": "Malware payload (Mirai)", "value": "ffa7406f83ab2aec8bacfdc4268a59dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015452, "uuid": "12e208eb-4b36-477d-b8bd-a3bb7ae365de", "comment": "Malware payload (Mirai)", "value": "3cb452a6c1013b79c6acaa02358ec79319f4433d2b43094de831b19a1b9d0cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015452, "uuid": "e81fcea8-4935-449e-9d95-71655c03775c", "comment": "Malware payload (Mirai)", "value": "1f1a34807ef73fddebb2fcd2b9ba36369f0d312b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015452, "uuid": "9a2fc601-81eb-46db-b95e-45713ddecda5", "comment": "Malware payload (Mirai)", "value": "04e0f2af891cc9fae1ea9818b0c4d253d1d76913807faefaa4d93a02e7ef35cdba0a2e0c9f0e4e6bb49dc70b63e16bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015452, "uuid": "a9389a25-1904-4ffd-ae9c-54b020c2646b", "value": "T104A2E1B9E2581D9FCC42483CA450D0DD0EB6F966F79E93425A80C18F9137286E437E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015452, "uuid": "1555c7d7-7681-4729-8e61-cd215aca68fb", "value": "384:MFBJFgCOvyJ2XMlPjHMdlygq4PQ0Zww38OQIYsrElpSyP:xJ6J2XMlHw+wNZww3MjGUnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015452, "uuid": "b5fc3fe4-0324-4269-a1b5-48ff8ec40946", "value": 21532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015452, "uuid": "c35f65f9-b5f6-4b8b-97ad-de076eb8fe3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015452, "uuid": "510ee28a-7c06-4975-aed5-202b91963458", "value": "SecuriteInfo.com.Linux.Mirai.9816.30376.3598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977f84d2-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770972003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972003, "uuid": "dcd72b98-9354-4d4e-94f1-5bd4f95e1cf9", "comment": "Malware payload (VIPKeylogger)", "value": "40e7d000bc6ed6a24f35cb5540aca569", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972003, "uuid": "6f8eca53-b243-4972-89ea-eb211a0f5975", "comment": "Malware payload (VIPKeylogger)", "value": "3d114fb14a84d391fbfd10ed3856bd7960ef0d3795d9bc09f0bee9f56c43088d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972003, "uuid": "c42e4dec-fcaf-40d3-8f54-d36bc3619ec6", "comment": "Malware payload (VIPKeylogger)", "value": "f381398c7536c772a2ccb80716e50d3284096b0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972003, "uuid": "46d70fb9-5484-4e64-91e0-f7f282d6d52c", "comment": "Malware payload (VIPKeylogger)", "value": "ab05ccb516b8ac0e0aa6ea652ed395942fc5d41b1f4262b1aafd39e2f791783cb307103f3e8c863b5e4406d2fe8638dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972003, "uuid": "d3bea2ae-478f-431e-8305-cc416b85e1bd", "value": "T1A1162A40F580E69C1D275E237775B0F082926B6B7D468B06E00ADAB1FBA71C3EE1D635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972003, "uuid": "34d51384-191a-46cd-921b-b668790293f2", "value": "98304:dEEcjqlnwGiY7C58ds1z08sGKo8xUZBFV7H+/rJR5w57uN+NmGNRkYagexNWmcwj:dlcjqlTJG5Us1Q8KoBZ/V7H+/rJR5u7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972003, "uuid": "8f0f3ec9-7011-4b35-9903-225dc97143d5", "value": 4306637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972003, "uuid": "edf1eb21-0c6e-47a5-9dc5-7461b3a90f55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972003, "uuid": "03e16418-6e03-4f27-a014-f6e26e5b87da", "value": "Purchase Order1232.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eca34e6-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013489, "uuid": "e6b63808-2007-432d-8a47-bdee68af8745", "comment": "Malware payload (Mirai)", "value": "cfe20a37f59b7fd98be4f83b58a68d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013489, "uuid": "735f63ee-861d-4099-856b-6043343bbac9", "comment": "Malware payload (Mirai)", "value": "3d5add2acceb6d8ffec49932f7bfa31e2c945dcf366e1317fe9c998dfb37fce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013489, "uuid": "625d0b00-45d2-465a-8d4e-f66ba3c9e4dd", "comment": "Malware payload (Mirai)", "value": "0c8a560eb81aab5a40fa56bc9abc01782c6fafda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013489, "uuid": "cbaff70f-6171-49d4-adb4-ed992ac3776c", "comment": "Malware payload (Mirai)", "value": "5a39f0b374d07f2b72771c7d83dc8893f8da20e9a716a374ee8f31c5b82cff55b35c72d2113afd2fe76c2e7128a93cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013489, "uuid": "08185b44-d28e-4fe4-ac9f-019c67949c4e", "value": "T12B043A07771C0A87C05B2EF036F723F087ABE95116A2A184F21EFE845376BB16519F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013489, "uuid": "76c64276-dcc9-42c7-b86f-fa9f0cc1c1ee", "value": "3072:5PBNOI3xxtqG3eMqilIlKbtye4rv7GqAxHZ3zpIJTKCfD:5PBNOI3xxYG3DKKE3rv7GqAxHZ3zpIJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013489, "uuid": "812baaff-c032-4275-864b-97d6744892ca", "value": 175750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013489, "uuid": "edfdf5d8-b988-4ded-882d-c521a8ef67c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013489, "uuid": "047dab5d-bd39-4ab1-a9c7-6c65b6410e94", "value": "a-r.m-7.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244939df-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955489, "uuid": "15c4ac7c-044a-419e-b940-f38432ad58d8", "comment": "Malware payload (Mirai)", "value": "a045b3232a68c3d635d4d377ef853b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955489, "uuid": "28cf6ae3-0968-488f-9c21-2f1b0127a537", "comment": "Malware payload (Mirai)", "value": "3da67b5c929f3631675f5a55f04439ac447f73065191ccec5f07fc8c1c10b058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955489, "uuid": "070cccf9-96b2-4e64-840e-6137987934e2", "comment": "Malware payload (Mirai)", "value": "2711c69fef6da92a1b33fc6ae5d128d0b3515c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955489, "uuid": "bd772c14-9e81-473f-9dcc-2dbf54fc7100", "comment": "Malware payload (Mirai)", "value": "17a79f143767aca79333a524dde8e7b9c3435f8daa454406a5e06e3b3fd9cf445c633731a1e696dba8a0ee1e6c67021b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955489, "uuid": "7b3d4776-6dd2-42af-8cd1-068013b69a96", "value": "T1F413E0EE8F8915EDED62C1B5ABDC0F744F29AB977847EE1222C1EC02A545B753003E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955489, "uuid": "75952884-415c-48a9-a705-0fd2105c3915", "value": "768:rC6yae+5yT/VTUzCslegLCmF7mOZdLQwdjdGLYauptfGPFD3/ZyoVD1kkOJgGlzc:rC6d55yBUeiegL1NLpj3pwPv/1kk6VJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955489, "uuid": "af89932e-9446-4cb7-8077-eb30834b8949", "value": 43260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955489, "uuid": "5362f270-6d85-49bd-9201-e148f2f11cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955489, "uuid": "7ba3080d-3d11-46a1-9008-1e5fb034c355", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ca05de-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770963300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963300, "uuid": "433314e2-749b-4ae4-92d1-8f64edbf7d8d", "comment": "Malware payload (Gafgyt)", "value": "efeecb9113ea3fc4b171148380a57caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963300, "uuid": "8d9759a1-b3ab-43ed-a541-51ff40b5838e", "comment": "Malware payload (Gafgyt)", "value": "3dc8788299e43342d65704aa1859523eafb41cf854fde90cb7e414253d429682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963300, "uuid": "6a0bbd54-500a-4aa7-a384-91fc4dc05fb8", "comment": "Malware payload (Gafgyt)", "value": "9dc3b4f435b83781f744aac9b2ee32c810352a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963300, "uuid": "4bba5487-145f-424b-94e0-b13ff9530847", "comment": "Malware payload (Gafgyt)", "value": "46bb728fb8365006979eeafd79091807ffabc7ea1c5843ad9f022e80e00444b2a05e0c8326d5f7a85c36c26a15d56c49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963300, "uuid": "4e2c187b-7dad-4376-88e9-a36650e67e64", "value": "T110B3E91E6E218FBDF769C73447B78E21A39833C626E1D645E16CD2005E6038E542FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963300, "uuid": "11688b34-9a50-49dd-ba2e-8cabb9cc7e7f", "value": "1536:3w4lPfv7d7Y/YLddso1LVNyHvftEi8hPDoM1ISWlKnKevNeThRd:hlPfDdMOdso3sHvftuhPDoMCsnShRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963300, "uuid": "3209d68a-af2b-491c-97cd-25a79b610459", "value": 114212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963300, "uuid": "85ec65bd-ab5e-4f46-b46a-46b717833672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963300, "uuid": "8dd0ee76-ac90-43c6-97a6-c42d794561cc", "value": "herios.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c09207-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013291, "uuid": "f72016e4-777c-45d8-b996-4417165fd7f9", "comment": "Malware payload", "value": "5dc43b79f89edc7655818855e361de7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013291, "uuid": "a86a5000-58bf-4a40-afbe-0908337a0773", "comment": "Malware payload", "value": "3df1d367238cbb55971e37f7b29d43a489029c119d9b1fba5dd499a074d0e75d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013291, "uuid": "b326fd5e-4a65-458a-a2a7-c43d5a5d6150", "comment": "Malware payload", "value": "564b9b2bed8bbac1783ecde173f11c359cbd1ed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013291, "uuid": "794a6cee-855d-4620-84f1-f452b89881a8", "comment": "Malware payload", "value": "d25c60ff7b4f7b4ddc44f4f2da4cc32e42ec798070450e8cbc4fdf0bf834fb1507d1cf1fa076f9fdd3ba6b8f78f2bc63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013291, "uuid": "2f354a3d-5fd0-4d93-8a7a-213119ccc9ff", "value": "T121D308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013291, "uuid": "e39313fb-a55a-4719-a992-3b92fb1ee5c0", "value": "3072:kSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIXx:0rybytG/Oyi42VOgLNwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013291, "uuid": "4bedf0f9-22c5-4d30-ad56-247104c68f02", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013291, "uuid": "9d40c84d-7dd2-4aeb-b2ff-92513369e928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013291, "uuid": "971c08e8-9f74-4dc1-9bc9-30062700322f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4260cf6e-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973149, "uuid": "d457e20e-e4e0-4db3-a8b3-22bf8224d5db", "comment": "Malware payload (Mirai)", "value": "e9464cd13b18487bad71a338ad06dc44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973149, "uuid": "80ba06c6-93a3-445b-a044-7386fa625b93", "comment": "Malware payload (Mirai)", "value": "3e236af3fc2e7aed2d44afd43053d60061b7c567135ebde1311d9ac0cc9d79ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973149, "uuid": "d0700d30-7bb4-40b7-9282-96384edba5ee", "comment": "Malware payload (Mirai)", "value": "48c25caeeedb844c2775d3ea1a00e96a338efd82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973149, "uuid": "eb08493e-3fed-4aac-b747-9be7ac841541", "comment": "Malware payload (Mirai)", "value": "ea4660a1f2bdd726965024f5fe823e382a20a0a2e4a931f3c91b2a7c76084405605f260f0e917486ebe137404667d9db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973149, "uuid": "a1cec108-d64d-4a9b-aeb4-fd2f7c26edfc", "value": "T1BC5301E2E3C03303C966B5350D57D68EA1562AE355ACEC0BB8DE57CD011D1E4BA3DD8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973149, "uuid": "f930fba4-96db-4ed8-9b9d-2a699549fed0", "value": "1536:hGp8WpGPjHGfF5uVdfKznVIb7tGPF+qcdj:hGPUGN5uVInVO7tGd+jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973149, "uuid": "6705a950-4d58-455b-a614-52f347e0cb56", "value": 61132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973149, "uuid": "a6f1ad42-da7c-44f8-86e3-63de820e6f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973149, "uuid": "c257bc19-a294-4619-b8eb-74ab7f94a215", "value": "sys_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9c23e-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955500, "uuid": "4048a78b-dc91-4b7f-a7bb-9c2fb7ccb060", "comment": "Malware payload (Mirai)", "value": "80c7c1515056540ea0d084b06ecaf205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955500, "uuid": "d5c82eb4-5527-4074-a3c4-a24d61edd148", "comment": "Malware payload (Mirai)", "value": "3e536938a806b874f8e09f409ad78ca4323a0fa4515212786a1ab79a05ee3bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955500, "uuid": "c9260491-11fa-4061-99b4-c7dbaa16737d", "comment": "Malware payload (Mirai)", "value": "8616a5d8899ebd75b6a450916cb7f06ee831584b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955500, "uuid": "4b7dd41e-e001-4e68-966a-31c89a05994b", "comment": "Malware payload (Mirai)", "value": "a91e31ee0de71c7ba74b098a0477208941616fc9a2cd8794899b5f343dd9a37da618ffd40eca1b5b27a4fa2207575ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955500, "uuid": "8ae49705-d8ea-434b-a85b-1d67f3a52804", "value": "T16613F14EA0F878C7CD8CA978F49C967311C3E0D1611257C6335589CA672DF3FA58C89A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955500, "uuid": "077fb8fa-c45f-4287-82d2-da33dc5b11dd", "value": "768:CHDdxBHzsx+dgV9I1VvU8KYyLEC4tHNgu+DYP2P1I7551timGELk4XNTXlOeWs:axBHzsxjV9oS8KpatrnO9m5PTbk4d7Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955500, "uuid": "64861c6b-af64-4f1a-aa84-a46871a2b2f3", "value": 44132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955500, "uuid": "57262797-a439-450a-8bf8-c5ffc8575a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955500, "uuid": "c0f3ede8-a873-4e73-9a94-62d68b092415", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05085aa-0917-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "de9a48c7-f604-47e3-b918-47ffb691ff0c", "comment": "Malware payload (Mirai)", "value": "c34b4e4a8958653bdd3b01870b97f87b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "f279a67e-8f56-4153-b78a-122384e2b1af", "comment": "Malware payload (Mirai)", "value": "3e6b57b7252d352f1b469bf958e8a8ee9477f83ea0c6c379505019b7d79e76d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "05b61241-bc92-4a91-bb56-88cf3f8fab01", "comment": "Malware payload (Mirai)", "value": "c07c9308b255baeed3591fee9edf7b85204807c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "1139b9e1-a706-4457-b761-cb416075d802", "comment": "Malware payload (Mirai)", "value": "caef8e9f9e1d68f864875e0926b7dddef64e45e74d86b0ffbbd82a4c3aa78f8e0e6847e3aa53eaf22577a160f2f4fbae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "1df4cfa3-e236-4808-87a4-d1e065af2456", "value": "T144C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A271F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "02131e99-e59d-4ba9-8915-33157d944e1d", "value": "1536:UrAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3i:UEFmSmviqS1Bs0+Nd6lAqktNMxSNbmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013304, "uuid": "c4fa1146-6841-46ff-9405-4b2181ab3ef1", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013304, "uuid": "1ed4071f-c10a-4370-9792-1ab802ec46e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "487ed898-ffbc-4bdd-863e-f92867ff8218", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57442d71-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974043, "uuid": "3d450742-1a6e-4d47-88fb-957bfa29777f", "comment": "Malware payload (Mirai)", "value": "8c4c63188514cf59ffbf9b3f4ff810e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974043, "uuid": "8003ec39-2253-4d01-8fba-70770840a3c6", "comment": "Malware payload (Mirai)", "value": "3e7d192f16eca15f985bf99dc18fbc55690e15615e425c0c9e8d76e8b934022a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974043, "uuid": "307be7b6-828a-4f7a-888f-d57f542efb77", "comment": "Malware payload (Mirai)", "value": "f84ce4ace826eebc4d45b47fa995a44f58e39a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974043, "uuid": "f1e34711-6971-466c-bccb-0178b65c5827", "comment": "Malware payload (Mirai)", "value": "5cc419e69e470575b5efa5250183816b345d4eab6f4a54dcef0cfd2ec1afdeb6028c5d088d7cc552534983742be33e22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974043, "uuid": "85f03c9f-1353-4c07-8b44-279ab6af2fde", "value": "T1D9D47D5277218F64E361D57105F38BA19AB521A30AF395C2A37CC6207A50B7D2C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974043, "uuid": "9162cac9-397d-42e4-8eb4-1c4380eae280", "value": "12288:/ca48X/o0XiMaNdiXJx4cBGm3zAJMgpjytsQj:Y8PA04cBGm3sJMsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974043, "uuid": "9dd3e929-8aa2-4d92-a84e-2545e6327761", "value": 597936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974043, "uuid": "a56840f6-ccf0-48fa-aa44-a1ba9feda454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974043, "uuid": "ed6fabc3-ef7c-4f70-88a4-da88988b16b6", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593acd93-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973187, "uuid": "bfb8b5fb-2e26-4c0b-9d1a-b5bd76a93b86", "comment": "Malware payload (Mirai)", "value": "1ff5ed797ab58169776e008f41d6d846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973187, "uuid": "1e7e1000-be9a-440d-9c28-5cc579b25cd5", "comment": "Malware payload (Mirai)", "value": "3eb0771300c54be016ba548cf11079a0e5209b82341cb986d4d564f5eea5fb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973187, "uuid": "54cd2518-7cca-46e8-9457-14bbec786964", "comment": "Malware payload (Mirai)", "value": "946fdc403efdeb3c0326cdf85a493e85b49ee2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973187, "uuid": "8ff02d8e-55fe-4fb0-9cb4-548c04be1f54", "comment": "Malware payload (Mirai)", "value": "e6abed8de78b3ce6c3c12eb50d0383943b6bb6aa3b1a5deaa9dece947a69b0efd98bec9db443fdb50bad3a86d06d6bef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973187, "uuid": "725713e3-dd82-464e-a8c2-ea235503f48b", "value": "T13983B382BB43DFB7E54724F112F75B724A32FC3E0C26D981E325BDE59A215D0A616328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973187, "uuid": "66d6a73c-a8d4-45a1-8034-fe48ee36c623", "value": "1536:aKXw70JA1/nxuKjY46uncBTaxajcm4a0SI8U:as9JA1JuKkIwWx1mjhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973187, "uuid": "807c4b00-ff4c-4538-8e9d-99dbabbdfe57", "value": 88280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973187, "uuid": "a092a94b-9500-4d13-bb61-f667583bfee5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973187, "uuid": "566837be-21e5-473f-910e-5c325d784ec4", "value": "sys_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510903d0-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941391, "uuid": "21ce16b7-ef45-4b31-a27a-d5474cb32810", "comment": "Malware payload (Mirai)", "value": "73b2e31059f1adcabbef8045deff3d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941391, "uuid": "7ed71afc-7a46-4be7-bb58-83b365df92a3", "comment": "Malware payload (Mirai)", "value": "3f302d91b24c943426d71e0775c4041b04123d78b0b9e778a64136708e9ee4f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941391, "uuid": "e2c144bd-6d2d-4565-8dca-060629e9e946", "comment": "Malware payload (Mirai)", "value": "fb6feae1501d860b1d5b1f1268eade7d5f59d216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941391, "uuid": "1b729444-ee19-4161-8da3-442436d9c14e", "comment": "Malware payload (Mirai)", "value": "f637bb56b7c3d4c87257c42e757143a75bf133a1f356ebfb5a8fc6fcd180a01a486ccdb437119f07407a61c8dd54ea79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941391, "uuid": "5082aea4-ffe0-4390-829f-975fa9c2cbd8", "value": "T150E34B06B5D098FEC899C1744FAEF136E971F4291138B66F27D4AB622E4EE311B1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941391, "uuid": "206df9b0-77d5-4be2-a226-f918433d7a41", "value": "3072:PwnwEYt+M8RVzQNT/pG+6YZ/qdFCeMjnd:0q+U4Y/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941391, "uuid": "deb0b761-c0ec-4d30-a993-81860113045a", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941391, "uuid": "f336cf97-0f45-4890-926c-56e3f3b04050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941391, "uuid": "8f7f4283-5e28-4fc7-94c4-6f1f3988d2f7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30c4500-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014597, "uuid": "c1bdb80c-32e4-4488-9e03-ce8a31b108e1", "comment": "Malware payload (Mirai)", "value": "2a7bb84a4947bde7e020a0471a833dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014597, "uuid": "f51df0ed-7e5f-4be0-943c-12f9c6765af4", "comment": "Malware payload (Mirai)", "value": "4005965e6eedbffb1f19a0454ceb00e1f8d7703de2247c43ceb7bf3cd056c1a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014597, "uuid": "c422fce6-67eb-4983-a83b-ea582862780d", "comment": "Malware payload (Mirai)", "value": "488ff4fffc251d3c4ca1ee2ae827d6b1aaa3fda8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014597, "uuid": "993d72ca-e4af-4f5f-afd8-308616ed3f34", "comment": "Malware payload (Mirai)", "value": "69582398a57070f22bdd6c367ccb38986dc1830eb3c8f06238a1419f2c3c3de61ecf2bfb54cc969f5f2f736321b886e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014597, "uuid": "054e573d-312d-40f3-a801-7242fff7c3af", "value": "T17C736BC2AB47D4F4EC2605712077E7728773E13E1029EE83D779A836ED52A41962A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014597, "uuid": "629d0bdd-70de-4761-b73d-12e59b20018f", "value": "1536:yUQvN+2LhcIKzuIpmQ3Pk798U755e1j+y:+lVNKzugmQ387O0PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014597, "uuid": "0bac5c7a-0546-4bef-8297-55e96b1f7970", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014597, "uuid": "ede253a3-86cf-4479-8765-f8255a2e2430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014597, "uuid": "c3439efb-b7e2-4695-a428-1f44a3a433ba", "value": "Calix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70b1ce1-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015543, "uuid": "df2b697c-679b-406f-8c26-437e11112194", "comment": "Malware payload (Mirai)", "value": "c1859dfd3d00d145910f8e62f22de43c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015543, "uuid": "6421509f-9bdd-463b-9cc9-f96409a4a496", "comment": "Malware payload (Mirai)", "value": "40238b4f8128c4a922610017e51aec9b42dc4341bbaa0f35538fb91db79befa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015543, "uuid": "f46f3711-584b-488d-a980-014b462c49b8", "comment": "Malware payload (Mirai)", "value": "e2fbc4388ad46fc524da4709599bb5bcf8010127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015543, "uuid": "a6b2ef20-4cfe-4939-b11a-9eeb3a8c1e6b", "comment": "Malware payload (Mirai)", "value": "d2f784bdbe7e016e915187d78e5d5da6e7a681ad9a756dbd8753a426f770aeef73b9b4cf4060f76820fcdb5dec7d4b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015543, "uuid": "0631fad5-72b2-4493-bab7-51540d448bed", "value": "T18CF34C45EA408A53C0D717BBFAAF0149333297D5A3DB730689285FB43F86A5F0D67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015543, "uuid": "ebc4eb49-db57-4aff-a074-a449fa7024a3", "value": "3072:jrNoRdlRm4EpkhYT2OXDcY0GCGTJQAU58+4Urr8TNM/9jIceE3C:jrNoRdlRm4xhYKk+GCGTJQF52UrrEM/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015543, "uuid": "75d15893-25b3-4c10-88af-cba5bee0cef8", "value": 169349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015543, "uuid": "edb7529a-e367-48d4-ab80-c75ec1e3bab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015543, "uuid": "9cb570e6-7fa8-4f2f-b3fe-fa0ff7330f8f", "value": "SecuriteInfo.com.Linux.Mirai.9816.13890.27155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5805be-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972548, "uuid": "5dd52948-140c-4bd5-8195-1db8f09e7600", "comment": "Malware payload (Mirai)", "value": "1f9172d618051b900667d362d94c7fac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972548, "uuid": "ad905c45-2351-4e7b-8a28-55ec65f141f7", "comment": "Malware payload (Mirai)", "value": "40ec178e7306a4dfa4502a2b865829a0c58605bac0cbf520761b1e22bc5f5c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972548, "uuid": "08bb49cd-b878-4360-9c44-f2907308416f", "comment": "Malware payload (Mirai)", "value": "8bae3218ca2e4917005871cdccf9546f7339ca1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972548, "uuid": "87147b15-fb85-4cf9-91bd-2e5dc60776ed", "comment": "Malware payload (Mirai)", "value": "cd02cc809ed8288d8f7b7fc8de71edaf4fc109a7ea10aee58b0f4cd435e9351d1e33c6aa013c47050d035f5c4c8ec5a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972548, "uuid": "e63a6562-7be7-4b34-8cd9-d336ead3ad83", "value": "T195535B027652AAFDC187C1304B7F5437F270B4296321A63F6B8467763A53FB44B0AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972548, "uuid": "7bf15665-b9b1-42a1-8f78-6c0e059e9156", "value": "768:i5Tep/Rg6W/QiCKBqLrhQPep22yLtbhL0IauJVvINsl9SyEYYVrce86AgmX:Kg87BQKPR2yLtlJJl9bkr0ZgmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972548, "uuid": "23350b3c-8258-4cec-b673-f3cf0c62c116", "value": 64288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972548, "uuid": "33966cbf-6326-41f6-b59b-63b3792af623", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972548, "uuid": "986e3ac3-3cf9-43a9-b172-d388f6ebad7a", "value": ".Sx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79118f1-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010309, "uuid": "32a22aeb-2bfb-4514-a8f6-201aa64bd33f", "comment": "Malware payload (Mirai)", "value": "73d45c3aa473e1e7700568dc58cf73c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010309, "uuid": "c851858e-b344-45be-93c2-9739f87161b9", "comment": "Malware payload (Mirai)", "value": "4184b42ad7dfa1e6a72710433c048d79b154f1248c1fc33492b8a32807ac28d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010309, "uuid": "4305fe33-d8fd-49ec-be2f-9bac88fd4d03", "comment": "Malware payload (Mirai)", "value": "0a1a9ccacded7fd22bcf101827146f32087e2bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010309, "uuid": "8e10c78c-9598-4d47-94fc-2f2085b0b3fa", "comment": "Malware payload (Mirai)", "value": "d0098ba97a297d2eff377f7110a78719ca23964efde142c9721c079666451f50415473a6d69be6144567469de6fc6007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010309, "uuid": "72fe8b03-a5b8-4891-9dc6-eed81ff8c80c", "value": "T18263951E7E219FBCFAAA863447B78E16564833DA3BD1C581D1ACD6012D6064F740FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010309, "uuid": "7a3bea0c-fe06-40bf-848d-78fdde3fc837", "value": "768:75mnnogDICLHYCLHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsC5siv5XLatAX:0nNlhA2SyOCuIp8LMTopKsV8BP3i9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010309, "uuid": "762ccff6-509f-40f4-8739-e71328fb9d00", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010309, "uuid": "c050a5cc-190e-404c-b284-8f690c48a508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010309, "uuid": "0d6d9d15-052d-4770-9373-f5a1bea4b464", "value": "SecuriteInfo.com.Linux.Mirai.9816.8242.24198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dec9bd-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770975489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975489, "uuid": "b3806bd6-97b4-4dc7-a719-f76c0984d611", "comment": "Malware payload", "value": "c8f89077cd2c9f38290b08098bb55e0a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975489, "uuid": "21b19afb-4fe6-4350-8271-06ec196ab588", "comment": "Malware payload", "value": "439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975489, "uuid": "5cc5292e-b46a-455f-bcd4-2d559bd2627d", "comment": "Malware payload", "value": "2f91ba64781a381775791eec67de6a1821c3bf77", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975489, "uuid": "94d174e2-8ae9-4af0-a50e-b2e28c784ac8", "comment": "Malware payload", "value": "0f25bb04d54831766cc8e1ca4aca9f27f7d01d64e2fb46a331ab66d4cda8f03bed2cbf1a23cf4e783d93a72c5efda515", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975489, "uuid": "3954f503-9b60-488b-952b-31140847f2f1", "value": "T1EC283312F07195E7C9B72531CC7BEA1656A8BD276B104CA7AFF4371F24362C32A32646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975489, "uuid": "702bf08e-a082-42cf-8f35-ecb24ac2d9e0", "value": "1572864:bf0o8POL7GuD111/Vppai6GpRZ0xWGFCxgN+IzNcBfAalvuajRwNSzV7Cnb0omo:b0oU26q/PQogxtF8gwC+BIap7RqPb0oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975489, "uuid": "57b83eda-2770-484b-8474-0b9685a9a593", "value": 98381824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975489, "uuid": "f7ccd83b-2b58-4e9f-9f59-cc5a5669bb3e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975489, "uuid": "8be96a29-ba35-4047-bf47-0d1b06d2ebd7", "value": "em_HscTfWi9_installer_beta.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa64469-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026689, "uuid": "ad78f414-3ea0-46e0-8fd4-67e8820093a3", "comment": "Malware payload (Mirai)", "value": "24a61b57e057a776073c60bfcc95dd34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026689, "uuid": "e75997d0-498f-40ff-b6a5-2ce120a8c30a", "comment": "Malware payload (Mirai)", "value": "43ad2628795c66807334028f91d3cbdef67d654c38dd17aec4780a38ab7b0b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026689, "uuid": "aa070d8a-8c08-4424-b8b8-80b6e69d3ece", "comment": "Malware payload (Mirai)", "value": "6a7816ab7959c7674b04eb79f2eca41b5fad0b70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026689, "uuid": "8ad4cc95-d852-4f9d-ac77-a8a95c8b1877", "comment": "Malware payload (Mirai)", "value": "f81ae53aea6f7867faba832c93a467045838b815a4f70b34f3523897cdce1ce72e60db5b3a8d329fa5ecd1456b3d9c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026689, "uuid": "5cb947ea-3ea8-4532-a5f1-e3dae8162950", "value": "T1DD93E606AB650FFBDC6FCD3706E9074635CC951A22B53B3A3634D92CB50B25A4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026689, "uuid": "cc199ac5-a14b-40bf-80dc-6421f2d1c99a", "value": "1536:7rPTr2o6HWyNM/OgRDNp0SVVU4KXYMAOhd8Zpvl96x5DnRCHIK9/Bq:7rPn2o6HWyNeVNKIzU8ijcIUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026689, "uuid": "c342d7b1-3802-443d-b863-5cdc97bfebf9", "value": 97644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026689, "uuid": "4024c4af-621e-44f0-9d7c-ffaae1b5e01f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026689, "uuid": "d34e34e1-ea5b-41e0-82b1-38ef0f1ba628", "value": "amsmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dba31b9-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025701, "uuid": "ed35b070-1506-4e19-a0bf-93eac351f039", "comment": "Malware payload", "value": "0410160fea94e63c281e7053a886e331", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025701, "uuid": "ba309bcf-4621-456f-a818-7bf773861964", "comment": "Malware payload", "value": "43ba09d342cbb3292d044cc4fe353692fd49f0fba36735559e477b9edb88d33c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025701, "uuid": "4c2e059b-3ffd-4dad-ae9d-f588202132c5", "comment": "Malware payload", "value": "7c027af0f5d5d5b9c2f67e6a3cf84d27d943f478", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025701, "uuid": "38d41f87-3e65-43a0-b29a-039b31f30859", "comment": "Malware payload", "value": "e732b4146a44bdd220515953ce5d3ec00a1c2c547e09a6919cdde65364f93fcf15063bff4e2d979e6302203f203bc1c1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025701, "uuid": "8c0eb60c-bdfd-4160-bed8-29f7b86348d6", "value": "T1253623317B8049ABC7408BB2B67F2A397E7E621340CD95D138EC81973746EDB523E859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025701, "uuid": "59cb65de-c60d-46b2-9005-499b61d0a9dc", "value": "49152:DRKbByFiEQ6l7ygcEt7mdqSM6GwtpoSMnteZ1QK8VxQMk:sMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025701, "uuid": "2d3e6279-e9a4-4a47-a1e7-c7514a6d3475", "value": 4929536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025701, "uuid": "84954e61-1a4b-41a0-90f4-4bec679a7e45", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025701, "uuid": "9d542841-dc73-4ce5-a535-a41a4e4b903f", "value": "Nmcl9UVBE90565_EHQPIH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f64710-0918-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013481, "uuid": "4c0d60f3-f9fb-48c1-bf86-f936d4f82620", "comment": "Malware payload", "value": "854a6656ad42911ddbe23e62cacecd0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013481, "uuid": "b530ab2e-8adb-499b-b4a1-b502d8223b2e", "comment": "Malware payload", "value": "448452d8804f49777e0d8d1f31b1bfe9bf6e73965574dc30dce6e8a58f1ca5bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013481, "uuid": "c71dc25f-834a-4f4d-b85a-539e43190f68", "comment": "Malware payload", "value": "042feb54d5ce3afc01cd166b9c20abb1cb74796d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013481, "uuid": "57d22bff-175e-4a81-b270-58f1fa041115", "comment": "Malware payload", "value": "993246645f9e585c151fcf54fc765c70360976da4b7f603253df84d06d7627327d3202bb2bff88269c0e8d3dd84ccc95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013481, "uuid": "43665a2e-fab1-4b07-99e7-b958333b1c05", "value": "T18E140B05E9145B57C2C22BBAF79F42D937336B1897D73301AA29BEB02F8679C1E39111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013481, "uuid": "68493bb7-0d3a-4ee4-abb2-3a2a16662881", "value": "3072:5RXIhWvWsGUHDOLzTRU1cVRgfFed+9nY2t09ntLedOb4ixPek/RXmykGKq9qTcD4:Twb4itekJWykGKAvyGLpcVZWne9452/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013481, "uuid": "73b0658d-3f1e-4bd6-8490-cad3d51a3ec0", "value": 192725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013481, "uuid": "0a67e3be-29e7-4c63-9337-b9d87f200c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013481, "uuid": "61fbc1a8-59d7-437f-8e32-7e4b2f5f031e", "value": "a-r.m-4.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d313ce-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976556, "uuid": "b43b95de-04a2-46d1-96e8-fe08cfeb31c5", "comment": "Malware payload", "value": "fae2a607d81c3d9c6a7e09ad7df63429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976556, "uuid": "dfdc061b-0290-4316-980c-2c7abc77b38f", "comment": "Malware payload", "value": "458c0bfe2ec4d8f1500684f9af0f4ba69710104469641c8425f5d2803af054b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976556, "uuid": "f2dd9d20-35c3-4b51-a592-0c7fceb11d81", "comment": "Malware payload", "value": "ef3196ce393cf8c99722a6d97fac217c9e8869c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976556, "uuid": "346a7be7-2803-4d0d-bb2c-2ea139c09d5e", "comment": "Malware payload", "value": "a27dd2c97b41e4af8ccbda38132def0d8c183c56d772b2f3a022d0404aeef6032d2e89781de22c6261e150c3dd3083ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976556, "uuid": "c08c1edc-6e78-45b0-9330-4c97ae69100b", "value": "T1A2623C44139251EDEA298DFCC0458E26E49FB0988350FEFB56F4CA321BC5EC2553B796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976556, "uuid": "8548a0ed-27c7-4ed4-b2e0-2d19a19dffe1", "value": "4588ba1b149b5cfd708ddf81aaf554ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976556, "uuid": "ecc4c9f2-62d0-44af-ba6b-aeafe6257fa0", "value": "384:RbE1A6oPC0xjf2NpNfjNxdiZM60Acz88ipCJLt3:z6YGLdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976556, "uuid": "37b1dc02-9e9b-402a-aefd-ec0436d64560", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976556, "uuid": "f687bc72-868c-4f26-bce8-6db93dd3ef6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976556, "uuid": "20ec2ea3-9825-428e-b562-081ef6628172", "value": "clippy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579204af-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770971037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971037, "uuid": "2c2e565a-6c11-4418-8e3e-e1cc66482533", "comment": "Malware payload (Formbook)", "value": "a03b75f4da011feb836a76c1b3f415d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971037, "uuid": "95c01dda-85c8-4fe7-921f-3deec6814bec", "comment": "Malware payload (Formbook)", "value": "46230cc0765d5835a360e608756cc301b17d0c61f93c7689e76d0669711f5515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971037, "uuid": "ba236933-1fef-40f1-9e6b-ba2601859db7", "comment": "Malware payload (Formbook)", "value": "00ae5409ba65f705bb7df594e33a873881ad47dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971037, "uuid": "f1d2d956-c15c-4f11-90ac-819002f2c455", "comment": "Malware payload (Formbook)", "value": "7af8fdc1946bdb6644d7738f5069a34f07052137f031731b961bbfe41eff7ecfab328cccebd87b7dd44fb2d17714d5a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971037, "uuid": "24efbc30-1e3d-45f0-91ba-6c8062d7cd4b", "value": "T13AF412286F0EDD22C48117B509B1E3B5A664DD8CE510D213DBFEBEEFF5289057A1C2A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971037, "uuid": "006e3973-a029-46f9-8b72-0e7fe828e8b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971037, "uuid": "0b6ccb16-59d9-4ae5-a7c6-7ecf37043e9d", "value": "12288:AOCF77zV2eqBQ0T3SYtWnaSX+CLcM0+/owfVl6pAQAleboEQHhks0/PbTbczTlCV:AHF7XV2vBlHIXJIM0+Q4ipAxGY0/zXQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971037, "uuid": "cc0abb49-8d71-4cc3-8e92-2dfb46e4afa8", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971037, "uuid": "346b54b3-602c-444c-8272-42e0f1f2bb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971037, "uuid": "b9f9ed66-b15a-49b0-9269-a259df2bb96c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.74983598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eada7302-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010368, "uuid": "d2aa63e5-487b-4a84-9eba-747d84de0d54", "comment": "Malware payload (Mirai)", "value": "0f7d787162f7583009841dc1d4716d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010368, "uuid": "4ef4605e-9697-434a-bb3b-ba9b8a9571e2", "comment": "Malware payload (Mirai)", "value": "463112de4f9093480b09632eeeb4e1970ed4f58eedc9bcdb60109792547d2763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010368, "uuid": "7d55e308-3dea-4c0e-958e-ab9953203f63", "comment": "Malware payload (Mirai)", "value": "8d86d3fb99f0f6c3fd3ca568811edc12d44f38d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010368, "uuid": "e406cfbc-0f09-4107-a1ad-908623996328", "comment": "Malware payload (Mirai)", "value": "37b72fb4b48d5ae9fe671ae404e5ecd5ae32e0b3b01303cfa491775336dc1c9b6aa79f426dc66af2b9f489ca521a3a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010368, "uuid": "a850eb73-3125-4ecf-b597-4acff470da92", "value": "T181231AC8E443D9F9EC4609742032FB279AB3F6FB2229DE43D7B495236C41702A9059AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010368, "uuid": "2fa9049f-2afc-4492-9aa8-7c3372a43f41", "value": "1536:N9XBoYwvf5QxWkkeqMOoHXUQMYV7vIgws7H2T9:NYYwvf5QxWkkeqMOcE5k7AgwiWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010368, "uuid": "1fd74397-03a7-4d05-b8d6-78a0559841c8", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010368, "uuid": "c1d01b3c-3576-4482-948e-16f40ca130b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010368, "uuid": "cec82cde-8125-4d33-a9b6-45aae4696a91", "value": "SecuriteInfo.com.Linux.Mirai.9816.31054.21158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5941a7a9-08ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770980059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980059, "uuid": "ec2464c1-5c65-4b90-8711-80853d470050", "comment": "Malware payload", "value": "4514ee3448808f41b17c450806dcd34c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CloudAtlas", "colour": "#B85F74", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980059, "uuid": "44037c1f-c481-45c3-ae5b-9816016ae11c", "comment": "Malware payload", "value": "46e0f6fd0f25b1c52b4e27979c923fb5a83bd8798c2a5580a0933aed5047be65", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CloudAtlas", "colour": "#B85F74", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980059, "uuid": "22396ff9-ec0f-4732-86c8-cf6784bb08da", "comment": "Malware payload", "value": "f81b208de15c5550a85a658f43c69e27fa1bb9ee", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CloudAtlas", "colour": "#B85F74", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980059, "uuid": "33f91513-f5c8-42c2-a521-c40e851eff1f", "comment": "Malware payload", "value": "039e73abf9ccb8b269c9d58b2850a4ddeb68c78f3a7772a385f8c423c96ea67fc261c6646109d5b48c46d21ff9800c33", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CloudAtlas", "colour": "#B85F74", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980059, "uuid": "8c20084f-34a0-4ac0-a101-eb377e8f2966", "value": "T1AB335C527686FF3AE113013468AFC344B338BD5C9F56921B329ABB0CFAB05B44E54B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980059, "uuid": "cfd44d6f-4077-4ee6-8bc6-320a3c8d7e7e", "value": "768:6FFhGRTuXQChoyR/hPFg9i/eVMabyUb3y+:ghGRTugCqWJPCnjy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770980059, "uuid": "942d5183-796e-4402-9861-ea4e25e0b876", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770980059, "uuid": "57df579f-f9eb-4a4c-9d64-c45893337b9b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980059, "uuid": "f98f486f-fbed-4319-b0fb-1388e45d967d", "value": "1. Decisions of the 20th session of the SPECA Governing Council_EN.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39755def-08ee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770995468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995468, "uuid": "baae58cd-f40c-462a-a890-667035ba52ee", "comment": "Malware payload", "value": "a7f748f415ec842b22db1c821b58c81f", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995468, "uuid": "a52b1c71-f100-4a1c-b43c-7ff91c6a7933", "comment": "Malware payload", "value": "471427968ff51f847e49d8432148e004f28603f40ca9f7c2b3b5804791be794e", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995468, "uuid": "613342df-263c-4513-84ae-acee0a17ebd3", "comment": "Malware payload", "value": "f2d64c51857c579c4f9119750d9789b466d14046", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995468, "uuid": "06d073a7-3d63-4b69-800d-0c7ef41bc42c", "comment": "Malware payload", "value": "4658023f8f76b6b03202af6ec3b6efbfe5099ea9974bd00604d3bce3690d20b56ef6f31ce36abc0195109b91287b5d37", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995468, "uuid": "7e66fd4d-66a7-41b9-95cd-6957c669091e", "value": "T16818332B636E53EAE34F0A3E7E21D18DF50D438D47B084E8705E48292B682F987D9B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995468, "uuid": "297d32b4-2452-4376-944e-da5881832376", "value": "1572864:BKsRCizpxtDdON6iAALO7oiWXlKNbdjPcbLLDTstymgH2cd:QsPzLftiACO7oQN1SX1mbcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995468, "uuid": "66f3faac-4761-411c-a739-b03683b91faa", "value": 90259345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995468, "uuid": "b880c865-793a-4b39-8979-b821842ddb2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995468, "uuid": "27573cf2-0f59-4e2a-991f-d8e9c8d6a9d3", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f173d4f1-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026700, "uuid": "c1e74059-c5fa-41cf-93fe-740c3054692b", "comment": "Malware payload (Mirai)", "value": "0a44897967ebf982478ea54a5f9105b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026700, "uuid": "0223157c-3a64-4f01-b626-558d866830e1", "comment": "Malware payload (Mirai)", "value": "472c6f780f921162987185a2a16368c8ed77b949c63f720fd357ac1a700f2c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026700, "uuid": "9aa34f58-a078-4703-8ff0-75f7cfa90609", "comment": "Malware payload (Mirai)", "value": "e5d44528d06f9d95daf0613f43fe940442d17852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026700, "uuid": "ad3e2388-2882-42c0-9561-7f0e3308b2a8", "comment": "Malware payload (Mirai)", "value": "fed3919e62f2146db8f46e7c05a0401a89c94e287e1feb383b95492f161dafe80c50a703f1857fc0115a29429b06cc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026700, "uuid": "0a41bf14-2738-4158-9715-87a52b282085", "value": "T186633B02B31C0D47D1A75EB42A3F27E183BFA99120F4FA89651F9B469275E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026700, "uuid": "53bab571-0eae-4ff2-a18e-50954ae02974", "value": "1536:mhblDRancJUyXCAvF+FQc7y44Iczd+pj9FUWysd9/B+:8Kz+I34I4+Fwq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026700, "uuid": "bba83183-71a8-4423-9c50-de52208aa17e", "value": 73028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026700, "uuid": "c0d79fe4-1455-4306-8cfa-eaaf8d0a3932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026700, "uuid": "def974ac-81c1-4e8b-beb2-e5e421f4b6fc", "value": "amsppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bce5508-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011471, "uuid": "76b56734-bcf7-4a32-a79e-9418c4c392bd", "comment": "Malware payload (Mirai)", "value": "ea60a0f3884fb464a7aa1164dec0ca0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011471, "uuid": "9591c543-a09d-4ebc-914b-ad812b1c4bc3", "comment": "Malware payload (Mirai)", "value": "472eb8d3cd3360426a1f99f5384c36ff8094f012263d3dc4a2309f37668dd2b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011471, "uuid": "40a929a1-fd25-49eb-8238-225d88075faf", "comment": "Malware payload (Mirai)", "value": "8351ed692c344b1a119befd78700c3116025917c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011471, "uuid": "c8914ff9-58ab-43e1-8d50-f45876fbbb21", "comment": "Malware payload (Mirai)", "value": "db61e0e48525233ba4d206e34c277fa3da1ffe86ca22e361f6160b8920b5235d4d8574008f2ea59f3315eba662d963b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011471, "uuid": "2ba72e28-4153-41c6-af5b-e4535d3e4c81", "value": "T13383D7192E219FBCFB6C823547B78E31939C33D626E1D685E26CDA005E7034D645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011471, "uuid": "a744749d-29fc-4c1f-8115-a224a60d6881", "value": "768:GBcp1fwWD3Fp198ZB2h7NkZrp8KhqKQ93RTu0gECOaKmKYqwflaMV8UcQygByNAK:1I4zw1PhpKufKYpfV+KZefJoefjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011471, "uuid": "600cde5f-7889-4f71-9882-a1f8f140ffd1", "value": 81412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011471, "uuid": "d0b2dfe1-b98d-4afe-adbb-3f85ed06bbf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011471, "uuid": "0f70a81f-ec96-4a0c-aa46-fc6723a4d9ab", "value": "boota.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72ab205-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011624, "uuid": "9f35e841-da84-4ea7-94de-242afc7c88a3", "comment": "Malware payload (Mirai)", "value": "9075f1fc943f5116f242ae64b755af74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011624, "uuid": "a226d900-ef23-42ba-9b46-8f6286252bb0", "comment": "Malware payload (Mirai)", "value": "477d40f3068ec38a38c79df25d29f0566e458f2fe41f8359fae8ee4e9a99f5cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011624, "uuid": "a65b51f4-9fbc-4c66-b7a3-b04cdd7a1dca", "comment": "Malware payload (Mirai)", "value": "bcecc81b7bfcc30ff76efa4ae19e228d034a03ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011624, "uuid": "149323dc-cdfe-462d-a43d-22d4b666b732", "comment": "Malware payload (Mirai)", "value": "8d648ed2e9f3aa574a94e1df3193da816d1a402aef753ee37ae942a999e36a48252c9eef2e0794b348f348eb4a64ee2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011624, "uuid": "68db3215-8068-4586-8d68-fd87ba3cfb7d", "value": "T154636C3279751E2BC4D5A97A21F34765B2F5438E35A88A1E3D720E8EFF20A5022437F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011624, "uuid": "2cb36ab2-ab72-48ac-9a8b-c6d112768fce", "value": "768:MgoQeq9MUTj/Xp5dWrwxkha4i+OiYdk0d94BzbO+lM5VdGeXZg0n1tFQ9qIGYYC:MgfeS//b2wxkha4i+QS0cLlM5xtaq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011624, "uuid": "9e1154ca-5174-49f8-bbd5-de172ce96150", "value": 68664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011624, "uuid": "3ba0b105-488b-4393-8652-1e56791b84ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011624, "uuid": "16527016-8823-4181-b1b7-79785cfb3d10", "value": "boota.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db44729b-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972547, "uuid": "61db2aca-11df-4761-a9ee-7a0872199342", "comment": "Malware payload (Mirai)", "value": "93136d831da128c4544a0ef4dee5ff34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972547, "uuid": "fae3f74a-8792-446e-9297-3ea567528a92", "comment": "Malware payload (Mirai)", "value": "47bc5da487763e1dda76e46bbd2d084c0d729623067f23c40357005f13f25c4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972547, "uuid": "2f725f45-2204-4079-ae55-93b979af87e5", "comment": "Malware payload (Mirai)", "value": "66b6ac792e7c3c47d5f029972a10eb1027f040e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972547, "uuid": "ac330e10-e607-4c57-9c68-6a644c79bc1c", "comment": "Malware payload (Mirai)", "value": "a03839431fc38ad5c79a601098f360162a99988c1d53acd6a59b9d8dd08e7223256de904671f042831934dd1085369c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972547, "uuid": "0d678ef7-f2e4-46f4-8867-c9d64978ee9f", "value": "T1B121DBC7C351163144409A437347C4BCEA659BCD29C78FBD6C4D0979B6E8D41B550F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972547, "uuid": "823e60d1-d9fd-4b5b-972e-25c67211e1c1", "value": "12:KF+2rzfD+Kkrzq5x7KpKy+rBUqlxM+r6UMt2rTzpOrQC7KC+rJxnoRre8s12rYtA:c+mfD+4f7KpoUpnUSGzfC7Ax186/Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972547, "uuid": "9e5d5c73-2ac2-4a7d-9539-871a184fb536", "value": 1141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972547, "uuid": "fc08fe85-3d91-49e3-8293-ed5bf0040e16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972547, "uuid": "2f98ffc9-d91d-47fa-bab8-1b7494ad4a35", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9cfd5e-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973198, "uuid": "94318d1f-e48c-41c0-8de2-e96cbe1dfd87", "comment": "Malware payload (Mirai)", "value": "5605c9d02dffba2ec6f7b218dd4fe78e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973198, "uuid": "d1308737-b2f9-4d75-88e6-d8b2ec1082f2", "comment": "Malware payload (Mirai)", "value": "4819e357399c8787de2ffcc319403c1fe99b702778d02c680366ef84ed053623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973198, "uuid": "63d9e681-aae8-4709-8655-1c62943257ce", "comment": "Malware payload (Mirai)", "value": "23c241ecb8e41fa5d43dce71ed3448df4a108b9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973198, "uuid": "6fb21896-45d5-4f46-9fe8-155ffd8970c5", "comment": "Malware payload (Mirai)", "value": "b032d458305a60c66164d3162cb39fca20eb76b19299902be48d6cafe692b8e0f6c8ab7279c10007245f240a32f8814b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973198, "uuid": "fd47d3e1-1d51-49b6-8e19-256462a887a0", "value": "T180D30702770D4E03D1533EF0377B2BE0879BBD9628A5A580752EBECA9271DF22145E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973198, "uuid": "3df7a0f0-27e2-48de-abe3-4cda60747c8e", "value": "1536:7HP6pPCaKplEmxsxEkizAHkLCZtr0a8z4B4WvA3YzNhxkCqG+9J3QkhGK:rP6pIexQ+4a8MBW3jFGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973198, "uuid": "c1df7d32-d97f-4c55-ad6b-143b43a1db30", "value": 137824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973198, "uuid": "b50eb205-f3ed-44ec-ab35-9e9e970e2151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973198, "uuid": "1f3e5fd5-788f-4954-a958-002d52e1993e", "value": "sys_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f53dff-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025748, "uuid": "8f0d1303-e9ae-4254-b919-8716558dbf72", "comment": "Malware payload", "value": "994be3cac640b8999d10043eef5c65ca", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025748, "uuid": "c627f885-6758-4988-b6c1-3eb6de984ed8", "comment": "Malware payload", "value": "482126e314d5a45ff76db7703eec8fd69117ca0b9c9c52e2fe643b7a3de6b2c5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025748, "uuid": "b86bee8e-2735-4941-bb41-5dc2aa6f0258", "comment": "Malware payload", "value": "6d84284562d88dc06a4c3bf256a9f814deb72d0a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025748, "uuid": "303532e8-825a-410b-8dfc-ceb8bfedbd62", "comment": "Malware payload", "value": "c95999dc59d61ef894f6ffb0e4447d86e36a6252daa910cf5100771ba3f50415fd97158879c646c3c35fd0a3618e8350", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025748, "uuid": "557e50d3-885a-48f2-a160-30822b601c27", "value": "T1DA462336B941AD97C60007B6755F37313E7C6107078ED8D2B87C62827B82FE26A7E994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025748, "uuid": "0af2822a-2211-4bed-87ae-b143ccf822c6", "value": "49152:/b38M38G2Ji7ZEekTs5KZpsT5I7L9AAWaYwEL7B2sit/56lx5+ysXa3eS3hXpoEc:/rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025748, "uuid": "e15b3972-1f39-457a-b4d8-780ff9646860", "value": 5636096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025748, "uuid": "c40e50fe-b44d-4a70-892c-b8f85c98188f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025748, "uuid": "62719a30-4ecb-449e-8b33-1fd627713175", "value": "N09IN81070_RmbPDUR-397624yapg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d105cf-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973200, "uuid": "71b5b894-ca4f-45b9-9165-08c033d7649a", "comment": "Malware payload (Mirai)", "value": "1414e4143830d864fa06c5c42be5f482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973200, "uuid": "5cec839f-06e1-48c8-9013-e20c47ef4a7e", "comment": "Malware payload (Mirai)", "value": "4887d7088e9de6b493dd719f95cf83f90d66ce439cef8e4e7d74159e80d85aac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973200, "uuid": "ae2aab40-8668-450e-a6ff-581decbe9489", "comment": "Malware payload (Mirai)", "value": "94643711709611355b7e8e4f68565b33ba598694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973200, "uuid": "bcf28386-744f-4df8-976e-a82ffd8fa02e", "comment": "Malware payload (Mirai)", "value": "547b9c0cf378ecc3e7be8ff6f04967afc12cc22c8aa5c2435ecdb705330e44bb7e94faab830d853353c932619cb54d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973200, "uuid": "2c867f99-4308-4410-8048-9d296280313e", "value": "T1AC04D806AF510FBBC86BDD7302E90A1139CCA81B26B53B757674ED24F60A58B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973200, "uuid": "39056257-6f6b-4c7c-8e0d-0f4709de4b5c", "value": "1536:bqf1uQIKG03BxfN0c0yKEx7Dz6DbtCxtnFPZ8xn12spZQhS7/lB1jHQBe37OfMEq:b81vIYBV+nolFPMn1ZUS7/n10Bw7pBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973200, "uuid": "7fb34098-3417-487f-8ba1-f18e11408e14", "value": 179400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973200, "uuid": "b05ef9fc-66cc-4cdc-ba20-0aa1b033dd62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973200, "uuid": "f2d05723-e83a-4732-aa21-acb93b52ceee", "value": "sys_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae916ada-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1770976767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976767, "uuid": "a301da96-a22b-4dd9-affe-9f272a5bfdbf", "comment": "Malware payload (Cobalt Strike)", "value": "f3e80d7433fa0ec908a332aca06e3f47", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976767, "uuid": "85bcd8f7-4a1c-42a7-8bf0-a82cbce718e7", "comment": "Malware payload (Cobalt Strike)", "value": "48cc6671cdf4aec9ebb25ec428dc47eb09f39dc063de1ae0b24a788a346b13d1", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976767, "uuid": "61395207-da09-4e77-91ad-9373ac97dc92", "comment": "Malware payload (Cobalt Strike)", "value": "4871b5d5b851794544baa1f282ad0c211eb12c2d", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976767, "uuid": "71588e2f-f4e4-4e62-b3a6-21f619c7a540", "comment": "Malware payload (Cobalt Strike)", "value": "f3b3f2c31350b90f1e31dfc1c51cb9faf87a59ecbb8914b011faf09c0e32adddd022431c14884f68459ffd42f370fe56", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976767, "uuid": "c90563ea-d8df-47dd-a958-f04f6c27b23d", "value": "T19254DF564DC2A252C67927BA16E4F731E7BC81B9F1CAFC74A0CED91C8711C8DB0D864A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976767, "uuid": "7a6cccca-b4b0-494d-8fcc-447799ddecd0", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976767, "uuid": "0d1d7971-c27b-4a12-9a2a-7749052ba39e", "value": "3072:+Rjxs9Z9YPGSLr+Y6uuEM0BGc7KYUg+nF68+7D92joUfABMKqUJ6xf:+Rjxg9YPGScwjBGXY3+nF68+nwcvBMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976767, "uuid": "d192b8b1-2538-41cd-a416-1d5cf9571f75", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976767, "uuid": "02e5eb6b-4983-4265-8ddc-b4d2b3b0d514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976767, "uuid": "50398974-8abf-42c6-8051-7231b56e9138", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82927796-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977981, "uuid": "c4287780-92e7-4681-9bda-26917a701a31", "comment": "Malware payload", "value": "1bb68ae34d8d9080ebffd0b4488a6b49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977981, "uuid": "0cf09bfd-4c5e-4de7-b61e-55128bb61349", "comment": "Malware payload", "value": "48f7fddb7ce4fb29a3028883bcf5d682ac31135d199701f8e23786476ccf6634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977981, "uuid": "1183eedc-9680-4b50-86d6-7f22833257d4", "comment": "Malware payload", "value": "5fd23096a5dae4fff35fd78b36a5335b74b572ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977981, "uuid": "2274e8cc-4a2d-4183-935c-aef65b0c38f2", "comment": "Malware payload", "value": "16c8d9235fd20f42d783f8e740159d879e64d9adbe7b2d800130496c2bc9c6ce4fcd4a570a6285c997a91ce3ed10c0f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977981, "uuid": "a3eaa0d7-76df-4760-81ea-971b401afe08", "value": "T12A4412F3D589D1BBF19ACA39B54B485B1237E43944CE5F19AB06FEDB143E2848C241B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977981, "uuid": "f0fa1424-c4a6-4f53-acb7-3249b305abae", "value": "6144:iO19RIRsylaewPapv7+Occ9qL5R659PzosCJNxhpohSAT:iOPOahev7acILzQesCB/oh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977981, "uuid": "9fa168bb-971b-4bfa-9aa4-7002b2a93d9a", "value": 253932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977981, "uuid": "45ea540e-ccee-40fb-ac50-c0333d2cc3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977981, "uuid": "e2d59abf-6114-4096-b6b3-c45ecab72f3e", "value": "dlr.I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709cd4c-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770996162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996162, "uuid": "370a9fe4-f7ca-4d05-887b-e6b7288d2101", "comment": "Malware payload", "value": "1414804eaf6b10c68088c8420ef3a1b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996162, "uuid": "a4de6534-7658-4387-9700-44b07c7d6e75", "comment": "Malware payload", "value": "496a49b0ee080581b38b6afe02e2a282a34eeb3689e9256d4c5e72067abfd4c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996162, "uuid": "cc8d12b9-f411-4445-89ed-24c92100ca2e", "comment": "Malware payload", "value": "bb57026195da4607dbea9eac4a3740be4fe8df39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996162, "uuid": "40de5907-dc67-48a8-84a6-a3378e46dcfc", "comment": "Malware payload", "value": "1aa08214c83aab78c3c3022857163e1ca0bbb23a68d30f42c3cf3d98efe3d05082b49f9bd9b43cf9738ff052d983d08f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996162, "uuid": "3eefce29-89f8-4b58-9916-1579295eecf6", "value": "T15931A4CA50D9B1D381ADCE69B271D35A500483AB20DB3E1BDDD86EB1C8D1D85BC3CB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996162, "uuid": "f90a6a62-b2d1-42b4-896b-9cd8dc389ea4", "value": "24:Ns52aXW1aoDcyG1C1TBCB7NOgLtiNZEWeENMtE6EhfVk10+JA+g4MqDgSd:NsIaXotDct1CBk9Eg5GZEFEOtE6EhfVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996162, "uuid": "222e1260-fb82-452d-8fdb-385c9a28d04e", "value": 1481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996162, "uuid": "7ddeb4d1-d366-4dee-b851-1eb342669f9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996162, "uuid": "9324ad97-7d96-4050-a63d-a18787f4043e", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75eb70f-08ec-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770994874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994874, "uuid": "6516d72e-6a86-42a5-9e49-537a73614825", "comment": "Malware payload", "value": "8cb45364e772256f5daea83f394ca7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994874, "uuid": "5c1afb03-710b-4c49-b841-afcd3f6bad59", "comment": "Malware payload", "value": "49ee12cda48f4b1aebafbd6311bd734aa3ee7bbcdbb8beeef648bb0307523045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994874, "uuid": "548085ef-0665-4341-a98c-1e21a59204b2", "comment": "Malware payload", "value": "6b28baed7e12ca63183bc76e85d6719aedd1da09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994874, "uuid": "4e30f27a-8977-414a-9774-79cc31a1e708", "comment": "Malware payload", "value": "d9180811d3f9adb1e4741fcb22e179428ffa338ec57e91a8c6eab5d159098d1784385dbcee7365e9f540a10724ac314a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994874, "uuid": "491a8a34-cf54-485c-841a-d951e27b433c", "value": "T179E733519158A11AF1E73CB0E1EB878ADB05784E8771D1EED074024B78979E02A3FF7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994874, "uuid": "3941356b-381a-40e7-a010-cb63d1f7bcaa", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994874, "uuid": "7f76bb60-62e0-4187-bece-b16a50a7727e", "value": "1572864:G9zo742qB4fXGMK4XR3bLSCU/+6yPl3WzUvncVrx8YRALZdI:G9mlqGfgYRPSC++6y9UVr/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770994874, "uuid": "4dcf94b5-8eef-4966-9e6d-5dc871e5720c", "value": 64948896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770994874, "uuid": "1e5ee4f7-dd4d-4405-a095-e2517a8d5c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994874, "uuid": "a3fa713c-440f-4e82-8346-4fbedc6affb3", "value": "AdvancedAIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7582919b-08d2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770983543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770983543, "uuid": "360ec378-b02d-442c-912d-3e9724037928", "comment": "Malware payload", "value": "f6e6e6ae1ebb2e1a6b5740551675bc94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770983543, "uuid": "da2c5015-d437-4b08-874d-85ffe74f10f2", "comment": "Malware payload", "value": "4ac02fd9af61d70b89b79e011837194f4b1d67038d17ab77643aeeccbae0e2b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770983543, "uuid": "a0b2044b-919c-42aa-89b7-29b6e5050480", "comment": "Malware payload", "value": "6635a794259ad9de855f124c45950dde2f58bcec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770983543, "uuid": "ae2f94da-b11d-4292-847a-1c7c6024a621", "comment": "Malware payload", "value": "682cefd574af5e0dc4693cb500b3c4aefbcca2cfb4bba03f7d229c8e2662c11cd52280b5fc30b9320cfbce48484db56a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770983543, "uuid": "e471fbed-261d-42ed-8bc2-c8b7a2d68027", "value": "T1BBD023C514319F63BC8DCDB0FA2710FDE004724064C50C44E8431857401F1D5B42552E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770983543, "uuid": "7bd6ebb8-5d66-4744-863c-f3027c804330", "value": "6:hiiQE0JI+7Axip1uCGFH+dWZ5y9FnQEc5:ciUJqQpMCGFH1ZYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770983543, "uuid": "66526f91-c51c-4b4d-8140-9aa70c548d10", "value": 206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770983543, "uuid": "d2b71230-a7e7-4537-801a-20a459d74c23", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770983543, "uuid": "3b10de74-44c2-45a6-86b0-48a87787c4af", "value": "j.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d936a8-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770971009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971009, "uuid": "1840385f-30e4-4b8f-86e0-553d87ea2977", "comment": "Malware payload (AgentTesla)", "value": "28e91dc344876b352979696459c05c26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971009, "uuid": "22d9e608-6268-46eb-9419-1d440e99428b", "comment": "Malware payload (AgentTesla)", "value": "4b52f519d4490764bd929c4160929097730d3997f64f6291872190ae26c401ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971009, "uuid": "befb3809-4bb4-4e44-8a0c-7b4f0bffe984", "comment": "Malware payload (AgentTesla)", "value": "91df8de2498902f899e9ecef2f9a2fd035b6b7d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971009, "uuid": "012c91a2-9757-4fb0-90d2-316b6fa55821", "comment": "Malware payload (AgentTesla)", "value": "b194dfa8359052514ebbe75e6607d3c3e3be9119343859f52b7fb2a1fed7e865cad42776856e6bde9cfbdc9e3531653d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971009, "uuid": "d84b16bf-0bbf-431d-83d8-6913f5a9de3d", "value": "T132E411A83619D807C9A09B301470F376277A8ED5EA21C24AEFDC6EDF78E9F104D14697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971009, "uuid": "51dbf021-e00d-4083-a7e8-e7e1ae655885", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971009, "uuid": "41241627-fda3-41fe-b84e-341ae8e22012", "value": "12288:pj76qbdvnJ5a3+RBS9vRuoJS7stpqPyDNUUIBxWzikB575wpjtpd6rTvmrmBuTkR:pj76qbFE+K9vPZtpqPyZ/Ia+25wLpdaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971009, "uuid": "d072f7f4-d2c1-4845-a67b-fca21f63f5b1", "value": 720392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971009, "uuid": "842df48e-b111-48f5-8590-eb3ce2da52f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971009, "uuid": "85fba59d-efec-4999-826e-2c8736c6dcb8", "value": "SecuriteInfo.com.Win32.MalwareX-gen.85681146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796d85bd-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011467, "uuid": "5014df56-f629-4888-adda-3624ce94b5dd", "comment": "Malware payload (Mirai)", "value": "dfbc93e46ee1c7b35b1146fec2bb7abb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011467, "uuid": "dbb1c36c-1249-40c2-a9ef-4c4f0320f115", "comment": "Malware payload (Mirai)", "value": "4bad57e1917fe733d1ebaf2dede40f386573e92133c2e701e1335f9cf866150e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011467, "uuid": "4aecf516-db65-4401-946c-682fa1e650e0", "comment": "Malware payload (Mirai)", "value": "86f4ae866475d8ca4526778bc9705f9c90cef469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011467, "uuid": "e85fe35f-20f3-4e35-8107-9f9c6923f368", "comment": "Malware payload (Mirai)", "value": "e28a1d380b3b0b51a3b4fb55b400d0ce625ff688be5fdba78ba6150ce8f9e452abf4d60cef088f936fb542a7fd232eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011467, "uuid": "b20253b4-ac7f-4d91-9fff-d6dd96cc4e58", "value": "T11D634B85BD818613CAD512BBFA5E028D332A67D8E1DB3307DE269F2137C696B0D7B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011467, "uuid": "0b25071a-59a0-4277-9899-43bebdc2773e", "value": "1536:YxcdM2x77PyFjM7Z054QoDtDgQMYvdD5qD5Sw:YxcdMJS054Ftcih5q5Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011467, "uuid": "f50a9cb2-495a-4db0-8cf6-f2fc2547c6f0", "value": 67076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011467, "uuid": "fc7e00f0-c139-4e12-84cf-85c20fee907b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011467, "uuid": "2c699429-60a6-48b3-aefd-9bd68c2f0070", "value": "boota.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7081893-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025824, "uuid": "0f92c09c-c250-4a75-9f6a-e9438c7fab46", "comment": "Malware payload", "value": "1a64fb55c608a78d4644c7777c2f9763", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025824, "uuid": "a146a282-8913-45ac-a8e6-bffd06b59993", "comment": "Malware payload", "value": "4bb57d9c65498b9fb7e208f61f0b2d7a324df4f27bb61f0b7174fd15f042bc42", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025824, "uuid": "fdae0ba9-1f04-49f2-81d5-42ac79f5c063", "comment": "Malware payload", "value": "99e7451dd8398b7788c02508dab0f5d42931c036", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025824, "uuid": "91a07c4d-f8d8-4933-af87-e5833c06e61b", "comment": "Malware payload", "value": "094c03ea58aaf091786db3d445db5a2c2523184fc989c41ea14492fdeb47d4c2b1c98905df2997ee17ffdec8fe23a740", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025824, "uuid": "987ee1df-6b5f-4e54-8bfa-f8eee0d9ffe0", "value": "T150462334BE412C6FC5E44B32606A3A226FBD76134BCDDA91BD7C72126782F85963F442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025824, "uuid": "365e66dc-0503-483a-8422-55b805623ae0", "value": "49152:dVmV65wkdF9ucMZ2Ml6leXnHco72HwMKyqjEa1ZbiScqSdtKxQ0+aLgdfSJ48eUt:UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025824, "uuid": "a34706ed-6555-4105-97f0-131ca5d1f250", "value": 5523456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025824, "uuid": "3fcbd318-ceab-45a1-9192-04e971d01955", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025824, "uuid": "ca7a50fa-dbdd-4ed1-963f-2ba7a5400071", "value": "Nta-Cr5YIX_577351JXSCSK0TY3U.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97202910-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014523, "uuid": "181a02fd-067b-4165-a045-afd0c7c6c183", "comment": "Malware payload (Mirai)", "value": "0e638c531df420c83400a5129689215c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014523, "uuid": "78ddee99-595c-42f4-b912-9e4c67e87e35", "comment": "Malware payload (Mirai)", "value": "4bb79dda3c05e095dac31cf094f1d627f44fdeeb461e985161c6e0c934b84a5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014523, "uuid": "ab169bec-c05a-4b20-8ab3-a5676df4f7c5", "comment": "Malware payload (Mirai)", "value": "3747e81c01cf8b857393b37e27906e6c8ec5992a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014523, "uuid": "254891c1-eac5-47a4-b56d-fa3d40a2a425", "comment": "Malware payload (Mirai)", "value": "d7e85652a4da7d524f7b769680c23cc568b203a11adee1caa35086f765307e546e3931aa43de1b7aa7abc4f9bf1325bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014523, "uuid": "734b21ca-0789-4817-b7c8-d2f5f6474d90", "value": "T19B514F8551024F79AEE1AD12F3AD4D6D3092A0EE10FB9F15D9D835BB50ADEC43204ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014523, "uuid": "2886ebd9-36f5-4bc1-a3de-1083c0e780cc", "value": "48:i1Od1/z1051vLf1Rv19Uu1/4/N1yt1tLL1GTJ13r17z1oZ1AJ1vXY:iqFMFHXg+DL+JFgMdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014523, "uuid": "bce4ce79-7b62-47e0-874f-a1be581134a7", "value": 2984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014523, "uuid": "d8df665b-120e-4968-ad19-939bac13ccd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014523, "uuid": "010b75d3-b523-4bf5-9e5f-1a228ff98c56", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f1ef27-08ee-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770995519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995519, "uuid": "e4537ab1-b1fb-4d67-a6ae-f34a39f8d3cd", "comment": "Malware payload (Mirai)", "value": "e484f8e9d9f848946a15a94e2553bb04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995519, "uuid": "f51b385b-91f0-4a4e-b770-f91806477851", "comment": "Malware payload (Mirai)", "value": "4bed1f83cf92484ec70fac6e66762a1d9149035048f03d097fbeb0b3eeb7451a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995519, "uuid": "1aecd7c8-2c07-42e8-996b-dfcd757dc950", "comment": "Malware payload (Mirai)", "value": "7f5b5c8968f80bf71e1031ceac40c6ba04ee36e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995519, "uuid": "71c4852b-8859-4333-89ee-192022add930", "comment": "Malware payload (Mirai)", "value": "f8ec6755a34d348510489ec1688a6429a934f60f387718f922b3668f49ddb17102b8e7294b550c7edd2f33e4c84be689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995519, "uuid": "3951ed7f-4eec-4fde-9439-c9ea903d2a48", "value": "T1D5F32902771C4E83D1676EF026F727F083EBED511AA2A140F61EFE845336AB16509F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995519, "uuid": "72c7603d-e7b7-4719-b1f9-5e2008ff0b64", "value": "3072:kWxjks+1eO8CVnfI4hFKoDP3Zvopbm4HamOPoKtKH7gxO:kWhkp1eOlVnfxhAc3Wpbm4HamOPoKtKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995519, "uuid": "e87c65f3-f6f5-457e-abef-b9c8f3771533", "value": 161046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995519, "uuid": "53630b65-c16d-4ae8-b6f1-5a79dabec153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995519, "uuid": "2a328b25-da09-469d-8d85-3281b00762fd", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc17d56-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013491, "uuid": "068792a3-4ef9-47ba-a16a-bb307363c482", "comment": "Malware payload (Mirai)", "value": "b7d5c71a65d20cda7e606e1cd8bb5d83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013491, "uuid": "04a3b15d-3482-4096-adce-52b751574e83", "comment": "Malware payload (Mirai)", "value": "4bf771b4d750b3d3beb1aaa1311d7890f1b83a9242f5183fe72e7dfe2a02ea70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013491, "uuid": "f882984c-ad26-4266-9618-13260d888d40", "comment": "Malware payload (Mirai)", "value": "9acce624ee46bfc4cf133e4edea5a12a62593f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013491, "uuid": "2c3392bb-3df5-47ff-a255-29436c02d27e", "comment": "Malware payload (Mirai)", "value": "5f4e503b9f012cc3ad18274623528491cfcd1731cdcb9eab5681275d6c29e24ca29bbe837edcf9fa1255dd0b1587a8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013491, "uuid": "1cc1d7a5-cf79-41dd-8459-95efa9b5e13b", "value": "T19AA33B05D951972BC2C2177EFA9B529D37232F58D39B3311AA287BB42BC279D0E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013491, "uuid": "23f9efbe-df77-4a65-b7e8-b16d9792b6ab", "value": "3072:v00aynNWED1M3WOUhrIJdyWFy1x691DNU9li493NQ95Qa6j3uTkCuwvseQbOFqUH:Jpa6j3f5eQbAmyWQ9qfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013491, "uuid": "2e6b4715-a634-4ed7-b4c1-4ff26ec63255", "value": 106526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013491, "uuid": "eae2022f-56b4-4bb8-a660-339e5c8184cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013491, "uuid": "27192ec4-5580-4967-91eb-7cc0d5722899", "value": "a-r.m-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27aa66-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986804, "uuid": "bc72c0d1-22ce-4086-9cfa-8584ba94b2ba", "comment": "Malware payload (Mirai)", "value": "632fc7924c28e2c0b8ff2edff5ca13cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986804, "uuid": "7e876762-460e-4544-9527-f66317a505d5", "comment": "Malware payload (Mirai)", "value": "4c6efd16955e9d4bd2fdd22bd2bc253b617a2d573214f9812a00dec2370faf7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986804, "uuid": "10ae0fbe-68c6-4fc1-959f-f301953cbda4", "comment": "Malware payload (Mirai)", "value": "4bea89a7885ffb7fd40469fd07973786ca14a896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986804, "uuid": "b266a848-4ca3-49b8-a279-1ee2ecf9bd35", "comment": "Malware payload (Mirai)", "value": "6513c9f47c362937252e9ddbb18d1f509f4887a2009fef4bc7ddae473e333c0d93b6f07c91804b76ddee526bae588e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986804, "uuid": "0ad517e1-f841-40ba-8c48-218536d3e3d2", "value": "T19B73A61E7E228F7DFBAD823457B79E16925823DA37E1C185D16CE6012E7024E241FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986804, "uuid": "122be164-8077-449c-9493-fd3438f733a8", "value": "1536:HrqTqV49vd3s6Gq2ZoyYlzgQ8Fw9Oj+bz5db9m:Oqirs6GB3yZu+bz5xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986804, "uuid": "025be1f5-3034-4bc6-8a64-7d60f2f6e931", "value": 80308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986804, "uuid": "0d361c99-fc9a-4c42-834c-a1649d6e4709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986804, "uuid": "44a89594-fbb5-47cf-a0fb-ccac3f552395", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c982fa1-08cb-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770980360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980360, "uuid": "74199d99-033e-482e-9b30-6fa4d3dce277", "comment": "Malware payload (SalatStealer)", "value": "02c7899b6826b2b43d64caed27de6ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980360, "uuid": "fc85b775-1bad-425c-a989-b62fb73fa207", "comment": "Malware payload (SalatStealer)", "value": "4c775aa1307cb251a5f71f04541b8458d8e351d623964c7a1eda6ab4fb0b22a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980360, "uuid": "8171ea7c-6dc2-409f-be45-a9d3a31c0550", "comment": "Malware payload (SalatStealer)", "value": "6dfd567442f7443215d79faa04a0c636c48cdcb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770980360, "uuid": "0ccf20bb-b72c-4d91-ba19-26cf4ef213fa", "comment": "Malware payload (SalatStealer)", "value": "def2048902f5185c214323ea9acfb0c64ec07b9a72e1bb2da205a9f521b02eb5b77b45ac7625c0e6f9c6c266b835fad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980360, "uuid": "d3ad9baa-504f-4e13-a5c6-2beafc47f56b", "value": "T1C6B623400BE56EFBC575A23F77FFB73D099DAB100142A8DB52221BC8CB2FA425666117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980360, "uuid": "191885ca-a1d5-4eee-8bdd-d2c0a60e010d", "value": "5835a00704808b8d6eff9e697fe9e4a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980360, "uuid": "4ff8c69f-de3a-4148-bff3-5a26d74c1646", "value": "98304:fBjlO6mSJ4xRb6mSJ4xRb6mSJ4xRb6mSJ4xRb6mSJ4xR7:fBpOXPXPXPXPX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770980360, "uuid": "716c2573-ebd9-4587-b703-ba81eb34e3c9", "value": 10772464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770980360, "uuid": "cdf90055-7a3e-461d-8245-71464abf9554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770980360, "uuid": "0043a3f3-ae7d-4ffa-8677-0eff2bb38e30", "value": "Midnight Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cecb45-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007921, "uuid": "c47bbd4b-4ddc-42d6-84b9-6ebb296e9179", "comment": "Malware payload (Mirai)", "value": "4194a9fa8eaacd9ca28449dea7718aaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007921, "uuid": "7efdf628-633f-4143-a1d1-a42629b85aef", "comment": "Malware payload (Mirai)", "value": "4dc3e7d7fdfb5a0ee9dd68cb1830c8dea5da02f70746034e28776109e5bb99ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007921, "uuid": "d80225ca-7c60-4bb0-b795-0fa607d252b9", "comment": "Malware payload (Mirai)", "value": "1b158c46e98cee055953c5ce3e1bbbfb10e9eee6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007921, "uuid": "c8e934f6-59be-4e23-b54e-2bd4c88580cc", "comment": "Malware payload (Mirai)", "value": "aea0d89d5e5a9f7b49920d6fbb00db2cb5e723df3759a62bbacd8dd197c605ea6ffb5b22b1fb0bf77a6dd0fec74fcc93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007921, "uuid": "617f8881-6bfb-4710-95bf-019c374e1d60", "value": "T18FA2E272AD1985C3DE32927895E4AA8C1281ECB1779F46094589C3ABF5F33499C30FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007921, "uuid": "6742a409-2d9d-430b-920f-b165d918192d", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+Zk0b6OtcWkogv2h/j4xXu80RceQ6wWSa:M98o08kxofBE+ZkpOtcWzCxexBQ6wqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007921, "uuid": "8f77b184-81be-4250-9216-579dfb3ce556", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007921, "uuid": "6726d7e4-6f97-4f75-beb1-af397057b8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007921, "uuid": "203aff6f-a2c0-4e93-9341-3110620da1ba", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be62fa79-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013300, "uuid": "260f7ce7-994e-4c16-b4d9-25b2a0fecfb0", "comment": "Malware payload", "value": "2ba0d0d656209064ba4df091bc562ff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013300, "uuid": "df48d61c-b83e-4c9c-a537-e6c4de7e39fe", "comment": "Malware payload", "value": "4f052080ce2e8e33f3e39c545c4e363c8916010c7660ae4a61c5566dcb972344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013300, "uuid": "bbfa19ec-8766-46e9-9763-2c0257ddc9f9", "comment": "Malware payload", "value": "9a79d0a42ceb98c0d2b116c42082d161e7a68bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013300, "uuid": "aa37dc48-5f7d-4633-aeb9-f0dd76a63a5c", "comment": "Malware payload", "value": "dc88090bec4fa47d2f848a3832e0c693c51ab04a7a17138fae725f0c4829ecfeb84f55f4cf043c7a56aeeb97cbb98de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013300, "uuid": "170377c5-fe95-4009-9503-04103fdae769", "value": "T15EC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013300, "uuid": "c9a5cbe9-a199-463e-9402-bc57eeadf017", "value": "3072:gf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4/qe:gf0tJBR4NSALD7rnCrheiUqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013300, "uuid": "1d403b62-95e4-4463-8706-49673d456dd3", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013300, "uuid": "9bf99708-d3f1-482c-9cb3-6fa46f5224a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013300, "uuid": "fed56e5d-4349-4de1-83ca-2e74a120600a", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc906bb1-08eb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770994426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994426, "uuid": "f8045bc5-ee83-4c8b-b4d8-df071cebc4cf", "comment": "Malware payload", "value": "ae9f32c1ab31ee6aa582c42c9dfcdd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994426, "uuid": "c9865675-67c6-4079-8253-d48b90c7ef6e", "comment": "Malware payload", "value": "4f3e4846ac3a598d9f6b48bcc470d048a5f3a9b5340e0ac42a38ea5b022dd0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994426, "uuid": "13ed6102-9ce8-42f1-a0d7-44fc10345d1c", "comment": "Malware payload", "value": "e94eb641d2da1396b395f79f46120db499d5aaad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994426, "uuid": "88625000-1f8b-48f0-a9c3-14bf158b7fe4", "comment": "Malware payload", "value": "22bf3b3ad2c4ae9f70eb84ace2090b54903b79b734a91a0e9fb480c8c4310fb5672ea58b690a27590d5600a49e73e06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994426, "uuid": "8eea0154-2be3-468a-b218-7ed0d7c1bb09", "value": "T10346632539EB505DF3E2AAAA4FD4F9AF9D1AF633270F30B9107103468712D819E92735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994426, "uuid": "479c649a-cb45-41b1-9591-43c3efe9701a", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994426, "uuid": "2ec1da42-6117-4de8-8da3-19d85259981a", "value": "49152:vHpvOm82zOy4YgmIh7dl7uoGK/S2JU7Rd9XK9sMRgB7Ai4UQVPSyCN8WtBTG16AR:vHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770994426, "uuid": "e4589c96-4dc6-4f4a-9560-6e77e19c3dd7", "value": 5566044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770994426, "uuid": "4c112ccf-f4d3-4739-8b42-3f29f86ba877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994426, "uuid": "78d3696e-aa36-4c86-bb42-1cf4217719eb", "value": "\u8c03\u585e\u5883\u6cd5\u767b\u672c\u51fa\u5316\u65b0\u8fd4\u53d1\u7ee7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b295bb80-0915-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771012422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012422, "uuid": "638389ac-f7b0-41f2-91d5-dc4bb344028a", "comment": "Malware payload", "value": "b8b3293d9e3f72dbe246e346b4d9cc0c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012422, "uuid": "6fd58108-3e39-4b66-9b10-833d76b325b1", "comment": "Malware payload", "value": "4f728efb2b0d420d3e69ef0a11846a8970e66e86d65f69b4c84a9545b922061f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012422, "uuid": "708a5385-45f7-45ab-9cbd-c9c4087d74c3", "comment": "Malware payload", "value": "d16943dd7628569395e41da02924df610be30060", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012422, "uuid": "e1969b82-78f0-4f3b-ae73-f1d90f46c878", "comment": "Malware payload", "value": "3a99bf84f6ccdc81c11ab42d9136f49249839d0ecf5cc611b4a2d30b8754941eb672c5e5cb979b85a44533fce9907e64", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012422, "uuid": "ee38f12d-61d4-4d2d-bdd0-87ba71bc5691", "value": "T148171227F29800E8D46AD278D5564223E7B1BC16077197CF1AB49A6A2F73BD06F3E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012422, "uuid": "20ef8cba-f9c7-4b2a-9e17-57139faa6cc9", "value": "393216:RwAjhLdA9LqBy5WZ84OO0agGWwOHhZbXNDX8LLdaJRV8:RbmqBGG84OcgGWwOBtXgLd6Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771012422, "uuid": "26d6e51d-b675-4962-8817-1cef7cd929a4", "value": 19852838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771012422, "uuid": "749e127c-cd13-406f-a177-909e36fddeb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012422, "uuid": "dd3be140-1f6c-4867-8623-95173efae095", "value": "Cometrix-1771011904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3a67df-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973191, "uuid": "faa8abed-424f-42bc-8c18-7ef0246bc742", "comment": "Malware payload (Mirai)", "value": "a1951d4696d9824270e213b4599617a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973191, "uuid": "6966f3fd-7b62-4b7f-9a2e-b86fe32daae4", "comment": "Malware payload (Mirai)", "value": "502d4fd4bf7ecdd75bd8d4dba42382806dcd0fb83093ba562bee7194d0c5ae13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973191, "uuid": "7590783b-2ff7-4693-acdf-5ed15005c37d", "comment": "Malware payload (Mirai)", "value": "f16ca7a7ba9d9b492c89f00ad34763a4e9310298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973191, "uuid": "e0313518-2c2c-4a6d-886c-c1758a8bb175", "comment": "Malware payload (Mirai)", "value": "9b4dc8dd9d6c1853d9bae043319f5dc8a5efa1842d249c2a2cb538546a0cafab3c412df70f025d610f2c72a80f119338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973191, "uuid": "419c0e11-fd16-49fd-b037-e5e53df655d8", "value": "T1A3D3F7026B0D4E03D1132DF4377B5BE0835BAD9628E9E580751AFECA9771DF2A106E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973191, "uuid": "153543c4-ae86-49b9-b0d1-014f7ff91835", "value": "1536:w5v8X2DkVdGNMEk2xzJ2KdWSvU+4RJkDhiAefOwFrpkvAq9oWxRvzqckHLh59N:wRTDGGNMYxtdM+46iAehFrHqsP9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973191, "uuid": "5bc79ed7-1a48-486d-bdf5-12b644ea39ea", "value": 137856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973191, "uuid": "84b1dd55-75a8-4949-8cc4-67e26b3d1075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973191, "uuid": "24603602-1027-47a3-9a3c-4f8d88294802", "value": "sys_powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893ab9e4-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977992, "uuid": "45abacfe-c9c4-46f8-9543-e802e3f6e86b", "comment": "Malware payload", "value": "468ab5d2bf7514f818ba982137e33e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977992, "uuid": "961a4e0f-d733-4b1d-ad71-65659af4737d", "comment": "Malware payload", "value": "503af7e2b3fdf47fa0333c73f5e83d3a666a6c0a9b2f13c64fb1d6999e0a0c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977992, "uuid": "007b77b4-339c-4b22-8da4-2cbe25781abe", "comment": "Malware payload", "value": "5373f8f80d2f96e39cdf9a1c5ed2625e69b6e083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977992, "uuid": "5abe935c-df80-4a5c-aeb9-5d0872adf72d", "comment": "Malware payload", "value": "cf2834898b4e7c94a170e21aa19e36a8ad0272945de750ba9bece5c46b008251bf575ba21141ed9bf98e237223960a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977992, "uuid": "acd89367-dd7b-40d2-b9a8-9f6e6691d4b9", "value": "T16C5423FFC22671FBE832537EF54C57D7D662A0B689AC82436EEC22468C175891B2E414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977992, "uuid": "eb34cd3c-f8c9-4d9b-8c67-75f15be662e7", "value": "6144:NemqhWfdVzKvinM5qsBoeEvU1PedLmMBcXm83dD+NVUfedOK:NeeFVn6ZsU1Pe2Xm2tYCeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977992, "uuid": "c6b4857f-9694-4023-9de9-9bb8a739044a", "value": 291608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977992, "uuid": "96712ec4-dfff-4ffb-bdc4-cb7bfedfed25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977992, "uuid": "3cc1c2ac-2888-4cab-ae18-51916a435a42", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f63924-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999462, "uuid": "eece387a-5f3e-477e-b7ce-dfb9e845e10a", "comment": "Malware payload", "value": "7f80ed4fb621e063ae052b3301acc938", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999462, "uuid": "c8e1b111-f8b2-4fe4-a005-ea7d9207b7c0", "comment": "Malware payload", "value": "5057662a1a63f17d9051ddf4f4c08b9eb1417a80ef86c60ba6e5a1109db4c4cb", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999462, "uuid": "7a3a43db-41ce-4816-a4cd-3f10bb08d350", "comment": "Malware payload", "value": "60c633d93e642d9944f9d2b50d6b50dd454bc711", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999462, "uuid": "601107f5-c41b-4c70-936a-2fedf2ea75f1", "comment": "Malware payload", "value": "2510856795d4905706f41abed760813101a3ac1688af1da13e598f97e57f9792a4ef543bee72a1fa897cbef89fc8d744", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999462, "uuid": "8bd3cc03-8f60-40f3-948b-ecdbada554a8", "value": "T131662333FE05086FC56083B170AF7E3E6F7D620799C856E7789C958237456C1EA2B09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999462, "uuid": "8cf1bb3e-c69b-4901-b9cc-282b8e93aec9", "value": "49152:VCUqvkl8HYmghOLrdrQhEncRn5exfPKW21kQg+SS50NNViTXZtgVhjQlVCMN8M7Z:ruim3YNR4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999462, "uuid": "afe6300e-512b-426e-b658-6cc3200ccdef", "value": 6582272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999462, "uuid": "f2e1108e-9b6c-4f02-8067-e551d30ed7da", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999462, "uuid": "d076b690-95bc-4252-85bd-f75d6f1a8898", "value": "Cobr_3842MDYCUZ3YUIG6603-De.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7b5357-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941388, "uuid": "4ae1a5b3-a720-476d-a942-fa22a1b55cc4", "comment": "Malware payload (Mirai)", "value": "796d487fa6292ed574418804b30dc8d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941388, "uuid": "82380f36-5023-4063-9aa0-5e56fdb33387", "comment": "Malware payload (Mirai)", "value": "505c7dad1f153d877d0eaf49c96fc5aea03000d3127fe927ffa4a1812f793186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941388, "uuid": "f1bc3acc-cc95-463e-bdd9-8182e66570b3", "comment": "Malware payload (Mirai)", "value": "0047b9089397557535f75ef6624526e26b2920ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941388, "uuid": "2c4cd752-fe8e-46b6-852d-2ab6f9eb256a", "comment": "Malware payload (Mirai)", "value": "4dee3720efea7f83726f945dd1526c4b903d59fb3166e8d8baabf4b2881fcc3a98393037a9f9ff7aa7e01dbfd9445cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941388, "uuid": "bd7aab00-577f-4c11-8a26-2e01958942ab", "value": "T1A6F30946B8819F55D5D216BAFF0E128E33131B78E3DE73029D245B307B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941388, "uuid": "4726f473-5470-4376-ba16-ad7fa5573031", "value": "3072:ATKrLo+Fv/9+VU8WxQqfYtaEhbJ6p60RPxd45kOsZCn1rH:AULLoVv9qf4aEr6pRx6vCC1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941388, "uuid": "fe2c05aa-a701-48ea-b39d-46c9660d3960", "value": 160060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941388, "uuid": "4e29c4f8-59cd-4e8e-91cd-1efb944c5e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941388, "uuid": "af86a458-d822-41d2-9bfa-e7d73e5e744c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f84872a-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985116, "uuid": "e3ca224e-1034-47aa-9ac1-141a356b0816", "comment": "Malware payload", "value": "b19f10e340f8c685a89918043c63e0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985116, "uuid": "c1ccbd22-91ab-4ea4-9960-7cd12bbd08dd", "comment": "Malware payload", "value": "50b8a2d1ff1e66d2e6d3172a3352625dd8818b0c5f424148dc30c25501f8021b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985116, "uuid": "67ab962d-143c-4905-bb78-b2bc9e050114", "comment": "Malware payload", "value": "c81dc34008ff33a3b26d4e33b653045aa3fc5ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985116, "uuid": "ec084405-86e7-4f00-9f2d-92feb9404dc9", "comment": "Malware payload", "value": "16d7b421612ffd2f6cdb243401704a1109ca1ce6a45034f9bd1985d9bf915372b60145214076631e7739b578f89840a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985116, "uuid": "ed10d175-5199-489a-bd95-015608e7b2b0", "value": "T16FF35A23D683CB77F2510630C8E5A205A93FBE5546A24B7EE9C17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985116, "uuid": "0872e91b-973c-4e9e-b1d7-47525129cf65", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985116, "uuid": "8f30a3b0-27f4-4b18-9b8e-e6ea8ac71ce1", "value": "3072:/FDVESApLltNnQUHcXR0LRYcXxiOM4CMqL:/FJESAFNnQecBqWcXMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985116, "uuid": "9440622c-9fe8-4e9e-9ce8-2816839b4c30", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985116, "uuid": "18d2faa2-1589-445b-878d-3652856168bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985116, "uuid": "9a537f5f-50e4-43ca-adf7-827200c6deb0", "value": "Specializations.old.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418b89fc-0899-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770958974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958974, "uuid": "d5fb2b3a-831a-4459-854b-73c3d9e7ad49", "comment": "Malware payload (ValleyRAT)", "value": "877790d49a09cdb450cdcdb713beb13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958974, "uuid": "a07886da-e8f7-40ed-849d-289c2959c73b", "comment": "Malware payload (ValleyRAT)", "value": "516201070aaa2085711cd65d71b59ae200cd1894a7b2f28a7c1ee4560fb6d5ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958974, "uuid": "300b9ada-25f5-4023-973f-b32c64eced06", "comment": "Malware payload (ValleyRAT)", "value": "6e7160247347f6d061851ad3e72708d53ad8c83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958974, "uuid": "e002b03d-9051-46d9-b3d1-f81c0195921b", "comment": "Malware payload (ValleyRAT)", "value": "b677769e55d4749319912ab5565486fcca71375f721c541c01bd54cc0eece52416a83c16e5c1892c7f63939dda102528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958974, "uuid": "6a5e406a-d5ec-451e-872c-75df6f85df5a", "value": "T10576E111F4C769ADE22DA9328152AC1C4BAF0A75EE22543E7197D6C0BF333508D5A63F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958974, "uuid": "044e593d-4755-4831-b301-64c766937a22", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958974, "uuid": "6520425c-7cf3-469d-8421-6b08f1b8a05d", "value": "98304:5rU+E5VZhLttEqln5LVEUltg8LZGGE2KUwvD9K/8v6ARAWahydppd:VU7fhtEAnwUFL1E2Kpto0dppd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770958974, "uuid": "a893b73c-ddc1-4e6a-b8a8-59dea3013c5c", "value": 7787715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770958974, "uuid": "b7a6d1e9-7ddc-4f0a-a4bf-1af25de77076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958974, "uuid": "75088d31-c163-4d31-bb8d-e7d8d9608c46", "value": "output_86_2026.02.06_23.00.00_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519b8971-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (FantasyHub)", "timestamp": 1770975322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975322, "uuid": "48c09f86-587d-4f75-a301-e3f4c4393f3a", "comment": "Malware payload (FantasyHub)", "value": "3a7e645b8cd31fd1574cb10ff6900804", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975322, "uuid": "cc93c9a1-a2fb-45da-a93a-d9ebd867b2bf", "comment": "Malware payload (FantasyHub)", "value": "51863351193ab67148e3e47255cad4927eb13939292c7854121ebedb4de28590", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975322, "uuid": "4e98404c-0220-484b-9c1f-0be0e683185c", "comment": "Malware payload (FantasyHub)", "value": "4784df9fbcf7d29ee06b5330a609d6306949773d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975322, "uuid": "0d9b658e-032e-4b73-99ca-eee31fa2087c", "comment": "Malware payload (FantasyHub)", "value": "b4ebacc3c0b825452228b39241fcfb44932a57403fe92d1b90681e287c41c3296881df3903a38d80dd49feaf280fec02", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975322, "uuid": "7da87ab6-58a7-4469-afcb-97633a352774", "value": "T1F89633A2F328992FE8B614B64D6A0A711397DE6B8EC543035088372D7D3B2C45F69FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975322, "uuid": "63ac86c8-ef76-44d3-a195-ae300db2a6e0", "value": "196608:6modgsWGzNUtfC3uHlUSUPptWscbWqrDn0elqTM:poCsWGzNUlCgSSUuscyq8ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975322, "uuid": "23b4a1ae-9bb9-482d-8c10-a465567d0905", "value": 9370377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975322, "uuid": "eb844de7-32c5-4ba6-8252-084a665cab68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975322, "uuid": "61fcbf89-8afe-4487-873f-9e48573e18d7", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6054a3-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973196, "uuid": "d1aa3630-8e08-4430-8d3a-7b8b4c46ea95", "comment": "Malware payload (Mirai)", "value": "af911a9198ca0bed062c69bd8b586c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973196, "uuid": "cc2e9a3c-b6b0-411d-b463-2e5fcbb33b1e", "comment": "Malware payload (Mirai)", "value": "519fee53fa9dd72cb1f065bcbf47f5d5302c78643ac4bc5ace955b75f3b8133e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973196, "uuid": "ef9b5ee6-33da-49b4-9fe7-c95d9ef1e1f6", "comment": "Malware payload (Mirai)", "value": "88c27dbac5f949637bb50321f1ad56a11dcf0d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973196, "uuid": "ed5da11d-b0eb-4afa-ac2e-96d466f35f78", "comment": "Malware payload (Mirai)", "value": "8d501c01e2c01d7953f172341394689eb8db9661783a01644d43fdc4a60b57eb952190999023321c8d1e017ce9fc2f45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973196, "uuid": "4dd28f07-28f8-4534-9bd8-b046a5cceb50", "value": "T16404971A3F228F6FF669827047F34E30975976DA26E1D680E1ACD5105F202DE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973196, "uuid": "1a0bcd82-5fc3-4262-b658-9e126bce3efa", "value": "3072:cXQ1FicYdzEe0UxXOnGJtTVLHtRNCwL1m6rqGReez7:nicYdYedxXOMxzBC+mmReev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973196, "uuid": "1fa17a29-95d3-406a-8644-dbef21c98c08", "value": 178888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973196, "uuid": "1646e9fc-2102-49c9-8080-463b13922037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973196, "uuid": "d05bc29d-5134-4b6d-ad12-69647a32d7d7", "value": "sys_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556f6708-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007970, "uuid": "01952b88-aca8-44ec-83c6-54c110e0aedd", "comment": "Malware payload (Mirai)", "value": "132fd235a91e355ee9862953c5bd6199", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007970, "uuid": "d9eba9f7-cf99-497c-85ac-e11a9d87895d", "comment": "Malware payload (Mirai)", "value": "522cf00918a36ffedaaf4bf077688c3c97d355c787909b57a23e92c7f5e834ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007970, "uuid": "872973f2-086f-4be3-b58d-7380f7ec0e42", "comment": "Malware payload (Mirai)", "value": "f86b2af438e9bcde5105b801922314cc6dcf8db0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007970, "uuid": "0bdfd798-fe15-4584-9542-90fea716643d", "comment": "Malware payload (Mirai)", "value": "e46ac75285738efc666c1c1b15241b63391314dfae0789be8430d8ad74bd600b35197471dbc8d9e3eb1d3691e18a6a51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007970, "uuid": "bd764f53-3884-499a-b67d-ba5b64a0a2a2", "value": "T1B5630A95FC818E26C5D5027EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007970, "uuid": "e045e2cd-784f-4a36-b274-527ca5d6d650", "value": "1536:itnVKuUrtVOPksP5VoiVLdml/vDEomtm6TkCcKIbina+H0dMc:+0VskgVbzatKa+H0dMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007970, "uuid": "1bc4b37c-923a-4541-a045-abcdea4e0b85", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007970, "uuid": "27583c01-2086-42d8-8e7f-12f08305dc95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007970, "uuid": "1b72dfea-1680-41b5-8f31-6bb8abb3357e", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cc877a-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999534, "uuid": "0c53f956-f614-4c9d-b02b-4f4e629719c2", "comment": "Malware payload", "value": "21aec330d8d66ff6f85dc9c9aafd21a1", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999534, "uuid": "7c29fe4e-10db-4d88-b90d-8e93723dbbc0", "comment": "Malware payload", "value": "534079ff141689afa9222921112d7bff21ed3766089b9d0ff62850dde8f32440", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999534, "uuid": "efe25165-efa0-4af1-abaa-97a464fe3388", "comment": "Malware payload", "value": "810815aaa40b655e7a167c6dc9a6056ac25c2d7a", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999534, "uuid": "aff907c0-a200-4738-bdb4-90e434f1f108", "comment": "Malware payload", "value": "614fa004268ace15212953fcba88243f9b23faddd2464a11e9a012b6c7446bfd37a4289fdf1425b802dd918741e9fdcc", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999534, "uuid": "46c4f784-4fa3-4177-b1d9-dfb70af27f32", "value": "T11F862335F781AC6BC608473530793A353D3E2387478DE9C3A4A993A7F705AD25A3E894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999534, "uuid": "20a15760-c320-49fb-91a6-c05b663f99bb", "value": "49152:4dhuI9jUFnlqKc/v9SUbaCBZZk8rmfiAG6w2k/BlK26DOf91/t+bH2igeNLPJ/Px:Nuim3Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999534, "uuid": "24bebb28-60a7-4031-935e-738bfdc3045a", "value": 8460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999534, "uuid": "b3823399-7d32-434d-b552-ed54cc57c420", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999534, "uuid": "6f6e4eb9-0994-47ad-8f87-4b3b6a0f5519", "value": "Cfr-OnZ1V39Z2621_TXHVGR.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91401b1b-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999481, "uuid": "99303fab-f9eb-4d10-833e-28d49e429759", "comment": "Malware payload", "value": "fd802c112e50b197a753ed4d916bef2c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999481, "uuid": "4487b16f-26cc-43e8-94bc-576a34a920cd", "comment": "Malware payload", "value": "55d1c817c438a8338b58c898d88ece6b320f93797d3ce01b0ac259933a7fb1af", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999481, "uuid": "273cf35f-cabc-4d7b-8618-3219215f1db0", "comment": "Malware payload", "value": "51c672b8553c87269a2cc43498967291a5616c8e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999481, "uuid": "fbdf1fb2-3675-453f-b276-a4b50125430c", "comment": "Malware payload", "value": "4fdeba33185e050d75cd16eeeff745933e2065cc2106bb28916ce33f886be25d111e9d371768b31c2db55dce011da7da", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999481, "uuid": "3b9d004f-de2d-488a-8090-1f10eaddf40c", "value": "T13A563332FE666C83C5108736713F2E356F7C2B0B4A8DD5D2645CFA963B879C2462E492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999481, "uuid": "3c1f2f45-980a-497d-92f2-e699eb8f23cb", "value": "49152:3AP5fa31DGG4IT0Im7TxmqHJb+3zMvOXCBBWyGU6b2QVFkPYt//4aVk3m3sw3aU/:laU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999481, "uuid": "1e49a9ea-c845-4757-a453-288be5934766", "value": 5924864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999481, "uuid": "c4fafc96-21db-47f5-8476-7182ba83ed52", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999481, "uuid": "3ea95ecf-36d9-4434-99eb-8eca554c3721", "value": "CnvnYFRSP0226-2V5OQAYSZU.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50b21eb-0926-11f1-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1771019700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019700, "uuid": "31c4d141-353d-4ed0-b500-5820bd6524c0", "comment": "Malware payload (Cobalt Strike)", "value": "f6bc7fb452deb644aae7fb6f5d9ae4dc", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019700, "uuid": "48426df7-44f0-4438-82a7-58a9f646194f", "comment": "Malware payload (Cobalt Strike)", "value": "56181f668b1bd40f2c72909e7ed346ae6fdf176863ac42c0724bef5bf14d57fd", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019700, "uuid": "4c99b05f-1f52-4b43-a4cf-53540f16a257", "comment": "Malware payload (Cobalt Strike)", "value": "ae1ba3d4508f5b2800deb82b95d795c7c376b833", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019700, "uuid": "d0ded104-67fb-42ab-b866-76fa1555b266", "comment": "Malware payload (Cobalt Strike)", "value": "9b2fc90fabda9356fc26462ffd62936026c1870d491ab4469134bce573c6ef8a966a5b39e2d8e890ca4ca1ecffe1483e", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019700, "uuid": "aa226ddf-2d05-47ab-a220-2ee0faf8fdad", "value": "T162230A2BDD6B906BD35DCD74C9134811DE227C868BD6B9CF6B410DE208A5BA49F3E207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019700, "uuid": "ded0622a-55d2-4258-bf05-efd250b9a611", "value": "98ea3c0f3ab664d6f9f53a06aceed7fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019700, "uuid": "2e50f2d2-3da3-455b-95a9-50891ec7606e", "value": "768:1JDYkXZmphxK6crEunjJGrptMndjqHHMuVTFjlKyC:D0wsbXotGrzMAMCJjlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019700, "uuid": "6a1f3acb-1c4f-4765-b035-9cb420c60cec", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019700, "uuid": "02ff7a4c-87d7-4c1e-9b32-4f0d236fc181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019700, "uuid": "f0ebec78-f171-4a2b-8268-ca05a593364f", "value": "reverse_bypass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaf2177-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975586, "uuid": "287db7a1-097d-41cd-bd84-e83af820751b", "comment": "Malware payload (Mirai)", "value": "beb8da5c2c9814c9cedb711d2eaedf12", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975586, "uuid": "e06b2356-dc37-448e-8b74-9e325d5796c9", "comment": "Malware payload (Mirai)", "value": "56b5a310c383c4f5e609ab09f0c441b781a8628f45c879fd4f268113a347f5ac", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975586, "uuid": "076650e5-c4b0-4f64-99e8-e19a09f20e9d", "comment": "Malware payload (Mirai)", "value": "4fb27afccd2abdc8dea108ba3c2ce438cd7d5f5c", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975586, "uuid": "5c9cc748-03e8-4745-8c6b-c43b31377543", "comment": "Malware payload (Mirai)", "value": "03e4a41c34394f42c2cebaed148e119ef4d55de1e2cb75fbad0f1229565de7e2bd5ceabd909756148e02f7b1ff852872", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975586, "uuid": "7bb7a5cd-5b8f-467e-aade-7fca187a13b4", "value": "T1D5C34C46EB808B13C4D5277ABAAF42453323A754D3DB730689286FB43F86B5F4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975586, "uuid": "d9005ffb-a83e-48a8-9a0b-04033648d5f8", "value": "3072:8faspbJOIa9oirnLgWbuZ17WMoXAkkM/93S9:8faW8IgdrnLgWbuX7CXAvM/9i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975586, "uuid": "18884975-b68c-4802-99eb-e5f6394a0a1c", "value": 123237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975586, "uuid": "fac2dfe7-a9bd-4078-b598-14fc613323c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975586, "uuid": "b3f81a5a-e360-4762-9eb9-ae72868b76dc", "value": "StormStresser.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e5b78d-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770970981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970981, "uuid": "75f981d3-0cc0-4cf2-aeac-8c479eb5daaa", "comment": "Malware payload (DarkCloud)", "value": "8436615c6a66aeba5290673c2b2ff8e6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970981, "uuid": "b43fe5ec-1e63-4cb7-a647-f105d015e11e", "comment": "Malware payload (DarkCloud)", "value": "56bcce30cabed6fa0a484821b4bcce0e67847bbcfc5bd3c4920190ae49e0c442", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970981, "uuid": "fb6a4d22-c0c8-4beb-a412-6d43826f84e9", "comment": "Malware payload (DarkCloud)", "value": "dedf3c5f0fc98e5064eac4390d9d333893f3c79d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970981, "uuid": "422e7ccd-a18e-41b6-89d9-1d895db3794c", "comment": "Malware payload (DarkCloud)", "value": "822051015fbf16330077ae2dd26f53976ba042594aa11eaae0285e33f231ff66cc66decf956e8a8b8bc04c2c2366b7cd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970981, "uuid": "5a637bcf-8b16-4354-adb2-ce03b3d94851", "value": "T1CF25126131ADCA0BD6A95BF00D71E77503B16E4EA630CAEB4DEEACCB35D17500E18693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970981, "uuid": "c29681c2-02d9-41cf-8353-38d6f4aed148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970981, "uuid": "1cc4f1fb-14ff-4fb0-b5c1-8b0289c7f8ef", "value": "24576:c+vSk+qkyTn6pUywLL99ophKy14s/YfX1UOfwNHEb:pn+kuf03oTR4fFDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970981, "uuid": "223c3d63-c68e-448b-aec9-1db51fb1b245", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970981, "uuid": "2c5fb219-dbc4-45bb-92a7-2e3934d884a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970981, "uuid": "41caf120-fbd3-40a2-942b-a83c56f904f9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.64596863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aba1634-08b7-11f1-a129-42010a9c0007", "comment": "Malware payload (Koadic)", "timestamp": 1770971955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971955, "uuid": "f0f38399-4771-47a5-bda9-4be24fb9b43c", "comment": "Malware payload (Koadic)", "value": "e9a5425979ec57d89ee9a18de395b3ec", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971955, "uuid": "0274dca4-0b56-4f92-893f-ac794797512f", "comment": "Malware payload (Koadic)", "value": "579480980575b052c18a85b686bd1ad28b4aba6b0e639dcad600c3ce28a64645", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971955, "uuid": "52013a99-f006-42e2-9dea-7644ea3fdea4", "comment": "Malware payload (Koadic)", "value": "3952296c6db9a3868b466a2fbb64cfadca3be0db", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971955, "uuid": "3cabe80b-1180-445c-8341-6b2ae9375d53", "comment": "Malware payload (Koadic)", "value": "c6ccb421e03e11a35d7deb43db00c8e57752505b718ca4010372b36a3d9fe11bd794740127e2b9278498b75c53231be1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971955, "uuid": "f7470efa-e8cb-4979-a93f-09c89e262479", "value": "T1F5F5421626623F2F14CB472456060975A9BFB53D09FD4A5377343A2F6BF1A0C262A3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971955, "uuid": "999b1607-0a38-49e0-a4ab-4a8ea9152aec", "value": "3072:ZTL24fe4OUTWoJy6qStv+caCBSP2UAsreAeojnAWbw2d49piArsioLhfbXSHXl22:Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971955, "uuid": "478c3d26-7d7b-411a-bd57-2f1abd9d3892", "value": 3500229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971955, "uuid": "a3e7fb0d-0681-4a5e-8cdc-4ed4bb26ac50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971955, "uuid": "2294d5d2-8fa0-4fa2-a0cb-793e0f161f99", "value": "Radiografia Dental Imagen Panoramica V12.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c526a26-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955556, "uuid": "665b84b9-8f70-4bd6-b03a-b068434dffd4", "comment": "Malware payload (Mirai)", "value": "9520fb30cee96e2aa6c7b1a5c7ee7570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955556, "uuid": "bb79b248-7634-4923-bb6a-bcd0fb07906c", "comment": "Malware payload (Mirai)", "value": "579cc8ae20e9e70dc0c46f53e43f3399584bc03d3b59a5dcdf009eb47d0823e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955556, "uuid": "ce2c6c35-cdd9-4b05-8338-0f88db8ec1fb", "comment": "Malware payload (Mirai)", "value": "b2279086ff0cad92052b483be1d30080add4e6cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955556, "uuid": "00a337c2-774b-49d2-8e2d-ae831672888a", "comment": "Malware payload (Mirai)", "value": "35b4cee7e7aef9ca1b705853cb0e2db9c2dff698d65212ad68d0c5750a4c253a915edddf5c5730eab25b87c165f2fecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955556, "uuid": "3a50a18d-849f-45a8-a569-a0dd8429cd41", "value": "T1CD934B91FD818613C6C112B7FB6E428D372313A8E2EE72439D255F21738BA2B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955556, "uuid": "0de5d058-8aa2-4bff-86e6-e0f485ce3eed", "value": "1536:24FWhBwtBJdZYtzEh8OZiKO7dAbeI+oIwdg8vOvY8l:24FWYtBJT8OcKO7df1R37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955556, "uuid": "436b11a8-222b-4652-9945-93c4958c11c1", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955556, "uuid": "e658b739-bc9f-47ed-92ef-ca882179fb90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955556, "uuid": "bc9b1b28-72d9-4a0d-9786-41ff9796207a", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91336e1-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015466, "uuid": "a0100168-b362-4e34-9ad7-ac2664608af1", "comment": "Malware payload (Mirai)", "value": "84da68b0e5a6acedbee95af9e46b06e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015466, "uuid": "416e574a-e5c0-42b2-a19d-0f864918bce8", "comment": "Malware payload (Mirai)", "value": "57e9666348b7c2fa584cde50f1123fb9ea5d9c679f279bed334e9a633aca12f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015466, "uuid": "25d704e3-0bb8-45dd-8796-7a4d1e94ed2a", "comment": "Malware payload (Mirai)", "value": "f82afe5e1d016000d5e8212c491bb20480bfccd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015466, "uuid": "c49516fb-d13c-4319-a322-9dd02e0bb475", "comment": "Malware payload (Mirai)", "value": "af4a1020a42cab62e03dd72a7c3413414b8f5ea639460bdb55f132a9e0eb55888d893126bd5eaa5e27015f6f6830272b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015466, "uuid": "83afd0f5-5807-492e-9577-f19293029d15", "value": "T1084301B9FA4918E6CC54B431DCA4128A06360BFCE86B20BD33DC59AEE6126D67116E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015466, "uuid": "490e0639-2f93-499c-8d24-d2762f5973d7", "value": "1536:Xg9U8VtMj3osaX4gg1R3aY1/iRTlw8ygLNVQuIInNI/i:Q9W3osIOqY1/we8ygLNV3DnyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015466, "uuid": "c04909e8-7dbc-4655-996d-aad6ee4fb640", "value": 59320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015466, "uuid": "114c428e-dc1b-44ba-8277-fc68d6d9bab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015466, "uuid": "44e2400c-2897-4b33-b039-8f09a17861e3", "value": "SecuriteInfo.com.Linux.Mirai.9816.13890.27155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bc33dd-088b-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770953129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953129, "uuid": "ff91a608-628d-4f63-aefb-6926162ca62a", "comment": "Malware payload (Joker)", "value": "8eab4ab124dcfb49798e97a0c139e338", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953129, "uuid": "91d57066-3606-4073-9e4f-2758997e22ec", "comment": "Malware payload (Joker)", "value": "5816ec367f51a9a9784dfb91b6a7dc1bc5f1703106516e2fdaadbb5a0a6c11e4", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953129, "uuid": "292e1509-5207-48f2-a24b-b63efcb290f4", "comment": "Malware payload (Joker)", "value": "8d6155ef7d2e63526348c555912a6b99756223f8", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770953129, "uuid": "853d6288-4d07-4f96-9f93-af38c9ca49a7", "comment": "Malware payload (Joker)", "value": "29034311953eecf6869cc978fa926837bbe25d9e5cb348ec565d5785052e8ccc8b135de5e4b3169302622c332ba8e589", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953129, "uuid": "c051243c-c8b3-48f4-a5a7-6936be963aae", "value": "T12E17D049F51CD427EEC9B0BC8D8B07D3B5627D151614C18B2822B60DFEB37D4AA62BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953129, "uuid": "ad1da591-f4e7-48ca-af04-ef9fc52fa529", "value": "393216:I5+FLoAACyxt0F98fjOhQsDAr7rQxCuKrW701QCFJ:g+FMqyxtJbbCu7cFv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770953129, "uuid": "3a383465-2d6b-46be-a2f8-e9fcd803ffcf", "value": 18531790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770953129, "uuid": "a5ab3fe8-c1d0-4ffa-b4ce-6091f7b11320", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770953129, "uuid": "7c19a81f-8d94-4d2c-bb87-5de1708ddb77", "value": "com.textimessages.textingsmsmms_1.24.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761a421b-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999435, "uuid": "84182ec8-cbae-4e1d-8255-450eaa193506", "comment": "Malware payload", "value": "15d3753077ae137233983bcc2e78aaee", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999435, "uuid": "d095c478-b5ae-4bd3-aaa9-50ffd7dcec8f", "comment": "Malware payload", "value": "5819f0525188b0bd82faffa8cd7d1f8dd6265d5fd82d024d5fd47f42585fe249", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999435, "uuid": "b447f36b-05e1-435e-ade9-8d139e69d1d1", "comment": "Malware payload", "value": "25b611066db7d26cf06265e0839946e00c7b7328", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999435, "uuid": "7288f6c6-0ec1-4728-879c-60d737638809", "comment": "Malware payload", "value": "50eda06236e4adbeafd6a617d1a2b328c6a0947de99417e94378d2895ebe9028c4d355d39ebc0e66b5d339db1d37ddc8", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999435, "uuid": "4a06853b-b4e5-474d-b90c-ce213ae8f085", "value": "T10E763333EF688D57C9444378752F2E252F2D67838788A2D735AC5647278FED08A3B069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999435, "uuid": "389f3ed8-72c7-4c01-abe2-5da4aa159c2c", "value": "49152:Wo8XSmnqsoLf5nep3OMcJXMFbBw+z5EClJVck0718K/q8U9yi5U:TULU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999435, "uuid": "ba7849e9-b6a5-405b-932a-131ccc5deedd", "value": 7274496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999435, "uuid": "06ea7784-34ef-4661-8310-6edf93b5f964", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999435, "uuid": "e64335ed-90db-4ac1-b3eb-d55ed1a624e1", "value": "Cobr_747431YZHIDBTMD598314-De.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24126d9-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986759, "uuid": "3c0159b5-1e8e-4dc8-b60f-0a017aaa699e", "comment": "Malware payload (Mirai)", "value": "65426b53d658a1ac419b9e79a58603fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986759, "uuid": "0f05769d-8df4-47c2-b45a-5cb274a4f516", "comment": "Malware payload (Mirai)", "value": "5846c926e463c1b6cba14504883c6911b8e21d9d3834ac3b2853b936d0199f98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986759, "uuid": "adbabd66-c544-4747-899c-87bdb56083d8", "comment": "Malware payload (Mirai)", "value": "4b098c5687dd26a0025ad7abf98f63cd794630d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986759, "uuid": "c850f168-fcfb-4d70-bef9-3cad18fd2633", "comment": "Malware payload (Mirai)", "value": "c25c89a758a5d3c5dbb2eb2f2e30f62d8576a2113738bd1c496b556071eb11928c64edcebce8eefaf0bb67792ef340f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986759, "uuid": "31ba2589-6e84-4397-b021-1a74424493e5", "value": "T193438D26E9295C94C04904B4706D8F385F13E1C9C3D32DF766A98AB1A847E9CF91AFF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986759, "uuid": "033c95f4-4afd-470b-b593-7b3e3df6fd8a", "value": "768:VOEeqMjf+aoxuNxVNfOaDmLrYutU3fEatHegYbht9yFPLC/oywku7UCGk:VOEq+aoxuN/asH3fZh5XPLzyRMUCGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986759, "uuid": "3aac6698-7de7-4273-a79e-d69437b6c988", "value": 55408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986759, "uuid": "358b6686-ff63-42cb-b80e-0021d1f05f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986759, "uuid": "4f6ed857-3f9f-447b-9c30-44e85d4ae622", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70187874-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949174, "uuid": "883209ae-6424-47c5-b8c1-278f64a0f950", "comment": "Malware payload (Mirai)", "value": "42b7144e9edce5c8f2040072e4b88334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949174, "uuid": "fda1bbd5-96a5-424e-b317-0edfae3c5778", "comment": "Malware payload (Mirai)", "value": "587286ea18a696b19efd2091a4136aae26a7845b45386e6f71195413faf69ec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949174, "uuid": "6f6ef856-f25f-4435-8648-f2586835e157", "comment": "Malware payload (Mirai)", "value": "8e7f76253740470ac7093def66065a5f75329650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949174, "uuid": "aba90d0c-891a-40d6-93c0-b0875818b244", "comment": "Malware payload (Mirai)", "value": "fb8bd92ae5189df771629b047f4f018d22721eaaf17dd7e76492400b6d27bb2cb2a3166455e0552148eb6bd9faa69378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949174, "uuid": "9b9a6b82-cedf-4ca2-9da5-112954a5757b", "value": "T12453F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949174, "uuid": "d59a62af-f707-4035-b6b9-ac80b1871699", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pXB:dn3QxJpRISDMKf5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949174, "uuid": "8e42b9ae-b33c-47e4-ab9c-ad914903adf6", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949174, "uuid": "01f306a5-099f-49d6-b26c-4df455296d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949174, "uuid": "449cb1c2-00a9-43da-9ccd-17bd12d0329c", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337d5d4d-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013497, "uuid": "1a778eb6-8978-4cc2-99b1-2fa6795fc1b8", "comment": "Malware payload (Mirai)", "value": "a2ecbd8af2465c81e99559b1b0e6cead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013497, "uuid": "a06f8807-8774-4c32-8c79-102dfba021dc", "comment": "Malware payload (Mirai)", "value": "58968266f92ea06e3f064e23e58d689cc9d6841082581e06876d36d4a14228ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013497, "uuid": "2ade63fc-1798-4271-84fc-c2beaf2d6196", "comment": "Malware payload (Mirai)", "value": "2681ea080025017d3d98c7050b2b7bf869eda89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013497, "uuid": "6b2f620c-734a-4016-99f5-33570af13adf", "comment": "Malware payload (Mirai)", "value": "6bf1a7d0c712fd8d3a3b149fe60498d92f0bc248b2066c7498cefa8b08dd884f86a1f69e861ff8f03576f09eab26960b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013497, "uuid": "e584441f-7e13-49d1-8d36-113bf3369f4d", "value": "T1A7F32A4768B55FB7C185AFB531A35A740757E9211B1B0B8AB23EEAF00207DCDF80A764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013497, "uuid": "2b078364-dc5f-4798-8e98-862abd497acd", "value": "3072:wgr/XQCUv5n5hOSqj1rWnnIniUDiWmgv3UqAKHZiXpIJTK5TX:wgEC855hxk6nsiUDiWmgv3UqAKHZiXpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013497, "uuid": "646fd4ea-3ac4-44c0-a59f-1d6edb810d8c", "value": 163752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013497, "uuid": "6fe224f7-8180-491b-b604-5e6b48e6d5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013497, "uuid": "d85144b2-2fa7-449c-9244-c9963346b6dd", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b0c223-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975576, "uuid": "640d9135-11c2-4e19-a0af-156d314a230c", "comment": "Malware payload (Mirai)", "value": "fd11f805b7914fad47cff678fd879b3e", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975576, "uuid": "1d598313-0d36-4f9e-abab-a9ddd50d3a6c", "comment": "Malware payload (Mirai)", "value": "59062a5b514ea90347c5023b6880bba8c327dfc2b782d76749f72c4f6247e0b5", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975576, "uuid": "7cad86b0-28d1-4463-89e5-d6e20bda02c4", "comment": "Malware payload (Mirai)", "value": "4a1685883e317adc1d41b20f9a2fc6e539fccd43", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975576, "uuid": "9ae3201c-36aa-4ca6-9e33-addf6bb46ddd", "comment": "Malware payload (Mirai)", "value": "a2bd61cdc46b24d5d5031ac8a89da83ea56ecff5f187d9539d5de59b2f4e6a1818efd357eec8f7f0428b9cf9e602fc68", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975576, "uuid": "0a031874-d310-4ed7-9337-ec94b07d340c", "value": "T12A331891BC828617C5D462BBFA2E418C372523A8D2DF3207CD256F11778A82F0EB7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975576, "uuid": "179fedae-72e6-4ee5-ac9b-4f7b31f0770d", "value": "768:4am+/Edkhe9F3OyNaDK7NVGhCChDG5ovXgTcSPyt5CvN+l/c54pm:Y+MdkU9lVGr9GcgTcayt5C5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975576, "uuid": "562c47b8-2627-483e-9fec-c59c6183e77b", "value": 51208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975576, "uuid": "b0981aae-9291-4578-8425-cd0424af90d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975576, "uuid": "3f2d8388-a037-4f83-998b-949637a09ae8", "value": "StormStresser.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f61f6e9-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770971023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971023, "uuid": "4d6529b1-ad90-4929-829b-ea8eba9ca698", "comment": "Malware payload (PureLogsStealer)", "value": "4a876ed79fd1c70195267b3b9326e6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971023, "uuid": "3ebe0dea-4e69-4904-a0d4-e7d374dfd238", "comment": "Malware payload (PureLogsStealer)", "value": "59b9ff739510ae6d1741c1835e79281a9394213e431627b11286a5691da49961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971023, "uuid": "21ac2f73-ea10-4593-b55a-913200631ee1", "comment": "Malware payload (PureLogsStealer)", "value": "9da33c860a8846aec55407b3b2ac8d1d5bde9693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971023, "uuid": "e7184ad9-8b52-4a5d-9a7d-96c2351c71fc", "comment": "Malware payload (PureLogsStealer)", "value": "3a7f6ae5e1ef36d1c12074723ec4175b711f90da82085f79598ebde2aba0977cc2d3a831004cd94c2c60f87ab1e29662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971023, "uuid": "a5e1586d-3511-4c2b-822e-bc7aa02c5905", "value": "T1422512D43F36A32ADD6447749526CEB853661E787011F6EB59CC6F9BB39C200A80CF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971023, "uuid": "166a2666-116d-405c-b7b6-dc74a213c598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971023, "uuid": "9c1df743-1dea-4df9-9f66-4240dc3aaf34", "value": "24576:R5BghRfV4hoYBv04d+KRV1wMzrUucHely:R5qLN4Sk84kKRzlrUuc+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971023, "uuid": "0f8e739c-f4e9-4138-8957-d1754f832241", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971023, "uuid": "bd92e12d-513a-4be5-a21e-3f7b046e98c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971023, "uuid": "013921d1-e29c-47e6-9437-53b86180937b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.47525823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424dd141-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955540, "uuid": "0f789525-a460-4a70-8f1d-13fc823713b3", "comment": "Malware payload (Mirai)", "value": "c00de82d107a7dc2e25dc1a991cfa9ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955540, "uuid": "69b093bb-7d0c-4477-b558-9d76f624fb39", "comment": "Malware payload (Mirai)", "value": "5a5611356331308f7a764c7f6b29c7e8f6b899c1c85e1d651986269b5461fab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955540, "uuid": "e0893c4d-1ffe-4e57-b7cb-43373830edba", "comment": "Malware payload (Mirai)", "value": "ce395ce98c45e7db1670ee3ee31460fb0ac3fde1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955540, "uuid": "20e51e92-2832-476a-a5bd-b9de308f1437", "comment": "Malware payload (Mirai)", "value": "c4cc48c78b11547eb5a28aed4ac2bd2d6270b805f4d4c96627c54287228aeb96b17c425517ee8cbb67d9437c73fd52c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955540, "uuid": "acd9f75a-472b-4151-9dcb-ba775c30d6f2", "value": "T150B3C71E7E218F7DF768863047B74B21A35933D626E1D685E2ACD9041F7034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955540, "uuid": "b53bc368-765b-4051-bdb4-7efa628c58e7", "value": "1536:5KFAJlCSYBqbZbKvrCdBittpVK2RLxSdWhSh/TqLegLBHDyoABsH:hJ8ubUvTpVK2RLxSSSdcWoxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955540, "uuid": "6d789769-f80f-4b71-b271-348a82b6562d", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955540, "uuid": "6c73bd7a-245f-4d26-9448-465fe0e9aeb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955540, "uuid": "f1963655-7c58-4204-8257-092cb33d8330", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33a7696-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986760, "uuid": "88044307-e509-49ad-b9be-63d6f384ad25", "comment": "Malware payload (Mirai)", "value": "9b526cd1ccaca59d7d58bb9d1079caad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986760, "uuid": "112256fc-85a4-40fe-a243-962475f509d3", "comment": "Malware payload (Mirai)", "value": "5b6ea279d9b3515d2d2badf4dc524034f3150dadbc3eba6e6557e80cdab7fb94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986760, "uuid": "cb498eca-566d-4603-8b46-a24756a1d27d", "comment": "Malware payload (Mirai)", "value": "8f48430d1f030201d018acbb53a8a014fd3bd024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986760, "uuid": "a10cb2e5-2b8d-4736-a88b-7f6a127e27a8", "comment": "Malware payload (Mirai)", "value": "a261557022dac88a35bf99716927392182d99fd60668e9f6d2e39588e12e61d7b1e56aa53ebcd57f2c32fa96e3080acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986760, "uuid": "c143be57-157b-491b-bd58-470f58a0e74a", "value": "T190C2E126FA245E7EF097523F59898E9228573E04B90E656F3B8A0BCF91E11741F18DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986760, "uuid": "4ad9c2a5-e8fe-4a7b-8941-f817b56c709a", "value": "384:M1MPUNXmohVnU+bq6M9KnH567qO5CJGGqNMGjyYiysY1AFslILf8pvhn9v1Ri:UMQXThVn0917qeovGmA1AFv0Jhpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986760, "uuid": "0b5afb9a-756e-44ff-a577-649d0cafe52a", "value": 26780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986760, "uuid": "f23198a8-c2c1-49b4-96e1-ffdc67595885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986760, "uuid": "06ebbbb3-cf57-44b6-ba5e-93417440ebdc", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38503089-0929-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771020806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020806, "uuid": "943dc973-5bcb-4ac8-ac77-45964b6a733f", "comment": "Malware payload", "value": "7fd96892b7edc4d6cf9c109ad4b9e9af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020806, "uuid": "8a6f5211-05e2-42b7-9fd0-4b7ced8cb52e", "comment": "Malware payload", "value": "5b98af6a05c1d3bf55b6359868fb3a49798c153a49175a2cb2f1f33096615701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020806, "uuid": "aaedead9-ed61-452d-a2d4-2a4a0c710ce5", "comment": "Malware payload", "value": "64190a80219986829e9da5f877315943c83e7ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020806, "uuid": "04a4e46a-a648-47ff-938e-e0ca2cd52e6d", "comment": "Malware payload", "value": "11295c94ac395ea1505f0c9e1cd18f4ef1058d22d502c0890b993df4e12e3e7951e97cce490f20ccc4803edf0b0adebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020806, "uuid": "94250af6-a077-4f62-8130-ef2ab618a88f", "value": "T189F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020806, "uuid": "2706f233-b22d-4e84-aa18-0611583f15e5", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020806, "uuid": "498483dc-7de2-4125-b88d-79403daa906a", "value": "393216:UQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGF:U+3LQxhnLUYg3muRovxOOxUj/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771020806, "uuid": "ba6b0f56-d9fb-4a8c-94a8-c2d748599e38", "value": 71523328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771020806, "uuid": "de33c025-0e55-4996-8427-1df8f3b6b8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020806, "uuid": "19e3a87e-f04f-462b-ae0f-94669be01365", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15af328-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986757, "uuid": "4b240931-ee81-4633-9154-eb199700bb15", "comment": "Malware payload (Mirai)", "value": "254e2f3f582278529c367a24020d2133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986757, "uuid": "c4884040-f8fb-485b-8013-ab31ab47c253", "comment": "Malware payload (Mirai)", "value": "5bb2565a8d695b0c9588b9ba9dadb4483756f2fb838202c63ff0362143f7d228", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986757, "uuid": "943c1789-645e-4b07-8706-25c8b2f05c85", "comment": "Malware payload (Mirai)", "value": "0d4f46f50c0b53c61a45a8befbbedf81f8ac17d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986757, "uuid": "0ab3e945-7139-47f6-939a-2cbad47e612f", "comment": "Malware payload (Mirai)", "value": "d9f547fca0ca8a3a2960cf4a06e7e73271e3ef162df4eaacf4d1a5b9ed4a62b65e5b9dcd4fe499e71ae8e2f1778d4d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986757, "uuid": "fe55c806-60a7-4a60-b0b9-98c59f0138aa", "value": "T113C2D07AF6956E4EFE6D4E916DABC3C4B3609F1E17E4CDB06042C7234303909199AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986757, "uuid": "c4e28967-0569-460a-bd62-e8c0c2d74e18", "value": "768:etllSYfZwJSuyrxyYxqAGxcrqaw4uVcqgw0zE:etHvfNuyrrxqATqJ4u+qgw0zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986757, "uuid": "ce7b4c32-de6f-4af4-97de-7cb97d97df7e", "value": 26720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986757, "uuid": "c3b2a710-6097-4c3d-acc8-33c488e3e8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986757, "uuid": "883c8299-306b-4af2-a272-32ac056a1f40", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ce67e1-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974059, "uuid": "1016c233-2a53-4306-94c3-bcb3fcbad250", "comment": "Malware payload (Mirai)", "value": "13cb79d88c8391371372ae8cb05fe682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974059, "uuid": "fdb70ff9-0b24-491c-a77d-02290fe77d32", "comment": "Malware payload (Mirai)", "value": "5c672c7f29ea04f829f5686c77901cea21effcc5fea52e5e83885e3a907e1e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974059, "uuid": "762d87ee-3ee6-4274-9b20-3ef8ff923f79", "comment": "Malware payload (Mirai)", "value": "914f3832510011664d22c68c73f1e5ba75b14d8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974059, "uuid": "a72e3399-6aeb-49a4-9787-623b9d57640c", "comment": "Malware payload (Mirai)", "value": "dcbf9c798db85d22ab90ce399513f4d2a5ec0e768ac8d8efadb2c0acd4482c3e6a4112c172e3604ca9e79551f89b2072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974059, "uuid": "12af924a-c71f-4527-a906-5d419b8597a4", "value": "T124259D51BBF101ABE640463646A2E760BA47D7A268D4024BCF114FEFEF472B50E85CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974059, "uuid": "3ac9be8e-9d8f-4f3f-b656-eb677dfd7860", "value": "12288:3TQESk40Vejo7VmYfe2FwpVxTOw5TH/fs:8EST/OmGYfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974059, "uuid": "491e977c-f721-4098-94a1-8ae3275efe04", "value": 1056632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974059, "uuid": "019967f5-b550-4433-b51e-904404a78a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974059, "uuid": "4e9eb6e9-c48e-4034-938e-9e2d2108b072", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1311d1d-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975590, "uuid": "84ba1fa2-c2bb-43fe-8d5b-2ab2abe9a30b", "comment": "Malware payload (Mirai)", "value": "9223ec391b95bd03cb5f7de80ccabaef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975590, "uuid": "008b2b7a-d9a5-4026-8215-e8ef84e9be56", "comment": "Malware payload (Mirai)", "value": "5c8d71d5c6523e8092e097bbcc5ecbdc3081b02d7e3e902089beef0333f4b0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975590, "uuid": "92554565-cee4-441c-99b9-b93ee34f0cd6", "comment": "Malware payload (Mirai)", "value": "d2eb490802c5b4d24f76d0f2e7c703235e23a4b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975590, "uuid": "724d4895-4a73-48ef-b0be-147c85a371cc", "comment": "Malware payload (Mirai)", "value": "5b8af1f593c5029d820421fa9cde5af14b4497bac8162f8972f4bceb1355126f9939c5c941985f11dbec9d62b1bfb82e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975590, "uuid": "6ae0c1d0-c247-4edc-b2cf-33d854fa6923", "value": "T145234A9AB8019D3DF94BE77F84170A0AF561335551930B3B63BBFD935C322A46D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975590, "uuid": "c1e6b5ed-5e01-4a6e-89be-b09ea4893f60", "value": "768:zjH2eCTxGdRTODjIfXLZ3Uo5/czcNug8mOko4BTsmxz+GzoJjXSGhu:zjWHTgKC7VmQ8g8mOko+fxz7zSHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975590, "uuid": "cd458fea-6022-46be-8df4-280bf271da58", "value": 49784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975590, "uuid": "032b920f-e885-4d5d-ad91-0f06e964c4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975590, "uuid": "62395f7e-60f5-4fd6-b3be-73afcc433dbc", "value": "StormStresser.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dedd6b-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974039, "uuid": "bb072fef-248d-4269-98f4-84859ea55935", "comment": "Malware payload (Mirai)", "value": "8eaf81570c0e0f42db7ce1e18c759b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974039, "uuid": "b229d8be-1e50-43b3-b7c9-2c9a78ba21f4", "comment": "Malware payload (Mirai)", "value": "5cb03a0ccd304d6542a9c32723147c37feb2a608401fb1ab5bad0db21ad7eaef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974039, "uuid": "75bc6b2c-60a0-477a-931d-706929451b20", "comment": "Malware payload (Mirai)", "value": "3fa518765ead5d6b8372efdccffa42d25da26108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974039, "uuid": "4e17f926-7c0a-4213-b6d5-949f20bc91b8", "comment": "Malware payload (Mirai)", "value": "0b92f88ee93847d2868852db8cd397eb64bff98da9b137a4b71ac0a52c5cd585ec7bd32e3d9f6beea2f8ccfc08a13182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974039, "uuid": "6b0e234f-2341-4e5e-ba38-21819e46c9b9", "value": "T1A0434DD6B800DE7CF947EB7A80164A09FA35722154A30F27A267FD93AC721564C2FD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974039, "uuid": "03dc2fe8-0d04-4cf9-a11d-e70a2c20617f", "value": "1536:bqgor9Y1asetA1PcG5eYzCktnSygjVWstg8A:JGssA1Te8LJuWqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974039, "uuid": "6144e711-ce51-4565-8cf7-923b9868e77c", "value": 59716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974039, "uuid": "35b9f167-0d61-4ffc-b7c9-8e649a4e5453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974039, "uuid": "04a58251-49a7-430c-af1b-5758505dcd86", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461a64b5-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985181, "uuid": "2a84777f-281e-46c4-a7ea-bac8742cb28e", "comment": "Malware payload", "value": "4d9514dbe2333f590c888ec878b37249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985181, "uuid": "ef1c0281-fe2e-4afe-b875-a085188f6f45", "comment": "Malware payload", "value": "5cc99e032c44406387794d8934f0d3affaf8b78dbacb9f5fb6e2d09fa09dd987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985181, "uuid": "69d8cfdf-1502-48b2-abdb-808764c90407", "comment": "Malware payload", "value": "45cd9aeb8d72379c305b9ce523c0c4dd4ae0356c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985181, "uuid": "ed4093d4-aad0-4068-8765-e427f9fbbfb8", "comment": "Malware payload", "value": "f6f38e7a7d531cd8fdc2ca8f51c53e70f6405d1e6f57a8c63bb01b654617577b7dab480c196432741a581f1ec1ca23cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985181, "uuid": "0453ea9b-fb2d-4f25-929c-ff762900f2a6", "value": "T122F35A23D683CB77F2510630C8E4A205A93FBE5546A24B7EE9D17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985181, "uuid": "77dcda86-5efb-4112-9a30-3caa069531da", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985181, "uuid": "85d197f6-e593-403b-a74e-a7a3b0c44142", "value": "1536:HNK0ETTW1PeabESARxJLwO4BAL/7dNu3NbfO5ra+Cp8xorIJlw5oeePHvBcdh/R9:tFDVESApLltNnQUHcXR0LkcJxiNM9Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985181, "uuid": "69601b7c-2b24-4b7c-8439-9ba4d48c368e", "value": 164456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985181, "uuid": "c29e287e-46b5-44be-a934-3d54a5907814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985181, "uuid": "b2e9305f-a882-495a-b0f8-ef044f61a888", "value": "ll1ia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41918fd-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015538, "uuid": "b5fa1b9c-0a38-4342-9798-3926e1091a4a", "comment": "Malware payload (Mirai)", "value": "d23fe26d204b74fff63fc7b76af95bf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015538, "uuid": "9f8c9bad-8236-4bf8-9534-bc5b7589084a", "comment": "Malware payload (Mirai)", "value": "6074210dae2cc3f68529e289373a412abae7de4af143f361b861baff8e4471e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015538, "uuid": "14acbff7-cf76-4fde-ac9d-ab3fc5740789", "comment": "Malware payload (Mirai)", "value": "d1da94516d484ff2f5c96db85014bb3515af8db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015538, "uuid": "eb7d19a0-1232-4137-aabe-231fa4e95dbb", "comment": "Malware payload (Mirai)", "value": "f225c07177b46a0dc4651ec78eee307752f324ac1e4d5b427145388c27b581e1f377082b87657a1a6e02d336ed215d9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015538, "uuid": "91ca2dfc-64b7-496b-b0d6-8c5486b7b18b", "value": "T1B463A51E7E219FBCFAAA863443B78E16564833DA37D1C581D1ACD6012E6064F740FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015538, "uuid": "a084df51-3c17-4d60-821b-40272f87316b", "value": "1536:ZNVBwPSyumuIP8LMBK09LvW/G85U4oq9zU:4gF4M00e85U4R9zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015538, "uuid": "7f76ad9c-ae76-4fd2-8d8a-a8664e271d02", "value": 72056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015538, "uuid": "0003902b-7977-4b1a-b30f-a642e10bb5b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015538, "uuid": "ab57f772-3923-4488-8e96-a38085a17e58", "value": "SecuriteInfo.com.Linux.Mirai.9816.12932.2643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd55d9a8-08b2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770969973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969973, "uuid": "dd4418e8-aae2-4e95-8276-8b87db87ce67", "comment": "Malware payload", "value": "52db22b481e495683b3a13cd450357ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969973, "uuid": "c98a4fa7-cbc0-4b13-8da9-baaceaf15f01", "comment": "Malware payload", "value": "609b843465bb8b94486f15f226a212a493b56c17b76e9bf1982c256fdb580f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969973, "uuid": "4b1d2a5f-971e-4534-a0fb-946942f928ef", "comment": "Malware payload", "value": "9d3ad93027ed23fa99d83b9666b7ae60aa0d4b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969973, "uuid": "ad059d74-9aa8-4767-9dba-72019a568255", "comment": "Malware payload", "value": "dc645ee7bcde1af30138d979e0ee5dca931f63caac7c1268739a79c9ac188f237b8d40daff0b4b32f02d3773010bfc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969973, "uuid": "89459ad5-15eb-48a2-bc8f-f7584c2beab3", "value": "T10D2412F2F1C75551DE2EE33FE5739620CE827587CB24375B820229B728B1392D974A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969973, "uuid": "10e4cf04-ab1b-47f2-b4e1-992269d51a43", "value": "df0774ee1f0224e08060a6563fcbd4b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969973, "uuid": "92fb16a3-8bc3-41dc-b6a2-ec09de8485c9", "value": "3072:oSIfGi9jvHgb1kYCmDyompaMckf9fDGzVTFD0IzjLiGYDpPRot/4AvxQpcUYYt:oSrUjvHGCmWopgLGZDiiwA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770969973, "uuid": "a3c73c35-e95e-4051-8543-05a3905bfb76", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770969973, "uuid": "063caf8b-2163-4dc9-a57c-3e0bec50fd33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969973, "uuid": "fb81b188-c40c-4015-be2c-1fd02ec2bf88", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f8e64-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013483, "uuid": "67fe5ed2-3e69-49c6-b7f8-7357cc09d819", "comment": "Malware payload (Mirai)", "value": "f8db0813d6192ba0d2b34c2b37df91af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013483, "uuid": "c8443fea-0e45-451e-89ca-cbd44ee5737c", "comment": "Malware payload (Mirai)", "value": "60d896fd063131c40e1036d648989147f787f46d17e33decff8a24c08651d35d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013483, "uuid": "e66950ad-e81e-4e24-adb7-0f384ea24325", "comment": "Malware payload (Mirai)", "value": "011cb1f6bb0f14e3fea2045ec09a45eb3a434fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013483, "uuid": "936cbfea-d568-4d61-8e81-626f3066b6d8", "comment": "Malware payload (Mirai)", "value": "e0cd5657bede8c739c047750ec623de5b5add072cadbeb0d2ade802b36c560590bc6d0fd3120fde24fc072bc3d4211ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013483, "uuid": "6d7834db-84d5-4f66-85d2-9fe24bf716e8", "value": "T140E34D09EB409B5BC1D2277AFACB428A33239B54A3D7331559386BF43FC27994E32516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013483, "uuid": "82d7c115-cc09-4d21-9bbf-7e9cda9f87ab", "value": "3072:4/qynRmEdMC3WiLhlYIdsgF+1B691iNg91i49INv9qtasWcsK5ukl1TGJJXZa+lj:4/PasWcsKEkly5Za+BM/9Mm0w3+6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013483, "uuid": "8a698f72-bfb1-4e65-9fbd-2c98dfce6d56", "value": 146038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013483, "uuid": "cfa086d2-3719-40da-b43d-a038a9650a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013483, "uuid": "7c80afe3-5c51-47b6-a0b8-a60dca353246", "value": "m-6.8-k.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14a1d79-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976771, "uuid": "53d2fcaa-0830-4398-ae78-e5775c57149b", "comment": "Malware payload", "value": "e15887561e7b57b2276e800e842194ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976771, "uuid": "fa239f71-c778-4756-a0b7-173698a6b45b", "comment": "Malware payload", "value": "612d940023d8530377f0571cb839d667e172dcbe307878ffd31b20f534c1169d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976771, "uuid": "fd767646-5770-46d2-973b-a0e2124d5fba", "comment": "Malware payload", "value": "0a696f30cb8b949597cd4b51ece5a52de966af39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976771, "uuid": "7431fdd1-4006-44b4-be00-317b6db30c58", "comment": "Malware payload", "value": "25a5876ed1b9e67528eac2861d378a3d530c0f8b8e203e9f395d8c5edeed343178a26558d296c414818611f7fe7ad9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976771, "uuid": "19db3ce3-1744-426d-a457-f42fce449fe9", "value": "T191563377470203B7A77A893F3B656C21E65F2C7A44D3052A9BBE4CD204B67D0273962B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976771, "uuid": "46d876dc-9bbf-436f-b993-bc957d3f6de6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976771, "uuid": "c2959f09-074b-4fb5-86aa-db6839dda651", "value": "98304:1uwVNE+m2EO9L2jwhoTZpDNUUuhGckwjNBW5HYMObuxv3tXmff:1dNgaL2MhoTZpDNu/pCHYMbxftWff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976771, "uuid": "fa32323a-fa28-4f4b-afd5-88c63830e227", "value": 6132736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976771, "uuid": "3e51fe43-851f-43eb-adce-6c5116ddd1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976771, "uuid": "9c05d56b-b679-4e67-95be-b6baf97beb35", "value": "fscan32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09f154a-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026645, "uuid": "5118f4c4-eb32-4c6c-8778-afadf972e142", "comment": "Malware payload (Mirai)", "value": "64518b1d32222b85255231774b30a689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026645, "uuid": "99126e65-31f8-4c65-8973-2da58f52536b", "comment": "Malware payload (Mirai)", "value": "61471eb021b09432e7ee034a8d826ebfd80bec4ea59752418ab1601162db8da3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026645, "uuid": "a9d478aa-6b57-43ed-b4e9-c8086b321a29", "comment": "Malware payload (Mirai)", "value": "d2f7e8b21cef8a55e679f1cc190305fd3f760a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026645, "uuid": "2d83d6e2-6fe5-43d8-b1f2-8a634c00bfa6", "comment": "Malware payload (Mirai)", "value": "78ea64332b5e130076e90fa3c2431514027327e372471be0cecd0be1e120ad46ec12021b51363cccd2f440491982f6b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026645, "uuid": "c66c34eb-f85a-4eb7-b94d-149e37e56163", "value": "T181E2F17817CD383BDE28A37B9737F8F593B3ED485D629BC9278882169C255109331064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026645, "uuid": "0c9139fd-5389-4c51-b849-715d529e04c2", "value": "768:pkz8xJLA9i8G69xZGQHMlFhsXELpfI7h/CE3U:QmJLAw8Rkr8+fIt6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026645, "uuid": "a0436a60-7ebd-4279-a28c-cd26153dd73e", "value": 33608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026645, "uuid": "f9fa17ba-1b00-416a-8b53-22760e45ed67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026645, "uuid": "e4477db1-bc98-4052-a944-a3fb042e2520", "value": "amsx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76eed014-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011462, "uuid": "d66153fa-9bca-4b9e-9aed-e00ba24f06b6", "comment": "Malware payload (Mirai)", "value": "af86ec939f9eae4a261d961f2b23cb4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011462, "uuid": "ada051f9-e9b8-4df4-9897-c73ff0687dd0", "comment": "Malware payload (Mirai)", "value": "61ec4f7620aef4897a9da4a9493dc1d232f5267b5cc74a60df7605ade8288454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011462, "uuid": "a9c13e2f-0953-4fca-8fbf-9bb114cff78c", "comment": "Malware payload (Mirai)", "value": "2ca2aca38b41452384e5445ded58799d7f8fa5c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011462, "uuid": "6b14d4ae-7b09-43bc-9d77-aeb328b84c63", "comment": "Malware payload (Mirai)", "value": "bcc36ff889c4c42b79d391e0f02cd41b1f77b9ee7088681fce0054cb3be77cc157501278f327cc850f6de7ab1745a30e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011462, "uuid": "422e257c-eee4-4335-9c12-6f2457208303", "value": "T1AB734B46F8819B11D9C502BAFA1E118E3323177CE3DF73129E206F25778A96B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011462, "uuid": "6c46bc9e-1e99-4a80-b200-5b56e8dabf43", "value": "1536:sYnGPHyE3MRNdJvMpR1aTMj9QUMXiPOfSr5bvDjU55YFD5qD5Sl:lJdJUH1aTHSr5bvDjU3a5q5Sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011462, "uuid": "625ed2ac-de11-4a62-b8fe-4ee18ed5fc69", "value": 76324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011462, "uuid": "79ef98f3-0249-426f-ac8e-d8c48ac6c0b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011462, "uuid": "91af6464-36bb-436f-a583-66eaea465777", "value": "boota.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a4b521-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985263, "uuid": "9afd7076-d2ea-44a2-9760-dc5efc9b774b", "comment": "Malware payload", "value": "18100eb34f52073e371698bc87337905", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985263, "uuid": "4914b568-f24a-4e88-9ae9-8292fe43b2e4", "comment": "Malware payload", "value": "622706fa8bc0dfd26ea5b9b95072ae524387e351bf24aec1987c466dea5e1877", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985263, "uuid": "08979feb-0d3b-4360-9b8a-695a72d7d40d", "comment": "Malware payload", "value": "282b3cce55a2ae379d1799da767f1b2c92c9864f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985263, "uuid": "778184f5-ddeb-475a-a2e5-5064daed98ad", "comment": "Malware payload", "value": "fd9322e19d3fc9887b40cd5c8d5760f6c04774f3ee019daf1033259244c84b5b428061466b6be1ef555c00738a48922f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985263, "uuid": "8262f51c-67ab-4ff9-8082-a542a657c729", "value": "T1FE966C53B2C8653DC85A0A3A2837A654583FBF7125138E3A67F4084DCE3DD496E39E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985263, "uuid": "0a32cf84-d33f-4daf-9282-986a874e6939", "value": "83bb430ac47307b3c50daf6740fc0ef6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985263, "uuid": "f1b2a485-0672-41a3-aee5-c2db953a4a07", "value": "98304:5kqGFGOlj7V8HNDgVC5vKONz/sAtRdfUs8:BGFv7quGvrz/7PdfB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985263, "uuid": "2da2fa69-dbcd-4c34-bac7-b485d61ecf0b", "value": 9036904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985263, "uuid": "e8f61651-43fe-489b-9363-20fe14347400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985263, "uuid": "d1f49a24-71e7-425a-8071-93efe7163f11", "value": "gurodveu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d7263a-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976616, "uuid": "112cb0aa-abe8-4d6e-b873-c92888b7acdb", "comment": "Malware payload", "value": "dca416ecd1294ca9331ad2d918fc1ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976616, "uuid": "525ccbc6-9398-4e48-a474-4a52a26d579a", "comment": "Malware payload", "value": "623818593676244268d790658ae9ea6a7080d89b0aba6dd64944fff2a3072c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976616, "uuid": "c69c725f-f1b3-451e-9270-af4b06a8672b", "comment": "Malware payload", "value": "f95fa180b47ad553f7ace16106b006bea8ea9a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976616, "uuid": "0f723c92-1bcf-4450-9df0-d18a0d2cf03c", "comment": "Malware payload", "value": "262522f62b98f73dc25e06e8f3e10940ed750ac1612a84d1aec73653e7ffde6254e8ee6ab1b5467d8800300327c12312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976616, "uuid": "da070c2f-c6c2-42e1-afec-527a6b3fd12e", "value": "T13C873B87F8E21DA4D4FAC570D129815BBAB13C6D0B3823EB1691F7201F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976616, "uuid": "07bda179-a317-4d2a-a9e1-60f9094213a1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976616, "uuid": "18f5371b-89f2-49a5-a785-cf7b520ae3b3", "value": "196608:gTAV6eOilr0Uq5AqmGYMIz+7GN8Bc5EDSgVX5Pc/AfLjIZxqfEJJC3skJu:gK6W0Uq54z+7q8MgLPc/AfLgJJC7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976616, "uuid": "e8b2051a-f636-4514-8f6c-09cb3f9bbcdb", "value": 38813184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976616, "uuid": "c0bec71a-9a99-440f-850b-212e4bf1b40f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976616, "uuid": "12bb347b-bf25-4306-b71c-fd264c763abc", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6d865c-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025783, "uuid": "e077da27-ca47-415b-92d9-bb6e094bfb69", "comment": "Malware payload", "value": "bdab6ead61c501d24811e4c9db3f9037", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025783, "uuid": "fbe8318c-a649-4cf1-b81f-a76c3f24ff88", "comment": "Malware payload", "value": "623bb80f8890efc2ee0fba78110fd807b380be75edb1bf7b4b782d6826d8b0d8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025783, "uuid": "d0d17c35-a2d9-4f79-b68b-bf48690f603d", "comment": "Malware payload", "value": "8b630cefa05d1e3b78335f46c5a0a4fc85671abe", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025783, "uuid": "b40ea935-4073-4b5c-bc0d-88b2dcf7ae67", "comment": "Malware payload", "value": "bf5cd8c107eb52a554d1dd060d6b8c812989e9b7bd04eadc2f5085f9e753db75aa7b771067be5eecb3d2efd2684d4801", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025783, "uuid": "e0a6a473-3c0a-41f2-b593-127665f573eb", "value": "T140262332FA401876C66003B5B92FAB796F7D7203858D16D77C9E82463743BC6963E8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025783, "uuid": "5c849b57-65db-4bba-95ff-4f9ab7a6ee55", "value": "49152:68PTlz8RJ/tRzbs+bS2A52vCDIzBWGAueOGDnT:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025783, "uuid": "84b8e4a1-62b9-410f-9baa-d9f9eb8fa565", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025783, "uuid": "34342772-8b1d-4c30-9e91-2a8a66d95039", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025783, "uuid": "1669f8c9-0eaf-4ab4-a491-cd44798833d4", "value": "Not-Ar9092641F70YYCIG80976.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9a6c7b-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1771001835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001835, "uuid": "9c0ceef8-f055-4f37-b9ce-be96a3a3479e", "comment": "Malware payload (LummaStealer)", "value": "a9b41a143823a919d095f0de78899ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001835, "uuid": "fb0fe509-ec69-42f9-8059-7ec2c7583d7e", "comment": "Malware payload (LummaStealer)", "value": "62739b475a41b2eb386aa7692dd37f64fc944b5857a59f646800efac3fa2916b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001835, "uuid": "a3f6e929-ba0c-4a73-88b4-f2a17fdbf9ad", "comment": "Malware payload (LummaStealer)", "value": "07114d74f4f08af39a1ed17a42538eff72db4f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001835, "uuid": "3fd6f70e-d273-4160-a435-56532965ab1b", "comment": "Malware payload (LummaStealer)", "value": "b02201f909fd65dcf8a1f51e72437f1e0735cfc14693c72177b0c3611ce286c386c1cea7bd04dae12d01502931e7d859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001835, "uuid": "ed67ad20-9703-45c8-8c61-edbf00f8b78d", "value": "T19ED5CF342B6CE0A2F27A117D8090A7D23977FFF907B405597EE47A7D08315823A6A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001835, "uuid": "d045aa40-b792-48e9-8729-0c0a083bc912", "value": "73b5f0d69f4e86fa8e59e96e04ea29a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001835, "uuid": "a1d0e07f-d3a0-4a7b-a6b7-0c01825dc3ad", "value": "49152:X4H8/ajDl79wa14C9DxC2l5/8aHoTRUtymtZq6U3ipY:XuR9x4C9FR8EoTRUBmPaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001835, "uuid": "04a1885a-8eec-4da3-a9df-176fd838b7b1", "value": 2848376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001835, "uuid": "5c4525d9-16fc-4403-a15b-6bb228ead7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001835, "uuid": "7459d034-113c-44bb-a4cb-9b875a060118", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d953fa-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770975269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975269, "uuid": "a89ae551-f398-4d7b-8a2d-1aedb201b489", "comment": "Malware payload (ConnectWise)", "value": "f9724281bf428cb34005a106f01cef74", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975269, "uuid": "7e9ed79f-80c2-41a7-b7e8-feea84a6c15e", "comment": "Malware payload (ConnectWise)", "value": "62c339d289514877606ec1e10b2c046c1e09f4042ca00c5f9801ea955f53b96e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975269, "uuid": "0eaeb677-0dae-489e-839f-c0e8c7385a79", "comment": "Malware payload (ConnectWise)", "value": "7fd69cfc8d2c81430e82b54c112b3c0b0cf41da6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975269, "uuid": "a28c9452-d467-42b8-a707-5e0059869326", "comment": "Malware payload (ConnectWise)", "value": "5eef9e9ad747613f6426533bb4d5d8686c9f4e9be02b4f7304b6315103c3a85725d0a137bf80568839a5ea058542fd00", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975269, "uuid": "cfb43d24-9cb1-4066-9d16-e4b8e3d8048f", "value": "T1BEA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975269, "uuid": "5a838813-f6de-43d6-b73d-edef81032822", "value": "196608:6KaLNkbg1i4Q4KaLNkbgRKaLNkbgXKaLNkbg:MWg1iHeWg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975269, "uuid": "0ba7e155-70e8-4432-af9a-60ed54135553", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975269, "uuid": "7ae07abe-54e4-473d-858f-b4e21ec96315", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975269, "uuid": "75ca2709-12e2-420b-af80-78ffc6dde93b", "value": "Adobe_installer 097.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f08ae56-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963292, "uuid": "2046e738-8a91-48f7-ba2a-207a4da9af54", "comment": "Malware payload (Mirai)", "value": "a7b2de8ba688b7701274ad11f6afc888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963292, "uuid": "1c3de03a-a151-4115-877d-d5e8b037bb3d", "comment": "Malware payload (Mirai)", "value": "631c566fe97d0673b92610a53049472bf6d8137b04a787f07354fb70ef6caafe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963292, "uuid": "c1804667-4a9a-467b-87e3-1b165e4d9b26", "comment": "Malware payload (Mirai)", "value": "c0a6d43d5b71894f099a0384cfa3df2f2f5505d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963292, "uuid": "7a7da7c8-626d-44d3-9b84-8335820d8f6d", "comment": "Malware payload (Mirai)", "value": "9910b31c5ad51d7620bdb2e44e58a1c03829eff10cc11974708ce9bf3a4554d491a52a20573afbf5bff15e39eb447e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963292, "uuid": "f1559878-d531-4b8e-9045-ad57b53a3441", "value": "T1DDB30946A9429B11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963292, "uuid": "71faf09e-b7d8-447b-b93c-35ac5ce7ec27", "value": "3072:hqiKVqVEpOFnYfG/7/0tZYC4dmnJokaZFbR17b5A7UfZpg0U0zf+f:hqiJPdYe/7/0tZYCCyJokaZFbR1pA7Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963292, "uuid": "cf0c67ec-2691-4624-8b71-fc87373275ea", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963292, "uuid": "eb3fdbb1-73c2-40aa-9839-5597d06c877a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963292, "uuid": "57821cb6-daff-446c-8115-0a67d46ac035", "value": "herios.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5cd088-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770975312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975312, "uuid": "50c329a4-9027-41c0-8ac0-23619a524f4d", "comment": "Malware payload (GoToResolve)", "value": "3236573469899cd75b270f7805f0fe7d", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975312, "uuid": "94fbde65-51b8-4567-8b9d-786c1171dc77", "comment": "Malware payload (GoToResolve)", "value": "638eb89f417e5416fedb8a0e62c6ba79f8a0b0d7ea8a427df9e367c7de61bc25", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975312, "uuid": "754dc51c-0d5b-4e1b-9a9e-77ca17a04ae2", "comment": "Malware payload (GoToResolve)", "value": "24094f7081cc84d25f04746ea27fafa317abdebc", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975312, "uuid": "227c751d-5074-4e2a-9ec5-d4855e36b12d", "comment": "Malware payload (GoToResolve)", "value": "2e53aadfc28713223b4b829cdf499c421b45167615b91ff46ee7d1da49ff47291241ed2fcbe1d3661297daaac1900630", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975312, "uuid": "e061a477-7a79-42be-ae81-fe831cf95b8a", "value": "T19B37333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975312, "uuid": "c8a0cb84-f1c1-40ff-bec2-07c9b6354c5f", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975312, "uuid": "f00e20ab-a87f-47ef-b065-815d09572649", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975312, "uuid": "5fcb445c-eeec-4d21-9384-bd7bb863d6fb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975312, "uuid": "0287caac-dd47-46d0-8880-850f588f8792", "value": "SPECIAL INVITATION (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc887d46-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014586, "uuid": "bed1843c-9875-4c05-b2d6-24305c12306c", "comment": "Malware payload (Mirai)", "value": "53e2f4ce2199276c81762638d11694f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014586, "uuid": "fba52fbf-0bc3-4e96-a096-1fa7691de2bb", "comment": "Malware payload (Mirai)", "value": "649a9144090587133b4db4623520afe7db41bfa870323a20e9828ba100147659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014586, "uuid": "229c6e90-eb2a-401d-be54-fa66e3c5ceb3", "comment": "Malware payload (Mirai)", "value": "69f1cebb0182c1eec3411aa7d771a06a0de9faec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014586, "uuid": "d7fbeaab-afcb-4ef0-ab37-4b34ff37375a", "comment": "Malware payload (Mirai)", "value": "3eb4e8693a59843f28057e1c65752a42f29aa9fcf51c8e03eba008b35a9363180d27c7538acdf94a948a2713efb3175b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014586, "uuid": "2c13901f-b6f6-4a2e-b7f0-076f844f2cd3", "value": "T107736BC2B743D0F1E9260632217BFB364673E13E0029DA43D7A9D87AEC52641E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014586, "uuid": "80c12cc7-216b-420a-99dc-9bec53a272b1", "value": "1536:+lBYOT1n4SLczH76OzK0cWw5oG3fs8kZ2rEZsS4W0Si9LJBJ:+BN4SYX6zTWUoG3ELZKgt6LJBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014586, "uuid": "c44b83f5-c553-477f-ac8d-13b5d9f7ddca", "value": 80208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014586, "uuid": "4fe465ef-5fbb-47d8-9b80-b03c2a723906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014586, "uuid": "8b6b900a-862e-4842-9b71-202f41aa04d9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550510c1-0926-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771019566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019566, "uuid": "ba0b3519-131e-4c03-b382-0717227ed027", "comment": "Malware payload", "value": "f6dcf54c897e28c106b146c8452842a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019566, "uuid": "5a9175ff-bdf8-45dc-a2b9-bfba937f7ddc", "comment": "Malware payload", "value": "650316ebfb7fc834a7cd0b4f9db79c0374cb92e1a671719f95939c0c8ff4ab24", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019566, "uuid": "93654a54-1c4a-4d0e-aaec-536a90f5643c", "comment": "Malware payload", "value": "5d42c7be8533970732d75303e34e61837849a5a2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019566, "uuid": "f0c62907-7f15-4da9-8c7a-a1c4285b4769", "comment": "Malware payload", "value": "eb092d29dbdbe1642b7224fa6f3f1477fcdc6eedb37142c1e6124b9ae8b4a30faeb0563f966dc1c03a3d4254b3c0566f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019566, "uuid": "aece51a1-565c-4fb7-a9ee-697566f104af", "value": "T15395BF8A2B9441FEEF6FE0768523E71AC376B81D17B38E1F41996E612F33664161E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019566, "uuid": "2500497b-cc37-44f7-a1df-fb7785a1212d", "value": "6c9794990dcbb89d798ebf671bb8138f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019566, "uuid": "f3765045-b04c-4876-a873-eaec73edf3f4", "value": "49152:C2EYTb8atv1orq+pEiSDTj1VyvBa3Sc9NXsBxljNvbwO+:/XbIrqri/LUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019566, "uuid": "b14a49f9-17f7-419a-ae88-3705d8fc973e", "value": 1959424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019566, "uuid": "f2aa5ff2-47f4-46cd-a3f9-5b35b5bf7827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019566, "uuid": "087722a9-b198-4a93-bace-9e1d9330f5a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8bb266-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978050, "uuid": "73cc791a-c96f-400d-8d05-2caaa5107186", "comment": "Malware payload", "value": "5f75d1f40bf205401663a436cca5e63c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978050, "uuid": "8db9c911-004e-4950-884b-0ed26ae6ade4", "comment": "Malware payload", "value": "665df799d34ed65f280e4df19e4c2b1802f410099c9b6669622385658fed87ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978050, "uuid": "0bc2a2e2-1a57-4576-aaf7-d49d490fcde0", "comment": "Malware payload", "value": "76e7bfaf61f3f6fa35c0638cc057f20502b59fce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978050, "uuid": "a067e482-cf06-48e7-84ca-4c7b52899170", "comment": "Malware payload", "value": "8d27aff9decfe7796f2e2bd0fcd693b43a46e7f294e00b1e7eddbca098e3064e6e733d01c00b1a2424aaea47dd422197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978050, "uuid": "921bc38b-23da-40af-92bd-a3056e2bba9b", "value": "T160B48D69BE5E3D43D2C7F37DDE864761222B75E8D322C2A27901021DE4D6EE9CFA1211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978050, "uuid": "910d4ba8-dbf6-4a04-9d09-fa94085d7a97", "value": "6144:92iy+3Bk6rk8a0EN2KB92NlTvSf8V+HNZ60Q/9+NXIg5IbjrL:xBbg8a0Md9YFV+HNwcNXIg5I/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978050, "uuid": "2519fb6a-f9f7-4113-977b-0da68612d52a", "value": 511792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978050, "uuid": "5d20a483-c03a-4bce-b779-f866d36af611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978050, "uuid": "2d66fcde-c57b-490e-a175-bf71152e313c", "value": "dlr.ARMx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4484c148-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973153, "uuid": "493657c1-8605-4ab1-a750-4cd1454cf80b", "comment": "Malware payload (Mirai)", "value": "8bfa15f4431d6c6c7e7cb88352d978de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973153, "uuid": "847cfcdf-fa81-461f-9122-51b762c958f1", "comment": "Malware payload (Mirai)", "value": "669b81f03199ea6304d88772aa23861d299ec3d58c0d6ec8da834539b3d50758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973153, "uuid": "7af622a5-81f0-4b55-a0ec-ea9e1ca1caa2", "comment": "Malware payload (Mirai)", "value": "9716954bd001efe6e112876a294281ffe116a5ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973153, "uuid": "c5539216-45e0-45a1-9040-271911d912c2", "comment": "Malware payload (Mirai)", "value": "9ad773a44170db9b602364ee5dfe74629c3a3b1c8de6089e02c92b0d42587ca6e71df3f127efca9535c6835274fade3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973153, "uuid": "27820677-8c9a-489e-ae9c-0cd9cc222d00", "value": "T12D6301EA4797E546D4065633202C30607877BFE90A4AD1CFBA60D6DC1AEA5C2173E7D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973153, "uuid": "bcb532d4-8527-4bc5-9f00-c541dfed8be9", "value": "1536:kSInGAihin5fk5MLnwrQWvqMRmKtucm+SgFTR46oiKM8:EGAjL7mnvqMgK4chTRyM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973153, "uuid": "e5d1fa71-4f60-4171-900f-0abe09f6048a", "value": 70484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973153, "uuid": "8e3dc9b4-2b60-45bb-b732-dcc9d21c36c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973153, "uuid": "bf89b6ae-ed38-48b1-98a8-83690d0513db", "value": "sys_armv6l-unknown-linux-gnueabi-armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f14d0-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985514, "uuid": "dac12750-fa6e-4129-a093-c0b5d3aa8398", "comment": "Malware payload (Gh0stRAT)", "value": "55e45b324c9abbcc3e4dc9304e5a4a0b", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985514, "uuid": "bf13ee75-fddc-4cc6-b924-a65caff5497f", "comment": "Malware payload (Gh0stRAT)", "value": "66e978a70857444d62229ebeb390aea62aa48af12f0cd3c92709491ecc054c90", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985514, "uuid": "3897d359-e671-49b4-8596-136b79a26b7f", "comment": "Malware payload (Gh0stRAT)", "value": "a80c9bde673c4057a7330e2eebf30970a9da4056", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985514, "uuid": "ac9be120-a028-4d7c-be5a-593bf9e483fd", "comment": "Malware payload (Gh0stRAT)", "value": "066a21bd08ef45adbabca5e5d3c35d0e60818bd871647aab8b25e68ee161fd2991498c3f219a8a4683290503b35b85d8", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985514, "uuid": "a273d837-2575-4b2a-b72e-8cbdb5fe3691", "value": "T1E2E6332232C6C035D67F0A711839DB5901AE7E608F7494DB53DC6D2E5FB21C25A32FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985514, "uuid": "70d33495-72cd-46a4-8df9-de1ac34ba714", "value": "393216:6zkHWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/q:6YHWrTOjnO9KrNMJ+Mu0oX2q4ljiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985514, "uuid": "a5bfacfc-adbe-437f-844c-c88dd95a810f", "value": 14777856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985514, "uuid": "a04e120c-9763-44f5-a858-5f1715b35735", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985514, "uuid": "038a276e-36be-4110-9787-4a95b18e0797", "value": "AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32bc4e9-089c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770960427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960427, "uuid": "30029402-912d-4920-816a-567d442499d3", "comment": "Malware payload", "value": "0ff15b1fb67ff94e069c249481f9e743", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960427, "uuid": "10d73f9c-63a0-40f4-9d35-30254edeeaf5", "comment": "Malware payload", "value": "6745cf8d0d99b63bc2cb0afcb15e992b12fa2ab5be3655cf409a1631634c2e4a", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960427, "uuid": "44675f48-b67c-4c03-991a-d7ab329bc62c", "comment": "Malware payload", "value": "8c43effb3101625038c88ef08ea8ad5a906b1ef7", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770960427, "uuid": "2f0b4752-424a-47b2-b1c7-eb923e622a79", "comment": "Malware payload", "value": "929c1642acbf56df3e9e66035b3d697c261b7b9ee64e2c8e33fcd36d69ab7f1d7371ff7861e097d195a4797f79badc50", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960427, "uuid": "8e0c90b8-e4e3-4b47-ae5b-74a0be5939dc", "value": "T1D90523BCE1997DF9D1063E585037037A650D20B0877929B6F60942E2B39604AFE35DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960427, "uuid": "a52f5aa5-a0df-4a98-b129-b717608c304d", "value": "12288:JYoGcO5MiFh4xqmvSLd3zFBq4doRlJc7cyBtjXU/EJIsPBVZebyZkIJ6IYATjpU5:2oGcJiD4ISc3ztJtYMjBjX6IjTjSJvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770960427, "uuid": "db948952-a8d8-49ce-8a64-0391ad9aef7d", "value": 844638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770960427, "uuid": "5799ae35-37d8-409e-aae1-cc017b69c94c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770960427, "uuid": "55353f21-f54f-443d-a85a-3320f67aa138", "value": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u043f\u043b\u0430\u0442\u044b \u0438 \u043a\u0432\u0438\u0442\u0430\u043d\u0446\u0438\u044f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab12513-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999416, "uuid": "925c2a3a-154d-4df0-a816-ee467e4a2078", "comment": "Malware payload", "value": "2806aa20c8e9629595b6c09698fe3b50", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999416, "uuid": "71cbbcb5-0763-49e8-9d36-63ef1e51c5ce", "comment": "Malware payload", "value": "67b5e6e1626f154d7756c39f33f4e1a3e23ebf6bb1a2f27dba52d8865aac0bbe", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999416, "uuid": "3e287688-f224-4e4c-a5ed-3b478e626b91", "comment": "Malware payload", "value": "dd3c32038302db70ca4ca1805308f0646a6569af", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999416, "uuid": "87839cec-2e28-4075-b13f-c18a4ef19748", "comment": "Malware payload", "value": "ab2e3a5b0f58fd42267530c4e22606de307380fe05d1f9d5795a5e597d89cc2a616530eddea61caba3d5f549474b17e0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999416, "uuid": "9a00c1c4-554b-4774-b5f9-73f0ee41c419", "value": "T157762331FA422C6AC6948732B03F2F353E7E7607048EA9C1D59CD287BB569D7263E845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999416, "uuid": "8c7ee882-d85f-4abe-8e19-4ee9989b542c", "value": "49152:yha9lujCKEhGlcr5y48ZKZbKN8QBQuMWRgAUU4Rkyrbb9lYGWCAmWO0Qh+ykpvDX:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999416, "uuid": "48d20b5d-7f7c-4b17-896f-be3f88dd57b7", "value": 7737344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999416, "uuid": "51ee64c0-f78a-499d-8f5f-e47f3bca5635", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999416, "uuid": "c56349ce-fcc3-43e5-9ef1-56d362aec315", "value": "Cobr_6795VQUJT6GRI83830-De.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4616a2a5-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973155, "uuid": "b25fff19-c99e-4319-a9a0-cbbdfb1d3dbc", "comment": "Malware payload (Mirai)", "value": "29180e39b3d6cb1eb8ef38615a6aa569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973155, "uuid": "4bb0a6ca-4292-485c-9b77-7c0dda49c0dd", "comment": "Malware payload (Mirai)", "value": "685491a2a67aec0c5bb8730cedadd38e258efe39d18ca17cb17cbb7be0c0c610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973155, "uuid": "f6282ad0-6657-4ef9-adf9-022f0493dd56", "comment": "Malware payload (Mirai)", "value": "a32bfa9f486b41251fb4a5d008300ad3eed9f14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973155, "uuid": "e02f5ac6-9a42-4a68-acbf-65021538ff6c", "comment": "Malware payload (Mirai)", "value": "4f25ce201808449eb20242ca1b5b6582eae9f1d5d029c8989f4a833edd5b4057a0071f6a077c7dbfcae972ce28d9fdae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973155, "uuid": "af166e38-cd11-430d-b884-0d89173462cc", "value": "T1C4F30A87FD01DFBBF80BA3B604A308157530FBB609525A73721379AAED391C51527E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973155, "uuid": "771505fb-7564-43a6-b983-7c4ff3035f69", "value": "3072:BWkMCfIb48szKSjfF9FVOl4Q/nV4jbi/L70hwYy8sci:MkMCfPKSjfFLV/Q/3Liy8Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973155, "uuid": "7166ab7f-cc86-4c7f-a370-70462ee0b9df", "value": 158436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973155, "uuid": "7e609c4f-df2f-43c5-8a56-d6cc3ebc1996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973155, "uuid": "2ea9c751-829f-4c90-8d0c-8638fc50cdd9", "value": "sys_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce679967-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026642, "uuid": "a86399fc-3732-4d35-bda3-9d1942a133e3", "comment": "Malware payload (Mirai)", "value": "1f27a9a65f0adb70195376b44077b29c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026642, "uuid": "a942ba1b-ee85-483f-a5e5-eb7d36bf24e4", "comment": "Malware payload (Mirai)", "value": "6904fe055ecbc779432c226c2828bfe3d25cb77f08600a0a0304015bf20bbc8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026642, "uuid": "604a7493-9396-4d9a-b97f-5ffaaa3d95b7", "comment": "Malware payload (Mirai)", "value": "4935dac32f4d478bf618b42e758fca7e5962d2e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026642, "uuid": "0c96b268-df37-45de-9be0-f7560d35683d", "comment": "Malware payload (Mirai)", "value": "0223328aab79ea38434bc139f8470a6bd2444fae3f44d0d2bcce4fd96202d69495a671bcb41acaf2a83458ae69611ef1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026642, "uuid": "ba152f4a-b4fa-47d9-8b33-ae4f1c3809e0", "value": "T1F503E1F4929245F1C6B120B6ED34CB493A7F4678C1EDFA6B56540BCD1F82912CFA8682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026642, "uuid": "903fbce6-ec91-4a8f-9535-2695f6f67d6b", "value": "768:1GKGbEfXYXslw06RvmQSX6fM5M+PtgWRbIu1cFE9q3UELnd:7GQfoXXRvSpi+PHRbIuCjLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026642, "uuid": "a7b0194f-6803-46bf-8f2e-3b43687ed3eb", "value": 38460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026642, "uuid": "6daac109-4abe-45fd-bffb-f00175fd570a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026642, "uuid": "10ebe692-1829-466d-b1e2-7007fac21023", "value": "amsarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d5a6b5-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014578, "uuid": "68123548-f203-4e52-b0c8-a96af226dcbf", "comment": "Malware payload (Mirai)", "value": "8e2b6377569db704a3bbc64df261f8d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014578, "uuid": "2a0f55f0-610c-41f8-b922-6cc00d7b0851", "comment": "Malware payload (Mirai)", "value": "6998d4787d9ca45249930a20dfd99dadb5c9ea0475d298940d1eae5d94eaf253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014578, "uuid": "240e875f-06ee-4599-b11e-83dda4584071", "comment": "Malware payload (Mirai)", "value": "639ce7b8951cbac67f0611df4987d1e0c16de6c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014578, "uuid": "02103ade-97d6-448d-9875-b100a08bf489", "comment": "Malware payload (Mirai)", "value": "b6d8786467daa15ade0fa1fe38949aa214878aaf3e7b12f19a80ad32164f8a3029799f8dfdeeecbf30df827ac96261db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014578, "uuid": "6ccf5918-feba-4539-a992-b9599815ad7b", "value": "T1E4835A0375C0C0FCC899C17557AFA236C873B07E1239B15A67D8EE16BD8DE602E6A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014578, "uuid": "2af9255b-10ef-4cd9-99ff-018185e3b0e5", "value": "1536:RsT6CjWT9kcxTtKM7G1tmg1f4M1YV3c47Rz9YxxE3Y23N0:udjWTZxTtZL4B1YV3cAz9YxEt3N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014578, "uuid": "ff51d585-3992-478f-8d27-0c48e2bb0bf2", "value": 85696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014578, "uuid": "acef08a1-8665-4b1a-85f1-acb457a92421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014578, "uuid": "9f8c8a1c-4d48-40ad-8951-ff5bbd091791", "value": "Calix.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cb7d49-0877-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770944571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944571, "uuid": "e2591d40-9e96-43b3-99b0-0b5b65bec8dc", "comment": "Malware payload (GoProxy)", "value": "674e1c0abfc6f92785ce8964a02c1768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944571, "uuid": "9aeadcbe-8b57-459b-9695-485bc65ba9bf", "comment": "Malware payload (GoProxy)", "value": "6a0568759075b0a354ff21e0e0be2282bdf59c34ec61d3d91718c87507b0fbd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944571, "uuid": "ff312c20-5176-4355-9997-0c2bd2640b30", "comment": "Malware payload (GoProxy)", "value": "33d923dafece1e595b8e21c6802c321acf173574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770944571, "uuid": "bb16ab51-f63b-47fa-b64c-af06fdcb7899", "comment": "Malware payload (GoProxy)", "value": "826234ce76a907070b125ca170b1f383432d659e5522b6e06c2dcb593d07b454ce35a8317d3dc35ef29b155d67cf7273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944571, "uuid": "a2b9b067-19dc-40d9-bd34-243ca4eb0b6c", "value": "T137A64B1115F8BAAAC83D927F841729C1F9B8344CF236F6937D4CC6F9DB5648016EAE84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944571, "uuid": "1098dfa1-95e1-4566-9f1f-f8b5a11ed29f", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944571, "uuid": "e9fb16ad-8a9f-42c4-b5fe-4571ed1096fa", "value": "98304:X567rQNEoYadKEtqgEMogL06HI5TSriCDWQLRrUiJA720cUfa:JGriEoYa1lYglHI5TIiCDWQRAiJ620c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770944571, "uuid": "47e49ece-3b4d-404d-b289-62db47646a7d", "value": 9576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770944571, "uuid": "fac18414-4463-431c-a771-71fc0ba5cda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770944571, "uuid": "f5abe30b-ed2b-409b-813e-87e7c591d4aa", "value": "SecuriteInfo.com.Win64.MalwareX-gen.76331715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788beab0-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011465, "uuid": "a916c6de-adc0-4cdd-871a-e27a038e53f3", "comment": "Malware payload (Mirai)", "value": "a8724d896eaff2295796d01e2467f67d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011465, "uuid": "65c953d2-0096-4550-9db4-45f071748e4e", "comment": "Malware payload (Mirai)", "value": "6a4a4ff5e91d56f57a023946759ec24cf3e6a6024401d9b459acf92aaec00e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011465, "uuid": "e76a86b5-ae21-4249-9553-07396e66b7bc", "comment": "Malware payload (Mirai)", "value": "f008992d3f297e4e3e5614b4294ac9ab00453b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011465, "uuid": "0039b263-87c2-4574-8b53-b7156df380e4", "comment": "Malware payload (Mirai)", "value": "2e4183f0678e7cd17fb68ac0c633c690c30c0fd23199ade11842e237cb8c7c4d47510a553acb72c3b43106816717677b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011465, "uuid": "8ede8181-3347-48cc-9f93-7b6b017277eb", "value": "T1A6E34B46EB408B13C4D61776BADF42453323AB5493EB73069928BFB43F8679E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011465, "uuid": "e2cd7304-0e75-43e2-8a9f-5bcc2367cad6", "value": "3072:YVIGeXHWSjaJOtnAhWowMEKbry5q5S03fWwZM/9mlsaz4:cILbjaJOtnAwowKUwd3fWeM/9az4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011465, "uuid": "5852397a-1eb5-47d2-9881-a6d1e19134c0", "value": 148238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011465, "uuid": "1e3fb7e3-f79a-4fa7-b982-357a7eb3c1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011465, "uuid": "24a1dff9-bbe8-40e4-97ff-e2dcacdeb8f1", "value": "boota.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee2be2e-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011449, "uuid": "f36f98ac-3897-4f2d-b705-233815eb9916", "comment": "Malware payload (Gafgyt)", "value": "4c5a7be674be8ec71ac929aa44a5d6f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011449, "uuid": "59d3f83a-cdc1-41dc-8a5c-25df1c57d346", "comment": "Malware payload (Gafgyt)", "value": "6a949a70a145f68826b61df4dfdf88276fe6776c1c4f6a9434b8f830d4d7b1aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011449, "uuid": "4327c15a-18fc-4fcc-93db-9cff2ca98966", "comment": "Malware payload (Gafgyt)", "value": "33e2e78fc7fe08539af5bb22220d1b31e358b76e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011449, "uuid": "223a34fd-a8cf-4696-a950-63705527bbc6", "comment": "Malware payload (Gafgyt)", "value": "a29d34a45091a9f35cdb0dc0011d1267935b70096b4c0ed978b3b1f4f2d33fd6d455383b139efe22c664635819c51a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011449, "uuid": "25859b12-9e03-4d2f-97b3-bb4527ea071f", "value": "T1E4443B15E4404F57C6C217B9BA5E465D3B331BA5A3DB33019E38AEB42FC27AE1A3C524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011449, "uuid": "71b8651b-6592-4805-8ce1-eb3f09de4362", "value": "6144:IiTKBjkX6BnihaSC7oMFBC65hBC6on4FeDmW3HwAZSjKOUmtf:IimZkXA+a1sMFz5hBvFeDmW3HwAYjKOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011449, "uuid": "aae55d42-a68f-46f6-80bc-b530a5669744", "value": 278606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011449, "uuid": "30596512-6c25-42ea-823d-c28d366f26a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011449, "uuid": "f73c3d9a-6121-450b-95ee-c0c289616493", "value": "dicknet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4358fcb1-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973151, "uuid": "c70e3944-a1b6-45c8-a55c-6448661432cf", "comment": "Malware payload (Mirai)", "value": "d5909e7e2a5b9043fda47dfcf54506a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973151, "uuid": "cb8fa94f-b24e-49d0-9326-116d6d65821f", "comment": "Malware payload (Mirai)", "value": "6b73478a81f19df21712c87324cdf11ecbea814224bb78543e2775873510e84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973151, "uuid": "9fb75697-b8ea-451a-a8cd-f11c8dafa881", "comment": "Malware payload (Mirai)", "value": "ca53ddf35b56efa1317af412ea8a460f8a55e843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973151, "uuid": "cf916e81-333c-42fa-85d0-a2762cb0666b", "comment": "Malware payload (Mirai)", "value": "42dd1b9c3bb7bb4e5301909368649f7438c3cab22fa5a9b07345c363aee37127918ad47d74307bf63eb34533a3a7e42f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973151, "uuid": "14decddf-f2a9-454e-876a-d99f60c9c12f", "value": "T1AC630264ED35AF52C71E4F3C1A37493DED43499F4C73231D8D68690A26974C6BB08987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973151, "uuid": "dd64d0cb-f694-4a6c-ade4-0fe7b7486ff4", "value": "1536:gtxhdIjwcCaH87nz1uHs8r7bCX/5JJuz7+PH1BsZo:gAtZH87puHs8r7oJJGO1Bsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973151, "uuid": "ea84037d-4198-4ba9-bf8c-d0b9871c2d41", "value": 69340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973151, "uuid": "12400684-e762-4bd7-92a7-6e169840ef71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973151, "uuid": "46b6d43b-a79b-40a8-9b1f-9342c6a11dba", "value": "sys_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f9ea37-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014528, "uuid": "afa8c2d5-cde9-4dc4-bc05-836ec03bcd24", "comment": "Malware payload (Mirai)", "value": "aca5a709ec0ae4feaad6f019c4d75cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014528, "uuid": "57a21233-5f44-44b9-b71e-abed0684ebe9", "comment": "Malware payload (Mirai)", "value": "6befd63af5f65e60c03d0ff5a945b4c55b6ac6315d24efcab6f663195a615890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014528, "uuid": "0b8a6031-9864-4100-94eb-4e8159233f37", "comment": "Malware payload (Mirai)", "value": "8bbd18689d6c86d5703933e2213ae5750fa9a9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014528, "uuid": "3ec413ab-1de0-4828-9831-84a7d9045d48", "comment": "Malware payload (Mirai)", "value": "68b46cc69cea687c610e5a0bf0014d171ee729ae7cc5477ad0759ed7a02da48825d782190f2fc3d9b4332b6b92300534", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014528, "uuid": "2bf0c34a-613f-4d23-915a-b1fe9d3afc05", "value": "T1F583BE63C8271D24D04848F0B0A49F3A9B63E115C99B2EF7959AC67AD087EDCF2467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014528, "uuid": "c9e8d750-c8f0-44d4-bab0-e28bd94f130e", "value": "1536:7w+LxZPZhH78p5EbHKzb2+yrqyOCH4vAzypO4:79LxV78p5uqzOrqyOJIWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014528, "uuid": "2c529543-05c8-4ee2-8216-2d4b36d2d51b", "value": 81032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014528, "uuid": "baf82305-60f3-4794-93fe-dfb0048a7b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014528, "uuid": "3f7c4065-1e20-4dab-b374-2454e0ba55d3", "value": "Calix.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b706eb-0925-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771019371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019371, "uuid": "fec20296-7838-4dd4-a7cc-1a724f450fd5", "comment": "Malware payload (ValleyRAT)", "value": "52b1d530011ac73b6777c655468a9792", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019371, "uuid": "6afda6d0-93e8-408f-8bd6-1202ead66fcb", "comment": "Malware payload (ValleyRAT)", "value": "6c1459cc141f2e4fe660b9e78f69ed538ba770f5c03b24e850a27cad81e3402d", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019371, "uuid": "138fd1e1-7c10-4bdb-938f-65b0cb90aefe", "comment": "Malware payload (ValleyRAT)", "value": "681426a66c98858b806294e97c3834e5dd1976ff", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019371, "uuid": "e4aaf189-b3f5-40c2-98bd-0943c37b7cda", "comment": "Malware payload (ValleyRAT)", "value": "1b8de9635588c0476a545cc987b09116314ba57e918019547ffa9ad1c80265d12537851be5aa9b0ee5b929fc0a6be028", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019371, "uuid": "463b9bb6-4619-463f-acbf-cfa1708dabac", "value": "T1CD183321B55AA9B5F62F937FA0A4EF9A40717EE03337D5D753783BA249B058220B1D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019371, "uuid": "8aa87f34-4292-44db-bdea-1c490b7eee93", "value": "1572864:LyGkr0QzP3eLuPLgnqdvCVrUckcWiOZXUaogj7k263ZxeuAQ+XpeQTVG:lkLWLBqpkrWjSg7kX3+Q+QcVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019371, "uuid": "7f739602-a9df-40f7-a7d9-ebaf8a7ffd2c", "value": 87202816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019371, "uuid": "53e60dfa-a150-48a6-af1b-8be740eb93b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019371, "uuid": "d7ff4838-b474-4db4-8e00-7933d4cfd603", "value": "chromasj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fd8fd3-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985424, "uuid": "f09cbd2a-d917-4fee-bddf-a618a254789d", "comment": "Malware payload (Gh0stRAT)", "value": "f3348dd43af2cc87c4dd6eae2b4f228b", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985424, "uuid": "726fae65-85a5-484f-9e13-404ec1d09a7d", "comment": "Malware payload (Gh0stRAT)", "value": "6c29aa8a25e227815053275a343b3fa700b8693e0baba2e851623d9f2509d9ec", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985424, "uuid": "271e68ea-2348-4f7c-92d4-ab17e5e3dca4", "comment": "Malware payload (Gh0stRAT)", "value": "4905efd04b2bf4018e8b1b7d200ca2e79d2dc7f9", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985424, "uuid": "6d344c3e-3f5d-4d5a-b827-7dd1f2b22b76", "comment": "Malware payload (Gh0stRAT)", "value": "8b79105a82876cc3b5fff910f5017f8bd766d08dae8bef8f1a76b9a3fb67c6817393a181ffb7cc0b8562d93cb916fc0a", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985424, "uuid": "b0db9e4b-7fb5-4ac5-85df-3cd0a6387ab2", "value": "T15CD7335138D6CE36D69D4CB6493696B004E93C198B34D8CB40E87C2B86B77C329B7EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985424, "uuid": "0713c542-b651-4776-b903-04a3d214a91a", "value": "1572864:dpGKO9KrNMYMlfIqXuXUQDHomV78QtJimKJpmh5DQCsVwmmalZQyVXGysD:PGtwJMYMdIqXuXjDHomV780JimKJpmvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985424, "uuid": "759cf617-0276-4997-af3a-18cf88c33c5f", "value": 61685760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985424, "uuid": "1a980619-8b70-4aa0-a3f5-de7bebf85007", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985424, "uuid": "d199b1f5-d8c6-4e27-8c50-6d92f18f99ae", "value": "AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e98db6-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986766, "uuid": "94aed461-21f2-48f5-b58f-0c1a32d5859b", "comment": "Malware payload (Mirai)", "value": "c70db0f9d38702320046eb6f3caca58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986766, "uuid": "618206d0-61ed-49a0-9ee5-1b8405003b4f", "comment": "Malware payload (Mirai)", "value": "6d2f821081e49963a740a2cbb9b8618fb8b3c21f8e4838f29c15c7e5dd65f2a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986766, "uuid": "f5ef3501-2318-40ff-b3d7-f24ca6b4f92a", "comment": "Malware payload (Mirai)", "value": "15c0efac1b0008e2dd4a05904b14b3b62439dedc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986766, "uuid": "fa9757e8-63a9-472c-9e16-2cdfa2048f59", "comment": "Malware payload (Mirai)", "value": "262bda4bd611b7883d02e59f01fec2e1c42af2e0cacc0aa7158d80ec509db2f2a966ad7e3ac90879a14defaf57eadba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986766, "uuid": "3a0ad26e-cac7-4a63-af36-1da407a6a2d2", "value": "T16ED2E01CD18800D7CE9DA4B019AB07E52DA41F7A9653EE0B3E58CAE74741BF13676BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986766, "uuid": "dff68384-2b1c-4b27-bcd6-35438263b33a", "value": "768:+b28kcLfhNxydfJWgSfxzxAj25Sely6JgGlzDpbuR1J7:eBj8dfMh61eVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986766, "uuid": "c014cbbe-fb61-4039-8fbe-883a67535a74", "value": 29344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986766, "uuid": "dedfd015-0893-40f8-80b9-3805f061cd8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986766, "uuid": "57a27e54-43cd-4885-9325-2ad22ecccb7d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540dd075-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770971031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971031, "uuid": "16765994-1ea7-4578-841e-f30bc2e1477b", "comment": "Malware payload (PhantomStealer)", "value": "fc78576621a2e5b3753edfed3351a7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971031, "uuid": "cab3d0d9-f588-4ae0-8403-65f5130fb906", "comment": "Malware payload (PhantomStealer)", "value": "6dd7534b85579ac8e5e70cfd206b55dc217db700e2d628af8bd0a6f4cdbd52ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971031, "uuid": "5e5eb62b-f573-4f88-8e75-561b535296f9", "comment": "Malware payload (PhantomStealer)", "value": "8719f8f6cfbf68150d9619264d0126a2d375ef1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971031, "uuid": "4a1b4c35-74b5-4d65-a34c-d189e9f1008f", "comment": "Malware payload (PhantomStealer)", "value": "a914662a59d6d31efbde6f71b9ab50de0a433781ae338e2eae878869c874ae3ff4715ab834576f68ed99bcb2afbdc697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971031, "uuid": "5e0a123d-2bc5-4d72-a471-1ee9d4235655", "value": "T1635512013229899BC0EF5EF8C055D13193B4CE66B14DE3E7ADC9A9EF7482B721621763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971031, "uuid": "758c09a9-2f60-4ead-b3aa-e292a0212c09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971031, "uuid": "0930d9eb-df95-4f0a-8248-5bcc5fe399d7", "value": "24576:EZGghF9tb2tbiM76+ViCcOZntEKRtmDHPxncM/U1tq8JgZ/W:mP6tSwEUtQxcb1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971031, "uuid": "1853921a-11f7-46f5-bdf9-6ee59e6ca8f1", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971031, "uuid": "997fb438-f340-4232-8483-ebdcb6d162bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971031, "uuid": "4a672540-140b-4ec0-aa37-5d284cbd9306", "value": "SecuriteInfo.com.Win32.MalwareX-gen.91327863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7bfa79-0893-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770956394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770956394, "uuid": "f53fe9b2-db74-4efc-a58c-353b51969e02", "comment": "Malware payload", "value": "1f85573e8863dbe7bd4ab0512ca0987f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770956394, "uuid": "14656e01-898d-4df4-b68a-81fd1c5c7d85", "comment": "Malware payload", "value": "6e91f7eae06cace724a242c90324e776276930b017a2140bf18aee8ef58ba620", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770956394, "uuid": "239378f0-35ca-4262-8600-e76cac8b8639", "comment": "Malware payload", "value": "ca7292bd22e821f9468f94b378ebda797cd92a83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770956394, "uuid": "04d1f272-5b39-401d-8283-f063fccc4422", "comment": "Malware payload", "value": "a84c241601479672202db21e6ae3e997a0d3c97da043f3d271684c95bc5802b3011a9eb867c14abb5e92a0c14a51f709", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770956394, "uuid": "26c29a6e-8af6-410f-9ad6-683884a679aa", "value": "T1AB06B7E620C266DDC516C5BB8753FD7F888F78368B1AE8E3A054B2129D26CC43675F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770956394, "uuid": "c1578e3d-ac51-4b28-9af0-fdaffd158873", "value": "9c3350a661ac6a37dbf204bf32eb55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770956394, "uuid": "d16778f8-ed1b-48eb-9e2e-18b5030c2199", "value": "49152:WXu0zni9Dt9HyaUp0VimykT3Vvsx4+boTffd:C3G7oYz3VvsxmXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770956394, "uuid": "a7341a96-3d6b-4b65-989a-1871f54e7722", "value": 3670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770956394, "uuid": "aaeff177-709a-48ab-8a36-145049bce7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770956394, "uuid": "66771fa0-88b4-463f-90d9-88e6a8d02cda", "value": "unpacked_sys.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f7f7f9-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1771001896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001896, "uuid": "f48493a5-afd2-40fb-9b9b-241517003efc", "comment": "Malware payload (LummaStealer)", "value": "33ecce2ecbf87b379433d6ce24433d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001896, "uuid": "2fc00e66-ab84-482b-9715-6a33c3b906e4", "comment": "Malware payload (LummaStealer)", "value": "6f5132da4148dbc96e164188f4d26414676dea38756ef2359d3ce90587f768d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001896, "uuid": "ae984502-d596-4f70-ab25-72a616c30856", "comment": "Malware payload (LummaStealer)", "value": "4920d470a6913d1310a76194aafafcb8620bdc66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001896, "uuid": "b38a5c88-337a-4fe7-8b9f-fc27c25b637f", "comment": "Malware payload (LummaStealer)", "value": "cd0426220be550c7f7cfb9b01a1fe0c93658bbe91dc9b6ba8c91d76a099f91938359036494878ffd80c87481567a5a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001896, "uuid": "d00a520b-07e5-402f-a694-a62beeee0393", "value": "T1F0D5E1F3EABCE4B6F2484871CC906723EC77B8E886848F9539C5A5370C59642FA5F125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001896, "uuid": "c439e9ec-8cf2-4221-a878-125eb69752e6", "value": "a1a36d8a93f9a95dec8c2b6f1b244074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001896, "uuid": "3416522d-83c1-485d-87fc-7d056b8b138b", "value": "49152:HBdTSNwHJF4gll5ZS0ALYgOUW2j8NPSqN1BdqbQe9LZh18WJR:HBdmqpF7lh3+YFUWc+N1Bdq0Ef18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001896, "uuid": "3c8306a2-ce5f-4ea9-bf1f-d1f79198aba4", "value": 2946576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001896, "uuid": "6f68aaa5-6df4-4181-acea-22c5d5794445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001896, "uuid": "d7387244-9fae-4582-96bf-06208aaf4091", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2ceb28-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013302, "uuid": "6a3137d1-0b41-4e78-923c-8a8a6269f50e", "comment": "Malware payload", "value": "72bff72be8645f3363c36d23f8f6f79a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013302, "uuid": "a9a6f153-8c0b-4708-ac36-26566233ad42", "comment": "Malware payload", "value": "6f852e071fffd523b0963de9cc625479733f96638a235411ed4debb2d579181b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013302, "uuid": "5c5000c7-3aba-495a-bfab-681a26b09487", "comment": "Malware payload", "value": "e1a69d56eb16058763a956603724bfeb754dfd6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013302, "uuid": "39f58394-2430-41c0-8c77-044fd1f6bd38", "comment": "Malware payload", "value": "863b2517bf19942542239eab2e6e925593304eadc516895ce757f6cea75855c7851721e02a146ce3daae0a636a8ce710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013302, "uuid": "07141da5-aa66-4e55-bffb-f999cdbcc6ff", "value": "T1ACC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013302, "uuid": "f6237e73-ca02-41bb-8f3c-81ce8dcf1ec8", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1j:fWD76aX9aKTcRQVnoiYq1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013302, "uuid": "537db281-adc2-4096-b7d9-840f3d977c43", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013302, "uuid": "6e1811a7-091e-4c0a-8259-7cf7af65c3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013302, "uuid": "97112b3d-0859-42c1-bfc8-6ee8406883c3", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11183d0-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972556, "uuid": "73d729a1-d098-4b37-b039-641fbe74c484", "comment": "Malware payload (Mirai)", "value": "77cce0f732c079a5eb400f676480cb7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972556, "uuid": "ecc48119-79a0-4333-b073-0cb5d28584b1", "comment": "Malware payload (Mirai)", "value": "701e218c7c650f24a7d4b2dc1f10d3997edcc8547ee884f804db05aabe1f369a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972556, "uuid": "4718528b-3b63-473e-a4c3-af67d1ddd3dd", "comment": "Malware payload (Mirai)", "value": "29231c27a17937d1d1b6a42b1f660081e0625833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972556, "uuid": "9c25f649-e2b3-4687-a8c5-e1a47f878074", "comment": "Malware payload (Mirai)", "value": "ede9c62f648939cf6ac2214eedb0d36a970eb41ad3c578e4dce393ecb7d0969477cf3d98287ba17e994500e6bb02c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972556, "uuid": "02a67c46-2740-40d4-a2e4-bbab488fcd72", "value": "T1F714A71E6E228F7EF768873447B74A30975D23D627E0E644E1ACC2145F2029E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972556, "uuid": "783d22a4-c73b-4b2c-954f-b8ed77f47a15", "value": "3072:BWSJzYszqhbMO4BFhJuRu6bzZM+FXXn6eo:BWSRYsWhb83uBZvXX6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972556, "uuid": "d2ab5449-f38f-445e-8cf4-ddbfed1d2d81", "value": 199368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972556, "uuid": "6a91c3f8-de92-4211-814f-c88d100fe7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972556, "uuid": "d42fd939-695b-4a37-a3a6-aefce4a9761c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f585978-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973144, "uuid": "6bc622c5-eadd-4837-a1ca-a27f780b7bcb", "comment": "Malware payload (Mirai)", "value": "d8cf84fa8ee3987c296d563db63bcceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973144, "uuid": "f58aff42-a15d-4595-a80f-2375f01c27e3", "comment": "Malware payload (Mirai)", "value": "70264b85ffe4dedb9497619c812d5d34196fb49f2c2358587b0224c9dc98fb45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973144, "uuid": "31f77085-efeb-425e-a915-af4f4e6825c7", "comment": "Malware payload (Mirai)", "value": "351cad4502e1993d79994799c92b826fc8843be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973144, "uuid": "966fba1b-9c8f-4576-9063-b8c2c08a122e", "comment": "Malware payload (Mirai)", "value": "7f915d74cd79ae471e4d721443035cbd0785cce7c854f791e246e883a1d3835c0dcdcbf082cb2a07d8c40b9dd4abb27c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973144, "uuid": "a4d852b3-95cd-428b-9448-01271bb4d38c", "value": "T18543025F9A10059DCCE781F5D82D2746EC839236C5D450DDAA90FE5A266CCECBCEB0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973144, "uuid": "8e8bfde3-1c34-4493-8b75-99993d8393dd", "value": "1536:G+xLo+QBXhWtTMHKVRTahhtmt+h1+Am9Y7:GXndhWmHKfKhctBXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973144, "uuid": "c47c86be-dc9a-4941-8d61-f118afe5f5f0", "value": 58068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973144, "uuid": "aa9e7e24-a3b5-4870-9337-3ace01a521eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973144, "uuid": "037ed794-b450-4481-a6b9-697622c1933f", "value": "sys_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea25e4f-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007986, "uuid": "d4881e4b-18d8-4c24-94bb-9ef089678c3d", "comment": "Malware payload (Mirai)", "value": "b9c0fefa351b20c96aef05d0d9ed92bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007986, "uuid": "622eb8ed-ed7a-42ba-ac6c-29d72ca92d1e", "comment": "Malware payload (Mirai)", "value": "702c0550add611f3b021d1abf1cf35179f77fd43f1c010856eac1f5129b0310c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007986, "uuid": "3f9f1b6e-16f0-4a3e-9ed0-4bc3fb79bfa3", "comment": "Malware payload (Mirai)", "value": "55fd0eb9452f7478ad51314b6feac4d5cec74eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007986, "uuid": "64f66a9d-2174-4d8c-9b68-791d141dc579", "comment": "Malware payload (Mirai)", "value": "920618f906d5edd98894d42245707eebb5b4671227a39f0e9eea1c82f835b4073313e57e206b6d542d46a0e724e46baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007986, "uuid": "e644fac7-2938-4d66-b209-f521493b98da", "value": "T12F33F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007986, "uuid": "fc63ab43-28ff-4e42-83ab-39aec05c477a", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1Hg6ct0QkiuVn4P:yHlPZMEcTFZ2A1Hg6y0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007986, "uuid": "f73afbab-af05-4a19-95da-9d38e5aa5a4d", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007986, "uuid": "8d435a39-339b-443a-97fa-6404ad691865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007986, "uuid": "4e5030ff-fcfe-4e4c-9e94-615ad67d3598", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508c05b8-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770971025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971025, "uuid": "2b9a3772-97dc-4485-8382-2984a80ccd48", "comment": "Malware payload (MassLogger)", "value": "87ce7cd9ebc2f932c32b0b7018c36f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971025, "uuid": "03f12998-a4be-47c7-97ab-7f46b1a0282c", "comment": "Malware payload (MassLogger)", "value": "70c4ce6e82ff2211e86387f9948bb2b76bdf3a81f99285b68925b47aff57a71f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971025, "uuid": "0963bdff-3c47-4a64-8f40-2b2f22f7a287", "comment": "Malware payload (MassLogger)", "value": "19e7b898ac02f9e4d7664cf083c1f5485f27f8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971025, "uuid": "3042ec72-d9fe-40f1-b3bc-38eab4698945", "comment": "Malware payload (MassLogger)", "value": "394ac0cff4f2730ddb87e0b4638c1fa0c808fe288921477844817b06430c2a5dd751113b4c3371eb252021b2555d8322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971025, "uuid": "2d26f1e0-da4d-4f73-af69-e6328e286765", "value": "T1FBE4DF1033A48829F4BF9BB56961C1300B72BC1698A2D25D96C978DF3C717D08EFA767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971025, "uuid": "a556bbf7-165b-4c84-b433-29a74871c500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971025, "uuid": "53dbc000-d800-4911-9d5b-06067f39673b", "value": "12288:lAYTRkzkbhhQ/ULkDoMTNlQotBe1Hg2CniY/u6dzlDCZWw9uxfIJ17BsZkCZN:lh4qoULkDoM8oM1Hg2CiWuW9/kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971025, "uuid": "dbfc5361-3cff-46d6-a88e-83c8371b5738", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971025, "uuid": "b6119e2f-3f5a-4314-9b1d-3ed18c6a3d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971025, "uuid": "a4ab77a1-4bd4-430e-b79b-64cf6adc0a53", "value": "SecuriteInfo.com.Win32.MalwareX-gen.27935397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d468d30-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949169, "uuid": "323c8c37-68f1-4d84-8a55-b6b783e0f39e", "comment": "Malware payload (Mirai)", "value": "8a67a05a467b59f23a308df24059868e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949169, "uuid": "2ff02174-6629-4196-926e-9483b7bd5bc5", "comment": "Malware payload (Mirai)", "value": "70dee0156c5eb98d66c3ecdfb0f1af43c421bc26d59660000abf50f537976c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949169, "uuid": "f2d102f3-5cf7-4dc9-bd7c-8cb3ba209c48", "comment": "Malware payload (Mirai)", "value": "0b38a8a9bd003bb71c91ea8d037fa8099b6c92f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949169, "uuid": "8a52f31f-965b-41a9-bef9-9e2f17eb6da1", "comment": "Malware payload (Mirai)", "value": "6300079b51ef9f2154176e3892bd0282a44524d8b75fa90e9b7b97fd18dc69d4d4678c134c9069ac8475efc935df8a0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949169, "uuid": "311b179c-ef4d-4032-b396-4fb06fc279ac", "value": "T1AD534C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949169, "uuid": "18b1f2c7-6fd0-426b-b0a5-c10a544be16b", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6ilG:BET6Rq1gSmQ+LzDIiEbW/ogI9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949169, "uuid": "13f19f10-3154-4122-83ec-4496baf5e0d0", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949169, "uuid": "581c4d0e-2b6c-4976-9348-74bf358da154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949169, "uuid": "1a411724-5248-4c2c-82ab-bf933248f18a", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50b6488-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986763, "uuid": "22cf2c17-5aba-423a-b9a4-d1c44ac85147", "comment": "Malware payload (Mirai)", "value": "36f5d953acca6bae301ac31d477a9ebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986763, "uuid": "d95abb50-d1fd-4355-a956-2c93a5673699", "comment": "Malware payload (Mirai)", "value": "71224ef6789a62b470abdaa75105104e2e4f44ee5f54a9a5b3980d014d140417", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986763, "uuid": "5c81c240-6ae4-46f2-ab52-6b03e0f67bdf", "comment": "Malware payload (Mirai)", "value": "502c04fe1b97b2a959c955ba2a097573c381d44e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986763, "uuid": "d69a606b-4da8-4961-8974-84cc2672c98f", "comment": "Malware payload (Mirai)", "value": "d72d9b74566987e194e170093a7d81ea4bee5378fc3a09dd834bac32859c5c039e058786fb1f13519173ac65902d952c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986763, "uuid": "7e6d96e2-72e1-446c-af20-c2e63a64c99d", "value": "T126B39D9BF6470151C86206F007CB9FDD3E2322918F6B94E7BC5E29799A760CB4A06FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986763, "uuid": "7f9f5cb9-64d3-460e-9978-a5462d8d834e", "value": "1536:IkTKr0ZHIc0AYMyCPwjU/NvDgnnyYfmCiFigAt/LWE:IwK8HIcKqwAVrgnhfmCiFig+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986763, "uuid": "c7993b58-309a-4829-b127-8d665f062300", "value": 116072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986763, "uuid": "bdeb3192-994d-454f-b9c6-530f5b155c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986763, "uuid": "5f081d11-cbbb-4d55-913a-51d2a6b4437f", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a2f319-090f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771009608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009608, "uuid": "06af536c-341c-47f4-9b88-b8e34ebd9677", "comment": "Malware payload", "value": "a25e06768c3c165072f2e1e817d17f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009608, "uuid": "414c539d-8d35-4ccb-919d-69b18656dd3a", "comment": "Malware payload", "value": "717854ed601d7ddbafd97550eb0b1bc019a6439ef86a904e2ef799ef3b991ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009608, "uuid": "0288ae18-5279-4e25-a0bf-7d710e8bae5e", "comment": "Malware payload", "value": "41f749ab966e48558e45250a6ba333b3dd684f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771009608, "uuid": "f16a26d4-63cd-4631-b308-96f8162df121", "comment": "Malware payload", "value": "cb9c4767b28031f7da9325f74f6b3d4a5656ce42a23cd7c1ba6d061db4efb9e523452c790a71f3157f261e936bd3ea66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009608, "uuid": "ccebf236-8edd-43cc-bb84-0740308eb2be", "value": "T156F733E505C10743F4BFB336B766A6D3D2AA7458692384FB2F800BE93E673C54976290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009608, "uuid": "7e2febda-d9b2-4a2a-9db2-c676da0d1ac7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009608, "uuid": "1650961a-6bfa-45e6-b562-9fc2bbf80fb8", "value": "1572864:Sqc01xV7UU2ofFOhaChZnIDoQWwOVUj4ve7kBNygzp0pLR:40tUUnfFO5FIDoQj2lVN0pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771009608, "uuid": "1ea0f82b-96b7-4708-98d6-3275bef11f25", "value": 74202057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771009608, "uuid": "27f37df2-657d-4596-8b33-3cfc745614fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771009608, "uuid": "5225f758-c66a-4e15-8ea6-22cef63dabc5", "value": "VapeV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d184d8f-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (VenomRAT)", "timestamp": 1770970966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970966, "uuid": "f24a5410-4879-41dd-bb96-048e6b73e297", "comment": "Malware payload (VenomRAT)", "value": "8c5dbc16c494e0c522811656e3e871ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970966, "uuid": "3f7c2a66-9c2b-4a14-b016-d9be979718c0", "comment": "Malware payload (VenomRAT)", "value": "7215cbe8e5dfed7b22c8bbe8c5f7f35a7848e545d1cdeb60a378baf0be32cb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970966, "uuid": "15c5a756-c546-4879-aa59-3b16c45d9ff0", "comment": "Malware payload (VenomRAT)", "value": "df5fa23be0e52bc5accbc04bd4612622c339839c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970966, "uuid": "400163ae-2f8b-434d-9dfc-fdf68fe065a5", "comment": "Malware payload (VenomRAT)", "value": "e7445f557554e5a18acb5b3b167ffc0357ed0fea28e4e38f5564f7da3296bbd4495dcabac4ce508dde82d169adece229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970966, "uuid": "a4316e11-a95e-4617-8b64-c4074d6b3141", "value": "T1BFC4DF9C3615F9AFC887C57189A4EE74A6202D6AD30AC11385E71CDFB50DE97EE081E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970966, "uuid": "399e5e8a-7af2-4e71-b73d-64c56e8976b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970966, "uuid": "ff5b0d7d-353e-4454-b27a-e893d48a7fac", "value": "12288:dedYZELpR73pGRFJY+qYEZ7/Wn1cq0xtJqJZVa6M/Z6VU4Sc:dedYSLr30RFJZhau1cRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970966, "uuid": "0a90afd7-cb82-480a-9d90-dc8d21d0a6a4", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970966, "uuid": "fb6d06c1-9654-41ba-8176-f1ded3f12f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970966, "uuid": "05c0422e-3e52-42ea-a283-3922873ed415", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77894243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f93428-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976641, "uuid": "3876b154-5a55-4985-b574-8ecd2cb9ed22", "comment": "Malware payload", "value": "e702ff03e0cec2886b529ece6a159c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976641, "uuid": "989794cd-7e7c-45a3-97a5-6cfce1cf2f11", "comment": "Malware payload", "value": "723ab1d90db9131b76f279d3f10469ceb444f90168ad060fc79179b9ca6970d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976641, "uuid": "303cd093-608d-4d5f-a32b-a133ffaba735", "comment": "Malware payload", "value": "082e6483313c6a04bfee5ea7ff6fda6ba5d93c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976641, "uuid": "267d7aeb-ee41-4e24-986b-1e2cc73cc4f4", "comment": "Malware payload", "value": "3d458660d327ec02fd1bd95ca51d84d9e8a2cf18851af04b73d963622f4755bee87e51e238d3eb147d0ed1a4e80a9343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976641, "uuid": "b289f1e4-c4b2-4823-8c11-36ff1563680a", "value": "T173674B43F8E11E94C4FA8675D139815BBA723C280B3823DB1691F3742F3ABE06A76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976641, "uuid": "2b5cb6be-b1b5-4b63-aa29-f0b23baaa228", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976641, "uuid": "84ca3639-d8ef-4380-8c10-e30290bea0b2", "value": "196608:cRy7uWDonHqf0mZwu3R6rKrY8GZH+VNI6DopmAUXAXqd13gU:cRfAonH9iwDr/8G9+TbAC13gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976641, "uuid": "7aa82274-3bcd-457f-8d2b-4f49ff9da5ad", "value": 32256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976641, "uuid": "259561a4-dcad-4fcd-aa5a-a387afb753ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976641, "uuid": "5a9c4eca-d53a-4df4-9977-57f9d8f34a01", "value": "test_pivot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcbf78f-0926-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1771019826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019826, "uuid": "8d826302-fc4b-4467-8db4-f403f07b6caf", "comment": "Malware payload (CobaltStrike)", "value": "46701fd83363edf18ab0596eb417f9e4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Rozena.YAI!MTB", "colour": "#29E1C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019826, "uuid": "4a1558d0-a005-47ab-b8c3-05de9596b058", "comment": "Malware payload (CobaltStrike)", "value": "72a595ec26cc06436af13953cd4495b0988f6f57a71b239671a22bde49343c49", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Rozena.YAI!MTB", "colour": "#29E1C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019826, "uuid": "e1c42f66-9771-462c-8de2-287556571455", "comment": "Malware payload (CobaltStrike)", "value": "839df29c777f114565d391af291af17d9e7e9325", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Rozena.YAI!MTB", "colour": "#29E1C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019826, "uuid": "facc36b0-727f-4f9b-ab42-2da4b8b69c7a", "comment": "Malware payload (CobaltStrike)", "value": "e6f54b94b187829e3f5937de096ffa5ab8d3ea658e986ff74f375b94a1bef72d7fa1059c1e78ef5ac286a6054a4d51a8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Rozena.YAI!MTB", "colour": "#29E1C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019826, "uuid": "ebb6c209-ce6d-413c-9a16-0080f3c9d2f2", "value": "T1FBC44BEC3686FB5CC2C9C8339D281EE084B015B7AFB747844E65B7BA55CCBE4695281C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019826, "uuid": "e8772e6b-9e1d-4d11-9ad5-3be5159abe96", "value": "900998ffb3f12157e44eef1bede5e79c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019826, "uuid": "9a1661c9-8cbf-4640-a0bf-7d28eedcc820", "value": "6144:5jIDIdjrOv3bkkBjvoHRNgu6Zzog/IPslu1fe4FR+SWbcaIoF56:yCrOvbLjvoH32j//uBHzucabF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019826, "uuid": "38c991cc-d05b-4b42-89d1-7d09a29f69e3", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019826, "uuid": "9b33047d-ddb6-4d39-be78-ebaaabdaf136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019826, "uuid": "5c5f6b73-97be-4ee2-8846-b729e1d6b77c", "value": "shield.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364e378a-090a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771007489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007489, "uuid": "8de47f56-ecfd-4cbe-8f07-66b9d1f9ccde", "comment": "Malware payload", "value": "e680e5c88f79d7f350994cf459a3fe2c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007489, "uuid": "7b53b45a-4f0c-4456-951b-d4c65318ad13", "comment": "Malware payload", "value": "72ba78aeec34bcd1c4181af54255e33f714d4998970839682ab003fc54dcb893", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007489, "uuid": "46462b0d-0ca0-4931-bf71-d1edaa3795d5", "comment": "Malware payload", "value": "fe53207c1fba30e8d398f115175cee4604ab0b2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007489, "uuid": "a949ae20-6c6c-49a5-8164-b7e7e451cd19", "comment": "Malware payload", "value": "40860e2f1353b13a40a4cb9f0cb778dc6713f884160f534206cdfae9cbfbda815f8aa1a1035fe5046b3a703f92ea16bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007489, "uuid": "4ff94732-04b9-4a55-a4f5-498ba7455c90", "value": "T1F51112D5C090F3235ADDEE49F6B18258E499B2856CD12C0A9B965EE50C274943DCBB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007489, "uuid": "115eceff-120a-4e9f-acf1-f3cdb50608ce", "value": "12:klCTJ1AxXaAocTCJAX9G0iT0qdG3X8ZwiTw4ANxXUYFYSTjuw3XU7jPTZmxXU6FJ:kHRYM9/8V4UYFXuwHU7ZmRUWplUpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007489, "uuid": "37135982-d935-499f-99f4-edcfd3a4008d", "value": 965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007489, "uuid": "ca5e2580-b706-4d97-a5f3-8acdf49d2476", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007489, "uuid": "c7cf2ecb-03ee-4757-8eea-8dda27714c51", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f75fb4-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955564, "uuid": "8168203d-92b0-4283-b345-1c927d389007", "comment": "Malware payload (Mirai)", "value": "dbfc415d515b2fa46124881deff05746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955564, "uuid": "9190160f-e523-416a-a1c3-c0c0a77104a4", "comment": "Malware payload (Mirai)", "value": "735bd463534a019a4dc8fbd5895c697746c4c9dc56727c5343fdfd8d1eea4a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955564, "uuid": "117280dd-3e07-44cc-8d61-d9fcfadc5def", "comment": "Malware payload (Mirai)", "value": "cd2e901c0c69e40af31cdeb06a1cb878a7fe97ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955564, "uuid": "2bace4a2-a0b3-4ec0-a090-6678d30be8cb", "comment": "Malware payload (Mirai)", "value": "bfd52f0f2c8a9a8f2f10479deebed9cfe603f739d39f7c27bf893f51bce497288af8df2d92fc57b58d0a67e65e8aed91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955564, "uuid": "96041ca1-edcb-42c5-9e36-d94ef776a4a9", "value": "T116935C42B70C0E47D0676DB02A3F27D1D3EF9EA020E4F684651EBB8591B6E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955564, "uuid": "6ac30daf-d168-4d6e-88d7-7bda8b78b7c0", "value": "1536:9d4pgZNw/TbOr4uWMd3yiAj6DHhWKGt+JxPJzK0ZJa86SQGI+VP1dpO:9dg8cT6eNTtCc0ZZ69Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955564, "uuid": "79b0407a-bb64-4d89-a944-f919d57b58f5", "value": 89584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955564, "uuid": "69dfafe8-4ec2-4864-a5cf-b52a45fab77c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955564, "uuid": "a77ab91e-22f7-4fb4-924d-e6c3f69bea58", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70dd004-091c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771015462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015462, "uuid": "7e251d9d-2b34-4e1c-8898-93d960054c71", "comment": "Malware payload", "value": "ce1b786e82668e5d7d7847936ff6f3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015462, "uuid": "b3805172-8457-4f33-a0ac-06fa6ad06cd4", "comment": "Malware payload", "value": "735f0791e2552d93a3cde270fc626733a466bc6eb5facd9f899e3f23dacd1bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015462, "uuid": "4ebdab3f-1254-4a0d-8927-81c6db0655de", "comment": "Malware payload", "value": "e514337f5f4874d4d162ea5e40b1bf9ddd02bb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015462, "uuid": "138fe6a9-b90e-4c48-9bcb-a8373618f10f", "comment": "Malware payload", "value": "422d4cf3ba61deea1576045cf92980158c7e0f456719741554b99e9a863159da8e5a81cc7565b494f7dbc2c36c5ee249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015462, "uuid": "5d7f1910-ab9b-420a-9b91-7a285128108d", "value": "T1D565925AE63651D5D5BAD1388213A62BFC713C5EC334A3E79B928B171B227E0E53E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015462, "uuid": "a3cd95f9-7794-48d8-b8c9-fff6b5b3c660", "value": "0272fbbe9c77af68526cb30b0364c230", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015462, "uuid": "9c517c13-bda1-4f73-bc91-231cb6016a40", "value": "12288:TEyMyacL+3tcHf3gJbbd229ITuejSi2trO9WfDfJZvpDHQyyGvrXfa:TEA+3+f34blejSdO9WLfJZvGKrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015462, "uuid": "c0db56dd-9ece-44ab-9c9a-10bec23a79f9", "value": 1425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015462, "uuid": "7eda3425-2d0f-48b6-b7ab-a0781dd61908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015462, "uuid": "237c9b22-3e7c-4cdd-a00e-85a90b529520", "value": "SecuriteInfo.com.Win64.MalwareX-gen.46384931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cacfc97-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949115, "uuid": "c54d5e72-3967-4538-ac78-1563e3714d76", "comment": "Malware payload (Mirai)", "value": "6a0aad209ce97884d29bb88f27a5898d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949115, "uuid": "d9d821ce-0b91-4e9d-9101-b1010b584fbb", "comment": "Malware payload (Mirai)", "value": "7392d01b268bc977b4306976135dfbe8d01253e5519e468a5ca2217fcaef2e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949115, "uuid": "b977f640-34ae-43a8-8d1a-5d1fc7352507", "comment": "Malware payload (Mirai)", "value": "a95bc0b8adcb30d3a68ba8d6fbecdd16da960ac7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949115, "uuid": "dea28b6c-1037-453f-9857-78642478b362", "comment": "Malware payload (Mirai)", "value": "efd11b15cd7ecbbf8d09032707b5d1cd2ae156657bb95bd9a48ad219c2d1c64644840a3f95a0df3b4e1c6acc93dd934a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949115, "uuid": "6789bcf6-ba9b-4f5d-866b-4bcb2dce14a9", "value": "T17BC2E1A360B5CE03C4F3837A2A3C59A722605434A34EED2D776A9BC837460D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949115, "uuid": "493bdd15-09a4-4be3-b8f3-d5a2e1f81ed1", "value": "768:u5+Kcrb9VDJee2KTgdTHOBcK5ZCAyXWaf:hlrb9veKTg9QB5V2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949115, "uuid": "7a1cfc40-a3d2-486e-8d47-c8d85050a3da", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949115, "uuid": "21d6fe53-9271-4fc3-aa3e-ced9e902f5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949115, "uuid": "5cd179b3-09c5-4306-bcbc-9172f61b5ac9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e0c9ff-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949125, "uuid": "46a752a8-e0c4-4ec7-bbc1-48385e4395ca", "comment": "Malware payload (Mirai)", "value": "382b3b3091844bd948af6a3e886a023b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949125, "uuid": "ca2b66d6-b5e0-4674-b176-0a4685b36d7e", "comment": "Malware payload (Mirai)", "value": "74af1a6dd10f9b2481ed08b8307469bbabc2f1835327bea5212a40258e7c85e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949125, "uuid": "08ebd949-61bd-4d9f-81d8-c86d38cda836", "comment": "Malware payload (Mirai)", "value": "993437c56b2488787118355da95d1a2e2451d150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949125, "uuid": "73b7c932-7ee9-47a9-9257-55c98011dc7b", "comment": "Malware payload (Mirai)", "value": "e6cb25e3b0f740fb354a3311c940b11a31f16e881cdc63ce2c25b0913756ad81f34a1492879eeab4e1cdc166c5c918ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949125, "uuid": "38a0d36c-95b0-4799-90a0-cc9c423f798a", "value": "T184C2D0732AEF38B1C2A424B6FC7C8BC7625F4BB965F16521765016A1CDE100352BA8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949125, "uuid": "afdecbc2-0b3e-40e4-91d5-1a5abe6c4535", "value": "768:ijKX9vt6GqA3Q0jzV7EUyUq9aE+s3UozY:ijqtBqoB7EUBOjzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949125, "uuid": "f4dbc650-49d3-4623-9deb-1aac4ee47812", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949125, "uuid": "01337d92-1f4b-4542-bf32-13b6e9b99b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949125, "uuid": "e96bdd69-0284-49b9-aaf1-2eafe55f2711", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39071a8f-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973133, "uuid": "6fd6e891-f9aa-44d4-bcfb-9d9e96917304", "comment": "Malware payload (Mirai)", "value": "ba0375c2878ade6812b5fde84ebceb33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973133, "uuid": "1e13c2ae-5700-408b-a857-e47d692bc7eb", "comment": "Malware payload (Mirai)", "value": "7572d8549a6e9282a59254f319bda9f39cfb985fa2b60ded16272ee7637fe1cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973133, "uuid": "3a9b477f-e9c7-417e-9a7c-6c0b3711cc0e", "comment": "Malware payload (Mirai)", "value": "0c5c68087fbf57387c2552fe4754f5bd9e601537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973133, "uuid": "8c4e16cf-193b-4f5a-a5ed-d1dc0de415e6", "comment": "Malware payload (Mirai)", "value": "9fb655bd955f9641d2b5901c485123c1afbfd6fbe98846a3f1436c2e27c6d44508af515abafbcfaf91f0b31591d4e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973133, "uuid": "75de531e-9ccc-4075-9b63-fc80742e553b", "value": "T1FC23F1DA5F53B543E4439233642C21A4BC7EBEA84989E0CEA654E98859B65C1133F293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973133, "uuid": "e9ca9990-b32a-443f-a3cc-9ebdf8f90569", "value": "768:KMRcHy0zqEX9i1tpypAFgh4qZffD4U85MF7ailnjuzrQZIe4FDvqM+em/ituc++K:KSInGAihin5fk5MLnwrQWvqMRmKtuc+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973133, "uuid": "1a8acd1a-fdec-4e5c-a5d5-d2e69b26c5cb", "value": 48408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973133, "uuid": "365ecbf9-dd22-45ae-95ae-67e565e858f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973133, "uuid": "8ace1ef3-e918-4c07-bdf0-ca07ce3de0fd", "value": "sys_armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f431b814-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986762, "uuid": "7c52294c-dd6a-4bd8-9d64-b65c4ba25a5f", "comment": "Malware payload (Mirai)", "value": "a511c93b27b927b5a4c42b33a168531a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986762, "uuid": "aaea495a-1a9b-4932-9d6e-95661d91d287", "comment": "Malware payload (Mirai)", "value": "76c1c46fb3cb0f6290f18733efe542946033cdbda8650329095acb48064b8778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986762, "uuid": "b979214b-5087-436d-a8b1-4363315dc844", "comment": "Malware payload (Mirai)", "value": "e550f885a7e46fc5e84ab81dec6190fd2deaaafa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986762, "uuid": "59d8fb37-678b-4a8a-9fb2-5337b9ac84aa", "comment": "Malware payload (Mirai)", "value": "66b1db5639d368e8b650bda1a664a3ea3e19195c6dc968a5c7aa83056ecdaeb73fa7ba0f8364382345d58581e4e882b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986762, "uuid": "6e1aa6c1-0afd-455e-83eb-3c9e234f0157", "value": "T10A33F119710E7DE6F8A86A73E5741E01F75D68F8CAED3A53081143AC8DD906C27A32C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986762, "uuid": "ece2b1d1-5553-4926-b915-510aa7469825", "value": "768:Hh+esWAui5dpOd1kR93BDtQ8K7Pzh+VZqqYH9q3UELENIJwpShfzbji6rN7uPKF:B+esOdm3x+9P9MZqqbLWAwp4fvjnqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986762, "uuid": "e1d40fc2-5277-4b62-b771-b90a52478696", "value": 51660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986762, "uuid": "8c81d3d3-1a25-4108-9842-55d8d785a226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986762, "uuid": "719addb0-1c1e-47b9-84a9-c817d2d3c063", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf364a8-0898-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770958696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958696, "uuid": "71311454-31bc-4884-a21e-db279ba47770", "comment": "Malware payload", "value": "205f8de0627b8c7c342cb78943730e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qt6]", "colour": "#225E8E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958696, "uuid": "123bd650-ece4-4b5b-92ba-dfcd7ab6ce64", "comment": "Malware payload", "value": "76d4142469fe6f8d1743fee5a3a38de3dc9ffe243f89479b99e90172005d5b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qt6]", "colour": "#225E8E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958696, "uuid": "ed78c1bd-448e-4eca-a47d-13ebd16a52bd", "comment": "Malware payload", "value": "8932d3c1cfee568f6961e0fe9b226aad56c3d93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qt6]", "colour": "#225E8E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958696, "uuid": "9d784183-0eea-4490-babe-f561baded1fc", "comment": "Malware payload", "value": "fe15b183103a86f43bff0e71c1a1ef1089fed0a4d772a638c184ce63697279b99211a99673bd9f988b7a9268f1782e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qt6]", "colour": "#225E8E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958696, "uuid": "6079ccbf-aea1-41a9-8b49-986b83df648f", "value": "T1F2F7CF9BA2A500A8C07BC07DCA67D517FBB134091334AAEB06B586965F33BF0697F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958696, "uuid": "74a5bbba-0b4d-405f-a467-efd1cfc8e105", "value": "197f18741a64eb7f5b248794520b56c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958696, "uuid": "095797ef-1196-4d73-a461-1b0e1959b074", "value": "786432:JSmU1TIhoASrJBqSxX9lr+0n3TQlIyH4W8FHBqEYSlQN7aKZfMuBAZnkM3o:JTUNgoAS9Rtlr+U3MxZ8dBZQN7fBqP3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770958696, "uuid": "8ee71202-d81b-4d94-87b3-c9b865622ecd", "value": 76962968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770958696, "uuid": "99827eff-d0d8-4760-a02c-f7e8feb2b210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958696, "uuid": "c86eb8e0-207c-4f70-8c98-7b4e16b3cace", "value": "5.13dasd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c07ef6-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995086, "uuid": "e7ad0f54-1225-40ef-a6bb-dd33db49a329", "comment": "Malware payload (SSHdKit)", "value": "25f857a13eaec470f4f8d48acffd7e4c", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995086, "uuid": "2ba64afe-027e-457c-8048-3f89129e63dc", "comment": "Malware payload (SSHdKit)", "value": "7716157437f31f91b6579a5f9b1090bc98149045b939f66c6d65d60f260e4cf6", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995086, "uuid": "dbf8b01a-67dd-43c7-ad91-5127e1b77f4c", "comment": "Malware payload (SSHdKit)", "value": "efdd6f9e6e599f439b8b3b58da095cdb83088648", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995086, "uuid": "69f51316-1025-487b-821d-17d8903a699a", "comment": "Malware payload (SSHdKit)", "value": "ccc31950cab8df0a88ab2f38e2a4be500b8bfa344aa775b08fd6171a87ea483f7c23496cc57cdcec9e45f09a69fd7757", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995086, "uuid": "cf003660-c72a-45c4-9574-5af2eed2bdd6", "value": "T123D76C51FA908B73C1C03779B6DF034C7366CA75C7D92106B90D96383FA769B4A3AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995086, "uuid": "13a28b1f-808c-49df-8436-1b98d937fe74", "value": "196608:/frWSxdmYu5sCwO6cJzGkioLPw/aBHTNTktRXTukMOWedw6XaZDRvoZ:y5wix9Tw/qTGfOO5zXuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995086, "uuid": "e1d9fb8b-9509-40e7-b5f9-7226649b44cf", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995086, "uuid": "6af0a471-3b91-444a-b96f-8b62ce3c05bd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995086, "uuid": "f0867cf3-2adc-44a7-bd83-4b25718ad0e7", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d39fbb-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770975458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975458, "uuid": "84ea6da7-1533-4d08-912a-f11b28187dd8", "comment": "Malware payload", "value": "0226da281e516cd169c5c3cfd2c0380f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975458, "uuid": "77185850-7c7e-419f-b5f3-bb3b2c09bb14", "comment": "Malware payload", "value": "77713446b55d716f103ec94b6d76f636b9a34b5138d5aae8a37fefb05592ff3a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975458, "uuid": "48c063da-0ae0-49f7-8c9a-86b1fc49fccb", "comment": "Malware payload", "value": "ae6dc08a4d50108b454d7ff8487d342296c141da", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975458, "uuid": "9b53dad4-a4db-4cad-8685-0a01175a1aa7", "comment": "Malware payload", "value": "d2d4020aeb52ee584d5e4419697ad05c16d30301dfe1f889a36d149f0039e223091ddd95756655dd56b52d9b3de31e28", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975458, "uuid": "249e4552-e237-42aa-9850-a6add0925c78", "value": "T145D1B5227A4190CDDB74C7F9E8C3A101FD7944BF5136360972E8C6042FB2B2B8B8A09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975458, "uuid": "af50f8ed-9ee1-4f87-a694-8d1ebfa1f6ea", "value": "96:gWYvUsWINlDGWPCiOxK/UumH+3kve5FUo9CfRxQDxrgp5AG4A5MsLqVF:Q1dNlDTJOkLNkv2Oo9maZ25AGNMsLqVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975458, "uuid": "e1b9d3aa-d348-4b75-9b09-726573058d2e", "value": 6500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975458, "uuid": "fb05cbd3-f1d9-4641-a67c-df40bfab3e54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975458, "uuid": "074b9613-30ce-4730-ab8d-a16afc17a926", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca64739-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985112, "uuid": "18b8445d-d6c4-42c2-9a95-142730fb6065", "comment": "Malware payload", "value": "baa07bcdfa04917c629eb1c5dbadf54f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985112, "uuid": "9fa5b40e-1779-4511-b876-107e352af8e4", "comment": "Malware payload", "value": "778b5a936b1b35c70f652594ac06e44cbeb340adccb60db13f6f8e78c4eb1293", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985112, "uuid": "644e90ea-7d61-47ba-8b2d-a4a642edf19a", "comment": "Malware payload", "value": "ab8485868aab6eadc9bed59cd7177566a6ccee62", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985112, "uuid": "236fa814-d435-4d8f-b07c-7f24e391be96", "comment": "Malware payload", "value": "0b4a3a826b87ce00c94ec08b04ab5dafc439073c3dd0e0b4af5f2af82a85a31d50711d676003724d1c93b9eaf3d34650", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985112, "uuid": "337f7819-7b32-48bf-94e9-9ae16819e379", "value": "T132966C53B2C8653DC85A0A3A2837A654583FBF7125138E3A67F4084DCE3DD496E39E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985112, "uuid": "a54191b6-10b6-4497-a55d-230efef8391d", "value": "83bb430ac47307b3c50daf6740fc0ef6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985112, "uuid": "a64d6e23-a327-4a3d-86f2-79a76fc1f240", "value": "98304:UkqGFGOlj7V8HNDgVC5vKONz/sAtRf3Us8:GGFv7quGvrz/7Pf3B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985112, "uuid": "0e8187f1-e3c1-4c40-aafa-3c118020e54b", "value": 9036904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985112, "uuid": "6f18b999-0fd6-408e-9f38-aaacece19af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985112, "uuid": "528dc17c-b436-4ed9-85ea-87954109c384", "value": "dugout.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6526930-08e6-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770992215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992215, "uuid": "dd94237d-1451-4889-8d37-0054c2da671d", "comment": "Malware payload (RemcosRAT)", "value": "95deb666cc7ba8424165eb78fd10bc31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992215, "uuid": "626ab2c6-ecf7-41ba-aeb4-8fd3fc47e3bd", "comment": "Malware payload (RemcosRAT)", "value": "77940063fcd0f276c574ea55967eb0834939e8d201922be88ffc53309351a3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992215, "uuid": "ef0d7b70-e35f-4010-b722-c63434705ffc", "comment": "Malware payload (RemcosRAT)", "value": "1d085654fa214327a774241069bbf768882c88e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992215, "uuid": "deff1aef-4024-463c-b1be-c974e95972ed", "comment": "Malware payload (RemcosRAT)", "value": "58f895fd26a3b5982c2c82607e37125b5abbdd2ad26624b83e1c0e6e0f7bd65b0c0d16ea0f56c7e8849b445cb514e255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992215, "uuid": "468e95bc-bc67-40ed-ad4d-44f120c6ff91", "value": "T16A540101B3E4C827DA6116309EB7D372A7B5BD712A5A9B0B33D47F1D3DB23D09A09291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992215, "uuid": "a9967b31-7a73-4ce9-99e3-1f32aece56a4", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992215, "uuid": "6a677c73-c485-401b-a95f-b32a30bd1e61", "value": "6144:F+MvoJXYsbLSRDCUXtZE41qVowcXp/xpfc74TJz3TsxvmnSgDKC:F+FHbLS8UX/p1ERa/xpJ1DsxOnSgWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770992215, "uuid": "4d9216ec-ea56-43fc-944e-ed649d344bd1", "value": 301759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770992215, "uuid": "59e5499a-68c7-4b2e-9378-af9edf382714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992215, "uuid": "b0c22375-a5ae-4e5e-97f8-3d37d968fa04", "value": "Payment Confirmation_INV-2026-0147.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d7736f-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985745, "uuid": "ade90b82-747f-451c-af0a-45f7c251b668", "comment": "Malware payload", "value": "559492d4c5057f3f0962f3b6b24def83", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985745, "uuid": "bb2a5458-e2f3-4862-a4ac-59b17d109f88", "comment": "Malware payload", "value": "77d58900406d8550cc5e794043f85730087b58cd67ff71ba1bdf788055de1783", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985745, "uuid": "9b804a94-ffb3-48ea-b616-f43bc260c114", "comment": "Malware payload", "value": "81a0cf8dbd75347f428d31a0c508fd87ac01aca2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985745, "uuid": "5b684c68-cc4e-4e53-8cf2-3596fbb74e51", "comment": "Malware payload", "value": "1fefde2b384e8fe12aa2f06b08d589df3519e2baae868c62fa29dc80ffd40c113b3c2b33e72b36979e03c14b7383a9cd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985745, "uuid": "90f6c921-a19b-4dc3-8657-87c3f46a272d", "value": "T1EB66020137C6C63BCA7F457169B9D76A10BF7AA01FB989DB53D84A2B0EB10C24271F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985745, "uuid": "d1b439d9-16a4-43b9-9b04-5c55dc06f79e", "value": "98304:MqZYq9A2BqwOSiqU67Q6+3XCVpeyAdIqPLqd7cNbr/kQB:jFZ66UCV4yUPG2br/NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985745, "uuid": "6e14b925-0939-45f7-b2d9-bb826018b5c0", "value": 6781440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985745, "uuid": "97f78d0e-fdb8-4569-b7ba-6f12aabea789", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985745, "uuid": "4ae1abd3-0e88-4bb2-b03d-76115a1d5a80", "value": "53ea5c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d765635-08c0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975637, "uuid": "fda236c9-36b7-4dac-bc77-a6128ca5a164", "comment": "Malware payload (Mirai)", "value": "cfa25cd0f051aad6839da4665c98e87b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975637, "uuid": "415f7339-2355-4ae4-8975-6af07c018c5d", "comment": "Malware payload (Mirai)", "value": "788a8d6c0a06ee6685ae2f6f8462291f17b0d04ffe7abf726731848017712ce2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975637, "uuid": "bd2268b7-d5a7-4bc8-b1f7-96f2ea4e6471", "comment": "Malware payload (Mirai)", "value": "8924545d0cdb9c43aab8b32789f5380916461a8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975637, "uuid": "bcf40d3a-7c5e-485d-91c4-4b491f81cd3f", "comment": "Malware payload (Mirai)", "value": "424e4ef99b6df0162d7b47803b048e22c8f64a9594dbb5f4fecad6cdbea7673e8697a45a0fafe7a7ab11982762e94640", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975637, "uuid": "a6be3ad1-5756-4f20-bdcb-ae1ebb82c675", "value": "T19E642339A74F81CCE7DBA47CB2E31999CC16111BB5940CA70F047BE7E905B197BAE118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975637, "uuid": "16bbef7d-d134-4396-8543-f03ef113bd17", "value": "6144:WRwvrFaytrPKDsxXekmqVQqyp4GmoSxhntbkgT:iURJ5ysdeVkQHXS72gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975637, "uuid": "8f05bf17-0754-4d39-a4b8-7fe3e573db3b", "value": 317452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975637, "uuid": "e16a4c18-a97f-4ec3-be79-e428b3e9215c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975637, "uuid": "52b4b14d-5f5f-4580-9018-6b41c8c9a509", "value": "game.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccfdec3-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026639, "uuid": "0e065b3d-b358-45c0-bc0a-96837d54172c", "comment": "Malware payload (Mirai)", "value": "ffb43918843057af8b9cc2b6adf0b13b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026639, "uuid": "c1e40109-2756-4d63-a9ac-3dcbff8ed997", "comment": "Malware payload (Mirai)", "value": "7a34277edccea9192113ec46e4ea7d1fd6029188ca56dae949c507ef9e87f42a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026639, "uuid": "9b533579-7a90-41f9-ac43-b98040de768a", "comment": "Malware payload (Mirai)", "value": "02129fd638273f41b244143a2277369d516e7fd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026639, "uuid": "8ec20d6e-1143-489f-b1f0-f1bedfd3f09c", "comment": "Malware payload (Mirai)", "value": "123cfe21a4e7fd2b8e04ffbb6d766d773d68fbad17c184153d02214d3c7090c184fa8f3a75b08dd6cc07b642d7324160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026639, "uuid": "0549678a-fac9-4c64-a063-0f91858f92e8", "value": "T1BDF2E09C41414799F86AE5FC0BC1CF821AB907718103E42BB55AEADBD94E2F27C63C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026639, "uuid": "c2cb9368-5ce9-4dee-a71f-f75fb4a742bb", "value": "768:2/FmChH94I+c2FAe8Tup0dGFkUxHU9JOa3uwAV0WWkFftr9JJgGlzDpbuR1J9D:2Nm67Djbup0dGrH2JtXFQN1VJuXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026639, "uuid": "52593351-6015-4338-9326-c2f65fe7ea19", "value": 37368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026639, "uuid": "a0aeb71f-16b4-418a-af3f-a050e2265732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026639, "uuid": "6f479971-0a16-4489-b073-8917e8244b3b", "value": "amsmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2a26f1-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971020, "uuid": "de557b5e-def4-4c55-97c6-a3db0406191b", "comment": "Malware payload", "value": "63c36c7e24be443872171b9b181bcf3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971020, "uuid": "e4fe2313-1a5b-4b14-aec4-e79f83376a9d", "comment": "Malware payload", "value": "7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971020, "uuid": "b7eb5f12-691a-459f-91c6-d3cd2227e2ad", "comment": "Malware payload", "value": "e04bde4ed318d91b585880f776369f426f8cd42e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971020, "uuid": "d39acb78-fb34-43f7-9721-91cdcc426771", "comment": "Malware payload", "value": "e1a08fc4d73a2c0fc25cea45a1dd5b434dc8b132a2e9963e54b0fafac1fbe4fbbf5074335a1296787a66403dfc1fdee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971020, "uuid": "71ca675f-f8b4-45c8-8b2b-cd678f1b8276", "value": "T1A125230EEB7DBE11CF5F9777D6239901C0E645A36469F4AE0AC51CE328368DD8B8B814", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971020, "uuid": "76c62737-c16e-4bfd-bd02-9ae6be68dc95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971020, "uuid": "0643d3a3-7c61-45b7-99d1-1e0f9d51a42b", "value": "12288:NhnzRCOuNcY9BHP3tqgXOyhfWXzj25KgYTV6g9nhBpFW1qRgfi3gKJvxs8AlHiyX:f8OwHBHP3tl+BzC4gYFhBDWu2SJ2ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971020, "uuid": "5d868f7b-753d-4db4-94e2-fbab2c721ad6", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971020, "uuid": "8fdf20b4-7c73-41b0-b6a6-91287ad469af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971020, "uuid": "a69db69c-7439-4a88-9e26-3aa1546b0316", "value": "SecuriteInfo.com.Variant.Genie.8DN.1477.1915.7798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6576ae61-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974067, "uuid": "4ed572f7-3d3a-473b-977a-eca447c823b6", "comment": "Malware payload (Mirai)", "value": "4e064e38fe4189c684ea8c43dacaf27f", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974067, "uuid": "5ad201a5-d26a-4a6c-a8a0-7e3f83957c9f", "comment": "Malware payload (Mirai)", "value": "7b62f190b8237a49f2f40adc11de24b48d462a0dce77850ae282d234b2e3d254", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974067, "uuid": "564fddc1-1f61-431f-af24-f9e75781b30b", "comment": "Malware payload (Mirai)", "value": "4f23389962234207df9692bad325c69aa1a45057", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974067, "uuid": "f56e0e45-1248-43db-b964-11c2c8b5e357", "comment": "Malware payload (Mirai)", "value": "1eb59558abd871f0eee792aca875466d485ae27f3cf1fc3f2533d7f995889468f49f0296f5b337338363dee3f37ed2be", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974067, "uuid": "b076a755-f8ad-4892-9911-faf732f19483", "value": "T1BBB44A55F8809FA2C6C12976F64D46AC33174779C3EBB2068A245B343BE786B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974067, "uuid": "cd26edf8-8dc2-4160-a119-fb9d05b8d6ed", "value": "12288:3EDOoh1MT0/jhwBoGtbGIODcKYgF9gpjrft:3EKr0LhEoGtF9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974067, "uuid": "90073cf3-c7a2-4f8a-8ae6-582dd320e070", "value": 508784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974067, "uuid": "2e593008-2bc7-4e1b-b883-25f1a81263aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974067, "uuid": "b52953c7-b5eb-4548-b734-6b00d40f5882", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b2cd19-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007917, "uuid": "24fb4a41-0e64-4682-b384-458625e40018", "comment": "Malware payload (Mirai)", "value": "2f685edcd1416a73e8697948c18d946a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007917, "uuid": "3c7a88ee-ac17-4097-8b92-fceb37f39fee", "comment": "Malware payload (Mirai)", "value": "7b672d8b605c88c329726e52463b851812dface2eaf2061997c9a216234a51d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007917, "uuid": "d84537d1-836c-4d08-bf8b-16616b9f609d", "comment": "Malware payload (Mirai)", "value": "2077e1c53d121e44ce21b4dc3231031582a22b60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007917, "uuid": "8359d8cc-0c1c-4a0b-b3ea-be013ebea19f", "comment": "Malware payload (Mirai)", "value": "afdb59a8fe3dce064fa368cbbcc8a8579e7c67470a491b4f9c16e58a9431d283a34533e2c62c433c515d549707b2ee09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007917, "uuid": "fe03ade9-e9fe-48ea-80c0-0ddf083083b1", "value": "T148330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007917, "uuid": "947bc69c-ad80-41d6-b359-9a8f79eb2596", "value": "768:gduPBFnHooqR8qOCKq2hH4Fje+TK806MMUVjzMfQXOtHud2oG3:r/hqaJFcjeqK806MHdMfQXoHuC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007917, "uuid": "42cff032-e438-4e6c-a97a-c2ad0d9461d7", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007917, "uuid": "8080b0f2-e1c2-4a9a-8fb2-bea79ecbe87a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007917, "uuid": "e8c49533-c2ab-483d-a0e1-349ab923ec3a", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cb7a9e-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985588, "uuid": "c518ae58-4352-4b89-927d-c502113491eb", "comment": "Malware payload (Gh0stRAT)", "value": "988df9acfd40f9c29aba31b2b1a48358", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985588, "uuid": "746f32d8-5971-4a6b-bb9c-22eb11411680", "comment": "Malware payload (Gh0stRAT)", "value": "7bd44d5e4bc65fd651752b5c7c7b4c85bbb3928972f1006efeb326aeaef9aeb1", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985588, "uuid": "d79f9c7b-5a4b-42a7-92ee-c197262c9a4a", "comment": "Malware payload (Gh0stRAT)", "value": "355b0934acadd476cf66f6b34ffb0c85e761713c", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985588, "uuid": "a4e2f904-c2c7-416a-a23a-22ddeeed0366", "comment": "Malware payload (Gh0stRAT)", "value": "ccee789967123585cdbf2f51f08f1ab217b105b3b93d87321161dab0f004f28f64bbc7a710383efb4b6aebe69380bd61", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985588, "uuid": "ce00d060-2929-4da9-887b-f9f466c5bde2", "value": "T1E3F6231233C6C13ADA7F89315974DB2910BF7AA05F7888EB53D8592F4EB14C24672F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985588, "uuid": "d0bb0038-dc4d-4832-883d-538add3f4324", "value": "393216:xB9HWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/F:xbHWrTOjnO9KrNMJ+Mu0oX2q4lji0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985588, "uuid": "e61f964d-094f-4c9d-ac4b-1141a1a67941", "value": 15409664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985588, "uuid": "180f0ee6-a317-4b88-9a21-6820d2a5865d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985588, "uuid": "60e2b944-0c78-413a-89d4-c1ca3029abc9", "value": "6b4221.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ba52a5-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974047, "uuid": "5dcdfa35-da71-42c8-bd4b-bda122ef43bd", "comment": "Malware payload (Mirai)", "value": "97675edf5492ebaea89a4fc4bcf34ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974047, "uuid": "2a75cd98-12e8-47dd-b4d2-1f24342b6b4d", "comment": "Malware payload (Mirai)", "value": "7bff004834bf658d972865cee0dc12935aea4b33169c1d583d9b8915bcf0f18e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974047, "uuid": "7e37b430-7edd-4187-bd8f-b0788b83b35c", "comment": "Malware payload (Mirai)", "value": "d104006d6f4b107e73591f6645139b9aa7720473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974047, "uuid": "f6b1812e-5865-4833-b198-5413750b8ffc", "comment": "Malware payload (Mirai)", "value": "6c8d6140e587207d324d711b432e54aed8ab13b51570725889fe44dbe7929d4da2a6e09e6cd46da727c4af06ca77d87f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974047, "uuid": "993efa75-da5b-496c-ad75-461f81e39378", "value": "T11DD45B01EF841FEBC4AFCE30852E834B14ED989742D1A77861FC8D5CBA9D2594BE7498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974047, "uuid": "bb15f81d-6832-4326-a1d4-1a65cf4a40ee", "value": "12288:haDVwMTpok8/IbCoZAodQVrleAW8ahBukDcvjmFe1bbRIXfOdq70BEwlbdLgc5EW:JMTpokfRfiDCGiJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974047, "uuid": "443605a6-334a-46bb-aeb8-b4e82e52474b", "value": 597936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974047, "uuid": "719f9a1a-0da8-4dce-8828-0b16042f86da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974047, "uuid": "7c41e98d-ed17-4f51-bb9c-0c759ff6d9a2", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b518996-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973137, "uuid": "a29ee964-ac7c-4e90-8159-9fe498dcd15a", "comment": "Malware payload (Mirai)", "value": "f3f0961b4be2d6d7157359a78b3a7f4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973137, "uuid": "f9054e3c-42c3-42c3-8d8d-76b525640fe1", "comment": "Malware payload (Mirai)", "value": "7c9fd5b9c57e12b5333a96d896c7aa844612ba9c319349dada108caac08464c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973137, "uuid": "86629a0d-e734-4f5f-b7fc-8d882c7cb8b4", "comment": "Malware payload (Mirai)", "value": "6c3a0bd2ca21f63fa04e65e184044f273c3904d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973137, "uuid": "d6832c40-0842-4efe-a5e7-ed145c5c5796", "comment": "Malware payload (Mirai)", "value": "ea3ea23781d2e8dc082aaab9cd9825c11ef1ec900752b23705a3fda52b29432360d1d889a3d32a52d4ef6d194819b65a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973137, "uuid": "0a5dbb2b-682f-472a-aedb-936c39c2ab7e", "value": "T14503F15E112586A6D58E767E38C8C1FB2EB20A3C5181432D2F588B988DD3115BBFD6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973137, "uuid": "631751b8-10be-4c94-be13-7d769da263c5", "value": "768:8RdwEJY5sH1yIUraWgNms4FvnctZu1s5+fM5xP0rwqa+TIJTkGbmWXdf:8RdwEJbRUrmNKFfcS1sIaP6w2TE4GbmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973137, "uuid": "7acd5513-a6e5-4055-85ab-dc4682316fa3", "value": 38680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973137, "uuid": "399e98fe-7eab-43a6-9e43-7884f7c90384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973137, "uuid": "27a5329f-4f15-4002-bd70-01f546b77bfe", "value": "sys_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c925d303-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010312, "uuid": "d316e049-5dc6-4954-ad66-4a4266d5c57b", "comment": "Malware payload (Mirai)", "value": "5802208d6e04f161764bd942a94d979f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010312, "uuid": "3f4cbd31-fd8e-4ac6-ac0b-87e9c9732e65", "comment": "Malware payload (Mirai)", "value": "7cbef6a904e18d877b59bf3d46e2d08e6eabb10342cb656a533e599321a5d2f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010312, "uuid": "1533c0d1-a1b3-4134-b0a4-b0751c2db7ee", "comment": "Malware payload (Mirai)", "value": "54ab8915ed052ebecd82168863bba47151e50001", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010312, "uuid": "ffccbc60-1bf6-448d-bf0e-2e627162114f", "comment": "Malware payload (Mirai)", "value": "def64ab50d95fb73ef6a4ddbb673d3814d8f7bf8a33757e7d5a35988209372d3c9a8b5c771745084920cf11ee052c23e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010312, "uuid": "2f3e4a55-0a64-4fd5-bcfe-c8317df902c8", "value": "T11D33F907F84281FDC556C17407BBBA3AE83671EE133CB6A777E4BB262842E614D09C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010312, "uuid": "59b9102e-db81-4258-ad12-69909c02b925", "value": "768:Wu6t/kgKLN5aKlVPTKVv1XWFPWCX2IABTvT0FCAiT0OTuD9sHngg:et/kgoN5aKlVLGv1mFPWmAr0YgOTuDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010312, "uuid": "bf6a0e56-03a3-43d8-b248-982427016e86", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010312, "uuid": "d4d98775-6d14-4973-9db6-5186eda43267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010312, "uuid": "7f6fd764-cbef-4b98-b69d-5e21dc461446", "value": "SecuriteInfo.com.Linux.Mirai.9816.24514.10409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8047bce-0914-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1771012082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012082, "uuid": "59e14188-4381-483b-8c69-89aa2b5a02d0", "comment": "Malware payload (NetSupport)", "value": "aebb9fc09538a76a652b496b1af763c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012082, "uuid": "2f7f86b5-f2d1-4e8c-935b-29843e6d628f", "comment": "Malware payload (NetSupport)", "value": "7ce751500e39727ad51617bdcb3b0a9f56bf3b8fe8bdf05b8940d9484c08da1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012082, "uuid": "3f67d4d6-8c30-4b4d-996f-dd3a64540a27", "comment": "Malware payload (NetSupport)", "value": "13b8b2110bd94c52341122b0c2157c1b9c9d484a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012082, "uuid": "dabe9cd4-7f1d-4c16-a0c1-ffc47ff29395", "comment": "Malware payload (NetSupport)", "value": "6589c80fc13777dd7a0c4263b56200e074ca26be80cd0f43726a2caea2293d5c5f9800bf23c948fc068692dc9ed5edbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012082, "uuid": "e2b28b28-4732-4ad4-8bf5-5d65caf9b8e6", "value": "T172D66A649B84974EAEAE194BE07C662F76F33F61D49272FC16633703256FC086639C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012082, "uuid": "0d0bc540-bb37-4626-8943-e7de9a21e60a", "value": "49152:JQMhy0MXQaRCo6B9RM/pSNCf+78hYwaRdduFfIM3YrRIjCp+Cir14ssDV:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771012082, "uuid": "58740b83-c5e4-4fae-9921-61e4878cacbc", "value": 13264649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771012082, "uuid": "bc584bb5-555d-4305-8663-9c724dec322c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012082, "uuid": "64af5922-7a36-4801-a259-5071735aff96", "value": "netsupport.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f0d5a5-08a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770963730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963730, "uuid": "f0c703c7-a4c0-43d3-b720-ddd211702b47", "comment": "Malware payload", "value": "7b64208e56baf5066faf85039275f85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963730, "uuid": "9b45142d-fa32-42cb-8827-d1fb570ebfc7", "comment": "Malware payload", "value": "7ce7dd2c8f694f2dd4f5571e8e294508cc81aa0f04fdcfaded9c1a27c44895f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963730, "uuid": "48774ebb-24ba-454f-8d12-d905d4bab02f", "comment": "Malware payload", "value": "28e29c31c8c0c0f9e08cfba96bb82beddbcb70c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963730, "uuid": "cc197ee7-a2b1-4319-a920-eebf398c77f5", "comment": "Malware payload", "value": "ae688574be44fff58c4e6e55106b5d6f863e38cd409339b0ee0d3b0b3936b1bacc2fa662f3a0547f57959ab3de376027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963730, "uuid": "3c7e9ccd-8b53-4b75-b23a-023eabcd8797", "value": "T19EA4DE609608B6DAC85811F7A4E67B4C581AEE0471D41CC67DCF32BA6E38BE1EED7D40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963730, "uuid": "b5d6431c-a949-47f8-a0c7-44f568b5877f", "value": "9cb9dff2cc09de0470e97faa96d810c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963730, "uuid": "a37a1534-eca7-450c-b26f-36039320ce37", "value": "12288:iAFJZiohwKLF+m+C53zWoiXm0nmSQOgmH86:iAPZzpP53zhiW02J8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963730, "uuid": "5c731e54-4f94-4d05-bcfe-460e959e8f87", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963730, "uuid": "ca907b1f-c6c1-408e-a3c4-accc5ba7cdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963730, "uuid": "3bb5326d-aee2-4fc1-91a7-6e27c2642369", "value": "SecuriteInfo.com.Variant.Fragtor.483665.982.24477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffcc101-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013303, "uuid": "5fa6f4dc-ba71-4a9c-a7d9-b511d2335240", "comment": "Malware payload", "value": "f962812ddeef823e094d748a773fb4c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013303, "uuid": "e5e98ace-e2f7-4a1a-8f80-f11ea47276c6", "comment": "Malware payload", "value": "7d1be3ac979c5f88ec13e7782e6a5024e193b8d18e7c9ba534032f588e298ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013303, "uuid": "1ea4833d-de76-4be1-9a4e-42d333f62e7f", "comment": "Malware payload", "value": "d522ed32bf1d48280db19c73b599f0fef8a1d393", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013303, "uuid": "c8206521-c420-414f-93b0-045cac821d3d", "comment": "Malware payload", "value": "f1599eed4b893c48a786c8c98234c2de566aebb21d327e6661f0a9808e50a656506c1a809d02f80ac8f5e5ae7eebb0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013303, "uuid": "fa6ea946-01ad-48a2-877a-81e6d4af7c2a", "value": "T153333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013303, "uuid": "6cd739d3-fb16-4208-9a00-0389747ed25e", "value": "768:twzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98SN+s:twdt3SpOzwLMU431ANA0BLBCGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013303, "uuid": "0d8715b7-1dd9-4261-ba2d-d477f5a6c00f", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013303, "uuid": "50adb20c-aa35-4fe3-8416-6140ad719e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013303, "uuid": "47bebcd9-bb12-49c2-ae59-40094c8f6faa", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e8b958-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770971014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971014, "uuid": "3a994bd0-c773-4fd8-8217-ea7592c857a3", "comment": "Malware payload (MassLogger)", "value": "a4cdb53c251aa35859c33d748bd57644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971014, "uuid": "d8339dd4-9c17-471f-8fe8-fb65937afc5e", "comment": "Malware payload (MassLogger)", "value": "7d354d35cf821e03dba4b665613ebf89970567e649f311f218131c05f61f4035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971014, "uuid": "a6d20642-2a3c-4a5d-b379-d686093c6bd2", "comment": "Malware payload (MassLogger)", "value": "0007888d17466ddfad82404e16c986ae80571eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971014, "uuid": "3272007b-c3ea-42f3-a5a5-6457c0963e4b", "comment": "Malware payload (MassLogger)", "value": "97cb6a19fc118bea48dd8e5c4e9f7f850ae6b2c42de9a263f61a425b659bf573c18c68fa8f4b907f77d0b883c5cd097d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971014, "uuid": "deaccc0b-0ed7-4d6a-9445-4a69c07eef04", "value": "T116D4EF623754D84BC05A06B02912F3F077B1AC937850FD8A2EE62E8F39A4FD55AD6743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971014, "uuid": "e82f706a-5b5e-482b-bcc7-54da5f3f2d39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971014, "uuid": "b83aae3a-e83b-4eec-96db-06c139206812", "value": "12288:QeNlZKeU0mfsBTaqvQpaUR1NfFy7aO+rFw5:QgNaqvQnNy7at6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971014, "uuid": "c8f76265-d589-48ee-92f4-a51f789f2a8f", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971014, "uuid": "889fd322-5fbe-4d92-aeb2-3dffb069ccba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971014, "uuid": "6f6a2257-c030-4a51-bab1-11f3dedb7b3d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.99878185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b66416-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976537, "uuid": "9170bb32-8b59-4df7-a61d-e0aaa19af413", "comment": "Malware payload", "value": "d6785ab53a439cb3c675cb887658ec53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976537, "uuid": "36877515-6e5c-4d4a-abb8-ed6536686f80", "comment": "Malware payload", "value": "7d7c26b459f01a5db8ffac1ccf083b89f8a2921e91c36dc2e57ae40f07732158", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976537, "uuid": "7afbefa9-8853-4bfc-9849-27838ae2b5f3", "comment": "Malware payload", "value": "7257b276ae051d82a4a376d3a81c54bafe93e654", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976537, "uuid": "9fbca786-80be-4665-9499-4812db5ae707", "comment": "Malware payload", "value": "3958d761bd2750651bc938fa0924b005b737105dfaf16b77b9916c8ff88a8ed35edf1bea7c822fa4d1a1cb630268bffb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976537, "uuid": "03010b75-2e0d-414b-bcd3-1e7263b088b9", "value": "T1EC522A49234812E9DA3A83BE90718E49E46EF0149275AF7F43B4C57AAF42E53252DFC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976537, "uuid": "24703488-af68-4eb9-ab9c-6f739ac6aa9f", "value": "d7ced86d4b3ee8f8be3740467ef2fad7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976537, "uuid": "dddac4ce-e613-44af-96a4-3a4d2dbafee9", "value": "192:hIjcRLv1My+l67Syr2WthukTKTS8CfbI+zchhAGRQfSda0:h0cRLdMyftbTKTZCfLz8C4Qqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976537, "uuid": "48778139-c315-4f98-ab13-d9e45d1f3eaa", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976537, "uuid": "8ef81b18-452e-4881-807f-0aef5d40134b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976537, "uuid": "ae84820a-1d56-490e-be1e-2e4dae383564", "value": "EdgeGdi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37439905-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973130, "uuid": "3709f291-d6c0-48b1-8a18-4c7f4a73d905", "comment": "Malware payload (Mirai)", "value": "9cd9e69d3ad3182788616067446eea1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973130, "uuid": "430e60aa-4ab0-43a4-82c8-489a237a5233", "comment": "Malware payload (Mirai)", "value": "7f27acb3c4c21ec2e4faefe69f550cb5e9152e28c8ca7bfc31c0e017755c54f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973130, "uuid": "91d6fcdf-46dc-4625-b833-6fe1ca790a3e", "comment": "Malware payload (Mirai)", "value": "df3f30b62a0c291fcdf3c0d820f459e06d53b037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973130, "uuid": "71160e3b-534b-483e-abe5-968c93b982e8", "comment": "Malware payload (Mirai)", "value": "da621ca34d21fdbb7c24e2126df6a6adbb7b6f3937b9130fbe2d3c24bcde840001c8bb9ea5411a73e4f1cd9f1d170676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973130, "uuid": "93082d95-a298-4039-a8f0-68740c06ce53", "value": "T12CF2023EA4F58837CEA6FA3C3DDBA0199087B00090FDD3B5A734DA5590E716073911B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973130, "uuid": "e99ce017-66a6-4f55-8b55-6ec3f6471d59", "value": "768:rdzAsQAgJzF6ZF4q+5+SKxrYqIwEaemYcJh5rDa:rdMsczF0F4N5U+qThYcxrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973130, "uuid": "8e790d30-d3cf-4101-a057-1158f0496467", "value": 37484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973130, "uuid": "7f755212-21b8-4895-8612-fcfbdaee8c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973130, "uuid": "b86387fa-dc0a-4e2a-b1d6-61006dada709", "value": "sys_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8539c6b-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025719, "uuid": "27cd36dd-dd8b-4870-8a7a-d1ecd3ecb4b4", "comment": "Malware payload", "value": "84b88896d7ed66739771b594391ea810", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025719, "uuid": "6aacd472-3544-47d3-a2f5-0a4b611c5f1e", "comment": "Malware payload", "value": "7fb0de47e740ebfb8f23f48dd2a0cacf8c93d9f59a33fff79da39d9cfb100e25", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025719, "uuid": "0df97aa5-1e05-41e2-aafe-c5f23a515c82", "comment": "Malware payload", "value": "fb0cc6511cf6cf2d25c32d4ad3e525871d513bc6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025719, "uuid": "4641f0fd-fd01-4ef5-a41a-8d3495fb6ac0", "comment": "Malware payload", "value": "97c2f29041f17e863d0e0547c97696cccc5cc9845d435d9f5e1e05d51d961fba19178de63175f248c1b3db8ac54b6937", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025719, "uuid": "26bc6316-adf9-4629-8718-25c755ba1eba", "value": "T1BA362332B8811CABC7448771316B2E211FBDA613478CA5D3B9DCA6923F47AC1D93F5A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025719, "uuid": "d99fe9e9-33cf-45e7-8dc6-2ea43bf8aea5", "value": "49152:YPRqTfGCFbxdN9D5zhkwKPl+6BwhDvWrEqEACv9CiCvABWbZVE/OuWoalgqE:qdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025719, "uuid": "48b3feef-baba-46f0-ba3f-6c35da20c539", "value": 5294080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025719, "uuid": "0468b543-f5c8-4789-a857-436b896da7fe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025719, "uuid": "68936b58-53e6-4523-bca1-d20235d2e745", "value": "NmclRP20YN00149_FZEOD.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5383d42-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025767, "uuid": "38570aac-8d75-4565-a856-6c3ab3e72c18", "comment": "Malware payload", "value": "1be47e30859241282509242ac3040628", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025767, "uuid": "1772e57f-c347-4b53-bd06-b6e89ed0949e", "comment": "Malware payload", "value": "80345c7ea70ce41ca48337ae1ce1c1a84c13277fc517195132af0aec9be47cb4", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025767, "uuid": "c9e899d7-b01d-46d1-9cb8-820b149cda3f", "comment": "Malware payload", "value": "1a700e9146d430f6dad10ad97f91ac3645ccf261", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025767, "uuid": "1839987a-b88a-4671-9287-f559f275d62c", "comment": "Malware payload", "value": "9448f0c869f36ae82646e5f4b9a713103fee59534726a5ca3882fe4fdbf5def7c9c3ee3b1091faccf63bf8d4a820f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025767, "uuid": "4843ae66-b59d-49ea-87e2-f7529e532b9d", "value": "T12F362333AA804C7BC4B08378B46B7A352F3E7213458D54F675ACD9462B8FBE0A56F095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025767, "uuid": "3715092b-9545-42f4-b386-451d4942c0bd", "value": "49152:LbTSruF0qrsMLqhy3A0uRCeRmRVlsNLTY4hEj65+5zajUXNsu2Aucp3:uBcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025767, "uuid": "2e0038f5-e160-4465-954d-650eeb01cef2", "value": 4995072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025767, "uuid": "26db723f-edaf-43ed-8f5a-f52f7f058540", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025767, "uuid": "abd9d305-e427-4a0a-bfe6-5b55be13ed70", "value": "NVGNDB56933_Hm-L982PO61300jzhxsv.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19647eb-0917-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013306, "uuid": "2b291a9b-3573-43bb-a027-b2f16bfe281c", "comment": "Malware payload (Mirai)", "value": "49a0f0185eed39eb0bf7c42ff7896272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013306, "uuid": "57546012-71ee-4233-b331-2f208f4c87ab", "comment": "Malware payload (Mirai)", "value": "80e89d82ca5652a3787d3b7b77db08992f0985b114bb019c26a95f38a8fe0ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013306, "uuid": "37947bcd-bf09-414a-9311-cab297928fd8", "comment": "Malware payload (Mirai)", "value": "57c0bbae1d881a0ac30034b594afa2c9e206a249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013306, "uuid": "4ba49dcc-c16e-4a65-834b-cbf81beb76fb", "comment": "Malware payload (Mirai)", "value": "80fef81eda976ac676f76aac8c22b811f22cb4110cfd90c11d7f4a926e018e8d90b3e8d8e264e114f407a6c7665e33f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013306, "uuid": "f330d200-cded-440f-be24-6e952a2b5ac0", "value": "T1F4B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013306, "uuid": "65cf1db6-98c7-47b7-9633-100463ea74c9", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvT:AixnUHz4Z+5ypkn3E8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013306, "uuid": "e62b7620-3ce1-408b-b072-29e1d3b8589d", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013306, "uuid": "d12a4e15-1f2d-4693-80af-b3459722074f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013306, "uuid": "26f2fa63-7414-477b-b048-971f44796908", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df40f03b-0872-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770942489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770942489, "uuid": "d3bf68f2-9638-40ea-b8f8-423b1a2f2858", "comment": "Malware payload (Mirai)", "value": "b82cabceb5acdfd10f121b7cd2633fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770942489, "uuid": "464c1c6c-bc57-4b14-ad7d-cc4fb205dde6", "comment": "Malware payload (Mirai)", "value": "80e9bb11f1d581b6c3159eccdec1dc66b203677588d0e31790196eb3ef049ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770942489, "uuid": "9aececbc-8ab0-4499-912a-6bcaf7b4f940", "comment": "Malware payload (Mirai)", "value": "e8641b388c061baa1f55c53a56860082854882b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770942489, "uuid": "c5ba0bb8-942a-4863-8bf9-1d146cc1cbe5", "comment": "Malware payload (Mirai)", "value": "50fe2bfe4971dcf2c0f599fe8fdd647af55502783ec49e59395962109970de9d8e1cf6dbf7bc2c9fe09db0a40ed632bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770942489, "uuid": "849aacc4-71ef-47e1-be1c-0107c3322f8f", "value": "T1FBA3299ABC85C302C6E071B6FB1F51DD371643A8E3E6B107CD19AB29674B8970E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770942489, "uuid": "4628ebfb-b238-427e-a08a-acdc2890a72b", "value": "3072:sdagyt8oJaLfva+TOs2k1LO3wCW52s+Ek0X:yFytzILFT9Ln+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770942489, "uuid": "be6937eb-0fc3-4f54-a018-bfda5af3db79", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770942489, "uuid": "d2155ab2-39c1-404b-a770-120b7470581e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770942489, "uuid": "f8f954f0-6e31-4ff1-bb6c-b1d2299b75bb", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f069fb41-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986755, "uuid": "a494ac98-fce0-42ea-880d-78388cb93ebc", "comment": "Malware payload (Mirai)", "value": "6ce89601935e584aff584c4f77a77558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986755, "uuid": "c8ac878c-e194-4861-bcff-3369261ce112", "comment": "Malware payload (Mirai)", "value": "818d02d3b669fc62bd36e35e158c562cea5d1b4d3f86514176931975d0960b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986755, "uuid": "dd2803ad-4518-480b-8cd2-aa3b664bf34f", "comment": "Malware payload (Mirai)", "value": "9381c0fe4783b0c9fb043c9f4fff2f0c4f777e20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986755, "uuid": "924e98c0-1782-4080-a9f1-80aa0a899e68", "comment": "Malware payload (Mirai)", "value": "e8cd1d4087221c3691feb1e67a719c551c3482ec835f0c3bba4e481246a9bca88bb07f63875f576c376c811fd29b0e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986755, "uuid": "3d8c6e28-a3d2-4628-b197-17e1075e8f43", "value": "T186C2E171860544F3C6A1887BD638D9E761538BB580F930B33C281AAC15835BFE5B97DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986755, "uuid": "283f9112-c2d7-42d7-b78e-c8b133100b34", "value": "768:CBffkPqPchxUdDCIbSyx/uZOdtdUOC10s3UozQ:yffkPqPchxUcIecmOtxC7zQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986755, "uuid": "b1af2bc4-4a6b-4a44-8b73-b62a24dcf6ba", "value": 27196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986755, "uuid": "618c4ba3-7a60-43b3-84cd-b5604e5c06c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986755, "uuid": "03d25b1d-90f0-46a1-84bd-eca140e968e2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d87c13-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999346, "uuid": "74110390-d00d-4cba-93b5-9619adc87a6a", "comment": "Malware payload", "value": "60e41f16b88971d05ad11f58c6bdefad", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999346, "uuid": "3d75309e-4bc0-4609-98a6-2914a9830616", "comment": "Malware payload", "value": "824220acf6342be516f0ab6ec8d62690193b6c05761d153b97871c24ed6f027f", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999346, "uuid": "8b0af7ad-dbef-4f75-8f6e-0a71882afe4f", "comment": "Malware payload", "value": "6167e466cc23d2f6f960b243c9040ac4138350d5", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999346, "uuid": "73a63599-11e6-4304-ad56-2b548240eddf", "comment": "Malware payload", "value": "d5c212ec302c284e76475673d9663a98ed515afc208e2ab01b52f19807e25ae60a9b89773769c2ea07a48adea6ddb2f6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999346, "uuid": "9ffc1d01-0bef-4993-a2cc-dc26b665a10a", "value": "T1B2362334BB513957C0908B7AB43F3A356D7D36070BCDD2E1B96CA252AB03EDA427DA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999346, "uuid": "e38fc911-ac53-4c71-b506-1c469055cca2", "value": "49152:HM9pUSjoySr96NQ7jbKgR+jReEYTf+sfjR7hrW1KwrYJhE4YzZGKyWft:VKyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999346, "uuid": "d28aa04d-4343-4753-8567-53ab4470eeeb", "value": 5099520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999346, "uuid": "b7f53f8f-3224-488f-8edc-7961030be8c3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999346, "uuid": "4377e7d1-69f3-4ab6-a0b2-680eec9e6ac1", "value": "CKPGCn-1ZFID951570_Autr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6dfdc3-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949119, "uuid": "511e1b25-ae70-41ea-afab-af59cfda8a85", "comment": "Malware payload (Mirai)", "value": "5e571090b819bc3f26669d06cbd48d70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949119, "uuid": "3a2a9001-e5ee-46d7-802a-9ad475c8b93d", "comment": "Malware payload (Mirai)", "value": "82d6acfe50ce5d563ac9ce83a0977e7715b378051113e29e5898e58221b4ef03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949119, "uuid": "1a16ef87-7e30-4671-8346-128c8c8d80da", "comment": "Malware payload (Mirai)", "value": "2826b8ba98f6ce53d5e201bcc142851617357f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949119, "uuid": "37ec4e2c-4323-4aed-a2b4-009ad098efef", "comment": "Malware payload (Mirai)", "value": "d89e111e9278a1b0477234c7baed1e4d6ec148c260ae23d5ed39215dabf284af49d7f9dc2b766989c8dc192a298178e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949119, "uuid": "18cfb6ab-a36d-4f2c-a95b-9b35d0d0c2a5", "value": "T1F0D2D06DE4B442C6ED5F5C3E809C3BB10E49E581221BDB927321CC895B32C57F16B4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949119, "uuid": "86a69a72-2d28-4905-b2ce-3ea215704bac", "value": "384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj+SL3RWGVCz0NvW:HMYHb62x4ahQ3CfdwLj8LhWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949119, "uuid": "2864d75f-b8eb-477d-b5f1-501bccac3364", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949119, "uuid": "8d6bf71c-3464-4863-8e87-49f5e91598da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949119, "uuid": "cf76a059-a43e-4fc2-9b14-66b721abcdfd", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09f139e-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014593, "uuid": "d10ec438-950c-4fa4-b4c8-ce84198f9283", "comment": "Malware payload (Mirai)", "value": "34917c6b7a9b44ea9f52deaf623530ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014593, "uuid": "65cbba93-50e7-4e29-96f9-461a63248741", "comment": "Malware payload (Mirai)", "value": "82f5c4aa916bf0a0619e107b84dfed8e735410309ef9f45f1cfa6ad17e66245f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014593, "uuid": "96b15118-388b-4e06-9626-eede5b07f470", "comment": "Malware payload (Mirai)", "value": "b9c66696f17d1bd1974e12e8ff5256400451e7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014593, "uuid": "c3296b36-9140-44b5-89ab-59cb173d6961", "comment": "Malware payload (Mirai)", "value": "bfcd81e9b4a16af908f8d21ef1967127e82e7f64a6ae0a1663c6bf75764b8ade726631fde041be3cf513749fa6ac13ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014593, "uuid": "8cefcb61-d478-4225-a080-41968a70a9e2", "value": "T1FA933951FD819A13C6C112B7FB9E428D372713A9E2EE32039D296F21738B91B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014593, "uuid": "9b95938a-c14b-4347-ab30-a79155c573ac", "value": "1536:QwxfXOMrQrm1XIFIz5xU5mHXIlNA/7W1QzF9XvQ+K:Qwxf+MrQOz5+5GXIUqOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014593, "uuid": "c341a2c1-15ec-4510-9d42-1c2f37e88ece", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014593, "uuid": "574ab8ec-674e-4cb1-9776-3b1e25467119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014593, "uuid": "df7261dd-9831-4701-acaa-75530d8f4e33", "value": "Calix.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358713f0-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770973128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973128, "uuid": "9b553225-52d4-4494-8be7-88ade9e41732", "comment": "Malware payload", "value": "b2f9c7c8ccfdf3543ed3d5a1130b5a44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973128, "uuid": "5df5de80-ca36-4f83-993a-2bdc89cde1dd", "comment": "Malware payload", "value": "83ae561889572a8af8d3dab98d8914406941e181b7226cd4d9ef759784477156", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973128, "uuid": "0fa97b0c-df6c-4f48-ba16-70a8031de3a8", "comment": "Malware payload", "value": "3d7216ae89a2a07f3470dde7ff65610dcf5d98ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973128, "uuid": "b07383c9-adf2-4d81-ada6-e17a37ad6bd7", "comment": "Malware payload", "value": "355f1a53659107052d60a879c3ffa50c8254aa1c756e1ee1c3050e6d56727f623d5ea4995db5d561758cf40d694d8daf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973128, "uuid": "8b93a11d-57fc-420f-8e8d-b83883b5b10d", "value": "T1DC11EDF6C1A40DB56D880808F99571C09A870D3FCD007E5EF8CD6D182F344E6B1E1E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973128, "uuid": "c94d5f2d-5474-4c44-a11c-ed9b4615025f", "value": "24:A1GqWvvGekjpxaPH9N6VqcTn2DOIRwOy8GsluMtI17KGPyo:A1GHvvrktx8H9N6VqcjCO1OyFsJ+RKGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973128, "uuid": "036424a8-1e70-46dc-8b20-7f9f039357c0", "value": 989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973128, "uuid": "7e0920e1-4fc4-4756-8993-73ccf004d0f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973128, "uuid": "46ec8d91-cda0-4dde-9b04-eb670b380505", "value": "hybrid.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb51fbc-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770970992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970992, "uuid": "3b6e5d7e-b5bc-4851-9c30-02da487b3230", "comment": "Malware payload (Formbook)", "value": "8b599b20852c6d8773212f5cb74b9636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970992, "uuid": "1e8ddebd-8711-47cd-a0db-549de6ef8d75", "comment": "Malware payload (Formbook)", "value": "8423546740ef45fb67130769bb418074104ad21cb516ba7845d11d8049ccab5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970992, "uuid": "e5a97b2e-5860-42f7-aaa4-0eb55765c54b", "comment": "Malware payload (Formbook)", "value": "2f449cc7bee31097752713bbce6b35fe58c7c2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970992, "uuid": "bb6d82d3-caf3-48ca-9132-b0a29c33b553", "comment": "Malware payload (Formbook)", "value": "85a4729c8938bf421ae0729b34ecb3bf6ba99a0595d89990b345c1c05a77e37904d8b7486977c18ebf16767974400cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970992, "uuid": "1c7e0d1a-5dc5-4214-be2d-e74de1b4bdca", "value": "T10EF401997349EA02D5F25BF00C70D3B017B8BE8E6822D30A5EE9ADFF78347506955782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970992, "uuid": "2c94ba8f-5dfa-4477-a1b8-9f43fdcc03d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970992, "uuid": "b283d6c8-307e-4dab-b09c-c878bb1e3426", "value": "12288:l/2RsFxzhnR+GBUkaf/FJKR0fKl41qnuMLYZ9JwwCYei15/hEAERY/:lhF3nRdUvf+qKlw0Mei1DEAEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970992, "uuid": "7342e890-6d7a-4962-b64f-8913fa1b7aa4", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970992, "uuid": "d15ac5b0-0927-47ad-a9d2-a2c5ff06ed82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970992, "uuid": "9e278b04-a574-43d8-bfe1-d70465a9dbe5", "value": "SecuriteInfo.com.Win32.MalwareX-gen.52425749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499a7007-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985187, "uuid": "4ea23742-4892-4cd5-8b91-f2ad2900e001", "comment": "Malware payload", "value": "966d367e196ab45db2417e7c17bdaf43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985187, "uuid": "deb5d1f4-fdb3-4fe0-a082-2c42974cc98d", "comment": "Malware payload", "value": "8552b721a17bd4c9765bb5f2f1a5d59c26b899417b36693fdf9532bfd6d25e47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985187, "uuid": "ad31c51b-2142-493d-9119-2eabd84111c1", "comment": "Malware payload", "value": "4fdc33a9b7f92b459c440105585f62365707d05d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985187, "uuid": "cdc43e83-aba2-444b-a1de-79f2f0698358", "comment": "Malware payload", "value": "fc7eee94ad9c09720c0fc28a40e54b3bddcebc9b8afadf65928858324afac63018eb1f5e9350f2c014a49156eb5883f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985187, "uuid": "ce3b333a-fb94-4987-bbda-a6fae4e444ea", "value": "T178966C53B2C8653DC85A0A3A2837A654583FBF7125138E3A67F4084DCE3DD496E39E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985187, "uuid": "948ec56e-a80b-4a5c-b455-596935f2d1e5", "value": "83bb430ac47307b3c50daf6740fc0ef6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985187, "uuid": "6578a3ba-d707-48f1-a095-80203c383bab", "value": "98304:akqGFGOlj7V8HNDgVC5vKONz/sAtRpHUs87:AGFv7quGvrz/7PpHB87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985187, "uuid": "1cf8789e-b85a-4dd6-8937-df92f4be879d", "value": 9036896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985187, "uuid": "c5b434d5-517c-4ba0-a635-69f1ae8159b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985187, "uuid": "2fe759d1-8ce2-453a-bb7b-1123709317a0", "value": "prophetesses.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83441c7-0915-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771012431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012431, "uuid": "815d88b5-82f4-499d-881f-b43fe4e19c74", "comment": "Malware payload", "value": "6546767e8fc9b5b2db22ffb29f30b107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012431, "uuid": "b3d8d4c3-70a3-4261-ad16-1dbd57fd5385", "comment": "Malware payload", "value": "85e604dcd901fb87130f7d00e65d64f9bfa1cef82d99ff40e55809121781366a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012431, "uuid": "d94d1bcb-9328-4c73-ba92-6a21ff7c37ae", "comment": "Malware payload", "value": "042770384073d9e5680c990fdb6294e84f911ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771012431, "uuid": "a7525cdd-e938-4d53-9427-6e3de54c6058", "comment": "Malware payload", "value": "43dc2d875cd09211be6bbf33d576ec149948197e21c7b51b353a157de77aa304c12947f6376f61506d1334fa37b6ef6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012431, "uuid": "1a2686e9-3a32-4ebd-81ae-8d93242e358a", "value": "T192F4236B93072ACCC806C67C85F80F73DF6135625A291A3EBF494F653FA1358B439A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012431, "uuid": "5d2bad81-01ba-46d2-a604-e837292b289b", "value": "07f5f8434ae80acc2908428e9b465cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012431, "uuid": "c5561c39-ea48-41c8-9d19-ef0ec9e151c3", "value": "12288:TNkNwr6LotFWILod+PNBAHxPMfrJI5YY+H1MEOKx/Z8APw9zq63hbzaUl:B2wVt9LpPNORPM4Y+HAPsvdzpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771012431, "uuid": "1bc9fcfd-4dcf-455f-9c56-18471f8defb0", "value": 757034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771012431, "uuid": "c64c7a8a-0a11-40ee-8f4b-2d567e6a1016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771012431, "uuid": "dc0bad2c-5be9-49da-b662-518b96c3b356", "value": "utils_af6cc9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817c521b-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977979, "uuid": "5aa555f6-26ed-43d2-8bd4-8859c9411d50", "comment": "Malware payload", "value": "8ec2f11a95450a27a7c7e993523df6bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977979, "uuid": "f14c7472-deac-4a10-b1c0-79279de1aa95", "comment": "Malware payload", "value": "86525268e4aa15a73f2ea47655c033ca7c1d7c55fa0af47228ec1db29925d160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977979, "uuid": "7769f0d8-f646-4858-ae55-c7537208826d", "comment": "Malware payload", "value": "590bd1d14b00fdc55e9f1c6d440cf0fe79b19f43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977979, "uuid": "722dbb30-6b8d-4330-871b-bc2accb53e9f", "comment": "Malware payload", "value": "11b529c3f431ffebd756a00288c3b886cc084a97552b1bc6ed9740cd0c66b37149ba1f03c3d79a4a733812af00e9bf4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977979, "uuid": "4468e3f0-457d-4b4e-b1d9-e82db41f5a7d", "value": "T10994B05373497726E1A8A43F84A38B16BB31E76341C3971FA12CE5B1A43457C3F86A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977979, "uuid": "82761c40-35a6-4f5a-9fcc-32d16c123901", "value": "6144:cxAh2LD2bfh7Rgty2XPQhz1ftHltWkzpWZRGt704yMR6cgN+PvnQhVe+:aAheSbhnVpmRGa4DR6cgN+PvQhVe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977979, "uuid": "f99a1520-abb2-4a85-9e34-ef2742605b8e", "value": 422388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977979, "uuid": "56be9dc7-4803-4a1a-9b29-63ab00e67978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977979, "uuid": "30e0d252-e5d2-418b-9d1d-699b1f945e60", "value": "dlr.M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c16bd8e-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974078, "uuid": "8c85724c-ba1d-4b01-91fd-940690732014", "comment": "Malware payload (Mirai)", "value": "f42ee0cf48a06ce036828f659e434ef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974078, "uuid": "fa0b53c0-808c-41c7-a69f-15d58493157f", "comment": "Malware payload (Mirai)", "value": "86b8d244bee9629886e800c697a6970338b520d75cf8f85792f69a11e8f10ba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974078, "uuid": "66bc6a85-6d7d-433e-b00e-23bce799a2d0", "comment": "Malware payload (Mirai)", "value": "411a2180689eb9f3c3eeaed09d47b9c0a38a70ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974078, "uuid": "634d0f13-fa82-4176-9d8a-8ec162d0d575", "comment": "Malware payload (Mirai)", "value": "687e15bd543feff00b23ce95230c62e7572046bc3d55c19b7dff1b114ad8699ace51a842b556ec78d3d82b267e32d029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974078, "uuid": "a8022f64-63ef-4130-a326-bc86c7a838b3", "value": "T102D47D5277218F64E361D67109F3CB619AA921A20AF284CA937CC6207B5176D3C6FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974078, "uuid": "1d90c77c-864f-438b-87b3-36abdb10374a", "value": "12288:E0Q0HecQ0xmi9nQdUjrm4hDGZVLU8mgpjyndtU:VhHec9xXFG4hDGZVg8Id+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974078, "uuid": "62cb68bf-370a-4c4d-9cf1-3e5281824363", "value": 597928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974078, "uuid": "1a537fa2-072c-465a-af57-0ae3f07c64c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974078, "uuid": "8c78c2e1-2bcd-45f6-876f-3fd0c1effa8e", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f875657f-08fb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001372, "uuid": "71650098-3d38-43f2-95f4-f6446d9b07d8", "comment": "Malware payload", "value": "bd6eaca124020ecc58d6d2338cf9e022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001372, "uuid": "a636c602-5648-4d9d-9953-46cfa1e43b4b", "comment": "Malware payload", "value": "86e8702a12469a1b8290eadf4be6751a922a601078fc2cfe1ddb043bcaad99aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001372, "uuid": "6abaf44e-68f6-487d-903b-b3191bab6b82", "comment": "Malware payload", "value": "e32250a8ca4c362849e594871fd8e3c201737138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001372, "uuid": "3f977b50-1a7a-4993-a731-f0b8e616a638", "comment": "Malware payload", "value": "dca4dc624aea884213462262a35687e539d3d95dfc69ed856d19f4becb525c96dcc09933cd06c5c35c7be18dea3b1d2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001372, "uuid": "6e9abef1-f4c9-409d-ac1c-92d9c9d4a489", "value": "T1850733F864F88202ECCC297616568AAA00614BB3FF774435F81B5F7919E0077F34A5BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001372, "uuid": "cd68f60e-f673-4616-bcd8-8eb87f8ef3a1", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001372, "uuid": "3aa87b7a-512d-4511-b3df-bb1117acd9c6", "value": "393216:z7KBlzt7kuvtRuaJxKXLiZVMs4za8TZg/KoHnJHaPS2Dj+Zu:yzzt7k6aL+VwzHg662+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001372, "uuid": "91af29e1-79f3-4574-9e4f-ca795dfdba61", "value": 17409536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001372, "uuid": "ea60dbff-4e6d-4118-b4e4-2a949b3c33ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001372, "uuid": "4a4385f9-64f3-4bc5-9035-ab9680eb8462", "value": "Installer_v3890_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ecfcdd-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014519, "uuid": "ac897140-c52b-41dd-9467-903ff50e9340", "comment": "Malware payload (Mirai)", "value": "f99385e2c496360ad0e423050043c98a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014519, "uuid": "43537978-03ca-4eac-b112-658c33e70cbc", "comment": "Malware payload (Mirai)", "value": "8702cc83df2bbc0150329d7e892bd247d8f05de6aa19a73df53e3ca232ecd8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014519, "uuid": "f7e184bb-2643-462b-9557-3089b4ac078c", "comment": "Malware payload (Mirai)", "value": "34380cc01a7dcd243e6bb9a3aadc2fd6fb24fbd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014519, "uuid": "15ee5f48-5129-4931-b38e-e57b136ce52a", "comment": "Malware payload (Mirai)", "value": "146ee8a1e71ecbc42f94c4b5ab76b455b8c84dd8df5c45f1b228484a249b1bee1ba9ac468498c3fd99e6258fa4039e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014519, "uuid": "334bbf36-6fce-412e-883d-71b5f4c6b62a", "value": "T10F03F1C79DE4C4A0D83E64F0A5BEF50C2C14E61C649C59B7E64CB0287809BF6928C7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014519, "uuid": "15a6b586-801e-4158-82fa-73933eb7419a", "value": "768:WrkIT3fVwO/vsJYLfAV9n8qJ9OJvmB+PmR5bMUp4t6tpey+J7v7LmnbcuyD7UtQ5:Wrkg3fVwOcufWNwJvmB+0hMUET77Lmns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014519, "uuid": "088f88f7-bf32-4cdf-8011-3cd4457df015", "value": 40300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014519, "uuid": "a240f728-69b4-40d0-9271-bf563e74c3ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014519, "uuid": "240f9728-06ba-47b1-823f-6c467a7267b5", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d09bf2-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013501, "uuid": "b6ae10d8-a132-40e9-8206-1532e57003b5", "comment": "Malware payload (Mirai)", "value": "1cd8c618737aac1059d9ac69c24fb845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013501, "uuid": "32c9f989-479b-458b-b49b-5adcbf1a38cd", "comment": "Malware payload (Mirai)", "value": "876577bcd50061d0ae066c6b6c328af673595233441df9c9197e440add1a09dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013501, "uuid": "e80180a9-9422-4f24-85b2-0f8c089733e7", "comment": "Malware payload (Mirai)", "value": "0f9517fac42ce451be3ad621d6cc723f1ca70821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013501, "uuid": "570e53b0-f762-4547-9490-cc9b7fb5d76e", "comment": "Malware payload (Mirai)", "value": "d1ad51ae73249fcc96f8c489c985e01cd490147a6929b58c9b14bcae197958ca39546d9e948f39d6adcbc84ee4feebbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013501, "uuid": "f139436b-db1e-4c18-b504-7f9b59fecb87", "value": "T1BA34A72A3A12EFBFE568873107F38A7087D525963AE19346F26CD71C1F2128D584F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013501, "uuid": "412a54ad-3c07-4df6-9cb9-7e7f0328798b", "value": "6144:tHyiJHp4wKld7Fc89yivg69LBlI4XpsZsKyN0:txpd80ivg69LBlI4XpsZsKyN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013501, "uuid": "d30d7634-de4a-48c6-96db-a8163a58d798", "value": 238852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013501, "uuid": "c4f761f6-4796-4ecd-9857-d5dca9c7e8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013501, "uuid": "a759140e-d303-4d05-af0f-11358eddfc78", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491965b7-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963282, "uuid": "fff7bfde-d218-4eb1-bea5-2e3b23f3e3cf", "comment": "Malware payload (Mirai)", "value": "7f9d5209d2c034b1fe64aaf8443fc882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963282, "uuid": "85ad829b-68a1-41dc-86ac-ebb0960e1e49", "comment": "Malware payload (Mirai)", "value": "87a5f36fbba03a581c7485a484912ffc36fe4b83480056a82dfd1ba599ad25b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963282, "uuid": "75a8a19b-266e-4eda-a645-5f3a88b24ef9", "comment": "Malware payload (Mirai)", "value": "175859b8b2d07efe9aa258873e8aeff5052c45ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963282, "uuid": "d34fdec0-6ae0-48ef-920f-d2c69f7f523a", "comment": "Malware payload (Mirai)", "value": "fb5cd55359dd320595b85ca9f718463531e7d683c51fac357f14008f048a89e31e7e5f319af288dd2019d8a992326a79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963282, "uuid": "92d8ca20-c2bb-40d4-bc91-7ea8b1ebf870", "value": "T193635BC4A683D8F4F96A01761137E7375737F6390039DA8BD764A832BC62601E6673AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963282, "uuid": "e95dc40f-a369-4c65-8d71-04f370be030c", "value": "1536:WcK8MffyU5RL+r9RS3TlUYf/wWBOHkVgu3Urpbr5ag1416mEv6+8V:WcHCfyU5MuTlUYnwHYgu3Spbr4q4HDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963282, "uuid": "66000556-137f-4332-8b4e-e5e3f0c691ef", "value": 71444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963282, "uuid": "a38128ec-6477-471f-bfbd-b8d0cf008ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963282, "uuid": "8288d720-2226-4121-8c5b-d3d42b271470", "value": "herios.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fe3b0b-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007916, "uuid": "3f4f275f-bf31-4eac-ae30-e0bb53cb9435", "comment": "Malware payload (Mirai)", "value": "0e5d20f28100a3f177b24a03cd849fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007916, "uuid": "c37b5579-fad9-4f89-b7c2-6b73d381aa7c", "comment": "Malware payload (Mirai)", "value": "8838ecffb5363400d52077b42b40716a0ed6063d27318b517ff6ef13fd77ce6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007916, "uuid": "edfe9e9d-8e5a-40a5-9cff-c05045443ac3", "comment": "Malware payload (Mirai)", "value": "13b73636c36f228db7df12c8a87e359d15e67149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007916, "uuid": "69e24ced-14f3-449f-9cba-549de2b882a0", "comment": "Malware payload (Mirai)", "value": "d12487d764a79d030b5d08f00723a15cc9855ee82150548477c74105c04c42e4b5c4bce058976dd04ca03c8d07f19cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007916, "uuid": "4558e75d-e0ea-4a93-ab16-9a97ecde633f", "value": "T15BA2D068D598AED3F7EEAD608BC2C3C2BB694BCA1112D9B322D5DF016517006B244EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007916, "uuid": "1a77a4f1-362b-48dd-b2fd-452369b4be5a", "value": "384:m/JywWc84Tp2YshxqlDojr7zQwlVRlG+NHdgeLwuDz6M4uVcqgw05VxJs:mRxsSVsMDYrvXlVRlGmdglunB4uVcqg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007916, "uuid": "9057e9fe-5558-404d-814e-eef9a6ed8098", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007916, "uuid": "7823ca98-27d2-4b48-977d-278249d63b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007916, "uuid": "758da97b-51d2-47a1-8bad-7ec08b483583", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c769ae-08eb-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770994150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994150, "uuid": "34740196-287c-4a07-ad40-e37dbc012406", "comment": "Malware payload (QuasarRAT)", "value": "6332505db61f12a4b71f5beed8ff2898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994150, "uuid": "362beade-f89c-40ae-8534-a173f9d11e57", "comment": "Malware payload (QuasarRAT)", "value": "8852ef713bc0078d9ae391ceb5b2d5b4901dd63ab2a74a5155f9d0416a033718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994150, "uuid": "489aa278-1e4f-44fc-b532-b6dcc55a06df", "comment": "Malware payload (QuasarRAT)", "value": "a6462ce88681f52088006a50f8155ca592f8425f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770994150, "uuid": "74edf31f-a171-498e-8d9d-282e62f9ebe7", "comment": "Malware payload (QuasarRAT)", "value": "91261e04ea61bb08cb826e44d626513b0588228716b8e05a99dd448a9dd402f21222fee349782ff4a1ce333c744c0b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994150, "uuid": "17c68985-4eec-492c-9c78-12242649525c", "value": "T154D4022037FC850BE2BFABBC9DB166115679F663E622DB4D098462DD0473381CD8237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994150, "uuid": "941476b7-bebe-4d6d-992c-b01890d1bc33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994150, "uuid": "e6bd779e-4bff-480f-9d01-8b0e57441cb7", "value": "12288:+y4BUsmPCYSr+fkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+BqHFvqR:54QgikqjVnlqud+/2P+AlUDcPt1avd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770994150, "uuid": "eb4d2580-65b7-448f-8459-b28b4ae642b0", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770994150, "uuid": "a02dc4b6-b9da-497a-9b59-5b0a0f0ac2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770994150, "uuid": "3ed6cc2a-cbb8-45ea-8287-fd22818d3613", "value": "nexorium panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9912fb5c-08d5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770984891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984891, "uuid": "603bb5ca-8897-4b11-ac3c-79aea0c7c969", "comment": "Malware payload (Formbook)", "value": "e15cbdf23c241981022f8a610e048b00", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984891, "uuid": "a74e0d11-8606-4986-8710-d54d1458caee", "comment": "Malware payload (Formbook)", "value": "885b6b1ee6d17188395c7b89293f322ae53e85d8bf8630daf002c733772e919c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984891, "uuid": "43a3d662-1b20-4a28-b678-d2b8d1319ed5", "comment": "Malware payload (Formbook)", "value": "e9a555a16277246056eab92c9dc5ca57f6e19ad2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984891, "uuid": "cc0f2590-025c-4a35-8cc9-81e31356cfea", "comment": "Malware payload (Formbook)", "value": "530ada943e021317abc431986aa3ac9947b45c49c88fae0379dd261eb2356efa6072d6455e2eeb62fe96295173b4c66b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984891, "uuid": "72f7eca7-1670-4975-8c3d-8d150eda7ec8", "value": "T1FF95332668BF7045C833BDB796A48518D2099C83C2FED277AA5805EABF513F704077DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984891, "uuid": "6f280fa5-6302-4559-92b4-7d5947d1246e", "value": "49152:T19pM3pQ2dT75NZFOXdg8uoWF9mDqyNuCPlTq5q9ZKCUBIYOBmKN:FM3e2dvXZ4XdgxFMqyZP+q9ZKfba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770984891, "uuid": "c7469c53-7119-4596-86c9-918e4cb508fc", "value": 2040998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770984891, "uuid": "377c3028-11fe-49d6-b622-35e70498df63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984891, "uuid": "3f9ff65f-679e-4c69-92b2-5313a669201b", "value": "RFQ #L25001116.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38311be6-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973132, "uuid": "ecf24daf-f51a-481b-bdc4-83944365d19e", "comment": "Malware payload (Mirai)", "value": "d0b6831e649d784ffab7fe510ac5ad4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973132, "uuid": "7988dc66-4a74-4b21-8713-8f2f14ca2120", "comment": "Malware payload (Mirai)", "value": "886202609d2317866d9c7280bf08afa6e2a9b6db8cf91412f0f7ae25047765a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973132, "uuid": "13e0cb19-57ad-4953-a88c-09ae0d89a6c3", "comment": "Malware payload (Mirai)", "value": "36416ebb7dba4bbe05ddff09be5c516eded0fa45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973132, "uuid": "ff973443-34d7-483e-92b7-9f337c94de31", "comment": "Malware payload (Mirai)", "value": "3145a4dbc0fae880ea7f75a67ebff09c39159e247fc7f30744ab4c3b9e7e14536a0936ae329e6284e9fc837878ddeddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973132, "uuid": "7f2b04d4-5803-48d7-8f71-ccb85b4cefd8", "value": "T1A703F1D2A1D0D29CE5D92A7AF07BD2D725316101179E11B64F72FAABD8C3360C29B40B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973132, "uuid": "550759a1-c707-4c27-976a-03da0273e8a3", "value": "768:yO10B0Hy258co/ze+SP52FiRvmbccnYgYHK1ZlFQ2/TcPr/:p1Y0HWcoLQ27fnVGKVv/Ts/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973132, "uuid": "1a84e330-37f9-4c4b-8aa6-3950c32d5b2b", "value": 39628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973132, "uuid": "0b5342bb-25ab-486d-b549-f333bc823d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973132, "uuid": "33d18882-8147-4707-9933-605b47cd7e0f", "value": "sys_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d723696-0918-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013460, "uuid": "1764dc37-d48f-44cd-aaf5-0f46673d3dd1", "comment": "Malware payload", "value": "be3cde516961778f07da05c733407e0f", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013460, "uuid": "a602b686-ad71-4b0a-a4d9-a6387a6263e7", "comment": "Malware payload", "value": "89606355d0beb18db269d6e75b56a6b6090700d8d22ab09998446fa4b2223e8d", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013460, "uuid": "3c4f3dd4-17d2-4835-9cb5-e33de4eeb101", "comment": "Malware payload", "value": "04b2fdf60692e7d45d2f839d96588c91fdae69a7", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013460, "uuid": "a97927ac-689e-4a44-a3be-be325fac37e9", "comment": "Malware payload", "value": "fd710f5e627c8422098560f28f4b85d4e2de3f9ea8328a85c5791a24627107225094fa4ce438f3173c4254d5fc52a576", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013460, "uuid": "cdcad02b-478f-454d-8a26-e66bf925de22", "value": "T132E7333676F8CA03D17E2636F89BC6136DE48C5E0468F20B954C4AC69AC5E503D6E6CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013460, "uuid": "cb07d49c-d78a-4b3d-a082-34171811abb6", "value": "1572864:RdceU5Qy3CSSC35Bhijne7HU68ifmf+rtsEV1iCwVqXwa9yH5YP06:Rdc7pRB4re7HJxmW7V1iCHN9lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013460, "uuid": "21bafaaa-c6c4-421a-890d-24e725e3eab3", "value": 69410534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013460, "uuid": "a2e615e1-fb4a-4cc1-a6a2-540441ff148d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013460, "uuid": "98e8a98d-b077-4cc2-930e-305e10096b94", "value": "SSHub.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400740c9-0871-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770941792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941792, "uuid": "de908f0a-3146-44dd-8884-6c42aa6b11c9", "comment": "Malware payload (DarkTortilla)", "value": "d7911307943abbf4750b1c5040642d4e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941792, "uuid": "6c65bbfa-ad34-4f81-b2d5-bb800e782def", "comment": "Malware payload (DarkTortilla)", "value": "8a0a1c0a305381c48d65ab4be874a4651c4446bc6067b6592db673c5664658de", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941792, "uuid": "7e51bb56-5a14-4bca-95a0-40a4e772adac", "comment": "Malware payload (DarkTortilla)", "value": "1702cf1a2a5fe9a3f3a1d87960abdc698c1aa0c8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941792, "uuid": "ad7c69a3-a3c6-414a-8818-f68b630e4988", "comment": "Malware payload (DarkTortilla)", "value": "b5f83a9933bb077ba0e3d7b27bc5217ee187322ab90ad3984dae6b5fe6038537b451cd37cb9bfe021ecf3faed66f45a0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941792, "uuid": "c4499f99-c5d8-4f2a-b55e-b46379d2b658", "value": "T1AE35E00723D44A68E5BD9B7A85BA14D103FFBB47AB32DB0C6C0951EB0D26B41DE41B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941792, "uuid": "247f438c-571f-47f8-b94b-afb934cc6097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941792, "uuid": "04221c5a-a9bd-49ad-96c2-cff7cd83843b", "value": "24576:lifZNC8ZHKJCX0fI8mVS7dXng07ehJKYC:WZWWgI8mchgGehp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941792, "uuid": "841eae0d-16e9-44a1-9924-5091466f441c", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941792, "uuid": "f2224ecd-660b-447c-b373-33d734acd6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941792, "uuid": "e2382e65-fd5d-40dc-a4af-947ed076d9f1", "value": "quote.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f373e2-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770996189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996189, "uuid": "30b36f9d-7e8e-4eae-8e3c-21417beaf11e", "comment": "Malware payload (Mirai)", "value": "e3da9405eabd78a2a7663ed86603749b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996189, "uuid": "e06be5ce-5721-4d28-9b88-9a062dba9432", "comment": "Malware payload (Mirai)", "value": "8a543e108f9997e3045c1a8649d5a9d0d9bc52b169004d4d8a21546d45a1b49c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996189, "uuid": "cde0cde4-9e26-4a4b-b17e-24f3ebf8be8e", "comment": "Malware payload (Mirai)", "value": "ee0de315140c487008a5c853a875ff4d94dc379d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996189, "uuid": "7d418302-08e2-4c67-a259-0de19f815167", "comment": "Malware payload (Mirai)", "value": "caff216968eccb58d5c3491d19daea2ce27278856edca1441c0f0edd94b1e0afe37dd1bcbdd8c801a72d3272c21d9f6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996189, "uuid": "b0cf5308-d6cd-490e-b220-077d975d2c7b", "value": "T1A2517285B3650D3128E3AA17F6F74228B091D0935CE9ABD6EDECBEE8474ED283140753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996189, "uuid": "3a482eda-1fff-42d4-a884-916d0f09eda0", "value": "48:vF7c7N7hFH6GFg/zPF3KWFZoUF7Z7o7UFfi3bFs9RF9cgF4pVF/SOFr+CFyfTFK2:vF7c7N7hFH6GFg/zPF3KWFZoUF7Z7o7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996189, "uuid": "a346ab45-c0d8-4487-b4fb-9973b9df9687", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996189, "uuid": "994be168-8a1d-48d8-a333-97b62db4eede", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996189, "uuid": "dc1d515c-c977-4569-984c-afeb19965b46", "value": "slur.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a335f2-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974092, "uuid": "ce072fbe-2d79-4fe6-a35b-877e712dd6cf", "comment": "Malware payload (Mirai)", "value": "695fbc68f19bf34f9cae2c1e509986ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974092, "uuid": "fbe23324-35d1-4523-83eb-4cd57d2c41b1", "comment": "Malware payload (Mirai)", "value": "8ad1ffc5900a13a1a68e589946d7d1818c0d7d004993cc8d1ef0ce704669de05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974092, "uuid": "e61d78f9-a8e3-4d59-b03a-244f5ae1d799", "comment": "Malware payload (Mirai)", "value": "d01205320a9bfa3b97842bf268bc00a2da4a0ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974092, "uuid": "3e6585de-811e-4464-83f6-c977632e3140", "comment": "Malware payload (Mirai)", "value": "aed472d5ae99c8d2fbf0512e56907ad39f65c73b453db9d01f36a871c8827fec58e0467fc213b76bf6c216bea90d6065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974092, "uuid": "20c6afbe-1a34-4930-b4c1-3aef7d295a33", "value": "T194259D51FBF2016AE64086364662E760BA47D7A268D4424BCF124FEFEF472750E84CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974092, "uuid": "81dbf159-a413-44fc-9433-87cb1f5c9159", "value": "12288:D5AnZALAbVrb7c0KvPv0UOv5VYww5TH7S6:aZALYFoPPQxVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974092, "uuid": "7393ad70-0fce-4e64-b9ec-473a941c45c6", "value": 1056632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974092, "uuid": "dd9f4cf2-8680-4be2-8f41-2145a39b9e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974092, "uuid": "0a82ae93-5114-497f-abd9-32d37489680e", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68a466f-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010281, "uuid": "b66f458e-3da7-4b34-be6c-73a208e1b623", "comment": "Malware payload (Mirai)", "value": "9de963f1145997831a0111bcdfc2fb45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010281, "uuid": "b4984863-12d2-4989-b24e-cf2c4bce8de3", "comment": "Malware payload (Mirai)", "value": "8c07994ac7f622666ea039e1617fbe3ef79535d4497860842cfb1da973aa19d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010281, "uuid": "71262db0-a313-4edf-bf12-8275848c482f", "comment": "Malware payload (Mirai)", "value": "43c79aa2148bf569a9e6c9496d3fc58eba0d9776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010281, "uuid": "b4cb9121-45b1-4c6a-9754-912cc189c6ec", "comment": "Malware payload (Mirai)", "value": "2a28c545a324c9705bfa8ad0eaeae9870967196b826708d9c3eb6ab2648274d49ec03dfa1b07d975ed998af3de266335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010281, "uuid": "231424fa-6e1b-4279-92d9-cef6a982166b", "value": "T127430172E8524CE1AFC1ACF8EA8D149B191351BCE7E09C362165163C62E624D2FC5E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010281, "uuid": "f3ccbf4b-5e5f-49e9-8024-4f9e5615ee76", "value": "768:owYfTPTLv+8vRqzwDvhvPj20D5Ip4C7B7nv9q3UELHmVfp4Gc0ztFZywq69oqe85:oLXW8vRrxCARqB7eLyRLcMXZHr/vke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010281, "uuid": "1e633ed2-aea5-4bb1-b942-fca51bb072f9", "value": 59312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010281, "uuid": "cecb7280-18ad-4555-a834-e4554658f032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010281, "uuid": "59c2efd7-4e81-4a14-9793-6d4328feac70", "value": "SecuriteInfo.com.Linux.Mirai.9816.8721.21102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cfda59-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986798, "uuid": "fa2f7b98-7703-42a0-a4f2-b42b84509c68", "comment": "Malware payload (Mirai)", "value": "36e9b425da50e33ffa7f6508bfd0bf08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986798, "uuid": "d47898b0-21f6-4318-bd7f-c1c65da6598e", "comment": "Malware payload (Mirai)", "value": "8d062306c81466cc4d312207e6d56797edd8676246ab020f95171a72181af762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986798, "uuid": "ddb96382-fa73-4b7e-93cc-0a15ed6dab0c", "comment": "Malware payload (Mirai)", "value": "9d588ebd0276a2abce5fdd4a0f62a6c0c1696876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986798, "uuid": "e7243404-0696-44d7-9236-838e26a278f3", "comment": "Malware payload (Mirai)", "value": "9ccfa182b29978d95022d444ecf16bed0eae50862d1019d200fc9c60b4a826ac651f9240ae7eefa18b9f53aacf238fe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986798, "uuid": "634e7264-0ea8-49c3-ab7d-9750bb3165c8", "value": "T18D334AC6F587C8F4EC061974307AFF225EB3E2BF1598E943D3A89532BD52642A405E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986798, "uuid": "e2e599d8-2305-42f3-ab40-13543b70efa2", "value": "768:AMc/D6SbHCsZYc0O8aUuqijM/YCOHJVPFowiBnOS/Zv9vzst3oJmMAoc8SRELSLe:A//VCPc58LN8M/YCOAFOtoAQSRgis4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986798, "uuid": "d1c753af-0c70-4207-afb0-20038be2d28c", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986798, "uuid": "826a81c3-23e9-4a40-b25d-cee8f92ab908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986798, "uuid": "75008ec2-8f02-4c15-9f18-d552b4f01f02", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cc089c-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977960, "uuid": "f6b49bb5-cb22-41cb-be07-2d3f0c6a7075", "comment": "Malware payload", "value": "020fdba796c930bfb885361c747967be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977960, "uuid": "da2fe483-121e-40d1-ac0d-965ffbe7a126", "comment": "Malware payload", "value": "8dbc4827105265af568f780a773e802b82c86a3a966aa15997557dfc7b23e904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977960, "uuid": "8731cdf5-d8a2-403f-9ed2-fea0877ad791", "comment": "Malware payload", "value": "b916be4e255412f8b4981fb2ba00ecf89cacd51c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977960, "uuid": "0aef326a-7436-46ec-981e-ddcb2559469d", "comment": "Malware payload", "value": "4b5f3fadd465b2e835a6e84827c68175e72b452ceca08d652d51c752b90ba91fe26d914ead3957a7f9ce3abccb00d5b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977960, "uuid": "fdb3bf62-bd66-455a-8916-f5bf821c91db", "value": "T189A28E69E7638E2DD8FD63B880A3423033F7948C5272C3231E00A9711DE33B4466A8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977960, "uuid": "2097bc85-9a8e-4b07-b1e9-c54c9942e6ca", "value": "384:kgRZxpU6iDNXhUwJ0m5akAVYd22mkPWojGpp5iH:9RZxpU6ihLJ0m5aOd2wPMpviH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977960, "uuid": "7bab54e8-61ac-4398-b8e2-19b80b2d4655", "value": 22248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977960, "uuid": "aa09069d-433d-4fe7-b61f-146aa790c5e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977960, "uuid": "da697eb2-ce34-4036-95b9-cc28d575296a", "value": "dlr.XOR_ENCRYPT_CNC_DOMAIN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d5d208-08a1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770962360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770962360, "uuid": "e0e878d9-f48b-4354-bc16-86e87c1dd838", "comment": "Malware payload", "value": "f40375ad99fbe325958ba596949c4642", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770962360, "uuid": "a8bc44b8-aa33-43be-bac6-7242189372ab", "comment": "Malware payload", "value": "8e9c2c28288bdbb846a30fffc8eada6d4da66f5823a613952f2dbb88c292da6e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770962360, "uuid": "7be0318d-85cc-4111-9ba7-ed303e80d3c3", "comment": "Malware payload", "value": "9e2afd9bacb91b84ee7b92f5971fbf1a3e9f7640", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770962360, "uuid": "5192fe7f-ff7e-4949-a6a4-7c1933d6a767", "comment": "Malware payload", "value": "8c93ad645d0e88d1f3a7d95697ecc66f8763e92ba8e0d299d2e58e77cad11f8fc1d1f674d3c96d7918c787c02fa55f8e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UNC6384", "colour": "#8BFD9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770962360, "uuid": "3fa1821a-ae2c-4d0e-a40b-74679214c5f9", "value": "T10A41581417E60229F6B7AF36FDBF76910922BDBADA36C7CE0244658C49B11049493F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770962360, "uuid": "608c1995-42fb-46d9-b4dc-e795fec619d4", "value": "48:8Gjv8g6GeNtM/j/lOSKZsmYN2Xiytv9ug0pst9tN:8CANS/lOSKZsmYNN8ugeUzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770962360, "uuid": "19bf817b-24a7-45b5-9760-7b1d6a1ccbcb", "value": 2250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770962360, "uuid": "dcea7848-d29f-48ae-a58b-3d21d738f9c7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770962360, "uuid": "980c0b3d-629d-4198-9002-ce8ec1d942e1", "value": "Election Commission dinner party registration notice and guidelines February 2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a9747f-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014520, "uuid": "7a3889ae-a344-4f35-a450-54ba9e7246c7", "comment": "Malware payload (Mirai)", "value": "faa7def1f8f66f7444f368bfc2e65869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014520, "uuid": "0eb67bb0-b98f-427a-96c2-285e4b18f26d", "comment": "Malware payload (Mirai)", "value": "8ea4e7dacb3e7c1abfeb45981a5b94ea7edbbe443bfe15ba91c5195b394f9314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014520, "uuid": "57128f7c-902d-4397-b804-3327464c2287", "comment": "Malware payload (Mirai)", "value": "0ab5d94950fea70e1816cc79697ef76aa9c8fd50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014520, "uuid": "a07b1e3d-135a-41d9-aa53-0a60f7408eee", "comment": "Malware payload (Mirai)", "value": "fa45f00c0471d95b8f0567fd822d057b3723f7d6a7c6d4fbc45e97bfaee2e03482bdbca6dc911db3e5748d57965f9c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014520, "uuid": "ec55abcb-0cae-4319-b7ab-05c428fa9747", "value": "T15F03F177B8B44ABAE91F637919FD324B6C409121036016F32E98AAB221F3B5D31347C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014520, "uuid": "1573b6b4-677c-4402-aa9f-63d47a0688ed", "value": "768:yV3j7GeG72sPKT2xhHpXxvO94pauC4ttmmbBWfknbcuyD7UHQRj8:sj7GeG7VyT23Hph294pauC4TmmbBWfkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014520, "uuid": "28103037-3a4f-42e8-9f38-bd035cf19cbd", "value": 40528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014520, "uuid": "42777dd4-144f-4a05-af95-a002c855389c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014520, "uuid": "ad80aa0a-0667-4e34-9c96-79c33210c600", "value": "Calix.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73168b3-087e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770947602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770947602, "uuid": "5267f693-45c2-477c-aee8-c91c865323b7", "comment": "Malware payload (Mirai)", "value": "176f5604c891b36f5e816edb6816f211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770947602, "uuid": "0b22e83e-96f4-413b-b003-f2fa7d821ffd", "comment": "Malware payload (Mirai)", "value": "8ea8293c6be9cea07ecbad10c95e963a0745c8c446c7ac03c42bc0640d4e176f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770947602, "uuid": "9d1b46c4-32a7-41bb-9ce6-6ef2c072a8e7", "comment": "Malware payload (Mirai)", "value": "fb75111f4ab3237a4fa6327780cb4fb8a7dae2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770947602, "uuid": "9d2ca29a-0520-4f00-9172-4590965eb15e", "comment": "Malware payload (Mirai)", "value": "d4a8f13302cb33496066fe4e67d66cd979678f40eb12c3acf957002b420174586486c6dc92ec5aca67cb95377d94e72a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770947602, "uuid": "5a9485b4-3f91-427c-8aff-658e53767305", "value": "T1F8C33916F58180FCC18AC2341B6FB63AA936F2DD1238F2E76BD4AF123D4AE614D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770947602, "uuid": "5a8f8c3e-c28d-47d4-9588-404f746a78b7", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmBKGHzNzQSRN6Fpjygajc3:jrguLRkHQo8SsGT74p1oB4n2pvalsBzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770947602, "uuid": "6db7e7d0-e855-4524-8582-6636ceb137aa", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770947602, "uuid": "77e57ebf-daa6-40a7-85c8-9881d7da20d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770947602, "uuid": "555847bc-cda2-4d81-b620-a32216c3082c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4735d06b-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955548, "uuid": "ecc42662-e98b-4bef-a5a9-d9cf4540a272", "comment": "Malware payload (Mirai)", "value": "5ed5c88133876df84a47353dc0c5615b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955548, "uuid": "cc702d01-6e59-4f16-86a0-851b83119995", "comment": "Malware payload (Mirai)", "value": "8f3840174b5d8d5cef2bd978c79841f161a68e0cde8b6556906a1b1051df6744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955548, "uuid": "3a19596c-a152-4520-9c20-8d4f1d14e71a", "comment": "Malware payload (Mirai)", "value": "f4293fcad1c65862a07575d1b57f0c42894091d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955548, "uuid": "4ce78a6d-e734-407b-abcf-5eb2252fa1b1", "comment": "Malware payload (Mirai)", "value": "52f6f4c28ff634a500fe2fe8e96c50bf8ac4209bf624c496558af2c4127b1667194e422709a50653994684d50628004e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955548, "uuid": "e93edf1f-3720-4d77-97e0-dce850045347", "value": "T11C737BC2AB47D4F4EC2605712077E7728773E13E1029EE83D369AC32ED52A41962A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955548, "uuid": "5f4a6d9c-4d5e-4255-afba-cfe1eb576a6d", "value": "1536:IUQvN+2LhcnKW+tGP238kvd8U75Je1d+p:8lV6KW+cP23Nvu0nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955548, "uuid": "a97e956d-bda6-46c8-9042-ba472cb3ed89", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955548, "uuid": "18c1182e-04e5-46a5-a4e9-18ac07a15a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955548, "uuid": "3e00b5ab-1695-4547-a64a-ab490f4b57bf", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb388688-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025831, "uuid": "9425b859-fc29-4e16-884f-cae79b4adbec", "comment": "Malware payload", "value": "38f66c1a6c45eea218ac7eb2d250992c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025831, "uuid": "817628c4-89d3-4493-acea-0612fda9166f", "comment": "Malware payload", "value": "8f83814eb21d66a75f0fde29c8f161dd1371dce433d5decdf7151126bf4d7c39", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025831, "uuid": "f54d21e9-d1d5-40eb-acfb-27812e321f1e", "comment": "Malware payload", "value": "2a1425d3f63216fb89cf2144d61350ee8f022782", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025831, "uuid": "e8cb3790-d3c5-4d15-9e59-b4f87a1f16bf", "comment": "Malware payload", "value": "051457ff34faddb88ebe53c39c57e4f0702d2f6d09755a8aff7100721dc17c2551765462a8ffd7236f3d420f12a3dc1f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025831, "uuid": "794b5b34-dc0e-4587-ad04-c40f7373e328", "value": "T1C1763331BE955C6BCA988235305F6F293D2D9A43470DD5EB68AC76C77B0BFD1403A0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025831, "uuid": "6e194285-c0a0-43ef-8151-1f8cb55d2c6e", "value": "49152:wjBGODvDPAAbZi2n3kh/VClFTPWiC4SjbfuTOMoO1P7qzVBaTHH+WsKhp2JI80di:oOvUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025831, "uuid": "4fa20711-bb88-4404-87eb-029ef51734fa", "value": 7133184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025831, "uuid": "0314be57-d455-4388-97d2-677cfe695043", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025831, "uuid": "097cf61c-2585-42da-83a1-c9024156228d", "value": "Not-Ar91906FLZXXVJHTD348092.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cc37e1-08c3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977074, "uuid": "b16a4856-e718-405a-b913-6f5677da128b", "comment": "Malware payload", "value": "3fe2b172ad50f843ff56a4ae7f7703c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977074, "uuid": "851aca0f-2dc5-4c6a-8bdf-c85763be4cf9", "comment": "Malware payload", "value": "904cee06bbc6093213e8653b120b2b72701bac7e8dbfbdd69bfb3aed9b6a7298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977074, "uuid": "ee316990-be4b-4379-87e7-c81b1affd0f4", "comment": "Malware payload", "value": "93781d80259cda15f1b4072cc43b6dae6baadacc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977074, "uuid": "9a88a185-8bcc-4304-8aeb-c8ea5e026364", "comment": "Malware payload", "value": "d6dcb935d1f174150c70ca102d93f60d8ec56d11ade9e4044c26945f9de29ae645bb7f9750aef823e44c10ab9e47f2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977074, "uuid": "9edc67aa-5be6-4b86-ad0a-4c26946a3f18", "value": "T14C474A47E4B615D9C4FAC174D22A6127F9A13C4C473827EB1A90B7312F32BE46E7AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977074, "uuid": "0b2b4887-71a6-45de-894c-2936bd2d4161", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977074, "uuid": "4acc16f1-f585-4d34-980f-355a2c173f48", "value": "196608:ItpNhsVa6kyyT/Vegd3u+d++4KaKJSPwzXmo1dvaRRXEC:ItPIgd++dyLKJSPwzXZyRRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977074, "uuid": "4e74788a-ae86-44b8-9be9-312a7f4d1a56", "value": 25285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977074, "uuid": "896e1d72-3598-4925-9a8f-016fbd367562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977074, "uuid": "fe42c4c3-9172-4f65-a362-1acedb0437a9", "value": "904CEE06BBC6093213E8653B120B2B72701BAC7E8DBFBDD69BFB3AED9B6A7298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f457061-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014510, "uuid": "18ddc804-5e66-4433-874f-73334a97fbbe", "comment": "Malware payload (Mirai)", "value": "c5b010c49806f337eb0bd77b8a13567a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014510, "uuid": "f97bdbee-2a8e-441e-8088-20c21739f17c", "comment": "Malware payload (Mirai)", "value": "9057fc697680957a46867798cf07ccedcfa9122d2eeb9265fdf0b83f9998c2eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014510, "uuid": "0ad1da1f-65a6-40e4-b251-e183203adbd2", "comment": "Malware payload (Mirai)", "value": "b842c93036461ff1f409a2b9d065f07f06fa2d52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014510, "uuid": "1148c4ba-0eb8-41ed-a927-01b61646efdc", "comment": "Malware payload (Mirai)", "value": "eb3367791ca31ff9a3df3f78b1fc305321989eb697458051a7cafb84f50ea8e28bdb5fba676a6c771910027f10e44580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014510, "uuid": "ae3e0ae6-67da-4194-8fe0-a5732c703da0", "value": "T16E13F1D61902A898DC76503506FA0794BC180FBB93870E0974CADBFB6F95027BDC68DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014510, "uuid": "37f8ccde-1794-43dc-a654-11a7ab86fdec", "value": "768:bUjKrZsAW6EpKKReuzxID0Y7pz4jf1RetVzEOFsKAgWJgGlzDpbuR1JP:bHZsAkpKKMa60Ydz2esusKcVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014510, "uuid": "65f51be7-4349-424c-a504-7d63b5cf6073", "value": 43196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014510, "uuid": "3d785a29-1f83-4287-9625-a5229b9eebc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014510, "uuid": "0df4ba77-aa86-4d56-bd5e-2a01de48a618", "value": "Calix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a7e4f-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975608, "uuid": "d7209fdc-9d42-4947-9e9e-3ea4cda35763", "comment": "Malware payload (Mirai)", "value": "79f32905ab49af8c36d947d7a01c5fd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975608, "uuid": "d857c9e6-86e0-495c-b26b-2161f86e2f61", "comment": "Malware payload (Mirai)", "value": "917f055a7ea82558a1ce794eb798c471e9dc30ead4a867b92c0f863b7b320f29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975608, "uuid": "36c92d8a-0a41-410c-bec2-6d68d84ecedb", "comment": "Malware payload (Mirai)", "value": "5e07c905c3a5dc2068e3aa2cb0fac2329c95108e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975608, "uuid": "11aec170-50db-4bc8-a02e-c69a9de2af0f", "comment": "Malware payload (Mirai)", "value": "8e79ad6568cddd1bd96736ff1ee5f1493ba44fc105b6999fc8a9c498b15aff17dc9c58c098590ac4f765ac1f3ac94618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975608, "uuid": "6bb3414d-2d6c-4580-99a0-412bdfc9471a", "value": "T13C333A21EE7A2E17C0D4A8BA21F74724B2F2275E25A4CB2E7C720F4EFF44640515B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975608, "uuid": "be5c4366-8716-4538-88c1-3c073e8d21ab", "value": "768:FFoKq9yqDkMUr4XAuwmPQqdvw7R0Zx6QkWO+0nq/zr:FFDSyqYMA+AuwkQqu7RY6Qk0bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975608, "uuid": "5d3c0fb3-3e0c-4597-a51d-74d48f153d7b", "value": 52244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975608, "uuid": "29eef906-d461-4323-b644-d7ac1ee3889a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975608, "uuid": "c7c77429-1782-4e45-a81d-cf5e5d75bce3", "value": "StormStresser.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112cfa15-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985522, "uuid": "ae25e4ac-3d36-4374-b1ab-c0ec50696da6", "comment": "Malware payload (Gh0stRAT)", "value": "890403fec03b19317d6908aa8ee0cee3", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985522, "uuid": "692d6dbb-0071-4541-bd4f-4433db2af48c", "comment": "Malware payload (Gh0stRAT)", "value": "9300b8f49a512b335f23e7b3a886a96c95255c1b9b5e0908708fba1c462c6012", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985522, "uuid": "172a5846-6f7e-4a15-b66c-ccae9f89daf7", "comment": "Malware payload (Gh0stRAT)", "value": "270771bf45b967910e1322aba33fd67cff254862", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985522, "uuid": "a2613192-b8dd-4913-9254-1ac492c6a012", "comment": "Malware payload (Gh0stRAT)", "value": "18684982ee9fd34552ba36f76089727e446d83a5a27b76c4829cf7b5bd3decdf6c41c0791de1f7c76b2d7362c1eb804c", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985522, "uuid": "1f8fa2b4-5015-4a62-a417-8d7f1baf7237", "value": "T197E6332232C6C035D6BF0A711839DB59016E7E608F7494DB53DC6D2E5FB21C25A32FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985522, "uuid": "11d7ed17-43de-41cf-8b52-5171e3aad316", "value": "393216:/K9HWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/w:/sHWrTOjnO9KrNMJ+Mu0oX2q4ljid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985522, "uuid": "d7f4a84b-fb05-4eb2-80d8-9d4709c64927", "value": 14777344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985522, "uuid": "896ee308-7aec-4d18-9bd5-7df6ee9124d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985522, "uuid": "f10bf662-c957-4cc0-99f5-4b55787a1bdd", "value": "52c2e3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921dcb92-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014515, "uuid": "289eca87-d144-4379-a5ac-1e5c07d6281e", "comment": "Malware payload (Mirai)", "value": "ef20ec728a0bbef244b7899536cbec41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014515, "uuid": "a3c586be-d58d-46f7-b748-0fa555ee283e", "comment": "Malware payload (Mirai)", "value": "943c40cfc793e19e0fabfe65c6315e2fc032afc78177d19b6be782073c14ff05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014515, "uuid": "ce328355-6841-4fef-993e-77c6fb964a25", "comment": "Malware payload (Mirai)", "value": "164ede6a706c3b0dcb2699e473a78dd165e12e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014515, "uuid": "f2b9b11f-a5a1-4b70-8996-23c4431ae23b", "comment": "Malware payload (Mirai)", "value": "b4a22e10687bbaf8cd2bd97b2d17808c01bb018fc4650a7c9cf583ed2a83e6e3aedae96e26162a1caa9c1d50630fefcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014515, "uuid": "fc057258-abcc-4daf-998f-0b8f3d6d2353", "value": "T13E63027AAD4A5A01B83404B0CBBC09224D7966B86DB0B665C5A7F27DF3FD8182DDDC08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014515, "uuid": "f8a33e94-dd30-4184-ab0b-f186817b2763", "value": "1536:iWHEfrNaCdfYFLzZz2RJEcVvjUB8az3L33L3K5omd6R9:iDaWYFqEc6j3L33La5om2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014515, "uuid": "ef6af932-0351-4425-ba3b-e9da5ddf327b", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014515, "uuid": "4067e06f-6972-4d38-91a7-22c71341c38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014515, "uuid": "88c7815d-aef8-4323-8997-398b03ec90e3", "value": "Calix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b466ff-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975597, "uuid": "789957da-bd6b-4198-b224-50090269d60f", "comment": "Malware payload (Mirai)", "value": "5381a30483aee10371392f77a8d34641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975597, "uuid": "995e7733-6058-4784-8f0f-79985d41ac7e", "comment": "Malware payload (Mirai)", "value": "94492a228b98982f5a075e792239ba6b7c41366551df182ec6b07270770d744d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975597, "uuid": "9e97e199-426f-4430-9be2-dc24f3d634ce", "comment": "Malware payload (Mirai)", "value": "5f78d17121238fb116050811a9124606f4beb0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975597, "uuid": "53b5899d-9a7c-4ee8-94e9-6e7ffbcc4185", "comment": "Malware payload (Mirai)", "value": "65c593c472a4abefbc9bdf706b306e0361c168460d9b434f102b05a31e46a85171b4ce3b777d381b60fd6b3bb31355de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975597, "uuid": "117cc7b8-e966-4e20-be45-d68f3c1e3ce5", "value": "T17D63B519BF610FF7D86FCD3749A8270529CDA51A22A93B367934D818F60B24F05E39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975597, "uuid": "0a1467d7-c64d-4a4b-b65c-969629f8e8d9", "value": "768:f5bhLnj0KaOcYGwyVWJ9jd7XxqPxnyAFoGVCEV5b9epRefXe4iVNUCBLXi7t8TNT:f5bhLjnMwyVWXsvo4VLERmXrcN5FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975597, "uuid": "698d0070-d6b2-4cc4-b042-bc306df62293", "value": 67664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975597, "uuid": "d8e06b7c-df85-4335-95f2-5d2be4681012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975597, "uuid": "6a059936-d71e-4bdf-bd83-88ed80a331ea", "value": "StormStresser.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfd5d07-08b2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770969837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969837, "uuid": "7086e403-b1b2-4ff7-928f-40ad800c9d10", "comment": "Malware payload", "value": "4976ef0054b0283c0d013be2f442e17b", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969837, "uuid": "bcbbfed9-efd4-4d47-a06e-9775e6b01b97", "comment": "Malware payload", "value": "94719581be164d57ce482f3759dbc40d772a6b469687b88036e3075cca784ea5", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969837, "uuid": "ecc401cb-e758-47b5-bf93-f684be42b78e", "comment": "Malware payload", "value": "5afc00d532a0df61db218a867a309234ef128051", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770969837, "uuid": "226bdc8d-836d-4f52-8354-a698183bdbb8", "comment": "Malware payload", "value": "eff6560a62b17f0c3c11693da3c2fa3cd779abf79eccef5339128bab629c683c4645005f22769b4740ebd83f473e0f4a", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969837, "uuid": "8b4dc625-9903-4c77-a377-7fbb12d5c7f4", "value": "T1FB51CB0327FA8359D2F34B3115B6E3A58A25FE59A852CB2F4394558E1DB2300DC36736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969837, "uuid": "801ff20c-60dc-478f-b673-bb8643bbb497", "value": "48:81kqhFOCojRAr84r8QyDbX+t0axbE/t04:8aqOCEi848bDb+t0h/t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770969837, "uuid": "e1c41f91-cd3f-4fe1-b120-1a8e36d54d6b", "value": 2535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770969837, "uuid": "2142bf88-b247-4429-b00b-8b2509b8cbb7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770969837, "uuid": "8a1090d8-e768-4222-85f6-c014f914f452", "value": "94719581be164d57ce482f3759dbc40d772a6b469687b88036e3075cca784ea5.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2937d3e7-0918-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013480, "uuid": "5d3b0a38-1f6f-4028-8d46-9ef5abcc9820", "comment": "Malware payload", "value": "806e14eb3fab9429adf17226be24fb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013480, "uuid": "292aa9ff-ae66-44ee-9f07-7b43082bae64", "comment": "Malware payload", "value": "94bca473a17a988566c7d5d94e8d6c63b167a8fbe1e8d7a97432ad0953d50d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013480, "uuid": "32427b04-8132-4e90-958c-3183a7e7f0e3", "comment": "Malware payload", "value": "26351b54da0e8720970192bd58254b9f51d31dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013480, "uuid": "4c215c52-331d-46c9-a121-be784db01600", "comment": "Malware payload", "value": "06b2656b3f77e426affaff59cd7f9c7a650ea8b73444e615d77f1d136086716e7bdae6e7f83ac5f0027b397698e4a46a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013480, "uuid": "4c29f85b-bb2d-4eea-8231-021ed7031bab", "value": "T14A261802FC9546B6C26DE1346CB513453E71386883B23B97395F61762FF9BD81A2E328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013480, "uuid": "3e9dd11c-510d-401c-8e94-533bf1e1e56a", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013480, "uuid": "01c40594-1675-4648-8e7d-999a23cffedf", "value": "98304:GDRJ9SEeA6j3ucHGtnDHPcJKJEwJNkZlG0Km9B77TEE+nMpp5h6:0bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013480, "uuid": "f639c741-7d5c-4f96-8fe3-4f4b50ba8a95", "value": 4622193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013480, "uuid": "40211b41-ce50-429b-a956-65c191327cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013480, "uuid": "f8f2e71c-d48b-4fc4-b8b7-d6f0230bb287", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00b69ef-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010297, "uuid": "6882baea-a1fa-4f87-84e2-dffbf5f250a9", "comment": "Malware payload (Mirai)", "value": "76c5d49c580de133c27477bf9dfda194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010297, "uuid": "8e243db4-cf57-4c5f-89f2-fbdc8776af01", "comment": "Malware payload (Mirai)", "value": "9534e732e87f3ba57adff64aad8aec5165701cab9d15a0e2dd83c7c02c888c91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010297, "uuid": "104d520b-6b9f-4161-9f98-d4719680174c", "comment": "Malware payload (Mirai)", "value": "29f287f8f73d41f11f4c7f6b498bcab8cad81932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010297, "uuid": "01a9dfac-cae0-474d-b241-1a63925098d8", "comment": "Malware payload (Mirai)", "value": "853d0faceef74b9d549ba2fe07e0d06210c3384e778a8ec09c276dc08b722ac0b23ed5a2ed670fa88e7fdc8dc0be5137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010297, "uuid": "45b4be3c-0779-405d-84af-8947a4283885", "value": "T1EEA2D088E7E6C4EFC844197524DAB95251E1ECD1C31D46A36F88C42F4A9BA54F130FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010297, "uuid": "2f845949-3ad6-4853-abcd-a7f2a74f60c1", "value": "384:McZjQ6CLLvLGyCnwIxGQyisDrsXRXtWFUiIWKve+2cRLwISFBfPbrkrD9SNSyf:1pCvvLC90QUDCRMFyeTewPFBUrRSLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010297, "uuid": "5fce8607-fd23-424e-97f0-22c61619a989", "value": 21508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010297, "uuid": "ca7cbc7f-8559-4658-8322-a5bd4a393f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010297, "uuid": "b9c31598-9a25-494d-8544-9e898a0551ff", "value": "SecuriteInfo.com.Linux.Mirai.9816.31054.21158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586f76c1-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949134, "uuid": "8a2edb9b-dcf1-45c5-83c5-ea3cb69e4ba6", "comment": "Malware payload (Mirai)", "value": "c2107fd13a009f6baf6f119a292a1b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949134, "uuid": "29b9da52-103c-43b9-a4e9-4c20f147b8d3", "comment": "Malware payload (Mirai)", "value": "9602f39a45c1b34271feb706101de0cb4f870105aad3f130485f0841e7bdf3d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949134, "uuid": "d9951c55-a554-4575-a749-9ff7f075c96a", "comment": "Malware payload (Mirai)", "value": "90754f2ca0fffc2bbb7967392818282ad82b9cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949134, "uuid": "2b6880f3-2d2c-4494-a365-feae80f491d7", "comment": "Malware payload (Mirai)", "value": "67335e21591d638d365a7e1cda6baab5bb7c537bf1f7df8b254af0a94471dc8bb09f7e690c1fd8c0341a10a83ab2de34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949134, "uuid": "2ca8deb0-dc06-47b3-8741-1ae9d508e700", "value": "T12A330113B759FD62DE761D3862F98CDE3048462ED4EC682235C899A163C315BBBD48E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949134, "uuid": "d57577ba-0d4e-4df1-b5ab-6a19d271568c", "value": "768:yfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfb/tOC9I9q3UEL2qEK5J6OAsNTGjf2tlm:9PtQjiZVcykHRDlJ9xL15J6RN2tAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949134, "uuid": "99a7d6af-4c6c-4fb1-87f4-8d1000fbc101", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949134, "uuid": "8d961bc9-c0a4-455e-b3da-3df4be00b754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949134, "uuid": "478177bb-4c63-48f4-83a9-ad53f4fd5849", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9f92ea-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941387, "uuid": "9f7f42dc-5776-4fe9-a399-e5d4c07272aa", "comment": "Malware payload (Mirai)", "value": "5291f31d2d75ebdce285ed09ed09541c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941387, "uuid": "76bba224-0045-4162-a44c-2d8771d117c9", "comment": "Malware payload (Mirai)", "value": "96a988d15e8d342e9f2ba4eda3a9bdded94170f743821fa1d97ab612cf69fac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941387, "uuid": "16a81c7a-9fe3-4d87-8579-1b6a8d725b0a", "comment": "Malware payload (Mirai)", "value": "abd2154b82fe8718da280906d3cc14b5e2565819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941387, "uuid": "85115b6a-514e-47b5-8197-e8b21f1dd5bc", "comment": "Malware payload (Mirai)", "value": "8d4f25427953bd135135ab4b5c00899ad8170e492a83895087f585730a814acc5c94b07075c91d41a166a4c07952f471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941387, "uuid": "2276ab9a-0c1f-489b-8827-99dc87831425", "value": "T1DEE32A45FC509B22C6D3267BFB5E428D372A07A8D3EE720399255F21378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941387, "uuid": "f18aa25b-9dea-4da5-b429-6682da94498a", "value": "1536:4YTfQ/eweefHRgXeQZSn5/Pcl+AxXFZAD5oVgTy20pBfCOoBJZxqXnHfKlt7wywz:4J/xeefHf5Ul+KAGml0nGY3/pYMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941387, "uuid": "6eb28ff7-e84d-407a-a6d0-ed5a2c98b46f", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941387, "uuid": "a43537c1-4a87-4e4a-ba96-77a21e4f47cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941387, "uuid": "f46314ae-f008-44dd-bcaa-ad1cd1565c29", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0ffaa8-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999499, "uuid": "6b3f732f-7ca5-41ca-aba5-b65cd679acde", "comment": "Malware payload", "value": "cd4d59f834df6754df6acd0a8dc1b28d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999499, "uuid": "96ac9b7b-0873-4f4d-b4aa-774b194e3fac", "comment": "Malware payload", "value": "96d52de6b4aaa997d8d6f76567e5991c234c1f4fc3fd93ad89aa556b2f6dd87a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999499, "uuid": "ea156fdf-e481-470f-ad00-5abd644e5580", "comment": "Malware payload", "value": "feeb9ecf8f8324cae1674a87e3db0325a0b2b16a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999499, "uuid": "898a9493-0ce0-48c4-b81e-eca2817d6657", "comment": "Malware payload", "value": "b5c806d91e087d3e0da99ed1b37c2862ba5550e4f878823bd37477768db07b488d8381e688d14aee146f38011c16f3a5", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999499, "uuid": "c4e305c3-1e90-40eb-a83a-ba3db8c4c786", "value": "T13F763333AE514957C640433AB03F2E362F7D67478A4CAAF3359C6147378BAD2A92F452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999499, "uuid": "378ac32a-876b-462a-a465-c081755b1c2b", "value": "49152:7iUEwNlWdwlQBGrUOSWuBm+rt3kD4t21uTvklxQUiwy1Eg8IH8rk48XLVnXOAKeT:JkevU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999499, "uuid": "d737afa0-07d5-429e-b6fd-d93b376052ef", "value": 7200768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999499, "uuid": "768d58f0-a7c8-4633-b84d-9cedf138c56b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999499, "uuid": "96772617-ac48-4f45-b4ae-99a9d470b955", "value": "CnsltLYE9M_1029DHVF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a47fe78-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770975283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975283, "uuid": "9b4a75a6-fd27-4d52-81b9-b6731dd17122", "comment": "Malware payload (ConnectWise)", "value": "a4366b619c403dc1c599ad10d7bb030d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975283, "uuid": "9f38a2a1-5532-49c5-ba22-9f237594cb63", "comment": "Malware payload (ConnectWise)", "value": "9787ad4b0c4091345249435ca75274af9fef6e261d25e9197c71767024d84783", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975283, "uuid": "4e44b335-e917-43a0-83f8-00acf5a2f2ef", "comment": "Malware payload (ConnectWise)", "value": "15cc57d4e699b5409ec78a548b2649760d36f8ae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975283, "uuid": "468d2467-8018-4576-8309-ea67b138b09e", "comment": "Malware payload (ConnectWise)", "value": "f0b166eb91d15b1509fd5f5685f3d365718eb4371c0aaa28770f09ff1d6220ae498fe67f64c6453c3471d6bfb5ae46b9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975283, "uuid": "a75aee34-ffa9-438d-8085-8ae929bbbfb3", "value": "T1B4C6237127E98425F1A79F39EE3A89E229347C64DB26C05F1BB4380E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975283, "uuid": "f23b169c-1b1c-491d-988e-48fc8216ca73", "value": "196608:ZKaLNkbghi4QyKaLNkbgRKaLNkbgIKaLNkbg7KaLNkbg:9WghiHEWg1WguWgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975283, "uuid": "f2c7537a-3bd9-49bb-a60c-3ff4edddecbf", "value": 12185600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975283, "uuid": "dc1806ca-4325-4cbc-9856-d05d2f9529ad", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975283, "uuid": "5a95b43f-9f5a-45a6-9c8d-034e606462a5", "value": "IDme-client-43244.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32778a4b-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001469, "uuid": "09fafdab-b90d-43e5-89db-d6686fafd95a", "comment": "Malware payload", "value": "4d06a96ce6a2c2ebc735222c85d42902", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001469, "uuid": "8f3c1a58-599b-4337-9318-6c325c5e14be", "comment": "Malware payload", "value": "97ff920a5467a5bc22b8a71ee5ff4ad571932d498ce752796be920b205c06677", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001469, "uuid": "f1bad3de-5bff-40d9-92c9-c558bd7e0e8d", "comment": "Malware payload", "value": "009d8b50112ed0520b0f3be485d4e58290b8718b", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001469, "uuid": "7e26b2d7-77db-4983-a640-3261dd3562dc", "comment": "Malware payload", "value": "a3331acf9c40e7795446f8237121102265d20fc1828c080acbfa2e6e1cd542367707d2d4160f6e840c0c80f326b5ad7f", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001469, "uuid": "a29ef728-b4d0-45ef-aa7b-5ec42a97638e", "value": "T131C533A9E9E541C8DD4B57F7971442C0A9A2A43EA3FACC646B131E71B3E0F94F13089D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001469, "uuid": "206eec04-4ef1-4ecb-885b-cbd95d37f997", "value": "49152:ZjSfltYBxEwwcmmjJBf9XxqhQCgP/gs3XlBMy1BpfEqTt9/N:ZjSH0yMJB1xqhM3X4yfpfEqTt9/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001469, "uuid": "71baf9f8-32d6-4d3c-8703-3dea211dddea", "value": 2731875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001469, "uuid": "562c484d-1630-4fb2-8f20-fabcd5d67d7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001469, "uuid": "7e3dea27-6e89-440b-abac-c4e4f9550da9", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f7417b-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986790, "uuid": "32fd12df-542e-4f2e-a76d-f47d5713ac1f", "comment": "Malware payload (Mirai)", "value": "0a435eb6e28b5b3dabd3cfdeda22061e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986790, "uuid": "b4ca769f-8099-445b-9848-36220c0dea0b", "comment": "Malware payload (Mirai)", "value": "9881055f3614e2e4b0b61ba4bbbcdec0164412be918197a7b16ed176b2b5c4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986790, "uuid": "2a575b50-b6d6-4fe0-b1b5-cec52abea9c8", "comment": "Malware payload (Mirai)", "value": "a890019417ec3549d8a875dff5707e8155e4b59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986790, "uuid": "90f50065-b54e-4e15-9178-d80e7ea87dd1", "comment": "Malware payload (Mirai)", "value": "a046d9981ac9117a50355fe91d113fdf360614530a3093551fc6cf5a5558cecdd3e7fc0d01ee0342a503d182f6f63596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986790, "uuid": "fe5dd53d-aaf8-404d-ba9d-0c6019507ab2", "value": "T1C173B605BFA10FB7E8ABCC370AA92B4129CD555B22B97B75B930D918F54B20F15D3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986790, "uuid": "1f79e0fd-8dad-4424-bfdb-f9c1a197dbb8", "value": "1536:vCG2+U+D5AwOe+4xfCe/v8L7k7sRUIVbXZLT24Zb:vCG2DASw44xDabXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986790, "uuid": "05bb5302-137b-4839-89c3-c1ddce3ab566", "value": 80308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986790, "uuid": "55e1304e-e40b-429f-be61-326af26adaad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986790, "uuid": "576d829b-8c56-4e43-bb65-3b905e1304f0", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a235b8-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011459, "uuid": "2f133ca4-24a1-4035-9b0e-a614be353682", "comment": "Malware payload (Mirai)", "value": "84a131b3494d1846e76213a6e60249a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011459, "uuid": "0b3b64eb-a44a-4859-8176-90b060e285e3", "comment": "Malware payload (Mirai)", "value": "98a83e3b4bec9d84def377fbddc5101ec7ad98843890ed153d7e3bbaffcea76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011459, "uuid": "e4794724-256d-4055-85e0-e3943b5aa343", "comment": "Malware payload (Mirai)", "value": "190c59666df4d55cc1adf954e66fdc6a38c36169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011459, "uuid": "1e115f48-4fe0-49b1-a580-91534b592b5d", "comment": "Malware payload (Mirai)", "value": "394d8f3edbc08e92668ca33ecaa8495251b80e1f2a089c48d670dcc7f2a4760d379960f57cd89e75d4a129086c30e875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011459, "uuid": "e0669e46-a023-446c-94f9-71ce5d92e214", "value": "T14D535B1BB58580FCC5CEC674476AF13AD533753D1239B2A967E8FB266EC6EA02E5D000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011459, "uuid": "2fd55e8b-7535-49c4-8106-181d7c3ef79b", "value": "1536:0+olRCVAfGzJSm87Asg5quAt7y0o0m+jaGD5ED5vkereee:qlcV/APu5mt7AJ+jaG585v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011459, "uuid": "e953e842-ef30-4400-87f7-82c546d0861e", "value": 63712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011459, "uuid": "a402405e-b732-40e1-9b67-daa3af5eeb79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011459, "uuid": "6a12578d-d0a7-4f41-a0bf-a934104d5ee6", "value": "boota.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4304b1-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011468, "uuid": "9c9cd8a6-cfb7-48dc-bac6-05d5bdb568ad", "comment": "Malware payload (Mirai)", "value": "8c096f8c4ca0edb59356afbc48208e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011468, "uuid": "3e336103-cbaa-4121-9758-1b25332aaf9c", "comment": "Malware payload (Mirai)", "value": "9920e71f7dde65e890ac3ede2a9c130a6a4f4a79b97cf2f4c731b55bcc8130e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011468, "uuid": "62254d7d-7296-4bf1-b2fb-6aa6b0ca122b", "comment": "Malware payload (Mirai)", "value": "cea680b61f0ad05abe7521a03086615dc2631295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011468, "uuid": "123ff4ab-2a90-4bb0-a59b-df0b100d8939", "comment": "Malware payload (Mirai)", "value": "63fb3ac85de59dd471595350cdce81108fb850ad9d57000649fa44526adf49a6d6eaac2b68a349d8166548caf5f3f770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011468, "uuid": "fc512733-be3e-48c1-a38a-75edaab20085", "value": "T1F6534B02731C0A47C6A35AB4293F17E093FBE9D121F4FA88251F9B8AD275E361585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011468, "uuid": "08c1f153-4f97-4cfd-9058-07af47685f11", "value": "768:1WzxKlk0g7oW1GoTuszhqQ5sPvIrcrKEQh4nh3c9r0BzVlKhIAXqUaFRut5quSxu:Al720GcNz5chNOrizVIhICqRuzOkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011468, "uuid": "6499d0db-4cf7-4c42-93e0-3d157fe8a927", "value": 63080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011468, "uuid": "1f4410cc-00d8-4a93-b115-579694aa1374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011468, "uuid": "e5e89ac3-72ae-43b1-b519-965794e1b7af", "value": "boota.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7305983f-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011456, "uuid": "b832ca4f-4b9b-47b7-a3c3-e171e3b49392", "comment": "Malware payload (Gafgyt)", "value": "7c9a4490dcb8dd4a0494fc0402c43796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011456, "uuid": "e45beedb-1659-4027-9f02-c74990c02f4c", "comment": "Malware payload (Gafgyt)", "value": "99260031e227d342dcb5d908142d56199fc0dbf5edec1a9c0be0f868c4f366f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011456, "uuid": "0ef38c85-f9e2-48de-8490-88c80c3ef992", "comment": "Malware payload (Gafgyt)", "value": "f0dd7dbb3617b5dc74f5ed9f0127718ead190c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011456, "uuid": "5f4ac1cf-0649-485c-8857-3ad61cae97ac", "comment": "Malware payload (Gafgyt)", "value": "ef0ba41d54cb3f29fba3860a1850263e29a0d942b5393ae75d6302f296352a7cb5f1731056993c55ccc5ae3c4ec45050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011456, "uuid": "8fe1cd97-4068-4819-9388-c37bdf5dec31", "value": "T127442927B6C08CFBC08646B417EBD932DC32F4BE1772710B77A4AE701F1E9999958A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011456, "uuid": "dc56b450-e25c-435e-931b-64f6c902c2bd", "value": "6144:g9YaQCTf19sOiOh6phabTQ+t+FyOhyG3a0baQQbe9q4R:gXQC719cOh6ph5lyOhyG3a0baQQbe9qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011456, "uuid": "f148d00f-3930-4f38-8f13-818957cd760b", "value": 255812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011456, "uuid": "3a745fb2-f2d2-4663-88c0-af59afcfcf07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011456, "uuid": "e6830c97-ff9c-4ed4-9cdb-e7f9db7544f2", "value": "swatnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac019c6-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014529, "uuid": "69c678da-15bd-45e1-b8a6-5848d7533581", "comment": "Malware payload (Mirai)", "value": "4380a41295c1e1fbb27ac34e8533f02f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014529, "uuid": "b2323fd8-d8ee-4bd7-8a93-aef7c053698d", "comment": "Malware payload (Mirai)", "value": "995192b878805837d77c8bb54925121b81a05667e0d3df8cc980c7a1a3c4de27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014529, "uuid": "57c9890f-ff7a-4621-bf1b-54ccc64cb006", "comment": "Malware payload (Mirai)", "value": "08b1f8662d8c6b4ea6136fb5133d9fb1b4c86a9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014529, "uuid": "778822b7-8499-4807-8a76-bb4c5ae3092f", "comment": "Malware payload (Mirai)", "value": "2bfe5bf0d41df5fe490eeca8113d675a327a3e8ea2c9fedd7478db92ea256f08d94b7a1fe599d23586e0c2706be17c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014529, "uuid": "2324f4c6-ab5b-41fd-acbb-0a297677eba9", "value": "T1FD03F1BDA46695A9DCBF06BC341E7A0F1C0155015F9AC296FA4CA47B38ABB3C7305381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014529, "uuid": "d19d0ff3-ff63-44a3-964c-dbcdbae97e7b", "value": "768:lWEpd2cR0FVepN18qzdmtRPwZVp60gR56VlpVqhOthWBrtFGMiKkD0NB3onbcuyu:lXjnGMN18EUtK6Br6LpQhOthaFGMiKkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014529, "uuid": "ef39d8e2-de04-4e05-b146-5223ffad2f31", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014529, "uuid": "408ae6ce-6e76-451f-b7e5-8f1e4f4e4e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014529, "uuid": "96cd1b4c-528e-4f0e-b826-f432b83e203d", "value": "Calix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ac14f3-08a5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770964189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770964189, "uuid": "ded5d106-f0c9-4ec4-b8bc-a4253536aa56", "comment": "Malware payload (Mirai)", "value": "e21e4a0848184c6df7875eab26f7423f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770964189, "uuid": "e13f1696-954c-4a1b-8616-d855e7f1ddf9", "comment": "Malware payload (Mirai)", "value": "9974f78b57cdd5938f472dfd5af2ed9e8167b1b0b3d33004197003a45db52c09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770964189, "uuid": "001ffefc-d50c-4c23-af9c-edac61dee13e", "comment": "Malware payload (Mirai)", "value": "28271a4c8d7ec8949dbe3ddad1f05434744f1990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770964189, "uuid": "58adfff5-6712-46e7-a198-b07252f10c7f", "comment": "Malware payload (Mirai)", "value": "07343b8fdc4738296d3a585011ba2d93697967ef4aba7132139ab1c6ee32520a591ac730b8de61a18739dbd5ff7bb7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770964189, "uuid": "6014bbe5-dd9b-48ac-8440-be9e1265a48f", "value": "T18E830982F9829613C6C112BBFB6F418D776713A8D2EE72039D256F21378786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770964189, "uuid": "381e73e5-729e-4046-a706-5c328dd0e27e", "value": "1536:cKDLhQ3BlLywjmConIxqPON/6mKBJw342nKPrbdtGwEgvWj0AnqDf8:cKDqXjmConIxq2N6mK+nwrbdzAq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770964189, "uuid": "17c0c90d-428b-4112-813d-ba7a4cb3c0fb", "value": 83348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770964189, "uuid": "7593f6a1-49fd-49d2-a68c-6a1e0e74ccde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770964189, "uuid": "d7af54f8-fd02-42de-abf7-68fa91864619", "value": "herios.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7118b5-0880-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770948500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770948500, "uuid": "2e0024d9-83a2-49f2-8dda-e2e8d9880961", "comment": "Malware payload (Gafgyt)", "value": "836ad64dcb0684d7c056045f6ddc86f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770948500, "uuid": "d7f36ec0-6dfb-4807-8ced-fa00ce9464d5", "comment": "Malware payload (Gafgyt)", "value": "9a1bd4bf9ecb0a37952279df8d813f3e1bcdc32a33cf133063007c05fc4dbe78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770948500, "uuid": "8ac29595-2631-4d0f-92ce-f90904e953d4", "comment": "Malware payload (Gafgyt)", "value": "e8d80cf8ea1a42eac7b3317d048597214a5c42ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770948500, "uuid": "07b6603f-a6cd-456f-9e88-eef1fd31e549", "comment": "Malware payload (Gafgyt)", "value": "845e1c48bc7fe057c348943be3a346bc18c881abd7184e569ee8ac61fde3981e29cb5f2618fe475596b8555bc7602ff7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770948500, "uuid": "d58c1d28-8a0e-4fd2-97bb-1b3b6239a416", "value": "T1F041DCCAE5920531FCA4993731AB54483591D59E56CB7F0828DFB4F990DCE4933C2AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770948500, "uuid": "46c3ba02-8062-489e-8886-73feeae6b73f", "value": "48:ZS+t8Xyb5seAJ+yW8MxMGMTMsoJWoLXWAE:ZS+tjeei+yWPqVosaWoLXWAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770948500, "uuid": "76bb9d87-58c8-4e2b-99f5-5839b9e7d4e4", "value": 2135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770948500, "uuid": "30358363-4da3-4a71-bfad-bdf734bef36a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770948500, "uuid": "55526c6a-2da1-49d9-b07b-500c560cea9f", "value": "nylexthecat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8d9e12-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025808, "uuid": "7c933159-6d95-4ed3-9b8e-551cb1eba303", "comment": "Malware payload", "value": "1c52c6c3a8e805fdca84b7ffdb57b095", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025808, "uuid": "b9062885-3da8-46e1-ac71-184e2873afc8", "comment": "Malware payload", "value": "9a58bc4eda32e677cd1b7fec00c1f39c2b828d05742b3a7ed4cefd44f9066746", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025808, "uuid": "48c300a5-7f67-40a7-8582-129cc32a6958", "comment": "Malware payload", "value": "de1f90c4ad8bbcd77f0209c8ed30b132a161a8b6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025808, "uuid": "900d0476-237e-4b92-b9e9-e7eb3077439d", "comment": "Malware payload", "value": "bb5179a9d630f96232b69af4d966b42ecc8ffdd7d9730c866b3b3efdcab480913c39e35610e4d00f8c838d8c0527a377", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025808, "uuid": "8eff7898-e30b-42ae-a6ca-860541fa5085", "value": "T165362331FE812857C1908B72717A3A357D3E354386CAD980A8ECE2577F42ED6537E982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025808, "uuid": "66fc9fb8-0652-4169-9f7d-33d51332ec5c", "value": "49152:z7K8cslqqk1HMbpy7jTaqo+LloN6+e8MjQxsVJCl8VO8mG0kxX72lrWxMDVtP5TB:/3Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025808, "uuid": "fd1d3955-75d9-4df8-89dd-12157f94cb27", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025808, "uuid": "20987fea-ae83-48b6-82be-26e569250324", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025808, "uuid": "5796c527-77ca-4ba8-b3ed-98355676f616", "value": "Nta-Cr8XHDIT_291836YMCBEFPLX4.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce939f7-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770973918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973918, "uuid": "fee3ce17-92c4-4c90-b163-5b17f09735b1", "comment": "Malware payload (AsyncRAT)", "value": "97eb4ef07bb73a47b66edb0a9146f601", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973918, "uuid": "02ec7342-dca1-4bbe-95f1-f4b8f57d08ef", "comment": "Malware payload (AsyncRAT)", "value": "9af0b0fc5a0e99e843539d69b31d5ff10c157cc4f0e31db0b6d24b3be347d57e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973918, "uuid": "e05f036a-d781-48a2-afd9-549bffc99e65", "comment": "Malware payload (AsyncRAT)", "value": "9fe87d1191896bb2af238911aa00643ffa3f2804", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973918, "uuid": "328c014e-b42a-415a-b748-9852ac2a1001", "comment": "Malware payload (AsyncRAT)", "value": "8907e8af2cb583a303ab6a3619121c0a22f0bd3c9bce3e4e3671052e3dfd7353b9d18df14e8de064b7bf5da097b4a366", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973918, "uuid": "04932d1e-f878-4d42-ab11-17d4d77559f6", "value": "T143D24A08B3D48566E1FD57B94D7292048771EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973918, "uuid": "77957eb7-61cd-42f0-b7dc-5e72d8a78f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973918, "uuid": "15e4e767-28c2-4d74-96b2-78833f33d591", "value": "768:c0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dTj/+:roRXD/qymB1iwRbN/V/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973918, "uuid": "f011fe99-b8f0-470d-b1a2-99040c4cc8be", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973918, "uuid": "37a496ce-5616-4240-b199-9ab504d4d258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973918, "uuid": "dea55083-d41a-42ee-a842-5e56e2e75fbb", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0945bc0-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001788, "uuid": "58dcc7c6-b37b-40ed-948d-9316f0e2b97c", "comment": "Malware payload", "value": "7a680a6555faea92c126750b3496bbff", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001788, "uuid": "aedd6009-1589-42ab-8570-2e9b79de6a8e", "comment": "Malware payload", "value": "9b43819456c6dd5ccdf459abac6d23bffd191c33ec38a119e6db3186c6aaced7", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001788, "uuid": "9de45ca0-29ea-455e-8528-ecb4f227d43f", "comment": "Malware payload", "value": "df452118424a97e079050443dbf3cf1afe071285", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001788, "uuid": "77e00aa4-a9e7-42fc-80b1-28a66df56d13", "comment": "Malware payload", "value": "2ddab4802c6663e7042b3e69a0f3a92781a73f742da295785c91d93cf0cc8254ecb150c7a6ae9eb7ea118158ef8954a7", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001788, "uuid": "0e851e51-e253-4d68-b638-ce2bb0bedb88", "value": "T1434633D76749EAF0EA9F1C7205D25A0F1BF3998600A6F15E0E3E86492BC38B05179D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001788, "uuid": "6143c527-b8c9-4f01-94e8-cd812af1ee4e", "value": "98304:qZoAONgb3QKtWMFtR1xl53qWCyUAFFTEG7pzfir0kUAWVDKhB//L5e2in:qZp33tdtR1QyfFzNzvvD8VJin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001788, "uuid": "21dbd78e-5145-4cc5-911f-e1a53a84ee6b", "value": 5585788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001788, "uuid": "d5289a2e-66a9-4144-9be5-21a0b0c25e66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001788, "uuid": "b392dc1d-4e00-4356-af6d-6c0bfafc89bc", "value": "UTmgce&I74q$lNsZt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a216f682-08f0-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770996502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996502, "uuid": "e93c423c-a66a-4bc3-8c3b-80b4f339f2e6", "comment": "Malware payload (SalatStealer)", "value": "9678dda359a8217062234a5d3a1cb399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996502, "uuid": "9ea4c38d-6915-4a68-9d10-a2ed13430a74", "comment": "Malware payload (SalatStealer)", "value": "9b458c288eae9ee7c1691295fab47b23cab86fb9d6d75986f1f0ffd05beccdea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996502, "uuid": "94ba8ed9-0c09-45e3-98c4-aedb1878d7c8", "comment": "Malware payload (SalatStealer)", "value": "b595b4288b148751b8a0bb768df579d9756d5714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996502, "uuid": "857b9ed7-0783-41c5-aadc-e26afdf3f764", "comment": "Malware payload (SalatStealer)", "value": "6ae3e00b98a66a6a08520d63ca25f9627f38666ffe2eb3f70f1dd29b21e7784c4f867900d4657fcd3f1afe27810e56b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996502, "uuid": "a2a9c6b3-3e4f-4f51-ba11-e8d9c394e841", "value": "T12F162319D7E404FAE1B7D078CE828526F731B84907A1E6CF13E599676F236908E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996502, "uuid": "79196ca1-ff90-403f-8eda-e613f13f0ce2", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996502, "uuid": "b6bc25e5-baa7-4bc0-8a4b-b4ee24f61e18", "value": "98304:YvO88xRTtNu6LJQ6To2CtJI8GCywBnkdB7xAWrDU9:P8q6/vdG6uPro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996502, "uuid": "ba6d18f9-399a-4277-a52e-c8bcde5405bb", "value": 4144723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996502, "uuid": "074a61a4-76db-47ca-b991-92dc96737abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996502, "uuid": "30446c42-7001-4502-9540-868bedd58faf", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d357f829-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025791, "uuid": "9406b004-14c2-43cb-a171-8d7811c820b9", "comment": "Malware payload", "value": "8c88b7ceffaa97e16cbf3082998a1b66", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025791, "uuid": "2b713648-9ebd-4e5d-8b87-6e8a96b30632", "comment": "Malware payload", "value": "9b9b3398632707999de79894aeed51246c725f098506c60d9e6ddb02220d1ccc", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025791, "uuid": "a58cbf5f-934a-4add-bf3c-47ef9e89a3ff", "comment": "Malware payload", "value": "221e043c7fe77952d65b237ac90ce87b39be64be", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025791, "uuid": "326d9ac6-7753-4307-b4ca-b14cb3aa2799", "comment": "Malware payload", "value": "81e13485473638f72300fd8a05a21726de6b3c4cb90c010b532862ea2857b350a5750d3ab71625519402fc6c3b9bd672", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025791, "uuid": "97a98748-ceb6-4a61-ad50-850ecf438dd8", "value": "T1AD362335BA410C9BC99087B5B02F2B256F3CB64F4388A1E3B45DB6472787EC1A63F495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025791, "uuid": "53464eb7-931e-4a17-9d04-988881d14efb", "value": "49152:+ImgKPFxSMKkRgw4Co9+vzLnz8yB7ikHsN8B2xJ0Sn9SYPh0GzZi/go2pAGQ+VU:XagU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025791, "uuid": "64c3f53f-09aa-4c9c-9672-d7994e0ca267", "value": 5015552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025791, "uuid": "d3ba49ab-aaa8-4c89-9265-cc1bfc2ae621", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025791, "uuid": "c905f01a-e6d4-4653-89bd-3806baed5624", "value": "Nta-CrZ4CP9_33746BNNXXU3R44.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6764bb2e-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974070, "uuid": "039a20ca-e86d-4a5c-81b1-76cbb2766cd5", "comment": "Malware payload (Mirai)", "value": "1ee1a0fe45365fe34f1f932506d1c585", "object_relation": "md5", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974070, "uuid": "22f6d9d8-6560-4a34-b148-2f6440dd26f8", "comment": "Malware payload (Mirai)", "value": "9bfe8232cbd03e6c165b85914c73f9418e3204678b5c6ef2a0c4d519e4c401cb", "object_relation": "sha256", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974070, "uuid": "604339a2-1c33-4222-aa4c-457035d7f48d", "comment": "Malware payload (Mirai)", "value": "7688b09619c78c9aa6010cc039810e5997977f5e", "object_relation": "sha1", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974070, "uuid": "8db86d21-695a-4955-9bbc-0a57f09ef75f", "comment": "Malware payload (Mirai)", "value": "15bd34745721fae14c016bffdba8e23041305d8edf18e6518ef74bc4da33bf68a76f63e149ce62ad3a39a064092c6c42", "object_relation": "sha3-384", "Tag": [ { "name": "arm5n", "colour": "#246FA2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974070, "uuid": "f5ae24f0-d62f-40d1-8677-2bfb1b0672b6", "value": "T165330986BC918957C6C8177AA75D118D3322A3F8C3C97315CD188B2567DEA890F7AF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974070, "uuid": "27ed67c4-f001-44a7-880b-d84002e37734", "value": "1536:SCYQog4wIAYQog4wIAJBZRph5xJBZRph5xJBZRph5xJBZRph5x2OGeWum+21153f:fYQog4wIAYQog4wIAJBZRph5xJBZRphu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974070, "uuid": "d18ad661-a5b4-487e-85ee-1bfc2e9640e1", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974070, "uuid": "2d4ce1e5-73bf-4bd6-87bb-93ee520c5920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974070, "uuid": "28664f90-11fb-4ac7-b13e-a983ba37ab42", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09abac74-08f3-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770997535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770997535, "uuid": "f4d0dd17-c2d2-46a8-a73a-f684701f44e3", "comment": "Malware payload (SalatStealer)", "value": "385560727e007dcb67eb01ca9f38f0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770997535, "uuid": "ccaa1f48-0950-41a9-8b96-a71ea364434b", "comment": "Malware payload (SalatStealer)", "value": "9d2118a91d26519fe3ef4c7fb1c4a2ae77da70962e10d265c3085872a7508b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770997535, "uuid": "dd1202e3-128a-43a7-99b8-80cf1c9c99a4", "comment": "Malware payload (SalatStealer)", "value": "251d2215899077d1eb461e3725fb1b1a2308e5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770997535, "uuid": "8158d9e4-b79a-4513-a622-9e6a870dd9ce", "comment": "Malware payload (SalatStealer)", "value": "07fdd8d2305b38c4d639aaa14120ff2a9993fc3d0829d00e4b2faf04f9ddcab9ff227ae3952d1cf5fa28fb79fc04389b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770997535, "uuid": "f0fa1b55-45b9-42b5-b7fb-cce74c0cf299", "value": "T13F262340FF832AFAC979167524AFB77E96B00B01801ED9F7D7D49D967A2BB01181B01E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770997535, "uuid": "e15db7bf-f40a-41eb-b05b-10f19cc659f6", "value": "c81d7552ddcefdff510b16a861ccc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770997535, "uuid": "be77f14b-c238-4786-900d-5a616096eba8", "value": "49152:/+KAbSxHnCFajoz369YQxYdi7IUUMsOMrQEmF0c1SsnLfat58a+uCU:OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770997535, "uuid": "bb58c7d5-68a9-484e-be28-f1fab0532f0f", "value": 4737536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770997535, "uuid": "4f7e70cd-2369-4fea-9435-3320e2592701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770997535, "uuid": "0f2ae45e-98a7-409f-8621-21316dda9a6e", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562a0f45-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973182, "uuid": "6dae43ed-cfc6-4d3e-b6e7-1c575380231b", "comment": "Malware payload (Mirai)", "value": "38fd198f9156c227ffd9c14f07a661ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973182, "uuid": "e9048150-2a38-4983-867b-af170211bc35", "comment": "Malware payload (Mirai)", "value": "9d5eb373dcaab4676cfe902bf80bae9cb408f3f928e4c7a7c3400350a5951747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973182, "uuid": "fbbdff36-bbbf-471a-939b-7ffa58344fb8", "comment": "Malware payload (Mirai)", "value": "95cdbfc1bb41afd2fad43dbc7938321925f3e9f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973182, "uuid": "8d9b053f-f631-4d23-a607-c37e69c1237a", "comment": "Malware payload (Mirai)", "value": "e430e617a5ea094fa29a336067bed2419d0d461be140edf84bd12e32bac73c118688f4006858e48d311e357f1cabd302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973182, "uuid": "e0068bb3-f7cc-4bb8-84a9-41ff85c8a176", "value": "T16493C582BA47CFF3D44714F042E76A3A8A31FC3A4C36D596E766BDE5CA231C16215368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973182, "uuid": "16d53fba-e6db-475b-9315-c7ae936cbe56", "value": "1536:V5rJ06T1ZiNMjNb/1Cdgr5lWpCk+Rrgc5/CwAiA4:V5y6TfYMJdCdUOoPRrj5lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973182, "uuid": "66e8920d-54a6-4ecd-a0ab-b396bc9839a1", "value": 90392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973182, "uuid": "9a689953-c9d2-467e-9341-ce24fab36224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973182, "uuid": "da45f8bc-9902-4a80-8f78-4527fb7b4243", "value": "sys_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24190e7-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978088, "uuid": "9332784f-fc4e-4e30-949b-7e5a9f708583", "comment": "Malware payload", "value": "41e3b4b942b8612d5ccb484400e68ced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978088, "uuid": "c233c9af-bc71-4f12-bf97-b995cb0b743c", "comment": "Malware payload", "value": "9d70d33f599b92639c7d852f87610e9863aa1e275967a6d054895b81a942fb8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978088, "uuid": "509b6fc6-b318-4f74-aa6d-8fda834ca098", "comment": "Malware payload", "value": "0760b8bdda935c0161694c49ef362c76d4f9c12c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978088, "uuid": "909678b0-200c-4c2d-95c1-b0fcb6acdf4e", "comment": "Malware payload", "value": "b04ad17668563644d55ca3050f88533d4603d224f492883f0db136f69c3fc380a843d040c4be39b61c9a9ed851c8ac70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978088, "uuid": "c8be1bdd-7f6c-45b7-b0e3-4a6f154e7db4", "value": "T192056C17B2F330FCD16BC030479BDB636975F46A01216EBB21C4AA352D52EA12729F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978088, "uuid": "05cf9da6-dad2-49b3-91cf-643b881b78b8", "value": "12288:5jaM2VIru6GVgGSLDnn4LasPjytyyC/BXtreI:FaM2VT6GVgG2Dn4LaEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978088, "uuid": "48fad7dd-ec7f-4f5d-872f-70c7f78acac6", "value": 797984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978088, "uuid": "2eb74b81-5ea9-474f-b028-1dad36a47823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978088, "uuid": "98ad03d0-d491-458e-8ca7-4aafcf9763e4", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c23b0d-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955498, "uuid": "096ca321-257a-4c7d-86dd-e04e2e4925ae", "comment": "Malware payload (Mirai)", "value": "c36b6576560309adc092e9f88ece2bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955498, "uuid": "1fa08d02-d843-463a-a769-08bb2eca4a38", "comment": "Malware payload (Mirai)", "value": "9d75fd2dc55207798e4b2daef1c8b104e14244ea3170bcdd28d8c80ed66b3ee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955498, "uuid": "bc18dfca-9e19-4fff-9247-c64127da4650", "comment": "Malware payload (Mirai)", "value": "199404c7f497f65f34b4b33e3298e09e57ec0819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955498, "uuid": "235493cf-7039-44cc-b426-459c7a03433a", "comment": "Malware payload (Mirai)", "value": "2281d695b8c21cd24b4eb93ab33065bd26db85b7451d4cb11de888e3c62dd759d446dd24c5b316569bee2c8ef2a0014e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955498, "uuid": "233eda1d-53b8-4653-9bfe-36331a1f0c2d", "value": "T1D1A349D7B801DDBDF84EDBB744530506F531E3A219831F36626BB9A7ED351A81822EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955498, "uuid": "3446945c-b905-42e2-a65c-b9579798b159", "value": "1536:FI3pWv1rezb4ZWMRMuY1rQP8tm8IxzrS2elsMWRbfbL0dGSKFwiYl6:qzUN4rQP8tOQstRLCKFwiU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955498, "uuid": "89cca4f8-d473-4946-a30f-d8c3670b9ba4", "value": 98728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955498, "uuid": "83a2f8dd-821a-4688-b153-77751422296f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955498, "uuid": "e8c3ada1-cdd6-4502-9d09-7a601cca7c0b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314b70dd-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007910, "uuid": "ee35d9c9-7571-4aa9-9f87-0f1b3e2c483c", "comment": "Malware payload (Mirai)", "value": "663ffc6031bd61f7d6654234ca3e0f0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007910, "uuid": "e43b0c2f-69f5-4241-849f-d661562d17c9", "comment": "Malware payload (Mirai)", "value": "9eb5938a7a6e070b8b112916bdb0cd67b1416195cb27dae1ea3486c63f0f6275", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007910, "uuid": "687db0ea-553b-4d50-8ea8-16ffcfe3ca18", "comment": "Malware payload (Mirai)", "value": "972c2bc983fe18dff91ad5a2b6c0f9ec1b0cb3c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007910, "uuid": "f4f932fc-0232-46f6-a6c8-a06007d81db6", "comment": "Malware payload (Mirai)", "value": "65db04cecb3657b68d8d4938664868239526770a0ac9cb07d9a05e9685d0e7ca4cc685e74169c86345b8cd6f5840d3c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007910, "uuid": "8fead74c-3d22-4d60-a47a-f10eb578c0d4", "value": "T1ABA2E1709747DDA085B04C39EAA3C7931D77097C93EA711E551066255BC622F21BF4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007910, "uuid": "24abbde3-271a-4d42-a5e4-50a33592ddca", "value": "384:D2I5hpgy5Kbyq1kkIdd68ZJBASdTFVwwq+ihymdGUop5hS:KEhpgy+zbCVwwss3UozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007910, "uuid": "3494e9b1-9b51-4325-a5f1-2b4dd4fe6628", "value": 22184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007910, "uuid": "9022e557-9e22-46dc-be81-41cab9c1f2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007910, "uuid": "0c95f66a-deb5-415d-897d-e1e39e694c0d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25aec9f-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770972558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972558, "uuid": "bbbeb47c-38df-42a0-8bc8-6fb2c54b3b56", "comment": "Malware payload (Mirai)", "value": "e4a8d79b0027c2b6341c9f7f7d4fe0fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972558, "uuid": "a2806c9a-2002-469e-9f74-2cc0a82f1dca", "comment": "Malware payload (Mirai)", "value": "9ecfa8723d042c9d4f60991e2b337cea5757fa5f39c729c5744123ea1da0c6c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972558, "uuid": "a091b18b-5851-43c5-ab0d-575fc0dad9a4", "comment": "Malware payload (Mirai)", "value": "aba5a27b2faf96cc5022b89b95a8660630ecccd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972558, "uuid": "9390bfef-79bf-47db-b274-0d7be3b7db64", "comment": "Malware payload (Mirai)", "value": "c76b6f0fb5d9bd27861c9269b85257d17817e1ff0d2d736db4394d2748425af3858ccc1db6cba418110c2e75d96a3564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972558, "uuid": "2c7ac083-c5df-42be-9b55-4051bf95e7c7", "value": "T1F0C30845A9429F01D4D731FAFB9F429933536FA9E3F97101D9205F6123CA98B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972558, "uuid": "2a214161-b016-482f-8701-7ab96588a35b", "value": "3072:mLdeWa1ASpKpZqMVTzTah21troOdBEn6ARuf7cH:GdewpZDVzTah21troOHrAsf7cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972558, "uuid": "2af669ef-11e3-47ca-a300-75f0e6600374", "value": 126368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972558, "uuid": "aab53c1b-2a44-49bf-9cdf-d8f8f25a13e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972558, "uuid": "4d8c5c90-69a8-4d35-a554-a9c108789fb9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afd2a4a-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011442, "uuid": "0ed07d92-009a-4ffa-b55a-f3ad04baba7f", "comment": "Malware payload (Gafgyt)", "value": "d6710f8547aabee0f9c9f4638a5ec00b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011442, "uuid": "2a5c3891-483e-4cc4-af97-66f5263c0757", "comment": "Malware payload (Gafgyt)", "value": "9ef006eaf6c5fdf87017615137dadb31ed9ee0a73d8a393633cb12527424da2f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011442, "uuid": "777728d2-6473-483e-aa2e-c01b6f23d11b", "comment": "Malware payload (Gafgyt)", "value": "62546ea0f0cdbdcc5ca14018412ef89636c3fd6e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011442, "uuid": "4a96b03d-82d2-4caa-b4ae-e17e14cb4a84", "comment": "Malware payload (Gafgyt)", "value": "10f61119a0939fd5504625d3c164d1c6a455688271f6bb12235d3206e40ee25d6a5e2004e080b4f9b7bf08a512a3126a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011442, "uuid": "7469589b-f7db-4428-8774-7d4c2509363f", "value": "T1DC31C4CB26B144703CE5A857B3A9944975C8F1CA00C7AFD5A8ED7AF4418CE14F058BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011442, "uuid": "e9d0b11d-b6d2-478c-a2ec-3bf8cbef6022", "value": "12:q0F8v7aGheo0F8kgaO0F8A02RVO0F8CO0F8oHO0F89YXO0F8jSO0F8jQAlWFO0FS:v87DshP025t1RxwQtJ1hV/KiwAEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011442, "uuid": "6fcca5c9-5305-4d8f-a5a8-0c5e5bc71f77", "value": 1723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011442, "uuid": "4cf6d96e-361c-42ac-8bfa-c7dba9718ffa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011442, "uuid": "3580d177-78ee-449c-8883-5be325a5ae0b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ca7d1d-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949126, "uuid": "56ef824d-4201-40fb-a356-d29b486db4fa", "comment": "Malware payload (Mirai)", "value": "3794e6343d9e5bde881ce7c4d1c517cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949126, "uuid": "a3a32250-b5f6-44db-b03c-de95e733ac43", "comment": "Malware payload (Mirai)", "value": "9fbc9b2dfdb3b1f0883e2ca5b34eb74c6029bdd80f2ad72d3bdb1bdbd74038ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949126, "uuid": "38b251cf-b2e0-4b05-9ff5-194c700bfbee", "comment": "Malware payload (Mirai)", "value": "854c9b031a8426046eb34c0925c96a61a9a3d030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949126, "uuid": "ad89b91d-b0ae-4ec7-864d-2daf907c3036", "comment": "Malware payload (Mirai)", "value": "efa31bb8f6a279f6faf9d0c24da13c89607280cfdd9012e21b0af40f407e1c0cb46b07c239ab420c2e7c5488df7f673a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949126, "uuid": "dc7a2798-7219-4c67-b222-eba09b657d06", "value": "T1B9B2D02461AA60F0CD316438F97EC943EBDA41FE90FD7721261640F85A5A88D19ECAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949126, "uuid": "28fb4e87-8641-44b2-b4c7-6fce7e904718", "value": "384:AoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1WhymdGUop5ha:waNSq5sOHpTqncvsdDePiAUgefoeDeXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949126, "uuid": "09bf9c44-3668-41d6-8640-53104240e518", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949126, "uuid": "cddf11c3-5685-4205-a563-1197f083bddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949126, "uuid": "814dc1c1-8dfc-4691-9f7d-1e0929c231c4", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6009c95-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978041, "uuid": "0e7f6aa0-e689-4a13-9d1e-f03fdb6bf059", "comment": "Malware payload", "value": "11f6ac6eebd61f2a89ead4491027fdde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978041, "uuid": "ab854bdb-a6b0-415c-8348-bd7a04f4cab1", "comment": "Malware payload", "value": "a0aa06cc8ab1ebf9307c132e2203b510a4b9a57cbaf7d1c372f6a89a29e7e6c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978041, "uuid": "3d2f716b-ba37-42a2-9cf8-ce96c25864c8", "comment": "Malware payload", "value": "1ec5b4f4359ee16a92043d327280304d7fa9b5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978041, "uuid": "f94ff1af-8e5d-4be9-9661-0a2f707adf6a", "comment": "Malware payload", "value": "7f667fb1d37c776efcd05e9369326898b5c102e776853de9f2d1bf1e0e716d3ac32a3a4baa3c24acf9bc476c23c34d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978041, "uuid": "f12d2e41-2a3d-4b67-93b4-7577915cad5d", "value": "T13F944A46F8808F62C6D539B6FB5E8298735B4779D3E6B1069E144B3437CB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978041, "uuid": "5c891f95-459f-4a9a-bafc-4e63063bd450", "value": "12288:hGyolwMlpq3x8VIfP2lJZadT3CNATkNmVtcJ52VRUVi7SvQ7RF+zZ3iZYQpKKb:47lwM5MPjax3i+t3iZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978041, "uuid": "211cd9b6-8860-4154-8d7d-ddc686a85545", "value": 447064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978041, "uuid": "06a57053-d3e8-40d0-941b-c6c96c8ae49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978041, "uuid": "a66328ca-7b44-45f5-a14a-ae3546901cef", "value": "dlr.ARMx32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32b7092-086e-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770940804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770940804, "uuid": "7aa04997-a6ef-46e8-83cd-c914a94dc518", "comment": "Malware payload (AsyncRAT)", "value": "f3aeb0b18295996edf9b14beb46f4308", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770940804, "uuid": "1f3fb5b1-9e3d-4740-8dcb-e48ed13bc6a6", "comment": "Malware payload (AsyncRAT)", "value": "a0bb1a57ce9f24c426e6a396bece5ad8ff28e04789c83ebae2180c2a8b51d881", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770940804, "uuid": "f6cf228b-ce3b-4301-a506-bfe96601136f", "comment": "Malware payload (AsyncRAT)", "value": "0a6d0fc78607d8583f535b3be0b32d7b1a821ddf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770940804, "uuid": "03bfe1b1-c713-4e8d-8a78-e029ac52e637", "comment": "Malware payload (AsyncRAT)", "value": "aa1d542416a5f7944101a780e0e1f646f35cef1429e26f25ff381ce72bf5ce42c2beaef161c40b2f5518c2c168d33b32", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770940804, "uuid": "f20d77d8-13bb-4659-bc7a-bf19c1b70864", "value": "T1CCE53335A54FB4DBD84A4C72957CABF1053EFFA1A49B06CC04CA4E3DF6C98268D11A6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770940804, "uuid": "108ece17-1df7-4991-b96b-f72af051536c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770940804, "uuid": "cd5dcc43-a55d-44dd-99b8-60b7c798f03c", "value": "49152:0PACmGMbYTWWkHjwacT2iHZfsNuXxuqnN+2dBaPgR8rua2aDVPe3YIF7LqpAhuQ8:gmqWW2wxT2iH7huqN+SBX8rdVPeNF7Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770940804, "uuid": "ebcacd1f-61c8-4b42-87d8-0533f6b3498d", "value": 3074560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770940804, "uuid": "1521985a-f8fd-4141-af68-668cf2036346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770940804, "uuid": "10f0a385-f83b-49b3-8a21-6a80557bebc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94adfa67-0928-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771020532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020532, "uuid": "3ee0780a-1e6d-4675-a145-ed96229a94dc", "comment": "Malware payload", "value": "b4d2fe21a468efff2e1a41eaa3cdd50c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020532, "uuid": "b5f3804c-c021-4647-a214-e1b18232baad", "comment": "Malware payload", "value": "a1908c349133c96aaebbf1ca00f031a56823c19979b8d56d7ff615fd412eec79", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020532, "uuid": "3f160b1d-94df-47a7-ab20-aea0f539e120", "comment": "Malware payload", "value": "140ad92f9988baa2cebc07e7b5dc822e1a16f6cb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771020532, "uuid": "edd7d0d1-7b42-4062-9eb2-d03803534586", "comment": "Malware payload", "value": "e803f8d3d61d2084f9966fe3f19145ed8920a587f910784b26227fa10d7c711245ccc4de8fee306e8cb3988022903198", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020532, "uuid": "96a7253a-8760-4149-87cb-c05f0e705d84", "value": "T19A936C41F3E142F7EAF2053100A6722F973663389724E8DBC75C2E529913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020532, "uuid": "cc41c843-59c4-40fd-bd08-469118532bd4", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020532, "uuid": "dcbcd73e-55fe-4462-9855-6f588a9b1235", "value": "1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfPwuOZ:T7DhdC6kzWypvaQ0FxyNTBfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771020532, "uuid": "7377b339-b823-460c-b725-fde7cf8277ff", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771020532, "uuid": "fd9a291e-6c34-4510-bc3e-c7e6c7dd307b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771020532, "uuid": "1aa17936-d37a-4ef1-a499-1192073028f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb2aa4e-08f5-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770998399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770998399, "uuid": "178aaf74-3d6f-4ebe-8e3a-0d6adca7d29e", "comment": "Malware payload (CoinMiner)", "value": "ce2b708477e2d2ea7d370283554e7149", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770998399, "uuid": "7d238309-8ab5-4500-931c-d711a5f98ed8", "comment": "Malware payload (CoinMiner)", "value": "a19efdcdb1497c680ecf90e1ec57778224fd5612e827fd88972915b047344464", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770998399, "uuid": "9d3c303d-0f15-46cf-945a-86bd08da0d4c", "comment": "Malware payload (CoinMiner)", "value": "fca8812874ea71b5613521fe98730b150260ac79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770998399, "uuid": "dc1336e5-b617-4dbb-bba7-bdfa01c65c98", "comment": "Malware payload (CoinMiner)", "value": "716a87189dc513a4901a448cafb283e55dd5d64666bc76d76317f8094166ea15d78dd7ae9cce8e80668d1b8fed707c3e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770998399, "uuid": "47166f65-6f28-472f-9802-d3e4031c733a", "value": "T105D63328E69401FAF9F7E83EE6228A50D23279022B61C4EB53A546C11E737D13F36775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770998399, "uuid": "93c55aa4-e03c-4165-b59b-2bdaab6cc9f3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770998399, "uuid": "7be7a214-b47c-4535-9779-e965a77c8ed3", "value": "393216:iLnwXloBHax5wGaa5wEMiuHClcuR6mdUSCJWw/P:ijwq5aGziuilJR9qJJWw/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770998399, "uuid": "032d660a-bb7d-4876-b28b-94497adbea1b", "value": 13867852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770998399, "uuid": "fa43d094-0254-499f-9226-01b77324520e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770998399, "uuid": "e6c6efa9-2b3a-4b01-ba4e-f3a2bc8ffce6", "value": "RobloxFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91659205-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014513, "uuid": "6815802a-24d3-4fd8-82f5-c94577a9f3fb", "comment": "Malware payload (Mirai)", "value": "d0abe823a1e16bb17ad070160437b720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014513, "uuid": "52c79e4d-64bf-41e1-9f57-609865f69c5f", "comment": "Malware payload (Mirai)", "value": "a23412478066435ded92556cd19749e547a8a6d0ea7a33191c71e11ae090836a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014513, "uuid": "97ff9fe6-a592-4855-bb20-90a9980f96a5", "comment": "Malware payload (Mirai)", "value": "e8889a959894c49e5af28d4962f092ca43fbc892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014513, "uuid": "9f88e0bf-7ce4-46da-b1ea-88ded5b3a40c", "comment": "Malware payload (Mirai)", "value": "9656ebabc35c828597afa3cdd976dbf18abe59dc490648a41e8bc4629231c29edd7cf8e71d24e3c165fba379df83583c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014513, "uuid": "7a6f4e14-40ed-40dc-a0be-5348502b800d", "value": "T1CD13F1E3B32AFEBEC03BD17314699264FCB6250628D70A1F40F4F2BE64B5E471652A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014513, "uuid": "bece6fcc-d1d4-4815-8d24-667e98345df9", "value": "768:Rb4Y1eWGAUw59yZsUUTmjnw0RLOEVEdbvNfu11vYquqvb0x0Kg:p1eWzUw59yZrwo5qdbvl41vHgPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014513, "uuid": "6d7f4baf-890c-4648-ba47-762c9ab9d52f", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014513, "uuid": "b40d2856-dd32-40d5-9f26-8f26cdb215bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014513, "uuid": "cd74de62-aeac-4e54-80eb-771826ce5130", "value": "Calix.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a67751c-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Metasploit)", "timestamp": 1770976572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976572, "uuid": "0f6f4ee1-2305-406d-832b-6dbe2228c61b", "comment": "Malware payload (Metasploit)", "value": "794ead5feaae9777ab2d65cbd04c5104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976572, "uuid": "b855168a-bccd-428a-8c6f-8f80d90e2722", "comment": "Malware payload (Metasploit)", "value": "a2e72444852787082d73c390cf12d82387db3707588506ab0d8a5aa9fd68e509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976572, "uuid": "f2b73c7b-39d6-479b-b258-8524d94ed3c1", "comment": "Malware payload (Metasploit)", "value": "6879bc9a3dee6349dd838039a5a8d3313e580faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976572, "uuid": "096018b4-fa09-4f46-8c04-1b589cb87db0", "comment": "Malware payload (Metasploit)", "value": "4f461cf71cc2cc222a9124522dc8f40c0fce3af035ecc6a55ce79d2be7294b5e4064ce9a4fa356ab4a60bde3c25d4232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976572, "uuid": "ec0bb490-e66c-4af0-b8c8-c59daea8a5d7", "value": "T1ABE1FCD7B2126977EB3A07BF8287C69666FD773063920B0D018404086941C5A7C70F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976572, "uuid": "9591603d-aa7a-4603-ab6e-103939c160e9", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976572, "uuid": "566990fa-80a5-4e9f-b116-ecce904244be", "value": "24:eFGSGfmYpF5knehtht6dp5raKq9KWZRCIPp:iGfmY+nehthEdTE9JZRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976572, "uuid": "b2c767d6-bc62-40ed-8f27-c668ad3b1828", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976572, "uuid": "e3d86b89-c5f3-4455-b492-90caebdf82ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976572, "uuid": "beff7088-0b2b-4935-bb7d-195770c77b3d", "value": "notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45f6912-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001768, "uuid": "b5fd52e7-991f-4051-9d4a-7693ed155fb2", "comment": "Malware payload", "value": "e114cb9cfca6843fd1e64db9ca5d8794", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001768, "uuid": "70096c6c-f52f-4056-a8f1-f70b6fc14b41", "comment": "Malware payload", "value": "a31771aecf734288580380d785270f3f9371ff0e637da4d7988b71fe07696bb7", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001768, "uuid": "d8c7c9fc-cb36-4faa-aa41-fa71eae0a67f", "comment": "Malware payload", "value": "2cf905cabe1310100e1ec0719d4d16a38766116f", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001768, "uuid": "58c37ff8-d22a-486f-9ac4-5f0ed5d955a7", "comment": "Malware payload", "value": "3bde1a4165cd5c609fa54104ac2ff801abce53d47884ee1bdf327884de3bb180ff290739d79a199e8c1102c9dc13abed", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001768, "uuid": "3f071ed3-e9c2-4538-8fa1-43b96de15e01", "value": "T156763331ABE52C6F4B5C4B3E70BE2E253E7D0BC3814DF4D190A5B6E27489781856F8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001768, "uuid": "c57c2924-8693-418a-9060-010ece009602", "value": "49152:KdhuI9jUFnlqKc/v9SUbaCBZZk8rmfiAG6w2k/BlK26DOf91/t+bH2igeNLPJ/PF:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001768, "uuid": "65f64a4a-dd89-43af-b19f-3ec456508599", "value": 7630202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001768, "uuid": "a199c86f-d74c-4b32-ad7f-2e0bdd579dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001768, "uuid": "0cb2ea88-d7c9-4247-8598-f4e74a626a53", "value": "Confrn-Tacn0K85YB00700seaf_YEDJXTKPZC6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927e4bf-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985750, "uuid": "946a3901-5f6f-485f-8cb2-06d013bf6c5e", "comment": "Malware payload", "value": "981fb064f1b31a80c9e94fdfa250304a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985750, "uuid": "205b6148-0def-47a2-8a39-6cf0e079ce55", "comment": "Malware payload", "value": "a34d832b104926cc85681475c21c47029708bbb14890ff9a1870024a416db88c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985750, "uuid": "fdeabf05-3e82-4916-81e4-323f60cec85c", "comment": "Malware payload", "value": "9fcc308122fb0b99686e3b0ea2679f6916a2fa6b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985750, "uuid": "ff87d4f1-ff46-46de-b528-00344cbe4b34", "comment": "Malware payload", "value": "0811cf464e9c9b158f6d8efbd9a9d9fe851842420fa28f141ce13f29a0ec32680f47d96d34e4a095955c14436b51bdea", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985750, "uuid": "1b427c6d-89c9-4059-861e-d79eac2bac1e", "value": "T17666020137C6C63BCA7F457169B9D76A10BF7AA01FB989DB53D84A2B0EB10C24271F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985750, "uuid": "a7341ead-4d1f-4dae-ae62-f80fc8ef1f6b", "value": "98304:+qZYq9A2BqwWsiqU67Q6+3XCVpeyAdIqPLqd7cNbr/kQE:9F/66UCV4yUPG2br/NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985750, "uuid": "47480d9f-6712-4ef4-a104-ffd1d7d10401", "value": 6781440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985750, "uuid": "8281a692-e089-4a28-8444-9096b9235731", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985750, "uuid": "93d3236a-6731-4d31-a6f8-e2a7e87f71d0", "value": "4cd54f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb06ee5-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011450, "uuid": "aae1e5c2-4a36-4fb8-bb90-17d99b4f7e47", "comment": "Malware payload (Gafgyt)", "value": "a8f1a1b7da2c6c53c73ca800c4a02335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011450, "uuid": "8164375c-400a-4c26-aa75-5edb2a8c2967", "comment": "Malware payload (Gafgyt)", "value": "a36d4ebc52b458921e39f28235d15aafe741c2c4d6e61099cba510f01ce51fdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011450, "uuid": "b152f3d9-7e19-4763-9039-507fd0d7226e", "comment": "Malware payload (Gafgyt)", "value": "3932ce66385e28a2c056c7f8f2dfe2917e4c56de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011450, "uuid": "d8247556-313e-4f08-bc08-cdd2bc5a78f4", "comment": "Malware payload (Gafgyt)", "value": "4afa0cacb8894469667b9f71e396a9751e45fb82df28aaf64e18ebd3ab4bd9c3784b3918d4fecd92a5f66ed63b290f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011450, "uuid": "c7824f3e-5701-4a67-941c-1819648c43a3", "value": "T18B44E610F8044B53C3C32BFAA79E4B9D3B365B9653D773019A38AD742FC67A92D29910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011450, "uuid": "7d3bcfaa-67dc-4135-a9e7-1d58200e85bb", "value": "6144:kE602497z58ypi525hG+ve8GnCDy25oZj2uP/dBfblu:Nr24/8yIw5hG75nCDy25oN2uP/dBfblu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011450, "uuid": "fe650046-53bb-4b4c-99e2-8752f11d4bbf", "value": 253397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011450, "uuid": "b28ab855-1206-4d44-9253-d94254004375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011450, "uuid": "80f3d92c-088c-4b54-a2e4-af1265ece941", "value": "unet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd06d0e-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949167, "uuid": "c6457c38-56f2-4b63-91c0-6647c18d5b9e", "comment": "Malware payload (Mirai)", "value": "e1f0952dc212970e2cd48d757d017231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949167, "uuid": "33bbbc66-e29d-4115-961b-91011074646a", "comment": "Malware payload (Mirai)", "value": "a4cac4cb8b734040b6e5f825819ee4f22932c51f367e0b76c0f274194b8e1cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949167, "uuid": "09af04d6-446f-44fb-b0d7-3dc4da9c5e05", "comment": "Malware payload (Mirai)", "value": "07c3c3b2c8e596a9db02db8d9feb76eae3919f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949167, "uuid": "1b0e4a4d-04c7-488e-87ef-d2ce9489c288", "comment": "Malware payload (Mirai)", "value": "58bcd08eb42dcbfd46d4e4d4dddeb9c95700063139bf8d59bae5904928da6634c03659badb6f47f9f78ff4cfb5b2992e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949167, "uuid": "f6d48731-55f7-4399-9f75-61f5afa31837", "value": "T1E083C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949167, "uuid": "6681340a-bea7-4e82-8c60-ff15ba04d7b3", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoANUG:x/8RHTgMcJ0fmqJZOpkM/uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949167, "uuid": "6de2aebd-8089-4b9e-83a5-158f5f2bbfbe", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949167, "uuid": "e634f1c0-6115-457f-9194-fc8680e36ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949167, "uuid": "446ae98d-0224-486d-b83e-f1cd80e4eef4", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0238ede3-08b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770968746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968746, "uuid": "d0501f14-7b84-4c2d-b4bd-e934c3ac8b1e", "comment": "Malware payload", "value": "45f39a9db47bfe50b083b4627565406a", "object_relation": "md5", "Tag": [ { "name": "ran", "colour": "#93D5B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968746, "uuid": "99e75911-82c2-485a-9866-2708ad0a632e", "comment": "Malware payload", "value": "a4f018379b710571d78ecb6f08ec5bef27ee6e4ed3e9942af0fe7e9b8c7b78c0", "object_relation": "sha256", "Tag": [ { "name": "ran", "colour": "#93D5B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968746, "uuid": "eecbf43d-2572-469e-a126-c552c80a25bf", "comment": "Malware payload", "value": "9c159a639b00df601037c15fe10b69fda052cc1d", "object_relation": "sha1", "Tag": [ { "name": "ran", "colour": "#93D5B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968746, "uuid": "a8b72a2c-256c-4086-9717-c040cb75ccf1", "comment": "Malware payload", "value": "bfebf1fe2eeef9876de7a8eaabbd7dfad3ba239b7477f725802ff64169c2ad8cbcafe1f9ec47f4c7dfe4a9975efdfe64", "object_relation": "sha3-384", "Tag": [ { "name": "ran", "colour": "#93D5B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968746, "uuid": "59b7ebd5-fa0b-445f-b2e2-16125785b50e", "value": "T101D73327A23F638328FC71EC945B813D1B27AB176318BFB6515263DA10DE4C483A95F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968746, "uuid": "ab91af13-537f-48c5-a496-d83481dbaec3", "value": "1572864:otvLTKqUtsh0XOzt/glHjKL+q60V46Xr9:oxL+o0utIl8+q6Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770968746, "uuid": "feda3768-1d74-45b3-9c62-019bda1a9574", "value": 61447133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770968746, "uuid": "11fc9f6c-d7eb-449e-8448-f6f8b11fbaff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968746, "uuid": "fa376915-df97-4813-99c9-33752345eb48", "value": "IcraProfesoru.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb195a2-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014588, "uuid": "d76eb050-1ad9-4a39-8b01-ccda057ad83d", "comment": "Malware payload (Mirai)", "value": "d72b8248c03ad6d1d46f421518e18bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014588, "uuid": "6862d504-db15-4c41-93f8-21d391a57820", "comment": "Malware payload (Mirai)", "value": "a516faab05a17017abdd073e4f6481b904c13c200c54f9d39665fb38879f22dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014588, "uuid": "2c664d3f-7e1a-42c8-867d-5668ed393391", "comment": "Malware payload (Mirai)", "value": "ad537695b6389279635b46ecf77f1f9d2b012619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014588, "uuid": "0b3fd2a7-59d8-4584-9baa-d4958983299a", "comment": "Malware payload (Mirai)", "value": "86609c63fed24a76aa3c010f26d2ed271e2107308525f4db54a00356693a3f0f55cf7b5ec28a3b803996ebc0d6a6cfac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014588, "uuid": "f0dd3a09-a554-4cca-aff6-aad0c1a11515", "value": "T1DE8328C1BA8BC4F5D80748304067F33FCB32E53940A6D65DEF6A9E26DE376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014588, "uuid": "c5f36e11-1193-48aa-b7a9-9b234b1b4026", "value": "1536:UMpfl9OnpbStfC7LOW4HIWRawsK2oXcK6W2EFI9R:Vt9Kp2tfULOBgXK7XX6TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014588, "uuid": "dd7de4fb-7646-4088-8a32-bd460afc938b", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014588, "uuid": "ff3205a7-0eca-4689-8b4c-c7c6bb80bb96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014588, "uuid": "65691b3f-ade1-4232-9c3b-37e1453a9f6c", "value": "Calix.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511e64ff-0911-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1771010540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010540, "uuid": "5da8485d-cd36-4b97-a48d-7ea10b38fd93", "comment": "Malware payload (ConnectWise)", "value": "484730d6e8a5e03f3d795062e1c5b199", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "conseg-ssp-go-gov-br", "colour": "#AABA07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "impressoraantig-com", "colour": "#90125E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010540, "uuid": "de83f6f3-c6af-40db-8d89-ffa7d7ff5deb", "comment": "Malware payload (ConnectWise)", "value": "a5b1a12aa56b1dd1ebfbcf8e658443f8ed0c314e8b9be6a9622427cd77bbeadd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "conseg-ssp-go-gov-br", "colour": "#AABA07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "impressoraantig-com", "colour": "#90125E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010540, "uuid": "e7a74352-8469-4d1a-a26a-1b6bdd3811c8", "comment": "Malware payload (ConnectWise)", "value": "760fc0ce2ec8f41b67b72a4e992fcb76a6766f32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "conseg-ssp-go-gov-br", "colour": "#AABA07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "impressoraantig-com", "colour": "#90125E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010540, "uuid": "ea33ebad-bbea-462e-bebb-c08c4f5bf81c", "comment": "Malware payload (ConnectWise)", "value": "de29af5309540b7f97cc4d5f6c13b3b01880384d0f386aa86cdbeb28af304f05a37f17a0c350a825f069741f2bcafa48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "conseg-ssp-go-gov-br", "colour": "#AABA07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "impressoraantig-com", "colour": "#90125E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010540, "uuid": "39c532a8-036a-48ac-9952-19ac88574ba3", "value": "T12B16337A7CCF3CAEE1ACC3B487B87113A1E0469DD187529729DD6A0B47B88909F061D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010540, "uuid": "7194469b-4725-4c78-af23-f2ff58aef930", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010540, "uuid": "5f4869b5-8259-4e84-a5de-e961040d1a8b", "value": "98304:LLPx4ojSGoG4oIfE4xIrVtBaN9xBbN01jPJU4Fr:L3poGqxIZt6bNGS0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010540, "uuid": "a8b513cc-ba33-4b81-beb9-ed924cd30adc", "value": 4045064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010540, "uuid": "7f578292-7152-4ef3-8157-32a2cf329d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010540, "uuid": "c2ef8131-34e5-4965-8353-55896912d7c1", "value": "COAF-POLICIAFEDERAL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622fc447-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973202, "uuid": "3f747690-227d-40c2-9c6f-a30180535e24", "comment": "Malware payload (Mirai)", "value": "ee4012e3a7e8dad9536d000c2bed9f3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973202, "uuid": "95c64482-350a-40c9-9482-315f9663c0b0", "comment": "Malware payload (Mirai)", "value": "a6409d2a434c42c265cbed3c5f69b1c1487e44ef741a2aee739e0314a4e16e3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973202, "uuid": "fe18427f-e2b6-4ca2-ac18-64ca623db58b", "comment": "Malware payload (Mirai)", "value": "14a5c160b8866f08a17438291edcff9c80bcb2a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973202, "uuid": "57331ed1-6c6c-403e-ab1e-98b5b404ed0b", "comment": "Malware payload (Mirai)", "value": "b25728f2fd97575b019c7a81bf8f995ea0586151d7f97ff773cf91088e7b1275d31c46ccfccee465fbc63fbd66ac29c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973202, "uuid": "70a4e9ad-1957-4916-b2ea-6cc79d8aeaeb", "value": "T19AE32B46E7814B13C0D21776BADF82553323AB64D7EB330699286FF83F867994E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973202, "uuid": "4191b96f-1d02-4fcc-9bbe-e63be34dfee7", "value": "3072:BcvsmBosAcaBk0JDnzABkoizPauAfPoEvM/9pzZ1mjwTAcEV:BcvjvAcaBk0JDnzA6ogAfPoSM/9pzLm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973202, "uuid": "bf1ccb77-802b-4fc0-b9f8-22f1de04a64e", "value": 145904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973202, "uuid": "1b9047ba-0b08-4a77-b477-28796425de32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973202, "uuid": "e002c16d-d534-4290-83b9-dc50d03473ae", "value": "sys_armv6l-unknown-linux-gnueabi-armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45433561-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770973154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973154, "uuid": "38211322-a81f-46a2-91a6-c575bab809ac", "comment": "Malware payload", "value": "dbc5974fc2dfe51cdca5537570f464b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973154, "uuid": "f95ca75b-51ed-48d6-9167-b1f6995ed676", "comment": "Malware payload", "value": "a7ea65d6b55b2d09804b1ec287c9a608ffa8bf00f7cb29ab6ccbaa8baff36e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973154, "uuid": "a717c96a-1124-426f-a143-3c783b85586b", "comment": "Malware payload", "value": "6db4bbdab8a499f2c197070c25de8de74819fa38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973154, "uuid": "0b551c87-ab51-48e5-8e65-29ff537422ec", "comment": "Malware payload", "value": "fecee69e3dcca82340ee689feb3eaaaf27e996060f2e6fe4056af35f69be24b98d02578f9232956e8b11508f7ee6ed1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973154, "uuid": "7a128143-2051-4035-aab0-1fa79cc3d27a", "value": "T1D9D3E746BD418F17C5C321F7FBDE42983A166B69D7FA3202A925BFA037864D60E36241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973154, "uuid": "550f6ea7-7b1f-42ca-8780-ef3d5527f6e9", "value": "1536:VnVnb0p6f7XDaCP+ct3YyELraFq+4a2c8CDJ4VK+cTHFhl0TXDggeDCEFK8lTzwT:VVV0yELeFh4aN4ZcZhl0fqD7zW7ur2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973154, "uuid": "16d72a0d-ecbb-4178-b03a-170013ec2a51", "value": 132068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973154, "uuid": "0cf7a288-2c75-42af-a579-b5515ca03535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973154, "uuid": "270bc452-81fd-4579-b222-542a26021e18", "value": "sys_armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bcfaca-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1770976696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976696, "uuid": "ea0952c7-2eb8-43b5-b4ee-855cb1f97c42", "comment": "Malware payload (Sliver)", "value": "823080dd12075f02c2282d80d4f79838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976696, "uuid": "c805031a-e3b3-4c3a-9618-49a88a71ffcd", "comment": "Malware payload (Sliver)", "value": "a8c5b5bbf41c72697e3695cffcc93e5161c813842df2cebf8c364b8b4e0b6839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976696, "uuid": "945f3ac6-68eb-4337-9198-bf071b486f7b", "comment": "Malware payload (Sliver)", "value": "da0d9123e5add6e319fdf2722278f831e0d2158d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976696, "uuid": "8f0aa550-e967-4b65-99bf-e94c1690c427", "comment": "Malware payload (Sliver)", "value": "091380680d623261162621409f747c32531a2be82ba3c70df55134069232ca57231a7e4b0f77d574db292d10db924c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976696, "uuid": "b61dfa3a-cd73-48c0-b0bb-13996b2162bf", "value": "T1DF071B03F8951194C4F9D1B489214262FA71785C0B7973DB2BA1F7B42B72BF09EBA790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976696, "uuid": "8fab1985-aed1-4bb8-a15b-bb92e3b2ee62", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976696, "uuid": "f258a632-28f3-4f60-ba8c-b9c339bceebd", "value": "196608:vGoxeu7i7dZDpMGktDzD0hHy960oNQ4eQjAXb:DkLD+Gk3iNQgkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976696, "uuid": "ddf81fe1-5a82-4af6-8ae3-4e2d53b6e3c3", "value": 17242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976696, "uuid": "04dbf250-22e6-4ab3-b7b3-2a9a5ebb447a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976696, "uuid": "51e45a17-85e9-4e2b-b5fb-4ede6dd0f45c", "value": "windows-test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5ad23c-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955504, "uuid": "85cc9d42-52e3-423c-b19a-9d34cfda2ae3", "comment": "Malware payload (Mirai)", "value": "945a0c8b6a18cbfdb76153e4dc6e24ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955504, "uuid": "f8740881-462f-41c9-8a07-a4bd7ad98b8b", "comment": "Malware payload (Mirai)", "value": "a99782379c80157c34dc4f158ee08cf1b1bd588f6023c506f5295fcfe605dcc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955504, "uuid": "99b063ff-3f4b-42c6-9769-7363b142f84a", "comment": "Malware payload (Mirai)", "value": "8d10d69f5a66f8bfbfcff111fa2ec1b572901b77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955504, "uuid": "1ac9964c-0ea5-4867-a850-78eb0bd1c697", "comment": "Malware payload (Mirai)", "value": "c9ccc1dc0ba48acbd69c5b6059d9072477547fffaff619734e71b6e9f7f1e7b0d7c98a0001c2ce40e504999bfe7c813b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955504, "uuid": "cade04a1-8bf0-491c-ac6b-51a4c70cd48d", "value": "T1E703F16015E2E558D16AF0B28D8EF8446D50A1098FC59A7B79CE033238E7FCC36BC586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955504, "uuid": "2b9e1be6-9b91-412a-a1db-b68dc52ae093", "value": "768:+uvVSVa/0oCgUJzMAhSkwBHaw3+PL6NKBooqvKjpGVb7mCvKuiNzEz2hnbcuyD7I:9vVSoMoCgGzMaLABiGR7mCviy6hnouyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955504, "uuid": "e28158b0-fb71-4c9a-8d9e-7a131322193f", "value": 40600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955504, "uuid": "d2b50149-bfd3-410a-b058-d71cdd56e16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955504, "uuid": "38962baf-89a0-4cc9-ad16-db038664b0fc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75be5bc6-0926-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771019621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019621, "uuid": "dacfabdb-8111-4d35-8995-ece4302b3deb", "comment": "Malware payload", "value": "5346d2cf3fb07e29c28bde88af7c0d02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019621, "uuid": "8488b333-64d8-4cfc-a5d1-ecdc94b9c8c1", "comment": "Malware payload", "value": "a9f9ec56d84cfb03d5ddcd39f248e732d1a5dbbbd82fb4899aa8a5e8400a388a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019621, "uuid": "ee9df34b-8425-4c7f-a369-10d4f157e0fc", "comment": "Malware payload", "value": "2e1b387d8b7eedfbcca85db4bbb1690b3c2aec63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771019621, "uuid": "afcc1be9-c890-4578-89d6-be04de2355bd", "comment": "Malware payload", "value": "9f198e3eb430ec84b199d591ddebc0d39e512b7f3e6ffeb4d6d401eb4445b7702d49b721c37db734ab33b5caeef12b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Zenpak.P!MTB", "colour": "#A551E0", "exportable": true, "hide_tag": false }, { "name": "Zenpak", "colour": "#B79C80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019621, "uuid": "14561d57-50e5-4447-9019-ba521613c2d2", "value": "T1FDA36C12B4C18472D5B3193249B4CA715A7CFD710F659EBF6398123A0FB41C0AA3AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019621, "uuid": "c2bbd972-8c00-47ec-b089-aa0bc4066124", "value": "5fd7af94a11c6cef784169e5722f7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019621, "uuid": "3fc0f294-075e-436a-a1c0-023e158398a7", "value": "1536:KxRPFIOcfJxzATYEcwlg8zU7lhyVk9j04mnzxHtYJJrrsWE8Mcd7akEoVb:LOmJxGywO8zUJhyVkJsnPswAOBoVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771019621, "uuid": "108262d0-c6e8-440d-ae7e-9b656a0c0cc5", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771019621, "uuid": "137b60d7-14b8-431b-b270-c09b38ade4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771019621, "uuid": "a92ec5ae-794e-4f68-8a1f-ce57f11ec1b7", "value": "260211emit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5233cb51-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963297, "uuid": "6052965b-3ae1-4938-bb1d-5207882b8e67", "comment": "Malware payload (Mirai)", "value": "ae9b45f1c3160aa6bd0c39cbfa86a83c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963297, "uuid": "1fb45324-c534-46d8-8db6-e7b058577da4", "comment": "Malware payload (Mirai)", "value": "aaa971931854b38f50527efb2881eaff013404472c18027f7db15894df67537e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963297, "uuid": "f5789625-e257-40de-b0e3-3af13e292fae", "comment": "Malware payload (Mirai)", "value": "1d1befac4237c16fbfcc716a0c2118225fe0cfca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963297, "uuid": "154f6018-193f-4b09-8bf3-73ea3af44868", "comment": "Malware payload (Mirai)", "value": "aaaadfe797f037eec154d2f36810a99ac949b84f25ebafcac94c22e89cbac8d847d6315ca90b6e6e48360b707b3309d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963297, "uuid": "5ac47d82-b754-4c0d-be3e-f56969097791", "value": "T13C732982F98BC4F5D81708748077F33FCB32E6294135C56EDFA9AE36DA676019217288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963297, "uuid": "8e3c41fd-b9bf-4f97-8438-4e2e795dbab4", "value": "1536:8+ml11IujxuIX9GtkxBP4HojKbshjte4/riWj8iamQuPbiXaGYjqrU9+H:8+ml16ujxVXPBP4HojeaJ/3wiam/DiXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963297, "uuid": "550ce2d1-484c-402d-a7e7-bba1445f061c", "value": 76244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963297, "uuid": "aba83824-763b-469c-8127-9e453951f203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963297, "uuid": "9fb28a3b-0414-41da-b6e8-9c51a4b41203", "value": "herios.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024ff0a4-087a-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770945554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770945554, "uuid": "234eaf36-86d1-473b-b154-1100d6c8d2b5", "comment": "Malware payload (SantaStealer)", "value": "fa6e6317592c3312923a4d7c688e69ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770945554, "uuid": "a57b5007-ed71-42fc-afcb-6fc593d5f04b", "comment": "Malware payload (SantaStealer)", "value": "aaef94ed6feb31db3509945d600826d85882f2491fcf0a07433b9be06703c15a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770945554, "uuid": "dc69d258-45fa-47f9-bb68-b6bf55fc1a86", "comment": "Malware payload (SantaStealer)", "value": "84bced599855d33490bb68410366daa3fca240cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770945554, "uuid": "7a63aa70-3eba-45cf-be9e-9e6bbd7f1d16", "comment": "Malware payload (SantaStealer)", "value": "f2e406bac24a45c9d18341cb186b0b0f5ddb0b1f26d9bbaa18e0952733aa684dfc20fb241d60d101bdce793517eeac0d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770945554, "uuid": "0920a910-9206-4174-a0b7-02e91e4f1cb3", "value": "T1FEA46DC6A3B351E5FC7B64BF062DD8B564307308E1A6C83941BC5C3F9AB1A5D5F1A02A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770945554, "uuid": "5d60094f-0754-40a2-aff0-7bfcb8345107", "value": "bdbcb7e62caa2eb5d6578f196029cff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770945554, "uuid": "088630a5-17f6-401b-8bd7-b9a06bd394dc", "value": "6144:/+MDQBAu0Cuhos2StOluED7AqpA401h6885dVpqiXD9q:2MkBAxhyOB8rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770945554, "uuid": "2e7a1ceb-83b8-4e31-83d3-1886d323a9dd", "value": 485249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770945554, "uuid": "b30c5b04-2011-4c26-b29d-a98862380ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770945554, "uuid": "4eb6f4d1-e1a5-424d-bd5b-a3b347257817", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c641bd-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "57bd8e15-0001-4068-b0ae-932a2ed14259", "comment": "Malware payload", "value": "3e91c825f06e64ad46e08e11471cf66c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "91c77b5a-dd54-47c8-b230-8ed7aaaa6806", "comment": "Malware payload", "value": "ab1dbf728bb2c331a139dab9cb6ca7cd8ed8f0fa073a3d5dcb7195315479ad02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "560a7a4b-9e0c-449d-99cf-e1faa5412ebf", "comment": "Malware payload", "value": "693b184b2a3b255dec56bc3cf10530dd3a1068ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013304, "uuid": "825a0d1f-d0bb-42d1-ad49-00f96eb402cb", "comment": "Malware payload", "value": "2a024193ed6337032f9314d17788a22854c2a68d75289f9e95eed09c9b3f54ca8bd5a6fe5d616623187b6fb5133f65b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "53d65874-5c4e-4062-a9f3-c7153d7d6998", "value": "T183143947B74EED46F07442F49A8F42937B13B0E337AB5D22790A529EEB8339C8D44589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "6ed67e1c-4bc3-4663-a297-9c969cbcf713", "value": "3072:kBQlPCld724qJQYlHNjQWy5ZT04KEQvfvm9a:plPgd724qJQYNjQWyb04Qm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013304, "uuid": "01267490-c42c-4050-bb94-fb0811a34e2d", "value": 194952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013304, "uuid": "d6023ff5-ca11-480a-8868-190e4c96a1d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013304, "uuid": "959c25b7-0687-4efb-bfbc-c4df5684e3d9", "value": "su", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b238863-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770995847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995847, "uuid": "2a15ce4a-9f83-440e-ab66-dcc6342a1894", "comment": "Malware payload", "value": "5ce261f147c3725884f873d656b99495", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995847, "uuid": "2cc83d35-454a-4a21-8bdc-ca0d408196d3", "comment": "Malware payload", "value": "ab3218e458976c85d8f224af96bb67edb2dde33ee1e984e6d6f15bf971967041", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995847, "uuid": "d1ce8b19-e3f4-478a-9319-2b55efcc412e", "comment": "Malware payload", "value": "bec1fe645d48bb59ac381bb342ab94f1b846b538", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995847, "uuid": "d5dade8b-a4e7-4285-addf-1445c3b6cb6e", "comment": "Malware payload", "value": "7965ae7a0c07564ca41d347500368ff707024dde1d2dd88bd5d395f79f9e9011c07dcb930a45f20782614138d02362cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995847, "uuid": "3e507629-12ef-446d-918f-d35d073468d0", "value": "T10CD423B77637C1A2FDB4C3231E149FBF6B610EE5BBB9A7105661D3A2A309D142D41483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995847, "uuid": "e2b4ceca-aa7d-4339-ba02-359fd79bbd77", "value": "12288:36AcTh8LwPuEmgELbHgidnki3SJqp2jNEEOvSf8KrkeBPy0oB2VRIhiESUx:36A+8L5ElcH9dkiCJegEECGIepG2rIhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995847, "uuid": "15148fad-5923-494b-96cd-80431e2990f9", "value": 599196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995847, "uuid": "9935439a-6ac9-4efb-a345-384a53f4fd88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995847, "uuid": "32511d85-653d-469f-b6e0-9d1ac06ea889", "value": "irq3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566cfeea-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971035, "uuid": "3179dd97-bbd1-4d46-b8bb-e2a10d676cdb", "comment": "Malware payload", "value": "46046a335bca6946e68231071ac796b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971035, "uuid": "cf53a588-fa1a-4927-9473-c9a7675e936a", "comment": "Malware payload", "value": "ab9aeb8492a9365f5a9c5facdd905c7d55e4c47d54482e331755cd21ce0e0777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971035, "uuid": "d84b0f78-28ac-466b-be6a-bc1899ada839", "comment": "Malware payload", "value": "d54d6efa6522b00102c4c580841b9144673f801e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971035, "uuid": "ce25edde-4739-4473-83b1-58498e8af244", "comment": "Malware payload", "value": "cab32e172133bc5b102fcfa34650b34362728b5aed0058730c77a04d2ab3089dcd8253cfe90ce9c955e733c4fb685c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971035, "uuid": "cc6f07a2-455c-4d28-9c0b-22fef6b16031", "value": "T13845023A2B949412C9B0CFFA5B9BF37313244D94DA54C222FBE0FFAB75B2B184544196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971035, "uuid": "d85e922b-f7ac-45c4-90b3-589b94310805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971035, "uuid": "ce7d4168-6014-4917-be22-3c8259185d75", "value": "24576:A2RuBRKJdqpxvYJ6SSunZ+mTh1uwain4VPn9Ly72g4FpnA:zRu73q6SSusUywaI4F9M2g4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971035, "uuid": "70ebceb7-24df-4bc2-910a-9c97c34ae9a3", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971035, "uuid": "be0dc160-5e59-4a48-ba44-d39fb732720e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971035, "uuid": "fd2d7c42-1567-43b9-b67d-d9402d195fe1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.85665951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f34193-08c9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770979728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770979728, "uuid": "c654a74f-0e21-4f9e-9287-a67c1d44a37c", "comment": "Malware payload", "value": "0f7f28b23d3211a2052afbbcbceeff04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770979728, "uuid": "e00a17cc-809e-424f-b286-29966b9ff236", "comment": "Malware payload", "value": "abab62d82379b2352694a21aefa8b49da17c2df83b7138b6f192cac3e3be4521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770979728, "uuid": "db975082-1c79-4db3-9b48-17e4db9a7173", "comment": "Malware payload", "value": "0c9f2ad4491c5d974eca6629b7e70d94fd490405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770979728, "uuid": "ca51b686-ee8e-408c-9b35-02e575b1fdf7", "comment": "Malware payload", "value": "7666d9a3b206c3ce09a1788c0d7019883131d964b357d03cd18290c3de8dd382b376617b541b7e100c5aca03167fb077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770979728, "uuid": "d4475a4c-1a65-4005-8e35-621e2866e0e8", "value": "T1E4A67D67F1A610ADC56FC1B0835BA332BA30F89905707A7F1A54DB702F61F601B6EB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770979728, "uuid": "c1fc5377-2fee-45d2-8ef3-3a6668b8c845", "value": "f376f717159646ad4463444b3573bb6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770979728, "uuid": "4828794c-c6c0-4809-b6f9-0ce765689ba3", "value": "98304:DAOgU1njr+FkaDnjs1RKr654wm1fbZBhmP8Y2ljWWX2Tzhy+rKsDEyN+L/xR8:DRPjl5wvZdGIe9DEyNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770979728, "uuid": "68bd0a57-98f1-4c58-b0a3-c8787ca4d25f", "value": 10336256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770979728, "uuid": "82f9160c-2495-4799-b6b6-7328cfccb53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770979728, "uuid": "18414f24-face-4f46-894b-c1334d41d497", "value": "thanatos.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69f5f20-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978069, "uuid": "bb343edf-fef4-4e9d-99f7-5c3c2073f739", "comment": "Malware payload", "value": "88d743a9a41e47365f08143660ff0f3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978069, "uuid": "b66092aa-f789-4f84-875c-7ae2ccbf4b2c", "comment": "Malware payload", "value": "abe25197bdf0abba0e068a4d19688347f65f27c579bf2ce3fec56b069d1a1461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978069, "uuid": "729460f5-294c-4020-a70e-9dd59cff0b18", "comment": "Malware payload", "value": "536c7d152e7f79b705a8ba61f3e6b5f75a4c8134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978069, "uuid": "c1ec799f-d86a-486b-a8c7-93131aec64fc", "comment": "Malware payload", "value": "e35d58a1d4025b4f1870ae6812f10eee0b9809ff4dda1d49f59a6e6f9ccd22f5f47cb8f75eb25f337110170ad75e2863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978069, "uuid": "52e0dc5e-7dc1-4f4b-ac4b-c28b7948d9b6", "value": "T14FE46BD2E6D3D0F1E46300F0205F9FEA0A34B1365056DAFBF681195AB8A1F912B5B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978069, "uuid": "1c2715ab-6046-4420-8c1e-8c694eef182d", "value": "12288:LwzCpuOD7hDjhqV8MU4Y6QnCgc7ebPRgNBzgyMB6hng:L5hDjhlMUxnCeDmNB3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978069, "uuid": "ad4c5db3-db75-4ea6-aa5b-efca364229ba", "value": 657224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978069, "uuid": "f21986ad-5fcf-47c1-8f58-f1d96e3db304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978069, "uuid": "31ff4e9c-78c5-4627-9fae-0231dc9bf738", "value": "dlr.I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b229695-08d7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770985673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985673, "uuid": "c801e7e1-e130-4f10-82a0-34b2a3ac0d16", "comment": "Malware payload (Gh0stRAT)", "value": "c49861cbe57d3008c03da58918bbea90", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985673, "uuid": "eee15591-d734-4666-a103-c5d89235e80c", "comment": "Malware payload (Gh0stRAT)", "value": "ac2f73d0ebaeef6d62ba86120563ed6b619e20b438d015a481dfb1c62af841be", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985673, "uuid": "035204dc-ad2a-41d6-a55b-c05293bf7da1", "comment": "Malware payload (Gh0stRAT)", "value": "078adc903eaedfb5048fdefaee03b4ee3176f392", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985673, "uuid": "896960c6-1e28-4e37-ab8d-738b5ef1820d", "comment": "Malware payload (Gh0stRAT)", "value": "6451f0a1bcde54e17b47a50e512ce1b4bc5cda6e236e05e35abff8f969e4cce1aadc2789cb595381f16da3d286724a56", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985673, "uuid": "d576581b-fed4-4a68-b02d-bbf2fdecbc4b", "value": "T19DF6231233C6C13ADA7F85316975DB2910BE7AA05F7888DB53D8592F4EB10C246B2F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985673, "uuid": "a860187e-d941-48dc-8f14-c55f8f4a95d2", "value": "393216:3KdHWrsovWNIsUsO/A4Kra5AeT6s+rwu0G/jX2KiyN4ljUX2/D:30HWrTOjnO9KrNMJ+Mu0oX2q4ljiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985673, "uuid": "133bb815-0448-42b1-8ff2-70f7b4366c05", "value": 15407616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985673, "uuid": "cacaca34-ee6b-4b00-ba98-980a4743d74a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985673, "uuid": "88937d6f-bb5c-4c89-a656-bb3a7f966d2d", "value": "AnyDesk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ea3db1-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999507, "uuid": "44ff40fc-2946-4183-8499-4e20b6baa416", "comment": "Malware payload", "value": "435265b098abf69ab166ecc5aa2b8f35", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999507, "uuid": "93372cc7-583f-4285-9529-351d241afca1", "comment": "Malware payload", "value": "ad472f0877dd11901f488839e76311178d78d061511c341ba2192bd1ddd665c1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999507, "uuid": "f0b16b5c-7592-4826-8feb-698171f986a6", "comment": "Malware payload", "value": "a72c224118f9d5f87a1d416dfea398d1008c5d54", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999507, "uuid": "6fe65849-3c5d-4649-89c6-54ec50000341", "comment": "Malware payload", "value": "71f69d38de6d7a5926be70e6df7d683411a9e4a2326e0b9be4a38ed21c923601f795c039a08d9a40696c43a3a5c15cda", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999507, "uuid": "4a521aac-cbde-45b1-8a81-fb5c2286f3d4", "value": "T17B362372FA9328B7C1A00F75B06F3A21AD3CB707498E8451F4ACFA477B569C0663D196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999507, "uuid": "bfe90c91-b508-46a1-b4f2-1ba046b2667a", "value": "49152:Rzvsu7vjkvwRO4OZqJ9nfkVHGDU15beiQ5+CEUozooVi2MkVtzQjpiZXjdOm6ui3:Vuim3YG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999507, "uuid": "363d0cf3-7981-4fb3-b077-0247b657c43c", "value": 5156864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999507, "uuid": "900200c1-0e39-48c2-bc62-98fd73a0e07f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999507, "uuid": "c1d3c8b4-dfbb-4cbd-8af8-c5822a1c2d2d", "value": "CnvnBINYJC426147-7D7MVMCSC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af964aa-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995041, "uuid": "8bda920b-6c06-4fc1-9943-12e89d532564", "comment": "Malware payload (SSHdKit)", "value": "519a4259ff0aa5487887e7086353d887", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995041, "uuid": "2f50087e-fa6c-42d7-be08-ad142ee4f148", "comment": "Malware payload (SSHdKit)", "value": "ad486a40dd926f56dfc6b31ab41290a7bbaa30dccbb00a99d9e1e56265f70de0", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995041, "uuid": "9a822d60-ab79-4c56-963e-a306c1f1e547", "comment": "Malware payload (SSHdKit)", "value": "03e2533fb8c0f7c2d42fd56c790b2a5ce2505a62", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995041, "uuid": "9a302a17-fb73-4a48-8c70-36cb51f7ccec", "comment": "Malware payload (SSHdKit)", "value": "a7e151e15c6aba1baddf34fd5185f9ead33ba12f7f788dc9cdb004bfdbb833534cdf5718942c451def7429cd43d2ed72", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995041, "uuid": "e2dd314a-5de0-4a93-8f4d-ed5a9bb41ce3", "value": "T140D76C51FA908B73C1C03779B6DF034C7366CA75C7D92106B90D96383FA769B4A3AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995041, "uuid": "c86c3467-1089-454c-a523-2d9dfcc7abb5", "value": "196608:FfrWSxdmYu5sbwO6cJzGkioLPw/aBHTNTktRXTukMOWedw6XaZDRvoZ:E5Tix9Tw/qTGfOO5zXuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995041, "uuid": "4dea034f-4d40-4808-916d-6415f1824995", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995041, "uuid": "62b1c068-2504-4cf7-a70e-66a600c57680", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995041, "uuid": "e6e9a81b-8613-4223-bcba-31b74edb4d91", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49c2063-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010251, "uuid": "9489abad-6053-49b9-b1dc-75632b1a07d1", "comment": "Malware payload (Mirai)", "value": "691597c741ed9b36a3fffecf205b5b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010251, "uuid": "bda58c0b-7e45-488d-aac3-d7cf2a12aef0", "comment": "Malware payload (Mirai)", "value": "ad57c2dde71c05a542ee4f03613ca76523dbb4ab7511eefb2bd27df1194227f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010251, "uuid": "b87bbcfc-2a09-48bd-9383-b9d36619911e", "comment": "Malware payload (Mirai)", "value": "3fc25eac1f00a02c0bf684b96fe7c9ac6f4efce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010251, "uuid": "e8eadfe2-a575-4962-b532-ce48d109808b", "comment": "Malware payload (Mirai)", "value": "7b51d52fb91ffd1433d60688d82f0f75c1e8129ee11839a82b73db990613565fdf69153b7b78e28d612e8d97251b7564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010251, "uuid": "a8bffb04-6f24-441d-89a8-46891a668145", "value": "T123A2E16092F8819AE747E3BDCC1D19DF5A87C428CBD8414BAC256483056C6E8B07DBF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010251, "uuid": "4e6b65ec-52d2-437f-a265-407c366291af", "value": "384:snyKVW/L05AXGer6EkpHhBYrz75ELfs/EPXrc6YUn21Jsm63s2NcLiNLAcuiFqcs:snFVW/dLrFkpIrzVELf5PrkJx2QOGnss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010251, "uuid": "d5aefd00-e882-451d-a4a3-511a222e308a", "value": 23276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010251, "uuid": "badc09e3-075d-4523-9c16-7cd2dd5a6fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010251, "uuid": "566800f1-71bc-4f7f-b5b5-c309628e9dd7", "value": "SecuriteInfo.com.Linux.Mirai.9816.24514.10409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37abd318-0889-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770952086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770952086, "uuid": "df2d06f5-cfb3-4445-8482-19ca6c619426", "comment": "Malware payload (Joker)", "value": "1b2e7df177e60f81a5503c84a517ae71", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770952086, "uuid": "5ce7bedd-eaa9-4828-8cb7-f55fe8158216", "comment": "Malware payload (Joker)", "value": "ad6a379a6e8bc4e0cd00e49fa732dc6264a9982f5b50bf7f365f3f127928f2ca", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770952086, "uuid": "c8ac505c-1bf4-44a6-b379-d8537958acd1", "comment": "Malware payload (Joker)", "value": "ee1ffe98aabc2c7704f0a2b6c2b948e683eb11b6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770952086, "uuid": "d522a4f7-662b-40ac-96d3-04289e5c47df", "comment": "Malware payload (Joker)", "value": "24d10dbe12023de45d89a96779a8f1d9867bac3950488c74cc18de4358438f60161f1fb962420149e7c13d06675a15fc", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770952086, "uuid": "9660a206-44a3-4820-8d7a-c7e46c90cdf9", "value": "T18D47120AF70D992FC8E7B43899A7039162176C9D5651C3A75A01F128BFF76D88F1ABC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770952086, "uuid": "05ea9317-58be-42c3-9422-7696ed2496b1", "value": "393216:9SsjlI+kv46zRPmKe/UHoLZ2Tsn+GmkSlZSTn1hWjfBKdbWuQ323S1LP:Q4e9Re/UHo6s+GmyTnPWNKAwS5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770952086, "uuid": "1f9ae3c8-8a24-4af5-8b9b-6e72743064ce", "value": 25211802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770952086, "uuid": "aa9706e4-28a8-4753-8655-9d148a86df7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770952086, "uuid": "83d5bd45-1995-4048-80d8-504ef741b288", "value": "com.mate.easyusecleaner_1.2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af4bfb1-0875-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770943475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943475, "uuid": "c21a13c3-1015-439e-b7db-754e57db3c5e", "comment": "Malware payload (Mirai)", "value": "697dcda7fc6a725ee4e598977c3a1802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943475, "uuid": "276b5307-6f63-42ee-b404-ed7c18e8948a", "comment": "Malware payload (Mirai)", "value": "adde4313b9c8891ae76112ececd08cb7c00927c125d3462aca3d7757cfd38c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943475, "uuid": "68dc17da-fa47-41d9-b0fb-f35d63fe8548", "comment": "Malware payload (Mirai)", "value": "709ba6f3ebb058e2d96424c5fb83d4ca6bf7368e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943475, "uuid": "8d5de2c7-b143-4c7c-a0e5-c865c03f45b8", "comment": "Malware payload (Mirai)", "value": "ef5ed5f82de96bfc7a912e04760a344c0760716a14f5a8b36dbb7ed4438bccdc46851a8c2461dddad19cf9fafb78fc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943475, "uuid": "1c98e269-130b-437b-b9ed-7184ddc4f8f8", "value": "T11F145A47EE890EDFC45BCEB086BE836B19E7559B48D2B1F4487CCC0C795D28945E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943475, "uuid": "d7f59dce-2c7c-4839-ba3c-ed43847bc288", "value": "3072:mMatDK7qGRQ0SzRA21TxEZl4SguEDqwB9btAin4yfOsMTXKqv/:YzhtrETSDqwBFtAiF9MTXKqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770943475, "uuid": "55e6a39c-2382-4977-9ade-2c4eeef40114", "value": 197192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770943475, "uuid": "26d06886-ffef-4290-afb5-d3d478b18dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943475, "uuid": "92d7aa63-c5e0-4eab-9b6e-45747001cb4b", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a81dba9-0876-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770943876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943876, "uuid": "260e6968-fc6b-425f-bdc5-753741c08ca9", "comment": "Malware payload", "value": "c60ce75c21764a7293d6aecf05da458e", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "process hollowing", "colour": "#1430C7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943876, "uuid": "1e661ae4-2f4d-4eab-aac5-44d24ed4dc23", "comment": "Malware payload", "value": "af2d83008fff89591cf33cdbadf50b3d9eaa68d3057eda9b4f04a771121d2abc", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "process hollowing", "colour": "#1430C7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943876, "uuid": "4ec4ffbd-1c23-47c6-8715-c958226bcd7a", "comment": "Malware payload", "value": "ad6b78b5f398128bd1471517a89d02565146f0d6", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "process hollowing", "colour": "#1430C7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770943876, "uuid": "9e58bf59-da0f-49f6-bc29-a3937a6bdc21", "comment": "Malware payload", "value": "3ecd88c2900ef7befd45bfd30843386d3335950dce157f8adc5894421be1150031365783412b291fd3044471bb01ff3d", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "process hollowing", "colour": "#1430C7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943876, "uuid": "ccfeb6cd-d3e6-4324-9891-b1c9c080acd1", "value": "T1C035ED384E93323BA777C525C5F502E3FB7134233E11185AD4CA1A5A9DA3A63FA81D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943876, "uuid": "52caeb87-3901-4a43-9bc9-6dce84f1713b", "value": "6144:xewtaEUUSXMGzR5GOT/Rn2/OTJlFoxdEWHFHiIxS4iIZPLFPCcYoa/kapmILLzdo:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770943876, "uuid": "455be02b-19d6-44e6-9e2a-04f8e0ec097c", "value": 1091668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770943876, "uuid": "3c157140-8ab1-4ff9-9512-11e60185d58f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770943876, "uuid": "453ed853-922a-4908-93ab-56e29d2b196f", "value": "malware_sample.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308942e6-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007908, "uuid": "7687e83b-0c21-4551-8c37-114443a8d9c8", "comment": "Malware payload (Mirai)", "value": "939381d54391d524c78e6175f77683ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007908, "uuid": "b0351115-2ece-4e7a-aa5c-8a16addf60bf", "comment": "Malware payload (Mirai)", "value": "af3aa2a61bb5debd1f4a2984632edb993d6784c6f12ca682c8d80d3c60a12661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007908, "uuid": "edad5c8b-fdb6-4802-8768-6c06cde7bc10", "comment": "Malware payload (Mirai)", "value": "3ca33dee22477b284405d1b89c8919238fd64762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007908, "uuid": "421e5b3f-916e-491b-90a7-9fc9cdf4e230", "comment": "Malware payload (Mirai)", "value": "d27f28b89125bde4aea05f0cba9747150b73dea49d5b3b0990431c11dbbae6eae62294a058333d985b0da6f435c7e0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007908, "uuid": "df2c2a1c-0453-43f9-93b5-f1a8a6b7437f", "value": "T19F336B36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007908, "uuid": "60063d3a-16a0-4215-b8bb-696c1a6e4491", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Bm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBAm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007908, "uuid": "87f646df-6514-4cbc-b8bf-f5effa2fe64c", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007908, "uuid": "95c0a31d-d563-459a-bd25-cb7dc57d3dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007908, "uuid": "a887c89e-59b6-48d5-947c-61a5f9ed0fb3", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3206fd-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977996, "uuid": "899314c2-4c9c-4d65-8bec-742fba0f6efc", "comment": "Malware payload", "value": "f4e54334a71a296b16edae978183f01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977996, "uuid": "3e092b52-2662-4055-9819-2f21d8554b5c", "comment": "Malware payload", "value": "af82bf31d5b62200bf3164b600f0ba747e94c7b772e0a55674462c11f00e6b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977996, "uuid": "844b643b-6906-4a0d-9e35-a436f38ad42e", "comment": "Malware payload", "value": "27b25eee3bc677f263affec89302560b808124a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977996, "uuid": "602d3a2a-29bc-48c9-b30c-e10c285c1801", "comment": "Malware payload", "value": "b39b7868fab3e36a7c6a3565b286cbeec1090e4f3ba4c1af5766251f5c0fd176db9e4f3669ccc9eb434fb28a7f98091b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977996, "uuid": "0a3286ab-3e6e-4d54-be4e-3164160ef028", "value": "T1FEC49C5277F11262D290923586E2DB60B606A79278E4431F8F904FFFEF531654E88CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977996, "uuid": "640ca644-a4ec-4f3b-a0a7-15ac2a2fb059", "value": "6144:yT/CnyFQ7AMkBn0InIoPG+4NzflE30YXSa3ObfDO74KjEKxwSg5Ofbwpsr5k/a6:xB7ArFuuiIObfAjEbSg5Ofbwpsr5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977996, "uuid": "5e6dccf2-47ac-49e9-b6b5-575775e9c73d", "value": 581336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977996, "uuid": "712568de-1b9b-4712-8c8d-6e2312276582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977996, "uuid": "d3e44e5d-0fbb-4070-be43-973deaded042", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac82a4eb-08ee-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995661, "uuid": "0a2bf6e6-44f6-4144-b4df-24d7bfff220d", "comment": "Malware payload (SSHdKit)", "value": "3d4ab6b2d01caade0d96adb4e172398a", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995661, "uuid": "dea67bdc-bc7e-4d3b-856a-c10e72ca909b", "comment": "Malware payload (SSHdKit)", "value": "af8a8aa644f0ff72a6381a180a9ed8489a32de1a6ad6a7bf9982e74ef41157a1", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995661, "uuid": "e832d163-288a-4fdb-b572-356fc01cfc7c", "comment": "Malware payload (SSHdKit)", "value": "956639e6e43535bf180763edb31ab44bf9118d22", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995661, "uuid": "d773c38f-01da-4c19-8aaf-d3b645d42eb6", "comment": "Malware payload (SSHdKit)", "value": "ae6479fdc1a7d3f3d1214a57699b3e08015ec58bfd2008bd64c7342f38bbf58c01fcdac5c026f0311f27ab068c641fa2", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995661, "uuid": "73b7989d-f09c-4e5b-90f8-8c21360fb2e9", "value": "T13FD76C51FA908B73C1C03779B6DF034C7366CA75C7D92106B90D96383FA769B4A3AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995661, "uuid": "23dbab18-438f-4e50-abb2-5138a29afa66", "value": "196608:WfrWSxdmYu5sywO6cJzGkioLPw/aBHTNTktRXTukMOWedw6XaZDRvoZ:r58ix9Tw/qTGfOO5zXuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995661, "uuid": "ca59ade5-a94d-4d09-8d2c-51ecf91b9e36", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995661, "uuid": "991d2a72-0cd0-41b0-bf98-0332a7cb18b6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995661, "uuid": "3bf804b8-68b7-42f2-8549-2d000129ad0b", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a367cf-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986793, "uuid": "f0d81cd9-8629-4124-a82d-2199ee38e8e4", "comment": "Malware payload (Mirai)", "value": "fb0a9dc13aaf7be79d9887bf25c90184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986793, "uuid": "f4a3402f-e463-4744-ab55-9dbc0558194c", "comment": "Malware payload (Mirai)", "value": "afb84a3840cf49049ae4a06785a3b1131030752b5344585771026771713e80a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986793, "uuid": "44d8c2aa-ab37-40d0-8432-99e79f82f940", "comment": "Malware payload (Mirai)", "value": "5cad323267c3962c32482ab58f9fe8e5eb5d53c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986793, "uuid": "83907a9c-6d7b-4cc2-bee1-669015f4fe47", "comment": "Malware payload (Mirai)", "value": "d427dc3d5377be51528b9d943c48069c3e048c370d3444fd231bd07ef86cccca31c69373e492265961c25c4c6b3a20cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986793, "uuid": "79e2bee3-e20d-4546-b0e1-2cfa75251a26", "value": "T1C3531895FC818A16C5D403B6F66E55CD3B2123E9E2CB32039E215F613BCA81F0D7AD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986793, "uuid": "fcedf9b7-5a14-4636-971e-43ce792354ff", "value": "768:Kfghqb8NZXHN5yCdCmnuPvkwmAytNF3TAddKA2sDci0GAO1qrPPh4b3g/GRNI2Z+:OgIYZXzLImnupcNhTADT3gscUWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986793, "uuid": "cd0f10a5-ccbe-41b3-ac59-ccd192060814", "value": 60776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986793, "uuid": "1687eb23-61c5-47ab-b77c-67a5fa1175b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986793, "uuid": "f15b5345-5b0e-413d-af13-c0175210953a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec3f779-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025730, "uuid": "0f06f11f-e7b4-4dbd-877d-b219826bfa5f", "comment": "Malware payload", "value": "fb47e3a1f31aba5f6a0d2b0ed02760a4", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025730, "uuid": "0bb701b7-cb02-4349-b8e5-6a6a4014879b", "comment": "Malware payload", "value": "b0ec6f19b1b4857081d99863bb6e4bfc28c735708b8f4a352768302d9311b838", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025730, "uuid": "fe9a3273-9448-4a4f-ac0d-e24fca6b1b42", "comment": "Malware payload", "value": "52378aec5a325eb57f34ce724465adddccc5f87d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025730, "uuid": "10463122-0c88-4de5-ad2a-c8ed6a13fffb", "comment": "Malware payload", "value": "4e34efe799b83bee8e7af2daceed7e5126c1be82ed11d7097105c9b6c2383071c8940fd18019175909c8275f23fcc4a0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025730, "uuid": "79abb72c-38eb-4963-9855-6cf0548db160", "value": "T1DD663332FE862867C5984735B06B3B256F6C2743558DE4D07CBC66837F4AAD0983F81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025730, "uuid": "813fb782-68eb-4eff-b6c8-ac9d31b0fafa", "value": "49152:Kf7RWncfAIqil5OKPooe0HmXml5fgGLe5TqJsDxr3ZANtB4FsO3to3ruXJJBT30Z:kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025730, "uuid": "d42d7313-96db-4b91-bcdf-03697857049b", "value": 6533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025730, "uuid": "7c832ae7-eb31-4ec8-b6aa-9502d681f64d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025730, "uuid": "93207d39-03fc-4e03-9473-6580be9cfdbb", "value": "Nmcl2VN8B259972_GGIUJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221da577-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001871, "uuid": "7900af2b-430a-4869-99f0-e63a87b08abe", "comment": "Malware payload", "value": "b1330ef4bff99687549d39ec77a4d321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001871, "uuid": "6293efa6-803e-441d-b689-6b5ed788b39a", "comment": "Malware payload", "value": "b0eda94f7b6930fc69b55c19646825a36d8b2cbd70d85589a63a94c0c5a59998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001871, "uuid": "8de14319-d669-4ab5-9a10-a2b1e5908220", "comment": "Malware payload", "value": "434ad32f4d83c23cca7af29787e97db985a2f4f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001871, "uuid": "b0844434-d4e6-4125-86c6-8c0c79800537", "comment": "Malware payload", "value": "a7667f83ab9be9d9d97a133052edb042392a809ca00022398b90e00f5cab22cc41fab670be975958717e387d88d1efa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001871, "uuid": "7fa5a595-2ffc-4c27-a7b4-208ed3444364", "value": "T143D5DF212A7E55D2E2D902B0E0A466032C74BDD90A9F099F6AB47C693DFDFD3391B131", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001871, "uuid": "7174636c-db31-41c2-99b9-234ca3a59b29", "value": "70c0e6ecd5189162030d722899c231a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001871, "uuid": "67841a70-1f8e-4347-b6b0-11f92a5a4a6a", "value": "49152:Dthj5JTbePpriAUU3m8Rv1qBddy4/9uOU+/gnrMwBSOsur:DPXmpriyL4BddDJwnXBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001871, "uuid": "fb37c8fc-b11c-4133-9137-649e552aed21", "value": 2976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001871, "uuid": "878c6d04-3a34-40b7-930d-248c8b56aeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001871, "uuid": "e5df8134-93cf-4ff1-9f7c-ef42a6b4a2c1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc74dab6-08dd-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770988386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988386, "uuid": "fe6c2e92-af2f-44e1-8ee7-b4b96cda9567", "comment": "Malware payload (AsyncRAT)", "value": "7f29a03e29a46d47e382d9b77bdcc560", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988386, "uuid": "ab30620b-43f8-4f94-a4c0-8066afcff062", "comment": "Malware payload (AsyncRAT)", "value": "b1081950688c518fa94c24bac590e3c051ca4eb5aea9512fdbde010d43156589", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988386, "uuid": "47f8e454-4b47-4219-b104-8b2ba91e0ebd", "comment": "Malware payload (AsyncRAT)", "value": "8e1e889e1645d03d9e9de5f742c9ae621ae14a26", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770988386, "uuid": "f7569d04-64e1-4937-bf5b-a797992ef506", "comment": "Malware payload (AsyncRAT)", "value": "4acdd2a50b4f61c790e5040c453cc4770cc1978f0b1280168f648d5605d5e499d9658e52f96d712a65c65641ec4615ec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988386, "uuid": "ceb926cf-5d85-4111-a87f-eb07d77b9059", "value": "T1DFA4C65472F2E89CE56ACBF714F1A1005DB1BC295E2CA64EB8753FAE4E3708224857F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988386, "uuid": "b74f792a-a4d1-45d6-b28f-85b2e3e78188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988386, "uuid": "a9558c7c-af55-4845-a20e-b412ec82fc5a", "value": "1536:Vixgi+MxwSbM78NUqk+gXQ/Zon9b3ZRVgxuV6AWOIXYuDPMXv:krJwJ7Cb8sZon9bpMnOIhPQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770988386, "uuid": "30962053-579f-4f30-acc7-458f5e7af32d", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770988386, "uuid": "9004ed3f-c55f-4872-b95e-3662f557b774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770988386, "uuid": "273938ee-5f2d-4e01-bf10-e8a72acd17bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302a378-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025710, "uuid": "c14ed743-32f1-4bd8-801a-1f4f4e3c6e38", "comment": "Malware payload", "value": "3e175e1debf1461fb51fa57f1e087c7a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025710, "uuid": "44b6d113-b32c-4aa3-8bfd-d2b55d862232", "comment": "Malware payload", "value": "b16736a6823e75fe5660f5b0ce7f15cba08435e715f1ad70c48431fbe053d396", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025710, "uuid": "6246d434-3bca-467b-a7c2-12ccd80c3e06", "comment": "Malware payload", "value": "258b6551d707d478d480b7a44b8c861a743e30fc", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025710, "uuid": "d21c6b20-35d3-4d9a-ba9a-c23285faaa6d", "comment": "Malware payload", "value": "95b5de04e32c06f092e21bd7f67e9a429c04f985d6532017305ec7149f97e124d0ee50e03a7df90affeb001e1723ebae", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025710, "uuid": "a4de01d9-2802-4aa5-b681-8b784e8e956a", "value": "T193362331FE421859C9A04BB5703F3A397E6E2A070BCED5D0B8ACB2537B429D6877E541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025710, "uuid": "f47a9874-ae08-49fe-a5f8-b895ad79ff01", "value": "49152:W/HRRQMnv8rQ+wxzIJ+DbC3kC7/z+yseCAoU3AaGO9qoFJgh+ATGpW/nrX08/nj6:MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025710, "uuid": "e3d04515-ba0e-4edf-a971-304955bf3b2d", "value": 5322752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025710, "uuid": "5a8fdf5c-433c-4a6b-8575-f959a873c882", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025710, "uuid": "5fafd69f-4e93-43d1-98e1-7932b6893150", "value": "Not-Ar405696A18DVLDV056908.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a38a73c-090d-11f1-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1771008784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771008784, "uuid": "d2877c39-7dfa-4452-8fe8-887e362390c7", "comment": "Malware payload (Heodo)", "value": "4ce2abf083cfc9d760c3fa0293c9f009", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771008784, "uuid": "0e002a01-5dcb-407a-8e77-a9e8c5dd95ae", "comment": "Malware payload (Heodo)", "value": "b16f271216e26bb53cb0e96794c6fae046123d92d07426fe415eac31a26bbe58", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771008784, "uuid": "82239fc7-7cc9-4bc9-9293-09f5d725f199", "comment": "Malware payload (Heodo)", "value": "f3b6b6cde0f6d8de0695bad79e55ed093e9ade16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771008784, "uuid": "28c1e099-2229-48db-ab79-a02e267227a8", "comment": "Malware payload (Heodo)", "value": "93ba5b47856da463b11ff5d9da5d8b26b3e4d193dc3d82f8cdea8d451d4a4fc95e897650956243b3802227a4226e69b2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771008784, "uuid": "32c317dc-21e1-453e-9ce2-6d582aa68f21", "value": "T1A0F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771008784, "uuid": "8ee100b1-3ecf-4955-8d85-3f26842d5f87", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771008784, "uuid": "f7789bbe-9b3c-4e03-b9ff-efe8b1bc56c6", "value": "393216:IQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VG9:I+3LQxhnLUYg3muRovxOOxUj/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771008784, "uuid": "04abb8d3-5aa2-49ac-8255-a24d64aa4aa5", "value": 71527424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771008784, "uuid": "0b1d3181-cc26-41dc-bf9d-d254cc6ded71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771008784, "uuid": "21dbf4ed-1583-4cf0-a48d-f91ce0de6860", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330c00e9-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1771007913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "530a6c2b-f47e-4a77-90ad-36a3d7805e10", "comment": "Malware payload (DarkVisionRAT)", "value": "91a79201806309f6af1182df1b5d54e0", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "460e521c-4557-4c2b-a5fa-50bea060156d", "comment": "Malware payload (DarkVisionRAT)", "value": "b1c7d89f04a4a9a2729f6030b581e5a7cfb2afe766b36c80cfad5ece7ecccfed", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "7b65717a-9405-476a-9e2d-993de43ceb36", "comment": "Malware payload (DarkVisionRAT)", "value": "a2412ce23e47b4ea6845d8bff875be9830e2c9de", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007913, "uuid": "bc541f7c-4b1d-4ae4-8a2e-d85a83609e4c", "comment": "Malware payload (DarkVisionRAT)", "value": "b5b67a76760262ea6b368cbf421842645d70cf1badfbc29da92932924c95f3ad9de7a517d5c0edca76eb05a3c158fcf6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "d154d64c-22c9-408c-9a6b-c37036e0f6aa", "value": "T141B4D847EBB550F4C8B6C0388AA26237F971785D5334ABD787548E171F22BE0A93EB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "ffdaece9-18e3-4d3a-b7a5-a09e71b2d502", "value": "0a8241508ebbe65c17ae6ec3be86cdff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "051cb1d0-e4ba-4383-8393-a5587c8f8df0", "value": "6144:xnLdxFsMwu9hQ6n4hsc10pUDZq36TutqTASyACfts3EhtosRo:xnLf6HCcepIZqqWa3MtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007913, "uuid": "f5fffb4f-7880-476f-b381-48864f0aa5e5", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007913, "uuid": "507c69a6-4f66-4461-84d8-d531a5afa6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007913, "uuid": "f7dd5a85-2c76-4766-8ca1-679ca699d650", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6426c628-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955596, "uuid": "04c9d1ff-d466-4478-9d40-501d31dc99da", "comment": "Malware payload (Mirai)", "value": "05fea125adbeb1288975dead4a4f62da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955596, "uuid": "260f0c79-e57c-44d6-a65b-16f354b5e592", "comment": "Malware payload (Mirai)", "value": "b1e4e939b36cd9f0f846f8dc800d97aa0b7de31e417b7c6882bbbcfe04095f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955596, "uuid": "e8e12498-68d1-40a5-979e-ead9e33e0e5a", "comment": "Malware payload (Mirai)", "value": "2a8479e3e7412032c695e3755151b946f3cc9887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955596, "uuid": "db4c3ef7-040b-45fd-874f-441703cf6f1f", "comment": "Malware payload (Mirai)", "value": "39b2040b372e4fa9dcbf4595ffa613bef76434489278270dd0bd7b2928a739b71da2d495cf96c7df03db4bedef9f2b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955596, "uuid": "d71e53f0-f226-418f-a144-7301bb122741", "value": "T1F0834A0375C080FDC899C17557AFA636C863B07E1139B15B27D8EE26BD8DE502F6AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955596, "uuid": "5320d182-3a6e-48b6-96e0-c532097d8332", "value": "1536:psunCjvT9kcaTT5Z9G3ogXf4q1Ry37vc/VN6fD4QXjHR5iNO:LCjvTZaTT5zooar1Ry378N6fD9DziNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955596, "uuid": "5123305b-c35c-4f5c-9426-06428af6197d", "value": 85824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955596, "uuid": "a430228c-ce78-42d4-a43f-788ba7d27762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955596, "uuid": "ca5e9ca9-4c4d-4058-832a-f0c37d62a3a4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790cb9d5-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1770976677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976677, "uuid": "125b6ea9-9dfa-4146-bd29-4d33df60342c", "comment": "Malware payload (Sliver)", "value": "858932ca4aeac60e5e214e588b2bbaa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976677, "uuid": "5face603-f57d-462c-a738-cdcb7a411c59", "comment": "Malware payload (Sliver)", "value": "b1f1d9a36693c00dae48cf4a85b8db8664fb202c529b906953fbd310c479bdbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976677, "uuid": "e2c0de05-7405-4697-af7b-dc3ece465455", "comment": "Malware payload (Sliver)", "value": "00c0478b10f51ed384e65a95113fca399b23c4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976677, "uuid": "60f9fe29-af20-450b-b07b-41d8a81e50a2", "comment": "Malware payload (Sliver)", "value": "32bcd1c9c610b7c3b418e09376da49e93e7358e77ab21e69a0b6d71b47e6798263257f54c4f8fc7d26cbc5a6e2f9cd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976677, "uuid": "7f94e5ec-a072-491a-9911-4fa1031f57e9", "value": "T1E7072A07F8D514E8C4F9D1B089254262FA70785C1B7963DB2B61F7B42B32BE09E7A790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976677, "uuid": "0da38513-aaf5-44f1-be17-e6e59222232b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976677, "uuid": "d2ff8a70-c752-4102-9b1f-aee8759f84db", "value": "98304:T3YZhVD1GjlE2OGgpsrgSOMU4+eDUnLI2q7EvcPLk6TkjEWEAQxvTsGHTUJma:bY/T7psrgAU4ngsov81PQoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976677, "uuid": "78186942-9ae4-4c17-be8e-94688c9150c9", "value": 17519616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976677, "uuid": "49f8623d-0721-4ed9-925b-8ae0dc982386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976677, "uuid": "60d1d062-b527-4470-8901-e9049efd651a", "value": "windows-test-beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd2b221-0906-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771005706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005706, "uuid": "3f88deb9-93f7-408e-ba5c-edb1119ee059", "comment": "Malware payload", "value": "18025ef08628cf514c4f98dcf9d91ef6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005706, "uuid": "f9b98d34-3f6c-4c78-b63d-fbfbf45f407c", "comment": "Malware payload", "value": "b305ccfab8c6661d896ccc6b5a35d80e28f3e164f87de8e6e3d82959f309e1f2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005706, "uuid": "d0a06bd2-7586-4d6b-a4e7-7fa4d8f3d0fe", "comment": "Malware payload", "value": "d8a74796f54cf01601e9f812c3e2dde910199c7c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005706, "uuid": "89ac73da-f106-4524-99c9-93ea98220c78", "comment": "Malware payload", "value": "aa25df2db6987370aafaf8ab8eeb49c92295fe914c8962b3fdc9968f52b1bf0c3c55f9c494826ba2815c1babe6ab1592", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005706, "uuid": "e9c99f17-17ef-4131-925b-1dded2830c7b", "value": "T1C5C02B7126042761C0D0A88354338541AB391CCA414F7C310B84B48DD0C13D07D20084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005706, "uuid": "c46454c4-1c71-4544-8d70-9d6bfabac491", "value": "3:vTjYcW+mlHBAITH3x8ovOAIiW/HNdy8EyOGoZympln:7FWFLAILh8sOAIi0td4z9tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771005706, "uuid": "eaeec345-105e-4e1b-99cc-76e60f91f61b", "value": 135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771005706, "uuid": "01c5d1f5-c66e-4520-8d8a-a316b0a268b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005706, "uuid": "2a3751f2-bb4b-4232-924f-c0bd7c1fb8bf", "value": "tq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a01681-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963306, "uuid": "23ea9f10-feea-4adc-a226-e9cb76579ae9", "comment": "Malware payload (Mirai)", "value": "004cd095e0c456280f35428369403569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963306, "uuid": "5eb7225e-158f-4b6d-98fb-e96ed8e5bf93", "comment": "Malware payload (Mirai)", "value": "b3267e15c12833a9e9c7895c9743d483b2a8bf81d31e75f45a0fbb790a67d97e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963306, "uuid": "e6cd6861-2f46-424f-adaf-4e0c54a0e6a3", "comment": "Malware payload (Mirai)", "value": "fff599ec76994b62ce3ccf450b847a353103acdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963306, "uuid": "d225af14-d5b4-44d8-b40f-d745efb9198e", "comment": "Malware payload (Mirai)", "value": "dc52d17e5e1e61f5cd4f49eb26ae53800361a6220ab5988b63f616090216dbe9507246d0613905fd7def1e9b9a6d6027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963306, "uuid": "9bf82941-fbfe-4378-84cf-141638a263df", "value": "T1A0931996B8829B11C5C112BEFE1E118E3313177CE3DE72129D246F2467CB96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963306, "uuid": "cb03949b-4b01-4dce-b453-a8d226d7eb84", "value": "1536:SUnBEkjRCMMZ0l3EVepOFnTRfGqtCMSj5CyHBoY08yvpaG6f0EarNQjiTQ9f75d0:YktCB0qVepOFndfGqtCF5XHBo6yvpaGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963306, "uuid": "00c67bcf-6a13-48e7-9b7a-814e8462882b", "value": 92736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963306, "uuid": "d329f851-0f15-44f5-903a-b500241e6091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963306, "uuid": "1874c817-16bb-48db-bfda-e7d83b391bd2", "value": "herios.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552c102e-087b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770946122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946122, "uuid": "da2aa1a3-5b58-47ae-92c7-d12628d5a361", "comment": "Malware payload (Mirai)", "value": "393994c59208f3de104e590f6feaf904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946122, "uuid": "5a9b8d05-69e8-4dc2-8174-339138df23c3", "comment": "Malware payload (Mirai)", "value": "b3ed53dfa1faacee5e39b26c35e5310accd42f0a2e5e293b38f1e814baf81d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946122, "uuid": "cf442184-aa7c-4968-a427-8cd3f710cc61", "comment": "Malware payload (Mirai)", "value": "fd7043bdfcf7929eba57699daeea6ebf399cdbf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946122, "uuid": "a200902a-15c7-4c96-9112-1182a94357af", "comment": "Malware payload (Mirai)", "value": "2fc8ff7c967030c069eaf4265e8fbb30d2c18c7f53f128c5508232fc4969b075057b8ef06e07dd9d0098e1ff44d10fcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946122, "uuid": "4fac187c-c338-4a7f-b931-84cae2a4b9ce", "value": "T18DB30999BC818B11D5D635BAFF1E518933138B78E3FA7113DE185B2A538A86B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946122, "uuid": "21e9d3a9-627b-4e42-abfe-d5618de183db", "value": "3072:DOEk2wxbIKE4EsmfdHUM+dw3e6Q6gYXFaBcPWKkcPNzsX:HKzUUM+dmgYXFaBiWKk8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770946122, "uuid": "125154cd-31e5-4671-8c57-82ccee1b620d", "value": 115184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770946122, "uuid": "0d6e577f-9473-42af-ba15-4945ab539fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946122, "uuid": "756c0c7f-31af-451c-9e6a-cd415f33debd", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3b4418-08ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770967398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770967398, "uuid": "4abd5f57-b3cd-40a3-9070-f22797297e30", "comment": "Malware payload", "value": "1954c5744752b3a8aa92f083b57940e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770967398, "uuid": "492c2b08-f192-4cb7-a668-2d0399a66976", "comment": "Malware payload", "value": "b4d1b2f81992764178c6fbee4b91118f0350d4fa3a70abc9a9abfaf7b7b77b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770967398, "uuid": "d3185c7a-1784-412c-8b58-5cbbaaf7818c", "comment": "Malware payload", "value": "ba62c7b1b36b0d158b217d60fef7a8b0ba967d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770967398, "uuid": "705d3185-b3fd-41a2-b1df-aa074eb19712", "comment": "Malware payload", "value": "5d38686767d067eaf664ae833029035fb7bcb487aeef68d775af9c9a645c53e9573609449dae0ca6d856176db3dfb409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770967398, "uuid": "11e20fd5-7437-499a-99a9-d68cd15c2e30", "value": "T1FD06333FBA41E5A4F815F4F8825222B30A76B415E9B8EC7B8BF1792139319E1D41E11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770967398, "uuid": "1601c077-10d8-4088-a405-058b77ebe843", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770967398, "uuid": "c2978d3e-c51e-451a-813b-2c9d6b88038a", "value": "98304:PdVbFa40XQU/gfsZh7e6A1zZLNGro1WzZe:PdVwVusZZe6WZp91W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770967398, "uuid": "bdde4b90-4367-4f93-9d15-f876e63b971a", "value": 3912704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770967398, "uuid": "3e1d285c-36a6-47f0-a7cb-6b7a2256e56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770967398, "uuid": "1f565f66-9bc5-422c-ae5e-6a13fdb415f8", "value": "SecuriteInfo.com.FileRepMalware.77298869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a629d14d-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985342, "uuid": "9d9a5e70-02aa-4762-b883-b88fad1ed54e", "comment": "Malware payload", "value": "3c27fde8cb55519d9a0e9294a5c7842f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985342, "uuid": "c0ba086b-1077-4e9c-8b29-85e89681f433", "comment": "Malware payload", "value": "b511b62f77206354dd3d878db42020b05905d08cc8bd52ad96a3e2b7e12c70ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985342, "uuid": "cfe1c0aa-7ee5-4960-98b2-842d323286c9", "comment": "Malware payload", "value": "3880108681f7d18c0abd6a8be2955fc4c4eb21ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985342, "uuid": "4b61b759-4bb6-4a02-9a65-75f665e88721", "comment": "Malware payload", "value": "8d295f02fc24b778664c17de415e3b7a99954582cef4f961e1dfee90994621f016e0db2fee2962261ff666ff779bde10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985342, "uuid": "b0cefcdb-b859-422d-92c2-4550fc771667", "value": "T1A2F35A23D683CB77F2510630C8E5A205A93FBE5506A24B7EE9D17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985342, "uuid": "c3dc7291-b500-4088-8bc3-a75f9ee2fde6", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985342, "uuid": "b3a7e5ab-7db4-42a1-bb7b-b9056cda370c", "value": "3072:IFDVESApLltNnQUHcXR0L0coxi4MT6Mqwr:IFJESAFNnQecBq0conYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985342, "uuid": "023b2b06-60ec-40fc-8727-8a9b4c289df1", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985342, "uuid": "1663b82d-cc5f-429e-b4a1-985060b59080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985342, "uuid": "5d1fe4cd-46ee-4c4f-b86e-e5203e05afa6", "value": "fw0zf2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbad24bc-08c3-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770977325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977325, "uuid": "bcbb7fa2-91fc-4e29-9ff4-f0bcd41fb6bc", "comment": "Malware payload (AsyncRAT)", "value": "78f4e672cf38ef0b6a187e309eb7744a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977325, "uuid": "ea9ccb1b-9fb4-41fa-82bd-1f0731470d81", "comment": "Malware payload (AsyncRAT)", "value": "b5c6d7d4280b6135045654ea8fb89755fb15ac682dcb18b89a5725cba5050d1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977325, "uuid": "346475e1-b13e-451c-ba39-cd1f97f4e689", "comment": "Malware payload (AsyncRAT)", "value": "2afececb753a45fee6883dfa511227e0b5dc4beb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977325, "uuid": "ece70ba4-420a-47f7-9ffe-ea89cf6998f5", "comment": "Malware payload (AsyncRAT)", "value": "d83c6c9fa7368a3c4eb8009c421a5cf830de46586d9645014b7394ea2a1730576168c6f1012f3a046cac84dcf0eefaa8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977325, "uuid": "48b736aa-9eff-40d3-b093-600570b39eac", "value": "T115D23A08B3D88561E1FD57B94D7293048775EA4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977325, "uuid": "d3d9f662-80af-4b7b-b5c4-77ff3773f634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977325, "uuid": "7c87528b-b3f6-43cd-aa5d-d6a176f66420", "value": "768:dYKqRXmghxwMhIEg/cIRGqo2/Rb7fB/dTnSX/+:dpqRXdxwUIV1iIRbN/EX/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977325, "uuid": "af5ebe98-c662-42b8-b927-597fa0e9ca1a", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977325, "uuid": "e37c3e9e-e7fe-4301-b487-5c04d9c9ad1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977325, "uuid": "1ea7d368-c0b6-4793-82ed-5988dc7bd624", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a9f4d8-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963295, "uuid": "147b48b1-9406-4875-aa13-39577b749d31", "comment": "Malware payload (Mirai)", "value": "b228e38536ac22d50919a5c8c53c70ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963295, "uuid": "20bc77ed-60e7-4f77-b0f9-4b6eb1d231ff", "comment": "Malware payload (Mirai)", "value": "b60eb73f2ef4d1e6a6e8916d6a515e4edb4d61a72d5f6d2002b70bf2ddc28622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963295, "uuid": "daf40e17-03c0-4796-bb06-fb0c8081314f", "comment": "Malware payload (Mirai)", "value": "29620391311dd21fa771f8df52cf70665d8070a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963295, "uuid": "52a778d8-9d26-4c8d-bc19-c1f84fb61ee2", "comment": "Malware payload (Mirai)", "value": "3510b04378b5bd08262842fbc471db524e00b6e47e7518e3edcffcfce364a55ffb5a5de9bf3510c6c56703c2c9e49965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963295, "uuid": "ed618e0e-a3a4-46c2-b442-40411d093ca5", "value": "T100835B42B30C0A47D5630DF4263B57F183EB6A9021F8F689294F9B4A96B1E324547FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963295, "uuid": "4471e5bd-f48f-46d3-8531-5a05ef691ba5", "value": "1536:ILMm0jisRhf6Y4iCbjBSeWbRfBjCXdzATqGbvxFqDIhhnrTWPN1Gb:ImvR4YQVOUXyFqDErWcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963295, "uuid": "64a1ea93-f058-4a77-94c4-90fbd43f8ea0", "value": 84680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963295, "uuid": "a341cea6-4fd6-4f8e-8f1e-3735f700d03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963295, "uuid": "e9712170-b95f-4657-90a7-535ea4737f7b", "value": "herios.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af1418a-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963312, "uuid": "d7927266-28be-4201-b206-3c14f2744375", "comment": "Malware payload (Mirai)", "value": "19004bcd79bca609762d5b1ce8c3b51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963312, "uuid": "6672c3c8-886c-4278-8176-a81a5e761868", "comment": "Malware payload (Mirai)", "value": "b71589bbacdd564bf09349d4b7475a487ecf6fd75c5f8c2e398512fada364366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963312, "uuid": "c895d355-0099-4f89-be5b-c510601a0071", "comment": "Malware payload (Mirai)", "value": "000caee45ad6575f7f5867791cefb7724dd4e522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963312, "uuid": "9335a50b-93d9-486b-8f2a-e7fed08fdda6", "comment": "Malware payload (Mirai)", "value": "4839d11f030011de6800ca5bc89b79f32f9017efb81143271697a4048a8522b74f632c4320eac216da5eee2618ab399b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963312, "uuid": "013764d5-c0a1-41dd-bfdd-96c4d888ea6e", "value": "T18E739E77C8267E58D6984570B8B58E781B63A400C68B1FFF5A59C6798047EECF2093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963312, "uuid": "47840b62-76de-4eec-9261-669086afaa4e", "value": "1536:Dpwtq/0FORx0SFX6Rw9jnipobBUh4HKc2nG7cOGk0KC+WULIhmV:Dpv0QRxJ0e/beaqcbzGk0KgAis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963312, "uuid": "21eccc77-8c0a-48e4-b838-8053716e13c5", "value": 75212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963312, "uuid": "7beaecc7-4e06-4888-a97b-8cd817da6f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963312, "uuid": "6b1b07b8-9473-4422-bed9-a0d3974565c2", "value": "herios.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c461b3-088f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770954577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954577, "uuid": "11facd30-a4d1-4082-b090-8353a83fac15", "comment": "Malware payload", "value": "76e1c5c9faf7b1ea41c5898bcf311207", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954577, "uuid": "cb7e5645-707a-4ec3-8eec-5f10636ff6f9", "comment": "Malware payload", "value": "b73ac8e843eb449dec913af433b1c00b5ec71f11d6b248fac6bc88f72f7c13a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954577, "uuid": "354af3d0-213d-416b-a78f-f6eac320f891", "comment": "Malware payload", "value": "48bb9120830b71c52b9717b1b5f2307d4d53f242", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954577, "uuid": "8680d9e7-10da-4dbe-99fe-ae931a824536", "comment": "Malware payload", "value": "430014b263c40c41d1c559c559f7f96c382e081bcaec03decb9d44a43ee124f200f3e6682e909c21e1729c7e28c33405", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954577, "uuid": "4ff1542c-57f5-44d6-8165-72ec5e8ab3da", "value": "T1D106337676D2E7D0F080DDB9A5D1E1B31F703851CD98BA3303F3683276A52C1CA996A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954577, "uuid": "afdd2a8a-5cf5-4569-bdc3-0c1872df6d76", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954577, "uuid": "7465716f-d111-464d-843d-f0b989b05220", "value": "98304:8ocwrTXT5oAG54pIZ4a57c4RQycztMl4KyxNoWEpNacl5QdY2ZT:8ocwtkYI6a1jO5K0Dsal62Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770954577, "uuid": "b8ae19b3-8972-41c3-a2b9-e3fb7e11f30a", "value": 3959808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770954577, "uuid": "456eb4dd-e632-4dc2-b1a1-35cb81f3f916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954577, "uuid": "bf3f54af-e78a-4c7e-9eae-199084d7631c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86cb222-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771002231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002231, "uuid": "d3174c48-def9-4b90-ada4-ac6c1a4c3e52", "comment": "Malware payload", "value": "f61b02d18ba92031c871760759162e87", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002231, "uuid": "e9509921-663b-48b9-8ae9-962910503006", "comment": "Malware payload", "value": "b7b7ac7132c3cc8cd9d5256e51d7f83233d5d6b67b16946e7b57a189db99246d", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002231, "uuid": "3c910ccc-6666-485a-a2dc-15cb948cd30e", "comment": "Malware payload", "value": "4b2cf048bdce5ebafa575c03e548568f07dcb0fb", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002231, "uuid": "a893af27-2eb2-4e0e-9c2a-db0746670442", "comment": "Malware payload", "value": "7bf7cd6260bcf170c6dfc2673138adb66c6f11130baf097ead51aaf3ab161b8b71e0415801ec3d22e3fad2d7b1bdfe0b", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002231, "uuid": "4b9d581e-c651-4f2a-bd6f-732db9cda301", "value": "T13FB66E13B384653ED05B0B3A8C27A754A87F7EA12E129C576BF4394C8F396807D3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002231, "uuid": "285918ec-3baf-4a31-8586-979cc8e33619", "value": "75ef7b098a720afb8d837e7926346bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002231, "uuid": "9f919a7d-bff0-4010-bffc-b1582543a960", "value": "98304:lExNW5ISvNCCe58UQpFqkexNKp5efZzPUWnqUN2KAh:axNW6tCNzN5efZzcWt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771002231, "uuid": "b53edeb6-4d41-4ca5-b17f-bf62c9a77470", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771002231, "uuid": "ebce2193-f639-4c29-9964-aac873ca4157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002231, "uuid": "28aeb42c-b74b-4548-b3bb-49ec809913c1", "value": "corrupted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a60150-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975594, "uuid": "ecd3b391-f75d-4805-8120-a6dfe3ef86b2", "comment": "Malware payload (Mirai)", "value": "61fc2acfcb607d28d56b0ab008879240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975594, "uuid": "cbb82081-300c-4745-a57a-c2a2a38d3a2e", "comment": "Malware payload (Mirai)", "value": "b8990787c2e9d8f1fc852b645aca2704bb4f7dc1a9cf54896b3c3d9a6d23efb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975594, "uuid": "4e66961e-80bd-41d8-a816-e27e447f34a9", "comment": "Malware payload (Mirai)", "value": "829f9a7ebd896a70c60bcaad6401005ea606a2c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975594, "uuid": "d3f7926c-3488-4942-8256-8ed19797fc09", "comment": "Malware payload (Mirai)", "value": "342336e086ab83dce1d00389372876b88808283fbe49b0959e552579ae3b9547b444e4f0c9bd30e5a0707cb32c40dd7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975594, "uuid": "eeeb15a1-df5c-46bc-a4ec-d2771ab8e33e", "value": "T18753B61A6E258FFCFB6C833547B78E219658339627E1D144E15CEA005FB064E642FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975594, "uuid": "7401c3a0-b2df-4ab1-811e-92965fcc3b5d", "value": "1536:s58dFstrH/DIj7MlSK9gMRTfqKIS+nE8prgYpbLcxousJz:GsOtD/DY7MP9gMRJD+nhnlLbuGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975594, "uuid": "bd611303-c03a-4e76-acae-60fc2287f01f", "value": 63824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975594, "uuid": "ea23bd35-5f42-4fc3-8de0-0ac4e0f45665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975594, "uuid": "c973e680-f387-4a05-8a2f-f47b2123ff18", "value": "StormStresser.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4c4c43-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977972, "uuid": "f7c9b004-2541-4390-bc01-ff94cebe8de9", "comment": "Malware payload", "value": "1562c9ff01c4993704096077af3f2c6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977972, "uuid": "3e1dc005-ae0a-4a66-bdd0-83ec7562993a", "comment": "Malware payload", "value": "b89c87cef5860823f6f20759bae9f7f569c3a5a5431e2b02447bc53136d50776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977972, "uuid": "4c0216db-5089-43af-8cb0-45b7d8d3b682", "comment": "Malware payload", "value": "aa48720586d1007c0e035cba76b78fe23ff9bb12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977972, "uuid": "81864a7c-3443-4597-8f93-b02a8fc8c346", "comment": "Malware payload", "value": "9b79a5191786d129faa795670c9512dcecf40dde8ab9ffac56c56e20af791af7c7407e2edc2999159b671bc172c948e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977972, "uuid": "c23b8acb-48eb-4857-9670-2df454233025", "value": "T1B924134C3F924866E185A3324F5AA2CE651845FDDB8C82FD588E9418DF3B2D4B8DF435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977972, "uuid": "a6c27da2-ae20-4474-b06e-3196aebce3f8", "value": "6144:l27rj9OsbeMxwZU/sb5qbRs5NVuT4BqD39j9H0x6:l2xOsvQEsss5NVNGjKx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977972, "uuid": "12497b54-7eed-4cc9-946c-23959629ac8f", "value": 230304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977972, "uuid": "697cfc59-527a-4cd8-a24f-8fccbc90fb13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977972, "uuid": "2906a0b2-9011-4b1b-9e30-266170e5fd96", "value": "dlr.ARMx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd947e8c-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013299, "uuid": "b46a2386-aaa1-4d72-b514-09628167e8cf", "comment": "Malware payload", "value": "570d4fa84cbeed18d9a493e233bdeebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013299, "uuid": "86ea0ac6-fc36-42b1-a99e-5c23ad2d977a", "comment": "Malware payload", "value": "b8e0fcc5b96793432ba42abb50a198169b32bbf7ffffbe2c73ec142773f8b534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013299, "uuid": "ed545ecf-aa89-4759-aaa2-ddf1fd348205", "comment": "Malware payload", "value": "95b1af2aa8a94d53fe3cd4123773db62d8083ce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013299, "uuid": "71b41696-bcf2-4347-91ef-208ec9feebba", "comment": "Malware payload", "value": "3c20216d60b164d341626c045955015cb1dafdc477e813946dadf2b922c50f722a5d7d5e483814a756c44694cb5f3f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013299, "uuid": "822cfdf8-37f2-4fb4-918d-efee6f6d4aea", "value": "T185F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013299, "uuid": "907df84e-d9bf-4de9-9cb8-c1f59012d712", "value": "1536:3dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpDEn5p5M/LW:/7vDtrnPTR71gmX7Dy7fMpDxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013299, "uuid": "8881e5cf-2535-4752-a35b-c0de531d43d0", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013299, "uuid": "904188d1-e249-4536-b01c-a5e83d6cf8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013299, "uuid": "5a27fa4c-37c9-4ccb-87b8-868a46badb9d", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73101789-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949179, "uuid": "4cdd2c65-9d78-4fc6-9dc1-3138f2bc5b0c", "comment": "Malware payload (Mirai)", "value": "c582c36aaea4219932db4ae62144b3cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949179, "uuid": "031a51f8-e7b4-4217-9443-c0f497cd534b", "comment": "Malware payload (Mirai)", "value": "b9a93699db2db9d73f3ec3a80f6c824563a14d14e50b1ddf789b469e886ca316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949179, "uuid": "9b1fd47e-b572-4e3e-83ed-e90160d239cb", "comment": "Malware payload (Mirai)", "value": "22a253f715553ba557f7af1a4090ee634775f4b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949179, "uuid": "0aef9867-dc66-4ed5-a7ee-a60c2499a227", "comment": "Malware payload (Mirai)", "value": "487257e8ced1c57f43e443e557ecde60aea6e3bacb42ca522fca6cd97f514f9957ac75de5d622b63e563eda5324d5ba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949179, "uuid": "636deb97-b7b6-4b29-8647-b40b7c5180d7", "value": "T184E32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949179, "uuid": "97c9c0c4-d70f-4571-9329-f3fb1ed5fa83", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzlX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduGWX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949179, "uuid": "146f1200-9c05-485c-b59d-eb85d05cff1e", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949179, "uuid": "fdfb35d5-1ace-4760-b219-24d1662389c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949179, "uuid": "14a7702e-d217-4bab-a5d2-dc8b88934d26", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32c6a37-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985337, "uuid": "156e3a0e-1bea-4759-925e-fa30d7e37128", "comment": "Malware payload", "value": "7d3ac3e9bde82545064701dfd0ccd5f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985337, "uuid": "7c501ae0-f2a4-47ce-8603-cd2f7eda1e6e", "comment": "Malware payload", "value": "b9cac69447eba48b903f6c073ab76e218049785d1f250af629fda63519933d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985337, "uuid": "d3259463-d891-4791-8f40-9b46da49e65c", "comment": "Malware payload", "value": "d6c06a49131d4acb3eccc02b323587eb5d2a315d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985337, "uuid": "7423ef83-3f66-4d62-8ff7-30850fa345a1", "comment": "Malware payload", "value": "881e96622f8a4a9bf67f7dcab9aebf0e4b1144af6402a697d588fc4a4a8d1614e6bb409ed74e0ce6c5dd2d0e264935ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985337, "uuid": "20afb2cd-47bb-4317-91ab-33121210e926", "value": "T137F35A23D683CB77F2510630C8E4A205A93FBE5546A24B7EE9D17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985337, "uuid": "eea4e049-7a6c-4591-8502-545248e1d21e", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985337, "uuid": "156f2e21-5747-474f-8dfc-df225d274db5", "value": "3072:PFDVESApLltNnQUHcXR0L3cqxiNMa2Mq2:PFJESAFNnQecBq3cqbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985337, "uuid": "11bc06ae-932d-402d-a149-996febce1186", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985337, "uuid": "44c11a56-6a30-43ca-8682-affb455107f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985337, "uuid": "fd1d9637-ac1e-4f3c-98dc-075716d1f86a", "value": "rrh22ob.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b138e52-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986800, "uuid": "d4ceaad3-239a-4cef-9514-e7b66fcbfbd2", "comment": "Malware payload (Mirai)", "value": "27d81bea44e535941459ee3e00be3f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986800, "uuid": "16e467e5-3edc-4a72-b554-c4b478e4933e", "comment": "Malware payload (Mirai)", "value": "ba1787a5ed987669c9ec1b9771b886d97080f924beeb8ce54f938d81cac00341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986800, "uuid": "07baeac3-f6c4-4754-bbcb-56f1c9ca4e1f", "comment": "Malware payload (Mirai)", "value": "106a71fe968c93dfd6106786f59be3dc21dc7d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986800, "uuid": "745ae464-07da-4118-b480-9db397d81b92", "comment": "Malware payload (Mirai)", "value": "8598bd53b467534461017bb647a42ae0dc2e380b6865efd5e183a563ea7c7bcf244ec4b006cda0df5f26c0bad545677d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986800, "uuid": "e6193860-af88-41e3-af27-f4e95a146801", "value": "T188D36B47FB404B23C0D6177AB6AF424633239795A3DB73069A285FB43F86B5E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986800, "uuid": "31afcace-8bb6-4e71-8aab-59667be3d01b", "value": "3072:tvY8ZgNY05/pQPq023m3DLxDL6iM/9iEmV:dY8ZgNL5/pQPq0Um3pDL7M/9DmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986800, "uuid": "5337c13e-6d01-4850-92a9-007c655b7609", "value": 135541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986800, "uuid": "2e86946c-b3df-4a60-986a-c0ffd243f0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986800, "uuid": "8443bb88-2a3e-4ac6-832f-dfc4f1eca814", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f85378b-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955589, "uuid": "f987660c-c4c5-46b3-a5a2-38d7d3839dca", "comment": "Malware payload (Mirai)", "value": "4924d290ef476b6c8919fa461adff272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955589, "uuid": "8334edec-a311-4522-af1f-4dd9991e6194", "comment": "Malware payload (Mirai)", "value": "ba532fa569b69dcef7392d9400a6d2722d29517639d6e50a4be212a149c11401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955589, "uuid": "9db09720-92c8-412f-921b-5cf8e7793553", "comment": "Malware payload (Mirai)", "value": "d6b63c8615758fe0e91bfe15c7ea960da380d372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955589, "uuid": "fb6a6613-0bb2-42fb-83dc-aa226c8bf9d0", "comment": "Malware payload (Mirai)", "value": "35586a5e38fea19ccc811e375ca3ab1df6494d7eeafc921cf1ad4875d5b90bf436ee21933a98508cc7b23cd1975883fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955589, "uuid": "0eda662d-14c3-44dd-952d-e67a060e2f1d", "value": "T1DE8328C1BA8BC0F5D80748305067B33FCB32E53940A6D75DEF6A9E26DE376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955589, "uuid": "6b8672b4-d8f9-437a-8c29-2bba69115e69", "value": "1536:UMpfl9OnpbStfCL7uW4yoWpawNK2I3cKJWaEfI9a:Vt9Kp2tfk7u6IuKb3XJFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955589, "uuid": "1a2dfe8d-4131-47b8-af0d-3d7d45207ee9", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955589, "uuid": "6545f63a-3fc3-48d4-9d00-083ae189db4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955589, "uuid": "53cdb209-7cf7-4944-acab-b38a0c3d933c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff3f15-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014583, "uuid": "6844aebe-8c31-40b9-b726-40626444de75", "comment": "Malware payload (Mirai)", "value": "530c8a5b6f04b38a42e4720e3d63d8f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014583, "uuid": "093793e0-bc2e-4111-b80a-80c93e7c0149", "comment": "Malware payload (Mirai)", "value": "ba5d4beed83e5862b6983bd55fbb17294b50dd5b614abb66ac263f8f60187215", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014583, "uuid": "fd908610-cfcd-4406-a6b4-ca9f544c88ac", "comment": "Malware payload (Mirai)", "value": "38cfcc1aaca3973376509dfe524d0cd0d758c7de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014583, "uuid": "707a8925-a1c8-45f6-9256-1b6291e8c52e", "comment": "Malware payload (Mirai)", "value": "fbeb5b93cf6ec2642abf07fc6fd2a403b939bb5dec209818956610519e7dd549cc8724d87947a131d1b583ca1abd25d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014583, "uuid": "65bdfaeb-264b-43ef-8ad7-1c271c7fe88b", "value": "T148932A56FC818B21D6D112BAFA1E118D3313177CE2EE7212AD246F2077CB96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014583, "uuid": "98779d15-65c8-4641-bb0f-a283e6e9de74", "value": "1536:6MnKOhfGPt13qvfWullrgoXBRGnFaR7pdlC5DuiLhhvwftq7Fx59Y1gL5P:Rhf2hoLllBrGnFaR0hhvwftq5xrr5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014583, "uuid": "d4975a01-a8fb-42e8-b838-65ac357ceec7", "value": 97472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014583, "uuid": "22261922-4fa3-4b0e-add4-694a09746083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014583, "uuid": "42df49be-bb8c-40db-b77c-a9b0758ae7fe", "value": "Calix.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092e2360-08f0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770996246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996246, "uuid": "95e1e0f5-6025-4c56-8db8-dfa0029700bb", "comment": "Malware payload", "value": "97b3d06cabef1e153541fdba3a6f55a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996246, "uuid": "9d4887c7-f038-45e1-817e-34adf3b662b6", "comment": "Malware payload", "value": "ba8513d09d7dc709e7bfed660efeb6f7be4227f58e60e5e9c49b91b5abb6c53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996246, "uuid": "847e3ce6-143d-4cc4-a665-a48fe38f0b39", "comment": "Malware payload", "value": "4abe15f8309fda1c1749630c7b1ca359abcb4da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996246, "uuid": "812e8c9f-8e70-48f8-ab02-a2cd050311c4", "comment": "Malware payload", "value": "1452932206f744fc9e7aa6a0abdb88318a5aae4cf3c1df0c7aa754851533de5ca3cd40c26f13899c2161d57ca9c536cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996246, "uuid": "65c1e318-c1f5-4b64-9abf-1bb042540bb6", "value": "T17C460902B8A689A5C06EE238BCF512557A3139B807767B970E5731760DF97DC2A3E31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996246, "uuid": "1250b2fe-3acc-4771-a730-47ebdd45bf0f", "value": "e542a0030c59ac8c1d215d99d2cfa082", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996246, "uuid": "aa81802a-a690-4f8c-b462-b4ba1e41fe74", "value": "49152:Mg4DTKjsCf3QRvuJdTg5l+lbf9+ANmkEu+UMFJldOYcOx:7ifVoTjmk2UkCOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996246, "uuid": "5bd4b966-56ca-4a81-9bce-cd4744e88657", "value": 5481532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996246, "uuid": "1086240a-a5aa-4bc8-980a-db197762495d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996246, "uuid": "96748de7-6565-4055-815a-e296dd2fd494", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d722832-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007984, "uuid": "9a5a1326-dbfa-4d4e-afef-32defdafcb9e", "comment": "Malware payload (Mirai)", "value": "d2b1562799de04fc697fd39a5b629299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007984, "uuid": "4fdc64a0-b65d-4691-b079-21a94c0231fe", "comment": "Malware payload (Mirai)", "value": "bb209a4fd4063d9785d7e1a8fb0cb5ca18f00c726843180853103f6e9ba74922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007984, "uuid": "2b647874-84a6-4809-a7d5-17bb55eeae05", "comment": "Malware payload (Mirai)", "value": "b0e14762b860e848e6bca8a064fbbf70b35a4de6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007984, "uuid": "7fe6551f-9904-473b-9f90-03cbbca1aa87", "comment": "Malware payload (Mirai)", "value": "2dad458ba986de417847bcb2afcb0a3f5b48d12387a66dc0638a67453aa95bc5919c7e731a8d2e22340c3731cba74e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007984, "uuid": "91f1b851-f3ec-45d4-bb89-d9262d5c8278", "value": "T1EC2309C8F443D9F9DC4A09742036FB27DBB2F6BA2329DE43D7A49523AC51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007984, "uuid": "65d9cbbe-64f7-4707-be04-a2ed54ab952a", "value": "1536:6nJRT4QPfZfW5XTOeY3DveaAGAZq/4Qw7bn2i9e:Gv4QPfZfW5XTOeoJz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007984, "uuid": "818f92da-4cd5-4cb2-826c-f87347f60de5", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007984, "uuid": "195677dc-bfdc-4b34-aa7e-3659a215d5fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007984, "uuid": "552df77e-b48b-48c8-9030-77ce4304ffe0", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72ea3bb-08e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770991384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991384, "uuid": "fe1c4b33-f769-4ab0-840b-119c2d1bd342", "comment": "Malware payload", "value": "8ebc92a0790f981de13147e4872e3d95", "object_relation": "md5", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991384, "uuid": "b4ab8a21-6dc4-410f-9b4a-4673c497049f", "comment": "Malware payload", "value": "bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a", "object_relation": "sha256", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991384, "uuid": "6caef277-fe5f-40af-8734-e7247759dc07", "comment": "Malware payload", "value": "62f08ff89fd824dcde987d8463b192c8e416a8bd", "object_relation": "sha1", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770991384, "uuid": "71c96852-8016-4056-bcbc-71bb88bcebd5", "comment": "Malware payload", "value": "834330b2d6ac85458e10d3dfe47e7403efbe8526fa81264067dcb7f2ac454acdf3d15c86d90210081184e806194d1bff", "object_relation": "sha3-384", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991384, "uuid": "e0fa5a3d-c95f-465e-a50a-75aeb586a386", "value": "T183A49E07735317F9C76B827891E6A7B1B431F4180725AE7F0A98DB322F64DA1066FE24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991384, "uuid": "066d8698-c6d1-490d-b3b3-ef94bf5199c0", "value": "2d3722789241a78d62128955367c756e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991384, "uuid": "65441a5d-cdd9-4044-a42f-d7f92c6ab959", "value": "6144:uEytwADnyoE4hyWeXVmq0+cBBs2kk9jM4UTwXi3ZGgDAijJDpK76vl6IUN7vSg:uEAs4hy6qxcTvkk9cT35jWol6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770991384, "uuid": "50bc5fbd-82cd-41f5-abcb-d617f29f82ec", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770991384, "uuid": "fd64bd18-45af-4473-a393-981eb9aa93c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770991384, "uuid": "da5f72d2-3f00-4ba4-9aa7-c25ea70dda35", "value": "Cortana.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1d825f-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011448, "uuid": "68141617-9dd3-44d9-b655-4547b6bf8c2f", "comment": "Malware payload (Gafgyt)", "value": "5d2c1d7436d3a989a6c3c580fb547525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011448, "uuid": "3d1a395a-5c57-4c49-8250-6df530c9cbca", "comment": "Malware payload (Gafgyt)", "value": "bb648324290f14f588e4111bb360dc91303f6e48ae8aedb03267b0f1003ee7ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011448, "uuid": "520261c1-eabb-4bf8-8fa4-149618fce953", "comment": "Malware payload (Gafgyt)", "value": "8aba2319fbd4bc0ddc65de0a4f24ba0b4a9753d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011448, "uuid": "26b141e0-280b-421e-a777-d0790c5d327b", "comment": "Malware payload (Gafgyt)", "value": "4b6020bde448b396d69fd61b8d8df32e6d68b91920cfc36fca954df18acf3c64bdb42e2d251fc4fe2edfef68015f4404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011448, "uuid": "70b8e56f-ecd9-48da-b713-e27cfc8c00d0", "value": "T1ED345C36B4944ED7C0929BB535BBAD310F16E4D30B635697B239A5F08E439CEB006EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011448, "uuid": "8b4354ef-5e1d-4c77-b553-bbe5beb2c1ea", "value": "6144:PjNKRYcIjmbns/rn05h9HsbPRBY/wpqrshb9U4y:PoRYnjmQ/r05h9HsbPRBY/wpqrshb9UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011448, "uuid": "d3abef91-74e9-4dc9-b825-527811e8d040", "value": 231611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011448, "uuid": "a6f822c3-6073-4d61-9f6e-82edee6233b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011448, "uuid": "1e421cb2-2174-47c6-98fa-138d8b9880a6", "value": "botnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559d2a57-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963303, "uuid": "5e076aac-cb04-4117-8edf-613d7c8f5721", "comment": "Malware payload (Mirai)", "value": "620c565af25c17432bbe94cdada46144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963303, "uuid": "40f18523-c857-496e-b3e6-1d9a531612f1", "comment": "Malware payload (Mirai)", "value": "bbafcb9ee7a6dbd62c8c4e7a05df6cede01f99673e2ad32e827c9dc059d76585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963303, "uuid": "f263c858-854f-40bc-bc72-8bc6d7fa0d13", "comment": "Malware payload (Mirai)", "value": "0d5b7d46ee28fb78209e57ba98a0a62f83ce6dca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963303, "uuid": "e49e5310-b526-4c3b-a254-2a0ececdb322", "comment": "Malware payload (Mirai)", "value": "f1459508915e3d268f5209d73d4efec4fa7e935b5bc4f7e2bb82475d668df79c60dcae22bf76f916de149970b8c0376c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963303, "uuid": "049b1c90-8ac4-4e76-a96a-e01819744176", "value": "T1BC833A02731C0A47D5775DB02A3B27F093EEAAA021F4F684255FAB8A9171E325196FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963303, "uuid": "455c48ba-f53a-4547-8c0c-b9158819ca0f", "value": "1536:HL7tgTewtH/OoIA5V8ecJIzeSyDPqQCqmJylhn2qMQXrzspTy:Haf2oVGUirmvqruy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963303, "uuid": "8e01d87b-5419-4054-9530-15ba6bf3f096", "value": 84600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963303, "uuid": "bc7bf698-1797-4be8-af3f-81187517b8a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963303, "uuid": "07125fe9-cd05-48eb-8e77-36ad6c7382fd", "value": "herios.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ba2fb8-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013492, "uuid": "5817f638-51f6-4c64-94d2-2b2406c51c71", "comment": "Malware payload (Mirai)", "value": "e2533469eb80d740170b80fb4108d0ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013492, "uuid": "2140d799-43d7-40fb-ae13-f81c67228f5d", "comment": "Malware payload (Mirai)", "value": "bc0b175fc6ca68475397d362b5c556c60ac2d1bac7b207fb016ba2fb9ace771e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013492, "uuid": "a00fb21a-54c1-40ac-aaed-5a098213b54b", "comment": "Malware payload (Mirai)", "value": "3b3ddb1ff74f4987e3634b0e2763a4d113c282c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013492, "uuid": "475a189e-5fed-45bf-821c-e94dd77ce4c6", "comment": "Malware payload (Mirai)", "value": "1489895a6ac406821fa58875b4a23e16daec86612c5fc2cd14b3587e9e516e8e41d91d7dcd545b7ceed646f204b1391c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013492, "uuid": "5f1b8838-d3d0-4a91-afb9-a8b65a15b059", "value": "T19F044A03759189FBC4D69FB81BEBA5228523F8391B3232067398FDA51F0DED86E1D254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013492, "uuid": "586536d5-734b-4208-b0b2-39c17782ca50", "value": "3072:DPZ3Q/ayISjT2ddmkY5mK0+TVM7fCvs8L5HyJ64Y23uKRTD:MzpH7CCvs8L5HyJ64Y23uKRTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013492, "uuid": "8f9aa0f7-4f42-41e2-9e8f-79fa1afd4222", "value": 187129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013492, "uuid": "80d2873d-2288-4ffd-858f-4c9e01ef5007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013492, "uuid": "9598c638-9688-4aaa-8667-ecc215ee72f1", "value": "x-8.6-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca59f86-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985192, "uuid": "f189a95d-d5de-4292-81fe-25129fa2085d", "comment": "Malware payload", "value": "be32e5cbadadd3166300e5852e9d0b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985192, "uuid": "de40fff5-bf69-42b3-83d0-6a47150bde7d", "comment": "Malware payload", "value": "bcb8f3c93bb17e96c143ad4f079d26c1bf7636b10d9ebdf56a8072d0c9f2e1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985192, "uuid": "87ce1e0a-66c2-4412-a0d3-68de3c86d20e", "comment": "Malware payload", "value": "f2c8d645bf8cc6700a461743cb60ddc91e42e31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985192, "uuid": "3e90f2f8-9733-42ad-b000-9b744880506b", "comment": "Malware payload", "value": "a63edbb35a7936265d73e940c92eb4d2a081141524c962a2391ef4b79ee33f2141e333e69e50d2a4d004808345f57f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985192, "uuid": "b830c7e1-e169-4897-abb6-299a99278260", "value": "T15CF35A23D683CB77F2510630C8E5A205A93FBE5546A24B7EE9C17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985192, "uuid": "094910d4-fce5-47ea-8bd2-2ed8cf654b35", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985192, "uuid": "3eafbd47-1382-4b57-8c54-6fb1920150ef", "value": "3072:NFDVESApLltNnQUHcXR0L9cUxi8MldMqn:NFJESAFNnQecBq9cUGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985192, "uuid": "a2cd0f9b-4c3a-4d5c-b5db-3c7a9441b7f3", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985192, "uuid": "28a5d251-5a7a-4d90-8b81-68cd3b2777fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985192, "uuid": "cbf58580-fb3e-459f-ad29-c3458464549c", "value": "Grunge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ae0ce0-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1771011521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011521, "uuid": "f010a400-22a9-4caf-bf7c-8fc2993b25d9", "comment": "Malware payload (Heodo)", "value": "70a3fb3ad1a43bdf2e5728afd092196a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011521, "uuid": "82e60432-ca06-4a54-bb0f-992f04de8dfe", "comment": "Malware payload (Heodo)", "value": "bd249a2056c9380a04e796a2846b40fbf715157a82e2a5c3497f963f92ef349f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011521, "uuid": "afe33c09-a6e6-4551-a6e9-add5ea32e375", "comment": "Malware payload (Heodo)", "value": "67ffaed24b54ff93c0c239af896e32b44f35c85f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011521, "uuid": "228bc450-ae80-40f6-b3d0-46621344b2b6", "comment": "Malware payload (Heodo)", "value": "364557318d5f41cd17e5a709b112e7148c4901c44a2ab51df403cd8abf831d1c20d07211e0cc02ab5757392ba10a3d90", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011521, "uuid": "72a7a493-436e-4bb0-a17d-1b175021e0af", "value": "T1B5F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011521, "uuid": "eb993c28-32f4-48fa-9cdf-4eb1d3854866", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011521, "uuid": "790724e0-cd1d-4bc2-9a31-50397d31690a", "value": "393216:kQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGK:k+3LQxhnLUYg3muRovxOOxUj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011521, "uuid": "0d5059d7-7ac6-4a12-8641-693875772424", "value": 71517696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011521, "uuid": "dfa64ebc-b316-467c-b043-48a50f47d1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011521, "uuid": "264c5d1f-1fbe-4288-a33c-d48deb1fc2dd", "value": "eLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59848154-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007977, "uuid": "82ac4b5c-166e-4aa2-9cef-57b9506f887e", "comment": "Malware payload (Mirai)", "value": "eac70c4f758afaae79376cf7200eb9f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007977, "uuid": "f84c5028-1f79-4ec1-a9d4-5993a85dec0f", "comment": "Malware payload (Mirai)", "value": "bd604d490ce3e75999beb1b8fbcc4e8694ea4066ad9723d45a5992e3749628b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007977, "uuid": "d0b008ee-e284-4b42-86f1-a61dd211de53", "comment": "Malware payload (Mirai)", "value": "ec043d427764de9fbdf5457e01ae95dbe6a8b9bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007977, "uuid": "cf277e09-b03d-403d-829a-ca41b6ccbc12", "comment": "Malware payload (Mirai)", "value": "3f31f988c6d1c4f41813f3e625119dc8fe7c6cc20d17d2857500e4021e81894302448ed1c149cf5cb7862875c844289f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007977, "uuid": "3ccf3bf2-b4a9-478c-91aa-6a7fd9da8acf", "value": "T130334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007977, "uuid": "6a4f0045-be05-4bb7-a23b-6d7021d8bffb", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GZPS4yns96BktDgIPi8TwA:ivW3jdQGqt7Y+Z+AN9cGgI6bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007977, "uuid": "a5a6a957-4a38-4555-8760-1b66b6c334ab", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007977, "uuid": "b7ad96e0-3072-451e-9b71-0cbe476df755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007977, "uuid": "898441af-b3d0-4ebf-b75e-91a69257ad4a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a291137-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770971041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971041, "uuid": "466b6807-81e7-44c0-8ac4-96939070a161", "comment": "Malware payload (Formbook)", "value": "304d22344cb0aedcb6763bf6cb66ee0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971041, "uuid": "11400e25-0196-43c3-8e3c-dae7d2b87512", "comment": "Malware payload (Formbook)", "value": "bd6352d2cc65a4ff636f327799f6cf0ae2715ccb9df5ad580b1544853b0c9d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971041, "uuid": "e8a257a0-7fd0-444d-893a-6ccc3d168ab9", "comment": "Malware payload (Formbook)", "value": "7672e8f11401fe165b87f4b98839c7f5cdf58025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971041, "uuid": "6bec040f-861d-4efa-947b-b8c916488208", "comment": "Malware payload (Formbook)", "value": "6ef89650ceeb8a0a50e2867a4834acabc27a8c8e76ee3b491fe73ab0c5c682de46b1e3d5cd50d3ae54803354b5ebd35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971041, "uuid": "c73b8bb2-2406-417a-b0f1-f7158dea6cd8", "value": "T139E401E03E66A716CD7503309929FCB852682E687011BEE75DDCBF97B3CA250690CF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971041, "uuid": "db5677d2-6f67-4a2c-b3a0-bf63bd8e6b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971041, "uuid": "fe16dc89-8e03-4ca0-a0b1-791a2d826af7", "value": "12288:uf64LAlfNxqGfKmQLr5AjIXcVY9Q3EkFHdUfAr+rDAQq/EJ0UWe2l8q+oUY7:uu5tVcQIxQjFHyf4ojCrC+UY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971041, "uuid": "7ce33919-0cad-42aa-8763-4a5c5cc51f75", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971041, "uuid": "c72b322e-9e00-4411-983a-ac551c052f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971041, "uuid": "688cba7f-ae62-420a-92fe-74baff1bc1eb", "value": "SecuriteInfo.com.Win32.MalwareX-gen.53134473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3bb6c8-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974051, "uuid": "09de3468-a095-43f5-bb6f-edd17898ec38", "comment": "Malware payload (Mirai)", "value": "1e67f237a2597e51b4683957e4a8aa08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974051, "uuid": "b34a1e54-d360-4de1-a744-78a3f4b49709", "comment": "Malware payload (Mirai)", "value": "bd6778b58d753b1614aca1fb977a038165d448eb2592f2f83e2a43941da9e39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974051, "uuid": "55808c7d-4930-4f50-8157-20a225a98b63", "comment": "Malware payload (Mirai)", "value": "fa11f1563361dcd81eb89974f7866e48f4c42b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974051, "uuid": "2a4df5e3-e540-485f-b6db-51989fcdfe17", "comment": "Malware payload (Mirai)", "value": "b26b74ab5830858b0676fd07c49ea372948b2a2bb8fbb1bc3c9831b949c366291b96f4c35a8cc1a9f97d659e9a5d3975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974051, "uuid": "f0b88cac-c70c-4e03-a878-697c999e2530", "value": "T187E44A41FB1C0563C9431DF0697F8395F325BA4241F9C229331EAB5B3621E3A9AC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974051, "uuid": "c6ba15f9-4165-4914-b0a6-5a7ecf59e0f9", "value": "12288:miPCd2bu+2RPNGQ25bQH+9u6w3JHY9Zk9ipROQfOm3Z:/PClRVGQ2VQe9/EtYfkgfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974051, "uuid": "41a5ea5b-fdb2-423a-8425-e211e45d439b", "value": 660020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974051, "uuid": "49a8f1c8-fb6c-4ad0-8328-300c9d756c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974051, "uuid": "8fee90a7-55d6-414e-ac3d-15684e2cec81", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988140da-091a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771014525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014525, "uuid": "481463c1-842d-446d-89ab-9b572c0958ca", "comment": "Malware payload", "value": "173ff080925a2e76d9ce9539b36af169", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014525, "uuid": "89093b5f-3263-4c14-9e65-f40a8cc99148", "comment": "Malware payload", "value": "be5e8e142a1d4b42f383cff08eac7a0f4ecd389e52eb9e1d3bb7d9260db56b91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014525, "uuid": "56f2bb97-5dc6-4b33-9ed6-60a17c3679c3", "comment": "Malware payload", "value": "7f54c8628984becd08ebada60ade9d6175653cc5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014525, "uuid": "44a3d143-f96b-4bac-8f0a-38581e8f9091", "comment": "Malware payload", "value": "a19b61490cdb661cd7d912a895060f942eb27b738b3414099b8588a11f73781497c480de20739646077a2f691b7ea1be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014525, "uuid": "7dd67f4c-87dc-4709-9764-707b5c1abf39", "value": "T1B3514B8603128B79AA677A23FDBA8E0D31C0D4D32CD5EF04DCEE24E9529CF887444B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014525, "uuid": "40503225-b74c-4ccd-92e2-76892316a27f", "value": "48:isQFXQFhmlsQFBQFnElsQFkQFCXlsQFQQFePlsQFa9QFazvZlsQFaLQFaFvjlsQv:iFaHmlFIZElF/oXlFXwPlF0W0zvZlF0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014525, "uuid": "a7d0291b-106d-4219-adb7-cd61c69b403a", "value": 3019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014525, "uuid": "90a08456-34e6-4896-8eaf-fc696ca6fef3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014525, "uuid": "32eea55a-48b8-4a30-bd56-a19f4ff9f632", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c71d7a-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949123, "uuid": "6e0e3255-7156-4870-b8c0-d3d1375b8ed4", "comment": "Malware payload (Mirai)", "value": "4043669d491a16d6ca615fc064eae505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949123, "uuid": "45a61b50-8085-4d54-ae49-732e27356c39", "comment": "Malware payload (Mirai)", "value": "bff33ae55c378d9d5ff75da4a2ca613626169eef8272e0e6bfd481fd13164fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949123, "uuid": "86b1bbd8-9eeb-4b40-a64c-41a89eae5c92", "comment": "Malware payload (Mirai)", "value": "e7e2d70cd3a5ee482224f8e0d5bdadb952a16ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949123, "uuid": "d9a74564-d20f-4493-8ce0-7e04dc2a183a", "comment": "Malware payload (Mirai)", "value": "375603fd0d23938f239190fb5bce0547107a93abd0a75d22b566a50b7066dd10c91b2a6eb9b1d4b7dccfbef3c071354e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949123, "uuid": "4587c205-8589-42d7-b1d1-f4f963a18b12", "value": "T15EC2D030F8C07DB6CEFEAD78985189D03BE51E4937D18DD6208DEE516222D3386A8A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949123, "uuid": "d2364c90-8b1d-4e33-bb3d-98bb5cd9ddaf", "value": "768:5KnqLiChP7gI5gBZw+LajR/Fl4uVcqgw09W:5KqL1h4Zwa6vl4u+qgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949123, "uuid": "c2bdb9b4-0b04-47ab-b0c9-7b869708bb8f", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949123, "uuid": "90ae10dc-8430-4797-b907-d095b8045298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949123, "uuid": "ef16bfe1-1654-4cc1-8344-859c0529dfd6", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8e8eb2-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999451, "uuid": "81a1ff1f-3e7f-44bc-9696-4044592e05c8", "comment": "Malware payload", "value": "a82e38333287816a892c04cb0d8e69e7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999451, "uuid": "b1659f95-d36c-4d8f-b8c3-e4ad7fe4d01f", "comment": "Malware payload", "value": "c0196169714e296393e6daca6b6bc07ed3eaa20c29d52501015f1f5cacd50013", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999451, "uuid": "980fc3fe-abe1-4925-b403-0a18c6cca60b", "comment": "Malware payload", "value": "86915511e50fbf27646ec8c2756a6f54423bd69f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999451, "uuid": "6a936575-57d8-4d35-8338-3baa1b6b84ec", "comment": "Malware payload", "value": "61a626ce9d7d62ce73a5e9c38cdaf07d82a7a7e2e366aceec28f2f04ed3554fbf5d43c97c0506f3d69d0b4d7741557fd", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999451, "uuid": "bcc1ab99-4945-45c5-8bc0-89bf15e786c0", "value": "T1F4562332FD9B1C1BCAA88376B05F3D152F2C6657468DD1D1BC7CA0C27B83A914A3E856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999451, "uuid": "b84ea3da-deb1-4921-873a-7ffbbef0a4aa", "value": "49152:GSxK8+879YhtS8FWnlMD3FIWVnOGkistpZ3gIgrXQOFyvPj4IQXfVsna3Gke1KW/:UZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999451, "uuid": "ccbb3039-1c4b-4784-a493-c0506f53dbcc", "value": 6160384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999451, "uuid": "6a61f970-016b-49a0-b6b2-65097f5872ec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999451, "uuid": "186e0f1e-e59e-4c50-99ea-c81914d26d89", "value": "Cobr_1663YOGDO0Y8H3815-De.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79be41d4-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985268, "uuid": "0c42a549-50a6-44ef-9706-ed7948c949ee", "comment": "Malware payload", "value": "310a1035cdaef172dc1cd74c28177967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985268, "uuid": "6e31dc8a-1480-43e8-be75-94a9e63ba391", "comment": "Malware payload", "value": "c05683462029feaca5b46e4b3ff58b44bad7d6629e94bd3f9f3ca88a85e02a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985268, "uuid": "22d37c71-d3b7-497f-a87d-49a0d65c7bf3", "comment": "Malware payload", "value": "53177eda7efbfb66d91f4ad4010f58a4023f1447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985268, "uuid": "6b22e6c8-21a7-4a31-8125-5fe656d64691", "comment": "Malware payload", "value": "32341c7b9e08fe05db2dff9862497ae8d17826333fe49c3237c48620e1f2e17451c60cda97bcfabb8eca11476e090fff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985268, "uuid": "2670e70f-475e-4d06-a54b-201bc5929804", "value": "T181F35A23D683CB77F2510630C8E4A205A93FBE5546A24B7EE9C17CD8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985268, "uuid": "8a61e6e3-af58-4401-a2ce-80145d2678d7", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985268, "uuid": "dc13dab8-6781-4795-b04f-c23cc79165ea", "value": "3072:wFDVESApLltNnQUHcXR0LXcLxi0MB3MqR:wFJESAFNnQecBqXcLA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985268, "uuid": "1e4fa8f7-4768-4121-9f50-45447c37b094", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985268, "uuid": "bfe402b1-e629-46e1-abc7-62e90f08f9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985268, "uuid": "596ef33a-5d93-478e-a803-613e63247da4", "value": "Inoculates.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ace587a-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977968, "uuid": "e186ebc8-d602-484c-a857-345a5cc02192", "comment": "Malware payload", "value": "867bc064dec708562d56aa9abb60ff04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977968, "uuid": "bb12b823-4496-4ff7-9ae4-9cddc6bfe907", "comment": "Malware payload", "value": "c0a80d4790bfaacccc878fdb234ee27064358679946c7f79d2f796927808677a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977968, "uuid": "45724b27-982f-4ee0-9eab-489e1627ebaa", "comment": "Malware payload", "value": "ced7fa07f05d04fa4f1f5e62163b7b5daa59172e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977968, "uuid": "9550a585-3fc7-40d4-8ad2-70b3a83ab2f8", "comment": "Malware payload", "value": "401331e7d88133104a4ca2f891d6ddae854ef1009ee79217f4aadec4e067721588ce99234e3d1d05e0d72a7e46254390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977968, "uuid": "264533a1-5d5e-4d0d-b818-408840578ba7", "value": "T1AF2412C627631A81937F42B5E2CE0A735118D4FD210A95C2BFF39BA50D136E61AC9F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977968, "uuid": "9ca657d8-13c6-48d4-8ae2-0a46f1af4caa", "value": "6144:t/3aTrlpdFJeJhHLJ+WwYw6V7Hrs6b6qyUIrQe9pT3BC:t/qX1qrDPV7Hg6bhm9LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977968, "uuid": "9a4920c5-1b6f-4676-ba40-8d93d4660628", "value": 213716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977968, "uuid": "3c571380-eae2-4c9a-ae28-20d063b925e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977968, "uuid": "95e4dfc3-4d83-4e5b-b293-804fa70d6bc2", "value": "dlr.ARMx32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c841e5-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977990, "uuid": "bc9b0236-7ed6-435a-b2ca-e9c100f90876", "comment": "Malware payload", "value": "4815989dd848469bed6ecd3a3979a16f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977990, "uuid": "606969a7-7c83-4e42-b5bf-f26c23842c02", "comment": "Malware payload", "value": "c0c85f0ab317faee55993d2a1f2eb86a43cf0918af8a16f908b01bc823e769be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977990, "uuid": "71d42032-196b-4f49-aa01-25f3bb4f84c4", "comment": "Malware payload", "value": "34ddb6513946d603d20717b3df929666e624aaad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977990, "uuid": "6ed9577f-176d-43d3-b2db-41f093dc492e", "comment": "Malware payload", "value": "1c379684db3e17bf5185f6a3d3eacfcacb6ebc1a835d031d46d5f5ff7f3eaa970228a668ce8285bccf16cb71d354f727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977990, "uuid": "61228dd3-9432-4e50-9d95-f23ce6b485df", "value": "T13D3422E3BF44189AD9AE9437715680CE05EF1CF246EDE260999FCB5923727F4218C9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977990, "uuid": "3528b93d-d1e2-4098-951f-a85181235f11", "value": "6144:KMWNWX6ErrTWSiTWdqyGw41eaFFp1sd9tRhixfDVjkqL:KMWK6Kr95dqd1T1otRhAfpkqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977990, "uuid": "7c6a202a-6dfb-4bfe-9276-3e7deb5d5af5", "value": 252460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977990, "uuid": "375e7c00-6d6b-46e5-b4b3-d60de53200b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977990, "uuid": "2784b8d7-631f-400e-ba9b-73a0508231bf", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eda6475-08ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770968043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968043, "uuid": "83c8461f-65bb-4c2c-a587-6e936f028d68", "comment": "Malware payload (Mirai)", "value": "08bee43834bb3d74c18465e77302cb2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968043, "uuid": "1e69736b-33bc-4605-8c97-0ef2161cf048", "comment": "Malware payload (Mirai)", "value": "c1430e18313ec2be1c31228a80b31af2cb04fb2d624c3488fd80b17a1d52d4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968043, "uuid": "0f100bea-536b-4c92-95bb-fa380de89464", "comment": "Malware payload (Mirai)", "value": "3b9640da9c341421eade22ccb46ce1cc5591a42d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770968043, "uuid": "00cb8fe7-e253-444e-a95e-088af1dca5e1", "comment": "Malware payload (Mirai)", "value": "0910e680783d1b62468e8e96bf72c75cf21468fa091ade2ef11f3e3070c7772b3ef91414f855995ce735bf8192001ef6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968043, "uuid": "9ba299ed-46e9-48bf-82c6-51ff332b0e81", "value": "T10A257D56F2F334FDC067C030875BDB62A936F46541222D7B21C4DA382EA6E741B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968043, "uuid": "6e115e0d-f9c1-4a2e-b468-84939a223e99", "value": "24576:R7zsC6Nw0oRLE2W8H/50LmLuxtnhVsGluJD62dU:5hLE98HOLmLuxtncn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770968043, "uuid": "c50d31e7-d716-4c08-adbc-baeb7d01db1a", "value": 972416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770968043, "uuid": "f4b0c003-580d-4a59-8728-c37c12a703ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770968043, "uuid": "88842623-6fec-445a-ac62-1d8b89521101", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00902f49-08c0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975616, "uuid": "656ddcbf-e744-47e1-bd53-e1e6fd1870a2", "comment": "Malware payload (Mirai)", "value": "ae0432eedcf4510e5000f2cfa4975e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975616, "uuid": "b972099a-36fd-4d6d-ad9f-ffbb38850a40", "comment": "Malware payload (Mirai)", "value": "c28e7804ea2a28fab3f53b5c740acaddece03c4427bfec92e0ab3e4997abf5cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975616, "uuid": "e576a45d-516b-44c0-9429-cbe0f2af44c9", "comment": "Malware payload (Mirai)", "value": "14ac8dcae3fbfecd36ed51d26877a3966be1693a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975616, "uuid": "01541ec4-2f26-4ac2-bab2-26e240a989a9", "comment": "Malware payload (Mirai)", "value": "d7925be463e3db26b9d1e4cab86c4935759f4ed7530024426bf740ec39a1b4d362b46f441991299eb0514ead9a833356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975616, "uuid": "bec152ef-932d-4303-a619-de5fc702c2b5", "value": "T193235CC09543D8F4EC5616752877FBB34BB6F03A11D9E9CBD3A9D933A841A21D20B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975616, "uuid": "4b518047-5f76-45ff-ac02-a1e1fc78ca87", "value": "768:dj/XpE1mCu3IeM07Bk64rzW4zF313Ww3tXdjfthglSBFIzGkO+eua:x/ZE1mCWIej7BkVC4B3lfMl8F6xOzua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975616, "uuid": "a171dc74-71b4-4e6e-86b4-5171538ee7ef", "value": 45744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975616, "uuid": "3d2598ac-72b8-440d-9f47-6c86f1fce669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975616, "uuid": "c4a4d487-2455-4fda-927a-c94adaec2f1f", "value": "StormStresser.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac995b-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999426, "uuid": "a220643e-2c3a-46ae-824d-a30a8a7d0909", "comment": "Malware payload", "value": "1c04dd1120705272478968bc84b68160", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999426, "uuid": "191adc70-d10a-4718-90fa-8083414b1e2d", "comment": "Malware payload", "value": "c2afeb6cc7052ab034e9c2c2b7b8200b973a2201f449b2a33a0446dd8835b537", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999426, "uuid": "429a56e0-3d01-4d33-870e-0c13e5f7cc9d", "comment": "Malware payload", "value": "a9ddb56f4a1ac6862fc226406050afe8507cce65", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999426, "uuid": "7611f699-1716-457c-adfc-d522a2e08638", "comment": "Malware payload", "value": "9b54a178cec491f4d004384cd067f4431ee99252e32205263e4a67173c2edfc141d8900372910c7914f00cd946f09dea", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999426, "uuid": "afc3cc73-07dc-4878-a083-7b0db49aa870", "value": "T14A763331BE015DAAC240CB79717E2E2A3F2C3647028F929168EDF2975786FD2532F465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999426, "uuid": "ca998213-a371-4423-bde8-b0c289197aff", "value": "49152:88a/WwPplITE2IID8wN3/ZWOz6UTjycl5vcdMGM4nXhiXI1YB7hgUj8CYE+lSQyz:Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999426, "uuid": "8e246f08-8161-42e8-ad6f-5b868432a196", "value": 7200768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999426, "uuid": "0fdad2f9-3b9e-40ae-8004-7719fe4fa9e3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999426, "uuid": "5189d20b-6ef9-4d8b-8bcb-192879800a22", "value": "CQBDC3249_Hm-IM0ZVU11756vrlr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ad385b-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971027, "uuid": "e520dc67-d600-46c1-b317-d4fd31b89775", "comment": "Malware payload", "value": "851292836a72acbed72c450ccea9282c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971027, "uuid": "cfc6244a-3baf-47ce-aa20-1e8c9c753d82", "comment": "Malware payload", "value": "c2fa4ca051a507a294c6d13c8fe75fae5e8f75a817c38dc9f51d5ca715d94864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971027, "uuid": "f004884f-a5ce-4b2c-888f-e7c8082d26f8", "comment": "Malware payload", "value": "624135201a7214621c68368d277cbc2fa6ba901e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971027, "uuid": "0c4c2115-c044-4c1c-b1e3-3f161ff11f36", "comment": "Malware payload", "value": "569459ca17a6c6989094608b578efbf8bd79d7c7691d84fd91cbc320b8945a614b554510a00d289ae139131f0e78ca62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971027, "uuid": "2ab7862a-f51f-4afe-9cd6-d80b61f73ef8", "value": "T152E41218261ADD03C4E25FF26C72D1B8177DAEDABC21E50B8EE97EDFB4B96184811341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971027, "uuid": "e86e42ab-16ad-4f71-8fa5-cca04cb226f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971027, "uuid": "ed6faae9-b4e6-4a16-b5cf-6310081cf7b8", "value": "12288:DB8Bc6kGN7nLXkjsszorli4s8uQ0pKsKpO4jmf+1FzY67tSNt8pdOB:DBx6kGN7LXkTz+HI52Mf+n1Isi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971027, "uuid": "4a117db4-9c7d-42cc-9fed-2401413f50d7", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971027, "uuid": "d399c2db-9c82-477a-8b08-fbb55ba6bce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971027, "uuid": "b92ef30f-0870-480b-963f-60a27517de06", "value": "SecuriteInfo.com.Variant.Application.lazy.6228.20138.23903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc2c347-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011444, "uuid": "4d4d6c75-c35d-4e8d-ab02-7d15e97dfc67", "comment": "Malware payload (Gafgyt)", "value": "948e2aa93f8aa32ac54bd1f6e5437289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011444, "uuid": "38201fae-7dc0-4783-a1ca-38c882451451", "comment": "Malware payload (Gafgyt)", "value": "c30d1450086ecc38d2e88bd7ed55d73e5b0112679a66b6baae8be922c43f275e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011444, "uuid": "dee9b611-2808-4dbe-87f5-5c5338310832", "comment": "Malware payload (Gafgyt)", "value": "1329c96df6e6ce6fa748151d71dee9d3526336bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011444, "uuid": "3c4d4e41-de45-498d-84f6-d6bc908c8e0b", "comment": "Malware payload (Gafgyt)", "value": "4eba072557462f60522470abbe2e21faf5222f8db29cc174313f4b17f5b4c13eb9f6e27b612ecf22e4218c06a80c6e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011444, "uuid": "c972f1d1-243d-43dd-9c29-b03ba9051cba", "value": "T19F243A32B241C6F3C08306F212A7DB660D33F5BB1B5FE509E3686CB89E66185B115E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011444, "uuid": "91610e8d-9a11-4fb6-93b9-6744259690d0", "value": "6144:q2MEkdpcNEWjyHkLYQTxOD8iABif5hjLyx0hyHy/0m0Qvha9x4s:lMEkdpcNEWjyHgbTxw5hjLyx0hyHy/01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011444, "uuid": "0e2b6296-4f15-40d4-ae1c-7b95eb6e7230", "value": 214099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011444, "uuid": "b2ec2619-954b-4ffc-9673-68ae9e32d411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011444, "uuid": "e6465c6b-6b19-4905-bb98-0ae1bdd77a1f", "value": "weednet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d3ff4a-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011457, "uuid": "0ec912eb-b0b9-4fdd-a9c0-df5c8486eb78", "comment": "Malware payload (Gafgyt)", "value": "f56f5bba23702556c68bcf84c301840a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011457, "uuid": "484422c0-f6b1-4e6e-9fcb-e16fd72a470b", "comment": "Malware payload (Gafgyt)", "value": "c3e5bbeaccc8c0a8f8d43afafa7fb0a6c32afcc0a2388f8a09d490fce2662132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011457, "uuid": "1e1e68c0-36bc-4645-8cb4-1fba16aca4f1", "comment": "Malware payload (Gafgyt)", "value": "5c287c4ca5820214c013c3dece9ced17159fecaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011457, "uuid": "95a8d6f4-5fa8-411f-a640-c6d52c3f57a0", "comment": "Malware payload (Gafgyt)", "value": "dea1a3b979ca8e605ca544fd4840cf023c942b867a493f10b27f46e8895248d180dd6cf7c5a2786396a95c75ac3aa9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011457, "uuid": "ca5aad01-dac0-4a25-9ace-036336cce92c", "value": "T13B443963F806EFB2F10BB27240D34B357A31FB9246931132631778B69D7A2C56993E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011457, "uuid": "4928e82c-848f-4e49-94fc-98a6c1567e08", "value": "6144:gCHpyoplGi+UWLgKymBJ3ee51UOKawDyB5/wCFrShb9H4u:gC5GCCJ3eT9awDyB5/wCFrShb9H4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011457, "uuid": "7437d17d-bac9-4564-a960-3b4a09efe188", "value": 263787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011457, "uuid": "68f1fb84-8bf9-4c0d-9aa4-7b65f7926e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011457, "uuid": "25444d1e-60d9-4d60-943a-004d3b9c090c", "value": "gaynet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ce0b05-0902-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771004216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004216, "uuid": "a63d0291-5659-452b-8b05-c39be3946257", "comment": "Malware payload (AsyncRAT)", "value": "b7b0284b0a883b14741a4de2b99d0be6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004216, "uuid": "d8efd463-625a-48b4-b97f-c6d70259638b", "comment": "Malware payload (AsyncRAT)", "value": "c41bdae3a8c738db247ce311db878cda9c7c4954ec0eeed58999b336360846bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004216, "uuid": "0bf016eb-8332-41bb-85b3-20174b577a93", "comment": "Malware payload (AsyncRAT)", "value": "c704e57d2060c40faa41ffe787da75712833db76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004216, "uuid": "bdd528f8-da96-42eb-8b37-9e231d1a5e2a", "comment": "Malware payload (AsyncRAT)", "value": "bf1f987a59307b0a678545c85c0eed8a674969bb347277ffb0b73faee12c49aebcdaaf0ea103b7113867693519adae07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004216, "uuid": "1b9336bf-5017-4c2b-b0bc-ad35989f5bf4", "value": "T103E523044F9BFCA6D52D0EB4497A98840B69DF5ED1A1A76C2CF46F7C33E2868D114F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004216, "uuid": "7a568c37-aab8-487a-99a7-c3aabd3ceffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004216, "uuid": "591b78da-50c1-497a-9490-62ccb1347449", "value": "49152:kCoa4sHYG5ovdgpd2gIGAYIgriJIRK84jlWp1kMYiaB9rfO/ovjCqD9E:vsvMdegxK80lWp1SrPO/MZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771004216, "uuid": "cc1f8cb8-ca64-46e1-9f46-60d6ace8e453", "value": 3097088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771004216, "uuid": "fb6a314b-7c5c-4cb7-aca3-2f91a2ab6c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004216, "uuid": "5696cc21-50c5-464d-8844-71a3a812354f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d746a3d6-08b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770972540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972540, "uuid": "20e5a707-3cd6-4776-bc08-020acf9be2e6", "comment": "Malware payload", "value": "59df1db95fede1cc371a0b4477a6efc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972540, "uuid": "e4f509ab-2b52-44a0-b1c5-6dda773cd7dc", "comment": "Malware payload", "value": "c47bc24ea51550ae30e8574fc23862208eb7ea1beec6b2550c7df91ee1ff15d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972540, "uuid": "2c8b296e-6a1e-4bb0-b208-88b408a38536", "comment": "Malware payload", "value": "37f1f45c9cb2cabb657c33aceafd94fee249282c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770972540, "uuid": "f5bc08f0-ea45-406d-8f73-f58ab61a613d", "comment": "Malware payload", "value": "e6f21035a8cec51cfdfc69e8272707e87bd4e35b8b74a13516982d0859b63675f2cb357d4e37d858e505db38ed625465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972540, "uuid": "9ef9fbc9-f7ab-44a8-b0b5-2b41921d4f4c", "value": "T159E31A45FC509F56C6D226BBFB4E438D372A1768D3EE720389255F203B9A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972540, "uuid": "27d17503-fec9-43d4-9159-dca13e37f9f6", "value": "1536:oOxE5WDSFCBnlIytVkTrLn0fwAMgbwmAD2GJTHLyfHfkOUJZzxSt8e2hfl5XwywA:djD0YqL0fw00mADJfy/kxu8F8rb7nO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770972540, "uuid": "b8973a0f-c8f7-4fe2-a9a7-5350c92625ac", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770972540, "uuid": "11fc0d5c-ffb0-4b68-8e2e-64055ecf5278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770972540, "uuid": "5d989e07-8f1c-4877-9717-56074eafc296", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ada743-08e9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770993468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993468, "uuid": "fbe88a5e-a84e-4b68-bf99-82ff5f317612", "comment": "Malware payload (Formbook)", "value": "184f8aa486fe05a6d49d6b9595350ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993468, "uuid": "01870615-80c2-4abc-bedf-cf73d999cf7d", "comment": "Malware payload (Formbook)", "value": "c516363e147f458e1806ace3348ded638bfdeef92c663a2478940e45b95cb911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993468, "uuid": "4d21fdbb-7c4c-416b-9d72-c1a45b951067", "comment": "Malware payload (Formbook)", "value": "d4c7682d7efdbd935b285280da26764696edc282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770993468, "uuid": "80c7224a-25ad-4acc-ae7b-66fad5073d98", "comment": "Malware payload (Formbook)", "value": "be8c03584987bf8bd9ad54dcaa4fa22de9eecbe6cad6efd9caafc75ab677e2308e3dc734c34e46bc68b14e43d2ba3936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993468, "uuid": "886b5d8f-7e1e-487b-b725-d93dcd54d05e", "value": "T142350264A26ED962C2980B7780E2D77403B48E96E553C3771ECA6FF77A57B930990303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993468, "uuid": "048ea6d0-280e-4877-9408-3a6e9d0f2833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993468, "uuid": "a2f80f85-ad60-4148-9c6b-ca0775ab2e71", "value": "24576:qG3wsNr9oqgAVXTT9SWEJdKspdrXdn5b8YE0C4oBjLDLguQlVict:qps19oqgIAJdD7rXbhYBnDUuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770993468, "uuid": "b8df6594-5691-45a5-b399-78e0cba4684a", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770993468, "uuid": "a8e87bcc-28dc-4adf-9d89-47b113fe4fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770993468, "uuid": "ddef249e-f662-438d-97a1-f0100aab87a1", "value": "Revise Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf6a145-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973194, "uuid": "433f1826-6c0e-45a4-a4ae-708c0b1b6e63", "comment": "Malware payload (Mirai)", "value": "9ca90863294287155df08fd807f14dd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973194, "uuid": "d1cd4769-ca20-445f-9c88-e1a67eb569d3", "comment": "Malware payload (Mirai)", "value": "c51d5b8dad461711efd48b1d65b12b3367b90ddb90d145e13a95e90dbe425ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973194, "uuid": "0131ffe2-0a48-4f72-9749-ae9f65f25d32", "comment": "Malware payload (Mirai)", "value": "dd25e3f8c62a9ccfd923fa8a8a72e266a7a61ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973194, "uuid": "ba1f680c-36f1-41ae-96de-800533fdd9b2", "comment": "Malware payload (Mirai)", "value": "bdec8c302ecee5d8bfbcc8aa94c209a82204e01093656ce1bb6d61d56ef4d1233fa6b47d3d8cdc52bcb7c6f1a29d51ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973194, "uuid": "d0d4f8d7-2ab7-43e7-a7aa-0b66f0e2b116", "value": "T186E308077A8189FFC497D1F44BEBA5369D32FC3E0935B19A6794FD911E19EA02E1C220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973194, "uuid": "2a5abfac-d696-46e7-a8cb-60faea331ab2", "value": "1536:EYF4IyQ1s68z7fkg+QPLGZBm+MQw6HR+mGblf1e/vZCcE3qcu3HEy:EVIxC68zQgTABmI5HR+Xf1e/vZCbzSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973194, "uuid": "9c377fe0-99e8-468f-accf-45310a8a03b4", "value": 144392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973194, "uuid": "0478d46c-f48f-4832-b781-bddd09f6b861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973194, "uuid": "c3bcd16f-7744-4fb7-95e9-4a9a8bef7d96", "value": "sys_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda18e4f-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026640, "uuid": "3b8f5a9a-7b53-4d19-aac0-89687f685019", "comment": "Malware payload (Mirai)", "value": "e490a829f7c39e5f4c772b024280903c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026640, "uuid": "187e548b-e15e-47cd-a983-f5606fafc455", "comment": "Malware payload (Mirai)", "value": "c5ae1522bd4681f32b6640e6525212457b0a237d7167a4da32a8f7a7075334e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026640, "uuid": "6fcf5ace-085b-4a2d-aa3d-e9cc86d6f2b7", "comment": "Malware payload (Mirai)", "value": "f8d00eea9248f6c053d1b3cd9c04416033922c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026640, "uuid": "72282eac-3c3e-4a11-a78a-c108dcc05585", "comment": "Malware payload (Mirai)", "value": "fe4c48f4a3da719166d2e3739f8ffb8ca5ba9bc820aa59db902c024dbf8e3d0121de868df011f5549c50febde31f2888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026640, "uuid": "069b2583-5db6-456a-99e0-db144f966d4f", "value": "T17A82D1B965BA1675DEB01236D83D8D4436570B36C0E634A535021FFCEE1900B93B99C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026640, "uuid": "11da5c82-49dc-4e5d-a594-4170fefcce22", "value": "384:tbF/Eio5q8yOZUq1T3YT2igLlDjabohymdGUop5h20:txMioAdnx2/JDG0s3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026640, "uuid": "b8e92091-5a1f-4cd7-9a2c-c156779a6ac2", "value": 19168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026640, "uuid": "4f82673b-de55-4a1f-9d7e-38b5d8ffa690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026640, "uuid": "b495e661-94a4-4e04-a07c-f3ea7eeba13e", "value": "amsarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bb8a7a-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975604, "uuid": "bd8546dc-42bc-40d7-8634-6e180c8a6506", "comment": "Malware payload (Mirai)", "value": "40f6b98bbbe2d9791eb743369c5723b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975604, "uuid": "2cd422e0-2c7e-47b0-897a-9153399e7e52", "comment": "Malware payload (Mirai)", "value": "c62c7c9567099175754f0ea1e0ba39ed0341a237600a838eaa1fa4f10f3ec805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975604, "uuid": "6e89eaf4-e5e8-44ab-ad2d-ad7e97c876af", "comment": "Malware payload (Mirai)", "value": "6ed6e5280a3187b8378197758f18630e6b30fa3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975604, "uuid": "b41c0231-1c6f-4231-bff4-41effb9e9f41", "comment": "Malware payload (Mirai)", "value": "bf24e5ec162a7d2da2d8539fc171656556cafdf36bb9541e157785e70dda13deca9bb8d93a3c9f375c3cc1b8964b1e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975604, "uuid": "0c09358d-924e-4093-ba95-fd0047539359", "value": "T11D238EB2C87DAE94D1598278F5219F781B33F006C6A33EBB4A4586764043EACF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975604, "uuid": "2f8c6eb8-104a-4c71-ad3b-42344de3dab0", "value": "768:LaQwtIXjZz6oReuUVlwzTlJsCErflynzkWCuoSWeCWv:LaQwtIz/XOlsNE4kWqxeCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975604, "uuid": "36d30cfd-f4e2-4f42-89ff-7acfacac1e93", "value": 45964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975604, "uuid": "7e201403-8dda-4140-b7df-e6f473aa491e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975604, "uuid": "f380fa83-77c5-4c63-a54d-b77050062535", "value": "StormStresser.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bf681-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963289, "uuid": "21fcced3-ec2f-4c0c-938a-6a10b4f58d9c", "comment": "Malware payload (Mirai)", "value": "ad38754618eac3fa45662b3e95f782ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963289, "uuid": "9910fec8-6631-42f9-9b1e-79bbc9f4c677", "comment": "Malware payload (Mirai)", "value": "c676ae3810d0420615c1c247b52a22963c2112c0696a30acd5d93b6e01cde3db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963289, "uuid": "5b5cb728-dbed-476b-8daa-95aad02fd2c6", "comment": "Malware payload (Mirai)", "value": "bbcecfd049904e47a3236aa6e8d335b12391e813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963289, "uuid": "64122cb1-8cf5-443a-a88f-c13030e5306e", "comment": "Malware payload (Mirai)", "value": "74565a77772ceb06adbb59ed498ef36c84d448e9c035603a3783b5c0990b4bc7b48325f4c79c061bd09a1af767577f5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963289, "uuid": "5323d961-77e5-4023-b786-bfb293c6a5eb", "value": "T1BC935A32B975192BC4D5A87A62F30731F2F6438A24FCCA1A3D710E8DAF6464036576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963289, "uuid": "217fa074-9362-494f-bccc-c24cac54d035", "value": "1536:Gy8MSzlPyzhCJuWsZIJH11SYIZDptbwgENWq5+/sAlhEtTr:Gy0A2j/SpVBJENlz7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963289, "uuid": "aaaca508-901c-4983-8be4-8d88fe6d3f2d", "value": 91596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963289, "uuid": "4a4163a0-0931-4cf0-be68-0d0afb18d3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963289, "uuid": "3129757a-ea2d-4937-a433-8290231da642", "value": "herios.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3202138e-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007911, "uuid": "b4169303-8589-4214-8492-e05f7564c6cd", "comment": "Malware payload (Mirai)", "value": "86b1dc7b1c2de3ec17da1270b669ccfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007911, "uuid": "24c94fe4-eb4e-4ec7-b10c-3658510da1ab", "comment": "Malware payload (Mirai)", "value": "c7992b67aef5c719f2c00d6c3280037beb86fd228e06707254574f8ef9d081c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007911, "uuid": "20294496-36e1-4284-9801-0b9b614d5f36", "comment": "Malware payload (Mirai)", "value": "0d93552a9cf902629b7359f292716f138c2e30f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007911, "uuid": "61aa4150-0823-4942-a038-88e1ce3307be", "comment": "Malware payload (Mirai)", "value": "30c6be6a53d866fce97d04bf40bfa3e291f7f1591c2c013ac8aa8338e4cd219fdc29252e99e59f0cf888f7c33b308207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007911, "uuid": "8622b89e-fff6-49f6-8169-0a09b300c5bb", "value": "T15C430228CB3864F7A558D5B0E0848907137D6FB8B6AF72B36A0D469078F148B8F52DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007911, "uuid": "62cd3947-1c70-427a-b7e8-26ef21614da7", "value": "1536:NCpI4gHg2slMMYHGglleyk/P0ge9EFaP6LUT4V3KGLzPFVm:NCm4gHtsibGx/P0gLFaCLUMnPfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007911, "uuid": "4cb74323-435a-40fe-b813-c9a9e30f1ca1", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007911, "uuid": "a9e067ed-6c09-4673-895a-faede4e49a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007911, "uuid": "e94d347f-8a68-4d09-b94b-3e0861341015", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d5332e-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971039, "uuid": "ea74e0bd-f8a6-424b-8936-bad35fa0282c", "comment": "Malware payload", "value": "702ab1e855fe3cb7d1f90f540699800d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971039, "uuid": "8e5cc43b-0b4c-478a-a838-262528021d07", "comment": "Malware payload", "value": "c88f4c23b80a549164f2726bda8b85eb32c0a285be334c60f6e69dc90bb77c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971039, "uuid": "9beb342b-0b7a-4c20-8487-9f501afb576f", "comment": "Malware payload", "value": "a1f88c7214d19a9cc433c6575e7504f39a848a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971039, "uuid": "e8398dc3-afd0-4135-a67a-dfa49981913c", "comment": "Malware payload", "value": "993ad227cc6c223c6fa545384966657cb0cf5169397fd2aec9e0f895357bd2b696b9f02458defed7c10d0bff2a1028d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971039, "uuid": "49327377-c2c6-4cbf-9b6d-97ec9fa28f65", "value": "T1E8F4126F3519C45BD06033F14062E779137C2D9AAA12E30AE3D9ADDFBD1F6A62518383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971039, "uuid": "6c852285-134b-49f5-857f-a390db6e0458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971039, "uuid": "717cc98f-89eb-48ed-9d1f-674a8e3ed8f4", "value": "12288:c3NHT8lo+SATYbX4Lqmy6b+mZGcW8aan4UlUAtu1Cw1s+w+1LStC7slZDN:oNHT8ldSA0zmyS+4WjtOEC9+pSQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971039, "uuid": "313816fc-15e0-47a7-bc26-09dd5bbeb58c", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971039, "uuid": "05435146-b629-4f4f-b45b-42d67e74aecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971039, "uuid": "b2dc3690-2ae3-4258-9109-e8e12e877ac6", "value": "SecuriteInfo.com.Win32.MalwareX-gen.94481899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343d59d9-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007915, "uuid": "cd0b4fdd-b8d2-4f26-bfa7-e3782e0dc8a8", "comment": "Malware payload (Mirai)", "value": "01147774e50fd70a99885c59c530ee61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007915, "uuid": "3f382f69-3907-4217-9d4b-8fbffe4c25b6", "comment": "Malware payload (Mirai)", "value": "c8948979715adacc6b9bd84c438ddd6ab38a3a681133fe10e04743730641fa16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007915, "uuid": "53c3abf1-eea4-4423-9008-97f539050bfc", "comment": "Malware payload (Mirai)", "value": "3bd8a065a4f341eb7d2b33182e4e0958a03abf15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007915, "uuid": "2230eced-3d56-470b-80b6-f214efd0ce82", "comment": "Malware payload (Mirai)", "value": "44c1322f15f501d6d07f981856a0dbf41d739a8d6afbabfc6dd51d7d5867e3c776d3b0fa4997de3612222534f608c937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007915, "uuid": "4799637a-fde7-4014-8dc6-061f34938c61", "value": "T17182CF714066B963C4F0C83F9D56CA86237B16B8E0ED26B63C040744FB8776F59E91C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007915, "uuid": "4eb0834d-2062-4770-97ea-41c75f256555", "value": "384:yCHdDxi5VVG8HuvbAO/UevAeEhNQ+GkmAhymdGUop5hXww:xQzVbRvSXEDQ+sAs3UozJww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007915, "uuid": "5a771513-5828-44ab-847c-ae039f2d042e", "value": 18500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007915, "uuid": "ee5d65df-5e63-4097-83dd-1f135abe0026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007915, "uuid": "54622e00-5270-4126-9039-1eba95b6d0bd", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74d10fc-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976862, "uuid": "85dce238-f525-4746-b71d-acf556296202", "comment": "Malware payload", "value": "ad5c3a5993accd42137694a589deee02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976862, "uuid": "2cfef65d-ab88-4018-80c6-e8a6b6baac61", "comment": "Malware payload", "value": "c8d78e0d38a5be0964355e0d1018210ea0aa58969ee166a6a39e499782420ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976862, "uuid": "2c010b46-7b24-4314-ab64-e4c68452242c", "comment": "Malware payload", "value": "dbe386aeb4c543a94606ccfb6c8f088f77479c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976862, "uuid": "1916e009-5986-43d0-ae20-5ea436da95e4", "comment": "Malware payload", "value": "1efac0c652923d7442c6ec81e9eba2ef8469f2ec8ea40ce8efc4515c0e3c2bb53615bba4f510db7060d04f5c3a34ac71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976862, "uuid": "0cb7271f-5b52-46bb-bb8e-06ac16cbd104", "value": "T119570751EADBD4B1E5025431D166F2FF6B209D424B28CA87F38E7F2BFB726850836146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976862, "uuid": "29d05030-5764-4a2e-9a4e-10a554c2ebff", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976862, "uuid": "01c976c5-b7bf-4cf1-98c4-8e8df7f606e8", "value": "393216:cw+sCd+9l6ylUF8/9RI06iNIA2BR3ep3f04F:cJcl6ylUF8/9RI06iNIA2BR3ep3f04F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976862, "uuid": "1cdfe511-8ed9-4978-ac3d-a94bcf495945", "value": 27772416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976862, "uuid": "509bc3e1-3e25-4f0c-afb5-0d7236ee216d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976862, "uuid": "a4e880f8-bb65-4722-a57b-325a43eaecd2", "value": "fscan32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366a0d59-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007918, "uuid": "a342b6c5-099c-4fac-ba99-47c09305d08d", "comment": "Malware payload (Mirai)", "value": "fc6673e567f5fbb22a451e393d2676dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007918, "uuid": "09fbb73d-9551-488b-98a8-b334c830f7cd", "comment": "Malware payload (Mirai)", "value": "c9187f26be3cc32f0075fe2af5816496fc97b6c2b79c8bface6d5a270e6ee84b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007918, "uuid": "b1f5f308-cb3f-489c-b8ae-6b44274069ff", "comment": "Malware payload (Mirai)", "value": "b8ae4b51f69e5157be4b0a23a7a182d1b47a6c2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007918, "uuid": "fb525462-4cc5-4fbb-bba2-6a6693898245", "comment": "Malware payload (Mirai)", "value": "33b66b57574ef559a9cadca6d9a2738fc583113d97c553043e73ec19d9adda7889f84ba35e90ccba93898a38e70a2dfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007918, "uuid": "b46853c0-e275-4a20-b34e-b7cc4a7e8f97", "value": "T1CAB2C02D6F040AE8CA1FC17916A50B402AF42F715642EC4F6255FA979E1F4F438C2AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007918, "uuid": "570a245d-c934-4395-90ea-e4ffedec5afb", "value": "384:deD8ZSH2LLZUYyGZbsOiTRli/xwkqvcsEXe3mKXmumd7JgGlzDpH7uNj1JA4c:deD8ZSWvZHZbs1RliKkvXe3/mui7JgG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007918, "uuid": "79be203d-92cc-4195-8036-44424c9206b7", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007918, "uuid": "32eb47d3-747c-43ec-afbb-d83d2ff018f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007918, "uuid": "d91dbf5f-36df-4876-9f53-f39277b15783", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32b5c84-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013308, "uuid": "95fcbb47-188a-4e4a-8a36-197f5384c082", "comment": "Malware payload", "value": "2e825e7af2b4b5030543fa52074e6c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013308, "uuid": "f163fa75-7767-4cf1-855b-050488316229", "comment": "Malware payload", "value": "c99a4b734172ccfb607f43ba3cd03d471d11e974354ef5ae86f72915b38ecfbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013308, "uuid": "7978af23-194a-4e74-8b9d-f3233af5897e", "comment": "Malware payload", "value": "3e2e06e02ba1378eee79cba31c50244925fe8660", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013308, "uuid": "edceb407-7e9b-4d0e-9ecf-c596c0a6b1e9", "comment": "Malware payload", "value": "455ea92ba296e3a8024f80edbd2a6641521cc2faee7d96fa613b8b7d134a7f938b65eca4265d6fb325fc32c8a05f3c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013308, "uuid": "694c8062-5be0-481e-af63-f62a3ef9d6be", "value": "T146C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013308, "uuid": "50926588-94fb-4735-bfc1-2b4338786ca2", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dWJ:6eB4exMF7oZKJnCNYakJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013308, "uuid": "a7a4a694-3006-4663-a26e-fc357fc8203a", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013308, "uuid": "13c6c52f-dca0-4402-9ef5-a66e46570f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013308, "uuid": "95ce6481-aa89-4887-b532-c69f70db032f", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ce83f9-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770971004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971004, "uuid": "ba466d17-13ac-4dc1-a6a0-9e3dbaf1eac5", "comment": "Malware payload (Formbook)", "value": "a0897752e596e42c8652a377e4a4c827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971004, "uuid": "02aab6bd-f1e0-4717-89ef-fd48fb897f9c", "comment": "Malware payload (Formbook)", "value": "c9a7422e9bda1f8e36f23648857c16fe5332be73c474503b6502eccf4d5ed059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971004, "uuid": "e860543b-fc7b-42f9-ae1a-300b32cdd7a9", "comment": "Malware payload (Formbook)", "value": "6796719fff3b51dba6906e84cc9bbda61284a541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971004, "uuid": "2832a3b6-4804-4112-9634-a73333c12248", "comment": "Malware payload (Formbook)", "value": "1ae6434a7a233d0cf488b069e1df646f0198972375c09d21678c8469d85c65bd10e7257d71e60e8650a249d4b52fe309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971004, "uuid": "e6e038e6-fde2-47b3-b4f8-aa8464dcb671", "value": "T12F452392625DCE43C09A27765531E33093B25E1AF121D3A6CEF5BDCF7929BA524B8303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971004, "uuid": "2b30f684-aa09-4c68-af92-8a486321ca5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971004, "uuid": "0e64c8af-84a3-476a-bb77-02a7ddcde481", "value": "24576:rguQZio0KlbICsKDyKAgN5oZPbrAv3Y4lRqp3gOuzhWPzz5CyJ09p:0uBrKPQKXNQzUgGRqpyQPzzUysp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971004, "uuid": "9dfb4c80-7dcc-4cda-b584-7822b3b5b425", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971004, "uuid": "93f5d4f1-b718-48e5-aaf8-5ede2037d518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971004, "uuid": "6b41c087-99f1-4683-9ab2-3f8ef4e67d6b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.25139691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658641dd-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999407, "uuid": "ba3ea59a-3c8c-4088-99d4-038bc434d505", "comment": "Malware payload", "value": "eed96290159abe79e20b132e3b0d6893", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999407, "uuid": "71c3c5e9-8c4a-4b31-9d51-f88a31d33435", "comment": "Malware payload", "value": "cafc935ef772399a8c881dfef5da8e1b55f3b6833df0991f5620b03387c8e352", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999407, "uuid": "a9ba00cc-e4d9-46e4-8d9f-429dc89c1c58", "comment": "Malware payload", "value": "dd967556bd0dc4bb1264246fb20a3683584c1462", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999407, "uuid": "7052331b-1088-448c-bfc7-fc70870f789c", "comment": "Malware payload", "value": "edefe4be0c21b5c4bf593217d759af979222d29579660ba51dd103cdc4965f93b853a19254c7f06ef53cfda9d00690db", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999407, "uuid": "51e26a2f-fe70-41bd-863f-68dcfbd4276c", "value": "T155662330AE115C6FC7A48F36B03F6B253FAD2153454DA4D13CAC72826B87AD1963F896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999407, "uuid": "8c1f79c2-4c49-4ebf-8075-4aa17796c8c5", "value": "49152:9cgOfFn6A67oV66InZIQQDpwNd2mJL1sxrXJPhLPI7+cPrb88aOqWWCnwqUyNW/R:emyWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999407, "uuid": "66d6146f-ff41-4fd4-8e27-0d38dfa9ea4b", "value": 6606848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999407, "uuid": "20b1af8d-4ff8-4281-bc0a-cabfa1b26e53", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999407, "uuid": "aba9abe8-e175-407a-9298-d4d22b29d4a6", "value": "Cit7B27X84713BALUDT_Lib7482.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec65bb82-0903-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771004788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004788, "uuid": "f24f3846-df0d-4058-9f63-d292ac67a5b2", "comment": "Malware payload", "value": "83d6895a9a0044eee2d502bcdd432310", "object_relation": "md5", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004788, "uuid": "a2bce81e-7e4d-43d4-b99b-7008d615fc79", "comment": "Malware payload", "value": "cb787d9673f15aa634d27d48525e8aae6e970f3ff52108410bd3cc155efa11d2", "object_relation": "sha256", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004788, "uuid": "b2c47223-354c-4afa-b9ec-b01dd52b6554", "comment": "Malware payload", "value": "79a5d2dff47f84ba8dc81cad5dd0008e9a62dbb2", "object_relation": "sha1", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771004788, "uuid": "440acd08-6e70-4262-aba5-6a0729ee1860", "comment": "Malware payload", "value": "ca46329a62b1df2d885bc9978abbdddbf8c809ad4cab3a29f294d0f40a947a71fc1c49cf3ba3aba84aa212d9db5d7208", "object_relation": "sha3-384", "Tag": [ { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004788, "uuid": "ae3673ab-3451-4567-9f54-a1a7232740c2", "value": "T155D733A1E0B41A31D45762735084A924C69A48603FB8FF9FD92152C46CE7AF60FDDA3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004788, "uuid": "e47fb5cb-bdac-450e-b92f-f4755b66319b", "value": "1572864:FCxQSHoPmABmhYCgDN9VcvGOQl1hCLaKm99e3lHdf:o6SHo+6UZGVlOQjhAaKOe3lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771004788, "uuid": "83d38fbd-4f2d-4b11-8e24-676b902d05a3", "value": 61302803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771004788, "uuid": "852bb0cf-8926-4b87-ad0f-37e250a9e015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771004788, "uuid": "ff8594fd-d4db-4dbc-8c30-4cb8d018909d", "value": "cb787d9673f15aa634d27d48525e8aae6e970f3ff52108410bd3cc155efa11d2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f944bd42-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955847, "uuid": "a559ce1a-338a-420c-8a40-bf37a1f29b96", "comment": "Malware payload (Mirai)", "value": "04903df20a3c4a09067f38506c136e66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955847, "uuid": "52ea83fb-9bee-4ae2-9321-ad8d717edce8", "comment": "Malware payload (Mirai)", "value": "cb8f17c3aba04b43cab3d8839cbbcd548d0f6134ad1fb21c57d2909479546660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955847, "uuid": "825cc7d0-f9a0-40ab-95d6-cb5caddcdc89", "comment": "Malware payload (Mirai)", "value": "b9fc0a9fc7a2276bc5441d6c3e5cdb7771ad955c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955847, "uuid": "b356a686-b059-48e8-9a8f-cdfc584e1b6a", "comment": "Malware payload (Mirai)", "value": "f3cfe4af9f6cc54c2f888481c6aad924b0ed293365ced3d6494cd2933e28aecf313e9c05ca8383619c69c47db1a25c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955847, "uuid": "9f741c03-947d-49b1-ac39-43a5d8545bb7", "value": "T1D543F792BC92856AD6C05772676E568A33B263A9D1DF7303DC184B1037CA60F8E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955847, "uuid": "3c069af3-2d43-4bbf-a3ef-0f93b1c4f49c", "value": "1536:EYWq/ZKVIqvCtlx7lJ0VvFsP6pntUgm+S:Eu/ZmI6CtlKvpntUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955847, "uuid": "ff2fe1b4-536b-4965-8a84-af541834621b", "value": 55176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955847, "uuid": "0a3dd087-c4ad-44ef-9266-8aeccec9b7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955847, "uuid": "1cd637ec-71df-45f2-96a8-33c18766febd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5097f6-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974082, "uuid": "5a4f6ed7-7e9f-46d9-ad43-4d52147f852b", "comment": "Malware payload (Mirai)", "value": "4749d5c176696c9cb43a0cc91c83758a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974082, "uuid": "960081b7-27b5-49f5-98ff-094ebda13fe9", "comment": "Malware payload (Mirai)", "value": "cc5948dc9b386b0691386742b18627e06d89f3892578fdc686733cb05ebe2ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974082, "uuid": "0e7dadf0-4f45-4ce5-b83d-b216445f558e", "comment": "Malware payload (Mirai)", "value": "ef404e539644d276cf558d6c5a1890eaf87a7ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974082, "uuid": "a2ca4290-2f4e-4da4-a3c7-285f76f0cce4", "comment": "Malware payload (Mirai)", "value": "bfb798055ea6b2436f03091221363ebf7be370821195a7346e162975fdcc77b789d5ab3470672cce73ffabf9c87786f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974082, "uuid": "fb83033c-9c1c-4209-bfa7-df263e21c6fb", "value": "T184D45B01EF841FEBC4AFCD30856E835B15EC8D9742D1A674A0BC8D5CBA8D25B0BE7598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974082, "uuid": "b0aa8e19-d6c5-4c62-97fd-f45521684d02", "value": "12288:EC62pnSdmXaE7+2mlG1fle/mvOZvdihkljGgemnDxDQfOXL7FCHYVbeb2/G9KUrE:3pnS67frEMOVXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974082, "uuid": "761824e6-263e-4102-9210-985fc1711d3d", "value": 597928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974082, "uuid": "f990c2e6-c9cd-4322-a8b3-610f4212bc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974082, "uuid": "1c219b56-5782-4cd1-90d6-49e9e13ed8b6", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df4f4bf-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976658, "uuid": "7c8b3d77-399d-4696-b294-95f369d35f89", "comment": "Malware payload", "value": "6587c48966f12eca67de6ab84096888b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976658, "uuid": "c2b10feb-82bd-4116-89a8-7f7fe147f750", "comment": "Malware payload", "value": "cce5527b07713aba842f089543362723d921231af1e28f844ed7dc64a3ea7c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976658, "uuid": "06bbe4c8-d346-4ded-82b4-f0ed0f1e893b", "comment": "Malware payload", "value": "76b8d11e1bb761a6c0e47fea217b14d5d9390e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976658, "uuid": "5495e8de-8ee0-472f-bd79-ddc2f9b5ec1a", "comment": "Malware payload", "value": "2f111ca1614a693c05d1e38f2554f8585061de9aed0acc478859a95a6eb95efd19004dc1526cc8fafc840421a8ea291e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976658, "uuid": "14b85461-c544-4f4b-93f1-680cf2f37101", "value": "T13A815403A7E8166AF0EB177409B7470166B5FC149F37DB6F49E80189ACF17244E63B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976658, "uuid": "77e94fdf-0be3-48b7-a343-36153ffea409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976658, "uuid": "d8eb61e7-230c-457c-8f99-d7e9041df3fb", "value": "48:69/B/oiO706o1/hRHXlX7BI20laT302csjPvDvtEOPulUf0l7WI:iVRP1hRHXvI20laTMstsyf0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976658, "uuid": "a5e22817-be7e-43bf-a72a-d2a612de49f9", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976658, "uuid": "2aa04930-1c96-4fe9-aed7-b01cdf4497ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976658, "uuid": "a011b27a-ff15-4d4e-916c-7aa03dbae6cb", "value": "vpn-profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fc115f-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955495, "uuid": "f8bcb5f3-76b8-47b4-b63e-c80f8b42843f", "comment": "Malware payload (Mirai)", "value": "1fe4c6b9317fae28d3822b3149a4d7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955495, "uuid": "386af7eb-67ee-462f-adb0-6d420f60bc0a", "comment": "Malware payload (Mirai)", "value": "cdc95db41484e000d3fa7dfb20ca4154ccf097d4bd5e4bc479ac4ac109102b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955495, "uuid": "cccfdde8-a6cb-47c0-aaae-3856e8a05e10", "comment": "Malware payload (Mirai)", "value": "fc29b51472c2b92ec2088cb039411ad42e9f5e61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955495, "uuid": "321d12b7-171b-45f0-816d-c1fcb3d2090f", "comment": "Malware payload (Mirai)", "value": "10b678394b8c03572c6453d89dab2934b9a649c3a06e4a5436f6513a5f32c714d1ef5f35e49fc2b83d545cbf3b72da0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955495, "uuid": "017fbb1d-5500-41fb-8951-26b1dc48dd16", "value": "T1EA03F260AA7358B5C950ACB6F615C16237EB3FF8A1F17B213F10C89C990604FF6A0996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955495, "uuid": "69741e1d-ef0d-43f6-b3c8-8983de88f1d6", "value": "768:HCqcTRywB6wIzdyoqfM+KJOC5yWTz+eaQvs3UozAQ:HXcTUaIzcoE0h5hTz+zzAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955495, "uuid": "17f6e3b6-6c95-41b5-b730-4aeff72bdbcc", "value": 40964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955495, "uuid": "8ea2a48b-a24d-4bb9-8ae8-e1ace3e384a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955495, "uuid": "7b3c2b20-5165-47d7-ae51-71d160587a28", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226933a3-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770970948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970948, "uuid": "a3a19769-1b81-44b5-ad75-80fc721ce1fa", "comment": "Malware payload", "value": "002f10bcaa5b30f44ec7764982c3611b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970948, "uuid": "4755525e-72ea-4234-ad2d-3ae89b54daed", "comment": "Malware payload", "value": "ce8d48a6ddc23c4bbea305c5ac303394148d981560a780c509d6fe00470d5141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970948, "uuid": "6e4adf66-bec3-47f6-b644-db3c31db19f3", "comment": "Malware payload", "value": "ef90ec278e20ddfcebf731fa91d8aab95d54d509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970948, "uuid": "ca1f910c-8e56-493d-9ca3-4a00c8a2c23c", "comment": "Malware payload", "value": "9e798096b974c7baf10e0c1a2f7108949300dc998022959c0b28b0c6e16147bcd981b5449e4ba27de7cca1b66d7cb431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970948, "uuid": "5e23e580-79cd-48cc-ac9e-29a165d0252e", "value": "T16DF412A8262AD016C55517764E72FBF513F90FDDA001E3278FE8ADAF793692208483C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970948, "uuid": "bdc5216c-0e8a-45e4-be23-0e5a566d3617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970948, "uuid": "9f2332c1-439e-49af-a1ad-51cc3a5674c4", "value": "12288:3w6Mm7d4r+NOY83n0IfC2Z8H33uYvE6lr5AmsCUwgKNS4FqO/YHdXjagBz:74r+4Y83n0If7Z6+Yvvr5/sPwg4/YO0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970948, "uuid": "ae36f479-a4d6-4f4f-8662-0362dfc1a665", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970948, "uuid": "19024df4-3e69-483e-b10c-0bd5564c3cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970948, "uuid": "106d55bd-16e5-43fd-8e7d-d3d09e7d97fb", "value": "SecuriteInfo.com.Trojan.GenericKD.78161350.10209.11477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6934de72-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955605, "uuid": "05304959-344c-4285-bcb1-a1f6b11c1436", "comment": "Malware payload (Mirai)", "value": "c82f43737a686b4043c0101b18982189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955605, "uuid": "61265a48-77bc-4343-969b-8066fc06859f", "comment": "Malware payload (Mirai)", "value": "cede308eb479ad46651fb4d2b9eea91d78ec5a9623cc5a6bf59ff2a1f62a4f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955605, "uuid": "6b73ab67-3048-497c-9610-212513af4a2f", "comment": "Malware payload (Mirai)", "value": "6f152fd41839a2b0095b5cb14659b4e21f345876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955605, "uuid": "515b1fd3-78a2-4062-bb50-6cd5fbbb5c35", "comment": "Malware payload (Mirai)", "value": "81accd438b57498bf22a3d313b05465654f1b816fb2d6b7b153d004f1ae732c3e45f4fbae43a9ed27529bdb617b19da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955605, "uuid": "479eb852-4bf6-4396-a99e-7a25e23149db", "value": "T10FA32A56F9818B21D6C112BAFA1E518E3313177CE2EF72129D246F2077CB96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955605, "uuid": "7e6f6a08-2bdb-46cf-86a0-8d31fac0e4d2", "value": "1536:4vnw3hbpnyoefCQmSorgN5QLpRtQEa74QNsC1D4iu14GjEP7N/Z5kY17HAv:PhbpmTmlKQ9Rtda7+14GjEPx/ZOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955605, "uuid": "ee074ba5-bab0-48b8-9ccf-90ae8ea4669c", "value": 100128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955605, "uuid": "1d5652e8-e40e-43af-9cd9-0847342e2ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955605, "uuid": "e70419ee-e2d8-4ddf-8360-00d0d0d8ab94", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814e10a9-08a4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770963806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963806, "uuid": "9842c92f-a01f-4afa-8a4e-d0cdf41ede1d", "comment": "Malware payload", "value": "8bf8ed302b9607fff95ae68d8f14f84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963806, "uuid": "611d0b61-1d05-44e0-966b-7ef9e8aee09f", "comment": "Malware payload", "value": "cf6a96a3d5f4a41f7087caec1e4fe86cac1e30a35f57ab7c31d92f050878e349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963806, "uuid": "50e0cdf7-270c-4aec-809b-84f15bbaaff6", "comment": "Malware payload", "value": "131b0435290b6a04b95cb82d565fea41b2ef3210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963806, "uuid": "84e67703-0782-40c4-84da-5bdef02e11a0", "comment": "Malware payload", "value": "750936f3b1d9d16a57ec5b96d904e6f6dfb8a2a98e093e0f32f36b88206d81e7df48a7f6f1dc8cc855a8414f308b8eef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963806, "uuid": "87fb524b-b254-4a74-8446-c3a28a3b970d", "value": "T17D553A23B5C56C3AD05A0A7785B2F31C943FAE61775A4C469AE4384CCE34390EEFB946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963806, "uuid": "90b86ea4-ea2e-4cc8-a3d2-492d52a29456", "value": "eea6f5484196052a85472ce45700e7a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963806, "uuid": "af62a6e6-cbcf-44b1-a3a9-a83861f637c6", "value": "12288:mmE/bX6eP3jAe7IgNNHpGXUfBFmUTgW+adegB/sp2Nw4s0B8w:md/ueP3jAYn9GXUfB4mgRade/Cw4TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963806, "uuid": "4e770712-3673-44b1-b591-a9be3ee97231", "value": 1306112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963806, "uuid": "06ea9f7d-05b3-474b-9be1-c025fc8be041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963806, "uuid": "52bd56f7-de44-4917-8a85-39a24c7eb38a", "value": "SecuriteInfo.com.Variant.Fragtor.483665.982.24477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e43ab3-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770970974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970974, "uuid": "31001abf-4782-4ef6-875e-3e2b36ec03f4", "comment": "Malware payload (Formbook)", "value": "062c9c3724f7a8d7b820a33e621db087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970974, "uuid": "c4ad595e-f838-4019-bddd-d4ca33a712b4", "comment": "Malware payload (Formbook)", "value": "cf938a9c9c24de96809b43ef00e50547a13d0abbb5fc360c33c93d6a69a2c688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970974, "uuid": "5165b785-9663-4450-808d-6ac09323c843", "comment": "Malware payload (Formbook)", "value": "41e56a6c257379cf9620722816c64bfe6d7da730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770970974, "uuid": "6213228f-a645-4c7f-81bf-f4918563e55b", "comment": "Malware payload (Formbook)", "value": "295c234d38aca18ca938fd7fdab2ed728dca4b61a91bf792ccf6e49a077361c3c6df129e3a3b877de1462b9fdd4b6d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970974, "uuid": "e8e562b1-a77e-4202-8519-bc5bc6453e1e", "value": "T146F40214226ADE07D5510F744D72E3B80F79AE9CE852D203CFDABEEBB435B501986392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970974, "uuid": "6bdd5572-36c2-46dc-8afc-b1c1576d027a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970974, "uuid": "395e9cf0-5035-4b24-9515-5d661cf556bf", "value": "12288:YQIV560rFVqghDQ1e6SfCHlPiV3zGKOOVEtQWp/JM2RE/eCN3ZjccnUiZEjIkXQ:YN56OC4DQ1eQtiVqdKBQRyWCN3ZRnUJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770970974, "uuid": "f741bad6-05de-49ca-9ac8-e66716ce9f18", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770970974, "uuid": "eea16d7e-960e-41b6-b5b8-8f6fc4880f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770970974, "uuid": "317cd6cc-b533-4130-9d8a-f19f497bc384", "value": "SecuriteInfo.com.Win32.MalwareX-gen.68132999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46294df5-08c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770976591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976591, "uuid": "8c0ac53f-5afb-4cd9-bcc5-c0fe2447083e", "comment": "Malware payload", "value": "418c2b0c5aae0bc82335f0ec2f12fcb9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976591, "uuid": "5bbdf559-a35a-4d3a-8975-227eb1e717f9", "comment": "Malware payload", "value": "d0e7bfe6a07be5cf060508f9dba6e5b5b9b1d70ae120f40510c446ee0d8c810e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976591, "uuid": "c26867da-da44-4f3c-91ee-dde0af390372", "comment": "Malware payload", "value": "50f324de952dc2e98e19b7c544bab2c898e435c2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770976591, "uuid": "8937d6e6-ddc1-4a07-99a1-68727cd9687b", "comment": "Malware payload", "value": "2b32f5fb2ee29ff88c02537ad185c8fda0a881d6f1ea2bad3f16f2b738609cb5c02b841efe73def59effcc9eec778ef7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976591, "uuid": "692437b8-2ee0-4bbb-9cf0-816f704645b4", "value": "T13BD05E53CC6ECCAAA6A32DC2B1FB8C0EC3C3C865B56DE6584D80A97C168AD924565813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976591, "uuid": "d174680c-86f8-40c0-9d2e-f4fde987fc2f", "value": "6:4hxANqWZ1nB4GGQfK33GK50oJLVbCvxZjh/JLVbCvLcOL:4HAoy1Zffq50obbkZjh/bbyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770976591, "uuid": "9e3e74b3-d5cc-453d-b100-3b9ad41377e8", "value": 269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770976591, "uuid": "00a9f105-e5f2-4700-9d31-52d6f03bddc7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770976591, "uuid": "ea89a711-0c19-4fa9-8855-4b094d7ecdca", "value": "shell.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe413da-088d-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770954032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954032, "uuid": "544d8a9b-162f-428d-86ad-90aa0bab344e", "comment": "Malware payload (Joker)", "value": "610bd1894eb01021307a79ec53b5d7ae", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954032, "uuid": "58c22b7d-8857-49e0-a3cb-e9572ee95519", "comment": "Malware payload (Joker)", "value": "d103b07918e1cf609034f220ed127bf1d9f03642889957dd74741c9ef275eeb5", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954032, "uuid": "02f0bb19-da1e-4932-9c6e-c658826afa63", "comment": "Malware payload (Joker)", "value": "1e1d56dca0df69e2f27f2deb6179d78fedb35f5a", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770954032, "uuid": "7c257745-55a9-43a2-9cf4-941ff57ca441", "comment": "Malware payload (Joker)", "value": "57fcda84bb4ee7ad8a7f6677daaaba296ad5149d71858c6ab9c74cb53d81bee4e8e2f12df999fb65e7470c5b5b9c5d3b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954032, "uuid": "05000d4d-47d3-4f3c-95c6-ab270a0adf7a", "value": "T1BAC7230AEB1CFA2FDCBBB0B9CD990132B12725559601C7B77411C62CB9838E28E55BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954032, "uuid": "4bf45d4e-0495-4b63-ada1-2d629852f677", "value": "786432:NYPMn6PlN45FB5He50Vo78hCM3TuNxFtajN0EHlzLx8mtf9tPdAar+m48IaFB9:LnAl6jBpeOeLTxFBEHlzf9Zrr+FJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770954032, "uuid": "7a5ff18f-955b-43ee-bc43-0cf6826145d0", "value": 56690193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770954032, "uuid": "47c7c224-523c-47b7-90e2-f0a10fecbbb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770954032, "uuid": "80881ed2-4223-41a8-aeae-82eeac280592", "value": "com.exceeds.satemoji.wemaker_3.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0ea944-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978079, "uuid": "a92c630e-1dfd-471d-8712-0aa9103f69c8", "comment": "Malware payload", "value": "c9e2aa933b5bdf3c12fd761c5990370c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978079, "uuid": "e55a3b5d-7387-4882-96cc-7f72315b8fe9", "comment": "Malware payload", "value": "d1c458ab62e9b20ec1b4981daeed50ad071c3a1e89f00a9f9b08955b1e8e4420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978079, "uuid": "b8f1b1c1-afa4-4292-adaf-505045daf980", "comment": "Malware payload", "value": "e8289670255ad78c94c0dc22bb5a99b91fd66135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978079, "uuid": "01a7e76f-7877-43cf-879e-a4e78853ff87", "comment": "Malware payload", "value": "10d515b2d7d8278f64ae7f967bbe1e3d11d311c7e0fdea7ca4e570f98348748e3188f8a829295049ba3ebd6c76ac159e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978079, "uuid": "22f02d33-66cf-447e-b99e-2df829d3c5bf", "value": "T1C8B47C2263114FD4E365D2F106F38F648AA126A20BF355D24378D628BB5077C6D2FEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978079, "uuid": "fb55d671-8c24-4187-b4f8-6f330b714594", "value": "12288:EgTmZYA/OkKTqwrETggK/zoDoNrQW5/ScgC9iDksIX3vhIhQpNK7U+4:EumZ5mkKOwAq/zoDoNEW5/Sc8oDvhIyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978079, "uuid": "d38b114c-7092-4975-9e56-178b514468f4", "value": 539576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978079, "uuid": "cd368897-23e7-47cd-a389-dcf816457427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978079, "uuid": "0db70b36-7eda-47a5-88c8-00a146a197af", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e8de8-0914-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771011861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011861, "uuid": "e2c991ab-2429-4e64-ae49-9e746eaa8d86", "comment": "Malware payload (SalatStealer)", "value": "ce18440a9565e48ff6266831975c7f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "webrat", "colour": "#AA2777", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011861, "uuid": "fd93ea39-efd8-401b-8f14-e3eb35929724", "comment": "Malware payload (SalatStealer)", "value": "d1cf2bed3134dcfa6cc837d263f99ab2743d7b770f801be92b172f441b6e0ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "webrat", "colour": "#AA2777", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011861, "uuid": "a0f29a09-7a19-4fab-a4d8-db60f2b02aa8", "comment": "Malware payload (SalatStealer)", "value": "1c89214667ee27334c501e74fac2ceba00ac8216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "webrat", "colour": "#AA2777", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011861, "uuid": "384a415b-bb2c-4b73-b81d-d1815de75e0a", "comment": "Malware payload (SalatStealer)", "value": "cdd8e2a8c2b2d45a21328a50cdaf3588a980ceb73ce04fca66144d69b84ac267183eb766ad94627cf4a59538dbb569b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "webrat", "colour": "#AA2777", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011861, "uuid": "c42eb9ef-861b-466b-977e-5c79a390b23e", "value": "T189162318B39A30AAD33646F5899D1502CD2EB8537F21D68B13528A863D6F3AD0F37731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011861, "uuid": "fa710de2-7b1f-4016-ac8f-395bbbe72589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011861, "uuid": "8c3f9e41-53f1-4a53-b03c-aa9b58c1c3a8", "value": "98304:RYMrRtXovrojMKLxTerDmPtvcGoN+V8BXHpHjcFrJC6guyr4qG:RY8TPLxTeX+tvcBLXHporJDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011861, "uuid": "edc486bf-514c-4cb1-9c8c-0d0bdf0ae4f1", "value": 4158050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011861, "uuid": "39700485-7a24-47a7-b4ef-25dd879184b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011861, "uuid": "f405c590-da5b-4802-bc38-7779d55d1f38", "value": "Telegram Fix by Sexsoldier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d48a0f-091a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771014516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014516, "uuid": "6a047cc2-3712-417a-9050-48c5536e4d3c", "comment": "Malware payload", "value": "e9833b8c9a120d286b2c3b378083f85e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014516, "uuid": "8e5452f9-755d-4eb2-9b72-c0231bdfa941", "comment": "Malware payload", "value": "d227b684ec88e5bfb3006dd4e97268c72977c8e2bb7711e2587c461eaaad949e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014516, "uuid": "2435551f-ed9b-42ed-8950-057c8cc5ef8e", "comment": "Malware payload", "value": "f4f1ce50a24a48288f8d0ee6c050ace90bde5dd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014516, "uuid": "607bea59-6a3c-4023-90f3-8b0e0af92c85", "comment": "Malware payload", "value": "cf151d1ae1a95a4fdd036644657f292e44624d636ae151208f25e8e3b0e5232a83b3a0605e536efea4d2a86ff5fa0bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014516, "uuid": "a01b0067-b2c9-41f3-8c6e-978ecc8c4c0f", "value": "T11C935A22F979193BC9C4A87722F34361F2F6438B24E89A1E7D720D8DAF6465022577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014516, "uuid": "bc82f89f-4fdb-43d0-ab36-9e0701f2cae7", "value": "1536:XjXLN8KKwDmyegYvZDFoi9yDUTtkuhq5SkIAZwraltU9CtM:ziTgqVauh6Skv9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014516, "uuid": "f489a042-f238-465a-bdc7-7b5f23dec795", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014516, "uuid": "67a1c27a-8542-4117-81ea-c986e954588a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014516, "uuid": "01871dfb-c8a4-4691-98c4-fa38bcab217a", "value": "Calix.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94433b8a-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014518, "uuid": "c6d46911-eb15-4e1d-992d-308b30c20cd6", "comment": "Malware payload (Mirai)", "value": "58630c6a380ed0a60a533907e41cbfb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014518, "uuid": "8e8717d2-d4cf-4118-8547-60cd43033a4a", "comment": "Malware payload (Mirai)", "value": "d2700972291443af195fe63ddf6c8a6738ebba2542c19c865ff520519656f076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014518, "uuid": "21b2b4ba-511b-4a06-b9a2-1bc736f0c06e", "comment": "Malware payload (Mirai)", "value": "88647fa9b1671c7bfc7fc92cc9a71859e830d307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014518, "uuid": "82a53fe2-9ae2-43c2-ab88-686b94de29dd", "comment": "Malware payload (Mirai)", "value": "64e243911d6a80e99be8ad996430601533e2fd082a02c9d41c4e2076c3a71006c9370b01ba6e589ee714db902d16109e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014518, "uuid": "a4bcef50-55b3-40fd-8eeb-a85763365873", "value": "T1AAA338D7F801DDBDF84EDBB744530906F671E3A219830F36626B7867EC391A45826E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014518, "uuid": "c0dfbe04-12e8-48f2-ac7a-d452b43b7c99", "value": "1536:WY3pWv1r+jbo1cZlR37Y1T0/88B8IxGaqm+lXcmhbfXv5N3Va1A+LG6:HjkQ14T0/88e/XNhLZa1A+a6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014518, "uuid": "7aae9448-b700-432d-b99a-7e8983682851", "value": 98616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014518, "uuid": "f552a419-e301-4ed7-8b42-8d6d009a5c87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014518, "uuid": "9751fa47-9eb8-496c-a463-9921a64f45ca", "value": "Calix.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5ff9ba-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971049, "uuid": "5b2e4084-195e-4bb6-8c13-1ccb7cedfde2", "comment": "Malware payload", "value": "419d70f359295907d9473a283e71b616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971049, "uuid": "2ba5f4c4-29f0-487d-afe1-5c530643edd2", "comment": "Malware payload", "value": "d36add6d0bba90bbe9c5cb49ef868aca8108bea91323fcc445441c59c4403070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971049, "uuid": "31d717fb-0b2d-404d-b9aa-54f13e98f016", "comment": "Malware payload", "value": "fbbcde7ea0e4cf4be093b707204549e99a7199e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971049, "uuid": "5804f807-1c2e-4530-b69f-d83aa4f201e5", "comment": "Malware payload", "value": "3e78610137d7c3c0126dd1fb03ef26cc4452b1e519ad8542b367c4d44ff0e5dd9300fa0fe933d39020095ab01893dafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971049, "uuid": "1bf7f13c-b858-490f-a0e6-61e51e174707", "value": "T17A3501D03A65772ACEB506B4D624EDB642F41D6CB050BAF769DC3B8735AD610AE0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971049, "uuid": "806ca6b7-11d3-439b-917a-fe21bde9a804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971049, "uuid": "83a36394-8151-458a-9006-a4f13db384ef", "value": "24576:x1rllmea7xuwZp9YAbzPhwwhl/YkjWak4qf:xllMea7xuwBYAblwwn/kaYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971049, "uuid": "930b45cc-68ce-4d27-a155-da6b590cb2b2", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971049, "uuid": "26bb4e47-0a31-4c46-b435-a7bf8b6eeb70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971049, "uuid": "59ede12e-752d-47cc-8ad9-a39f8f6c94de", "value": "SecuriteInfo.com.Win32.MalwareX-gen.29588674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1600ad44-091e-11f1-a129-42010a9c0007", "comment": "Malware payload (Fuery)", "timestamp": 1771016024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771016024, "uuid": "2a60ec38-2327-4789-9248-e5d40f4bb60a", "comment": "Malware payload (Fuery)", "value": "8e4c07963077228de130111ade5705e4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771016024, "uuid": "d0080b89-dfa0-4bed-ab02-6f81c3391612", "comment": "Malware payload (Fuery)", "value": "d3d2e7c99c692c73840dc1cbb73b1613f4a4267104d6ce073df8c12d0c7e158a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771016024, "uuid": "1adec731-855b-47b5-921d-56787e9d25d2", "comment": "Malware payload (Fuery)", "value": "d257ff6bac266a0319f21630daca08440f8c911d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771016024, "uuid": "1571928d-00cf-41b8-baf1-a2585e00e7ae", "comment": "Malware payload (Fuery)", "value": "0012ed42e3b559c9e9c30e499731fb5fdf907c0187fa5291d1414accbab39ad4f000cbdd404b82dff947bc2ac6cebdeb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771016024, "uuid": "e377c444-75f4-4d77-a23a-d3440822c9e8", "value": "T152252265768CCC06D5AD07F16A70E33457B5AE9E6822D21AEFCFADF7B44A3420848353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771016024, "uuid": "bbb747e5-2b02-4af8-aa40-5f6d408d874c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771016024, "uuid": "e434f264-f0ae-4ea6-91f5-ac9448d562e0", "value": "24576:nsWguQrHxEm+TdUwH8i1U1hN/tLGXwCgpLo8hbVictUY:nsPuYHxGOKmj/tV/Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771016024, "uuid": "0d1e4e53-05f6-4c48-9334-78dd8d6abb79", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771016024, "uuid": "e4cd29d0-ae27-424e-8065-9fb1cdcbe2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771016024, "uuid": "2fc7e58c-f0c4-433e-8d65-7aa819a3a0a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c08e048-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963287, "uuid": "c1808e97-384f-4631-85b5-0f0e749f8969", "comment": "Malware payload (Mirai)", "value": "0342b5f7bc0ef26e40b2dfb0485c1499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963287, "uuid": "5a60779a-cfbf-4cd5-ab0c-4bc66bc8181f", "comment": "Malware payload (Mirai)", "value": "d3d7def5ebada85b025beda0a8c6f8ee396783df82f0a9ba87dde7c22ba749e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963287, "uuid": "9bbb4a23-4308-4c22-b46a-26dd6ef98ce3", "comment": "Malware payload (Mirai)", "value": "eb404a0b8dce64dfcf2bda5c7bbfde4473d62060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963287, "uuid": "689c7c3a-a0c9-4d24-b15e-b8de3f98de1f", "comment": "Malware payload (Mirai)", "value": "4bd2a79ebaacc592b82659dcd5d6876a1f53930209a02d186ef8c2f7bc4df400a29067aff09dceb858d410d916c3384f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963287, "uuid": "812913b1-6a67-4a48-bb27-fffcf1cad76b", "value": "T108831891BC829613C6C512BBFB6F428D372617A8E3EE72078D255F21378782B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963287, "uuid": "cabaade5-a357-4f1b-820d-660f5d103173", "value": "1536:/V4F+8wMvh/zTjmCon3rqMGbICileevkQ+PnQDgEsQdxMU1MLK:/VSUujmCon3rql0YkkbPnQLMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963287, "uuid": "d53aa9d7-6165-4603-9326-7da988ad9728", "value": 87444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963287, "uuid": "6fd40e9d-eee2-4d9c-a308-85a11ec66cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963287, "uuid": "ebe9c669-e936-40eb-995d-c9910032ee29", "value": "herios.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b232dd6-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010235, "uuid": "3c81c47c-d2fb-4443-a0af-4611c6ccec28", "comment": "Malware payload (Mirai)", "value": "c9a40cb1a2c717f6168c841e5f907688", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010235, "uuid": "cd4f8736-7eef-448b-874c-04b2be2481a0", "comment": "Malware payload (Mirai)", "value": "d4436e6314e5faf9dbd01bebc39f7ec7adc83735a1c3fbb3e7d7e8b0fd57747f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010235, "uuid": "20609e8d-f147-4381-b134-c13395c391e1", "comment": "Malware payload (Mirai)", "value": "74b29ee2265816259e02b3ec027188c228676901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010235, "uuid": "d676b30c-865b-40fb-aba4-01c4d8d0b2ee", "comment": "Malware payload (Mirai)", "value": "64b9f50faeca654c7e39f75c5b7957af47026a202e929962aae556ff8784057f5616ab8981ca224bec877971cbada2eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010235, "uuid": "30621b36-6321-44b0-bae2-9f94813136ec", "value": "T1D7C2E01A73312C63DE31B577BC7DCEC292A51EB4D0BE3413194423647AE38526A6F5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010235, "uuid": "b5f67f2a-dcd2-49a8-b2a6-cb6ced1e417c", "value": "768:+9e6qn7R4YqdxwQ+EozPAr3Op8FnDgW79q3UELzX:pWpqzojbdaLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010235, "uuid": "dc3157a5-d361-4c11-9d4d-5e6d927b4269", "value": 27320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010235, "uuid": "85e44495-63a7-4edf-abf3-f11aacfc62f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010235, "uuid": "6600a03e-85a8-4c83-b4bd-67280fc67745", "value": "SecuriteInfo.com.Linux.Mirai.9816.3330.15148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cbe4b0-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955497, "uuid": "4f28667d-6d5c-4497-9e89-f3ef112bc326", "comment": "Malware payload (Mirai)", "value": "fb962317b0bab7782477df0f4449f7f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955497, "uuid": "2d41b44d-4edd-42b3-89c1-bc5871d6b07c", "comment": "Malware payload (Mirai)", "value": "d4d3922650016439699983e98f84fe324797a5cc4e3c636b2f3fc54551551494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955497, "uuid": "e24b61a2-f4fd-4397-bbc8-4b0bb5a90534", "comment": "Malware payload (Mirai)", "value": "8fd3f096fd0a5b9d96542a477dd8e56129f8f5bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955497, "uuid": "7efa91ba-1890-4d0b-aadc-9d2df59aa784", "comment": "Malware payload (Mirai)", "value": "84706fa6ea43ae764d573c5a95dd2c9b48def4d3157b0d03e1bcf310ab40cfcb6ea82ec95f66689b4294da5b2bec16ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955497, "uuid": "1e542ac2-f220-4602-9bfd-583317eaf1e2", "value": "T13503F11090719857EAA81FB07A909C87276E2F5F23678E70F1C9EE95190B4E30E19FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955497, "uuid": "d4f5cb44-5ac6-4b27-b8fb-508cba7612e6", "value": "768:GH3uujJEDYAZ2DSJGBi80VV/pHVOJ9C7Fh7HSZ6BMuQjJ8Rp4uVcqgw0Ig:Geuj5AZ2DHB3iVx1ioF1HI6hv4u+qgwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955497, "uuid": "6e8bbd28-d954-461f-a128-dd355a8946bd", "value": 39988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955497, "uuid": "d0214f2a-c53d-4738-83c8-f196f98a9d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955497, "uuid": "ec0a8697-4245-4710-b392-cb73decbf638", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727922b6-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974089, "uuid": "6018d214-1ff4-4404-9e00-d41e066d72c5", "comment": "Malware payload (Mirai)", "value": "487e5b702cf85e982f14fb0023425fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974089, "uuid": "139efec7-80d8-48b2-aded-1a72d834a988", "comment": "Malware payload (Mirai)", "value": "d5751515c03d2a3238802b90290d88f080acd7d8a073e34fd1eac44f78b818c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974089, "uuid": "492f96a4-49ab-4452-89f3-0a4d6612adae", "comment": "Malware payload (Mirai)", "value": "fe3b3133c2b3b2f63c930ff66709c10c4a3d8f76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974089, "uuid": "3cb5fc41-2996-4782-ad20-dd4f4a4abf02", "comment": "Malware payload (Mirai)", "value": "e6d45f57d25dfde9dd36e75d422e0d9d12caff1c3b62f83dd14a05394ef171f0c1e0dab08256c8535135668fa8b57844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974089, "uuid": "1d764dd8-fd3a-4383-9f6e-068f88b4158e", "value": "T114238DA7C43C7DD4D15982B8AD248A3C5B23E006A6D33EF6B64785628047EECF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974089, "uuid": "5284a53f-7d21-47d6-abb1-28d0a4e7dc2a", "value": "768:nat/jptstaT85n1OYwtgl4QpfqlrK2jfGcQ1q95LSXtbRQGCWo29a1Ca5E:nat/3s+YfwtglSKLi5Wdl6Oa1Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974089, "uuid": "44dadd85-6af6-43db-a586-582f1402e373", "value": 47556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974089, "uuid": "99f45497-8fe5-4e24-8cac-7d25d09c45a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974089, "uuid": "7d4b7a8b-6440-4f52-b426-6edf7ce32da1", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d17174-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770971029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971029, "uuid": "d7aba19b-9edf-4624-8e53-55320f12bcc1", "comment": "Malware payload (AgentTesla)", "value": "41e0c1c88abedfef27cc9d50e2a5f6fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971029, "uuid": "b146e695-6bf4-45da-bd1b-28d59cd8b45a", "comment": "Malware payload (AgentTesla)", "value": "d58f124c5fa8c860d434a1e533bfa7d4fabc252664ddd81a55a871ef7decf237", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971029, "uuid": "ae6cbc88-8182-47c4-9704-000f2c26e4cf", "comment": "Malware payload (AgentTesla)", "value": "577338ecc05df79d813808ee2869238abddc43a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971029, "uuid": "e949d2ec-754c-4c7f-840c-f5c52eed3f94", "comment": "Malware payload (AgentTesla)", "value": "7efc21ffd312cdef9e5b064ef7b8a71e6868f4d00e5c025179d8dc3885a79f7fa2e9168752dbf9420a3bf676f520b422", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971029, "uuid": "118ca75e-bec8-41ec-8f8a-b8a15fe335cd", "value": "T121F40224215ADF03C4A30FF81A60E1B467B8DE9DA525D35B5FD63DEFB86AB811900387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971029, "uuid": "ac01ad9b-6c85-49cd-a422-573ffed8cea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971029, "uuid": "3d3cb9f7-c26a-481c-84ab-4efbf4ce3f2e", "value": "12288:mRR/fRec0Y4IswOvBWTGLdCP+oPgCriboXqcaKF1SO4UNFEtFVL/QeS28h5ejDTU:MpvswOvBW4d95OnqcV1SOh7EZJ1MejDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971029, "uuid": "935b4c1e-b420-4828-8f3f-a23f04d5bf0a", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971029, "uuid": "9960a9eb-0c81-4352-8607-e3cfdbc770b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971029, "uuid": "98eee2b9-8e1a-4f4e-9827-8ce00f9e8a70", "value": "SecuriteInfo.com.Win32.MalwareX-gen.72285744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62b7565-08fc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771001663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001663, "uuid": "726ff5b2-9363-4c86-9858-aa5e05eff021", "comment": "Malware payload", "value": "515e61cb7918b928f55f33ab823afbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001663, "uuid": "6bbf1ba3-fc9e-4fa9-bf00-159556ed47b8", "comment": "Malware payload", "value": "d5e76679fbd2f3070f64e06eea4ad435b416063b5e9576614bcb44837c8c65b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001663, "uuid": "a05aa411-9db8-42ac-93a5-44d7ab5cc731", "comment": "Malware payload", "value": "e91af94cde98bc311de844f96ce44354cfe614a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771001663, "uuid": "8651f9ee-7ea8-48e2-9e64-f99b3cde344d", "comment": "Malware payload", "value": "d015126e2b337fe445dd5f603de63bacce8592e123b4e1f09e4b65e41d25d8473884b50a15aed2dbfa6250f65b822b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TrustConnect", "colour": "#028D5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001663, "uuid": "3134fe08-e6a1-46bf-b318-88a6c53a0bf2", "value": "T1B6871256E2FD00E8D5BBC0B8C6575517E7B1341913309BEB66A48A692F37BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001663, "uuid": "2d596dcc-a6ed-4a75-bf32-787abbcda7b0", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001663, "uuid": "85109c7b-ebda-49ad-9457-35ffa62d54e1", "value": "393216:FKxapWfk2IWDr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81w:R4NPr/vbpvuY7Key+7PJsYPUlbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771001663, "uuid": "85a1bf84-4acf-4f78-9b36-71e5954c6f12", "value": 36333216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771001663, "uuid": "821d3e7d-a7db-4466-a78e-aba4290d4d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771001663, "uuid": "04424b8c-178f-4eb1-989e-9243509970d6", "value": "Cake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9783d1-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974022, "uuid": "e25b754c-4775-4673-8670-beebcd4cdafd", "comment": "Malware payload (Mirai)", "value": "0448a5bf601d4fbe42f726d24611b3d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974022, "uuid": "5d022654-a7c7-4a1c-90ed-c14801d112c1", "comment": "Malware payload (Mirai)", "value": "d6c0b00bc17c5b5f710c5ce98338ab9a3fd1455247af6dd8eaade35825fcf3ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974022, "uuid": "55ff36e6-9966-474e-b6f4-9075d5b272a3", "comment": "Malware payload (Mirai)", "value": "c142607604926edbf810ce085f354a4d99f418b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974022, "uuid": "07476147-cd30-4a9f-8df4-4379d24cd525", "comment": "Malware payload (Mirai)", "value": "4088e345e143c994aa9fe9a4887e172f93d294403bc6cbb1b983b6bafb567fda992f47ab9987aa8b1b00f8585f3f18db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974022, "uuid": "59bbb1a9-682a-4d36-b9fb-0cb638ade3e2", "value": "T126E0C268145635967E931E50762BBBC135816C85A610062EE3B9BE238CBDF017B0E971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974022, "uuid": "39175c30-6bdd-4925-8c0b-34ef2d95608d", "value": "6:hdc4UUy0OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:X+OZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974022, "uuid": "03b6aaa4-09d8-437f-9898-a28c44fb2914", "value": 331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974022, "uuid": "8d478983-a924-4ee6-8803-80d424c2974a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974022, "uuid": "ca2e68f3-7a93-4d95-b7d7-cddf9bcc02b4", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b941855-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999364, "uuid": "b4205daf-eac7-42d6-8610-713deb2a8976", "comment": "Malware payload", "value": "fa32b9a5afe1b0035ef35cf9c5b78ba3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999364, "uuid": "4fdd5281-16cd-48d7-9014-280e55ad0dca", "comment": "Malware payload", "value": "d6c5f1caf50e9c77571ef19c774c6b2012542453ad38f3d52c94c965661411a5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999364, "uuid": "f1c509ea-1971-4b60-aa07-ee1d79771587", "comment": "Malware payload", "value": "9c0434270a29cf98818dbed072ff169dc5597c55", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999364, "uuid": "6b7808dd-3db3-4392-a00c-c00da73c9c1f", "comment": "Malware payload", "value": "79b58544d6b2cb27a669238acdcaf0ed7194bc409c419a8539f449d192abd0cb15500c7416a1a9b0b5d7b228d433919b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999364, "uuid": "747aa816-7caf-4ac2-a7e4-3e6de8c2c4d4", "value": "T195262230FA852866C5904BB6B43E37353E6E3203468F85C1B8AEE257BF429D75B3D851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999364, "uuid": "cd575f03-4c9b-45c6-ae58-226b9510dd47", "value": "49152:ZH3d5q4RV/4qpi85NEvW6SczeL6heLu9CBQXgAPpgE5YzK:eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999364, "uuid": "82639968-e6cf-48b2-8bce-033c4ba93f5b", "value": 4861952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999364, "uuid": "b6957b7a-5877-4d74-a081-f8de8a1fcfba", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999364, "uuid": "ad76f260-35bc-4505-9aa5-016ea46e10fd", "value": "Cnslt000S0_84226HGAQTO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5843578d-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007975, "uuid": "f75e72e0-f808-4d6e-b745-3aca0d851f70", "comment": "Malware payload (Mirai)", "value": "7f36cdc742969a670897ee2d4fd58ef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007975, "uuid": "e63ca03d-51fd-4116-8c52-a232869e73a7", "comment": "Malware payload (Mirai)", "value": "d7c7a35f68ea36ddb720aa82621caec1b1040592f24d574d727406f18e7a5afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007975, "uuid": "3e709bc0-7d79-4cea-95cd-672404d57f99", "comment": "Malware payload (Mirai)", "value": "1d454026308d929e74943ad732fff276af84e04c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007975, "uuid": "fb1d1d8c-3c74-4280-a128-09472a31a7c7", "comment": "Malware payload (Mirai)", "value": "5bb63b60f58473236ace92b61375dd5a8bcac17ee64ecaa67c4f24ce54e7d57257afb25576355a5f1c9b28cbd5fb028b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007975, "uuid": "352df3c0-0574-432a-92f2-ae74708b8b7e", "value": "T105230991BC818A27C2D41379F5AE998E3361B3E8D2CB7227CD614B107AC551F1C66FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007975, "uuid": "2fb389d6-1d66-406d-ab62-c4bfe8cec7c6", "value": "768:ioHTwOcm1zHwLADnl9OYW77rQTZQu8LStjB8/cICdjMiVYHUGyVIDKoKEuMqTRJm:ioOm1f9Od7rQ9+StjBDhwOfQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007975, "uuid": "d6f8db30-35fc-4534-aa2c-6b194bba9021", "value": 47100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007975, "uuid": "32367019-8d33-452c-8272-6bab9a9e921c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007975, "uuid": "27d08bd4-df52-4a05-8641-6872af7cf590", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601cb9cd-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999398, "uuid": "4be92370-9ebc-4945-821c-9ddd76ad64c9", "comment": "Malware payload", "value": "7bf1efb590c0aff62f66407383d1fcac", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999398, "uuid": "50d98598-8e2d-4746-9fc8-71b0cb15c214", "comment": "Malware payload", "value": "d828de243015ab511252423c6f20f48d013ad9d95204c17ed6542cae86a71112", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999398, "uuid": "cf148f93-660e-4d86-a05d-3c6bca82ad9d", "comment": "Malware payload", "value": "4ff0fbe4d975d8bb13a9dc510d913d5d66b9d08e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999398, "uuid": "776d7a8b-d642-40d2-83c3-f84851ff6ff3", "comment": "Malware payload", "value": "5e72498c960dec11152c1da4625d707bfb028bfde04a35b93db3efd3b2ed16e1dd066f449005c429eba2697e2cba4049", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999398, "uuid": "86008798-8029-4177-af61-fa4bbedeff59", "value": "T1A0462335B9D16877C1A14B79B42E3A302E3DB9230B8CD5C278ECE643BF429D5963E581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999398, "uuid": "8018c9fd-44f1-40e1-89f0-68efd47340df", "value": "49152:U6Ig2GnpnJ/KhxZo/oUVNdgH/HzGDRq1/pyWAvWVZwIyen357e31u2xrc3Fo:ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999398, "uuid": "fc1c1427-a59e-4069-97fc-9f8923f4b50c", "value": 5367808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999398, "uuid": "d5416122-e9c0-4891-b695-2deb14685ee5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999398, "uuid": "fed1067d-0e54-4d8f-b728-9de302dd1695", "value": "CitER69RH107220TACLM_Lib429704.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85444f-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955854, "uuid": "2f86ed02-0b7c-41ef-ad37-9f8e355c4a63", "comment": "Malware payload (Mirai)", "value": "8ce3480ce2e8f9ce798a60f2baf91d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955854, "uuid": "13a7d87b-677d-4ad7-a860-a424ca9a9c61", "comment": "Malware payload (Mirai)", "value": "d8bd7e20e4009c8fd126d42fbea66d8460b04fda463aeb10f0a27286343e81ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955854, "uuid": "810f8c0a-e833-44c0-983d-6ffee88bd555", "comment": "Malware payload (Mirai)", "value": "84f33b6844cf8824a5e765375b6676976efe6a71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955854, "uuid": "11ef6ef3-dbe9-4f7f-9adc-c5a7b7bb6fa3", "comment": "Malware payload (Mirai)", "value": "8726b9ee9448377586a3b8fb5d71c368db96ded6e68af29c55d659d4d91c505d7a82ff7683e2fceda063a8b93b1d9be0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955854, "uuid": "08010f7c-d4ed-421a-9f45-ccb61c2c8c24", "value": "T158043B46EB418A13C4D227B5B69F42453323AB64D3EB330699287FB43F87B9E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955854, "uuid": "01105941-c01c-4188-91b0-c6adb1222352", "value": "3072:EY869bi5k2AtDaEIMZfylwSPN0Mz4Qcp7KxX4fXS7bFM/9xBDOU:Tt9a+Da1MZfylTV0MYpuxIfXS7pM/9rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955854, "uuid": "9f82a23c-3924-4492-84ec-d9cbbbea56db", "value": 177947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955854, "uuid": "0656e740-b141-4452-a8dd-de3eeb5b3a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955854, "uuid": "1acd7a0e-08d7-4243-a0d4-bf7aaca76c58", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd1fe5c-0897-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770958136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958136, "uuid": "f0fb9761-3a74-4c20-af5a-47f878a23afc", "comment": "Malware payload (Mirai)", "value": "0239370103a4ec1a32207c72fa57b8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958136, "uuid": "889a606f-44a7-4bc4-955c-4993a7869ebe", "comment": "Malware payload (Mirai)", "value": "d8e9fee6181326a251636a97c8909fb59460b5ba132b7247395548faa53319d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958136, "uuid": "0a174f94-9023-4498-8b3b-d4f53bc6f3e8", "comment": "Malware payload (Mirai)", "value": "673fae54c0af0dd5e0c0e1dc468c7ea0badee7a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770958136, "uuid": "97a73545-1cbe-4ca8-8e59-69d7515003e0", "comment": "Malware payload (Mirai)", "value": "2da242605b10e4fe19d3e97c4f9a029e8ea8585188a9c43dd6326089b29e6f56925824785764aa0b27d9fc2bdd2b5bf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958136, "uuid": "ee449704-6d4a-4513-96c9-153367f6a1ba", "value": "T1053301D01762178C8361D9743CAA301E4524292F72EA39542DABD08FF55B623ACB6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958136, "uuid": "873ce49a-2c8e-4f46-9076-ee138c948a71", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQH:8D+CAXFYQChaAUk5ljnQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770958136, "uuid": "85a94bfd-4f87-4676-a68c-ba734f013cc7", "value": 52000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770958136, "uuid": "6ffeb9e8-660f-4b1a-9912-18db5370211a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770958136, "uuid": "41eb21d1-5bc8-4a84-a8f6-112d72b2f4d4", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd63556-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941386, "uuid": "667826b3-80aa-4596-a862-92aeeae770f6", "comment": "Malware payload (Mirai)", "value": "bdd439fa874a68481b2f6f0c3952505f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941386, "uuid": "85ea1657-bad8-4141-99cd-4ece876af0cf", "comment": "Malware payload (Mirai)", "value": "d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941386, "uuid": "38eccd3d-dd79-4979-8aeb-cb463393fd42", "comment": "Malware payload (Mirai)", "value": "89b3373225f5b77e77b915d70fb57cf2bd1e198f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941386, "uuid": "fd5d1f6c-d2c4-4cc4-a8e1-415e32f457a8", "comment": "Malware payload (Mirai)", "value": "6cb6982b203835154698c9cab8fae754ebf813b6bfda807a94c32aebd7fb6cbce78511304660a1149edbd4702cd2a525", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941386, "uuid": "a8848dd4-5fd1-4818-be87-463e1ff06ff3", "value": "T1121182E604D4C023D89E9E8EF3B1835AD4ADB3CD7CE12A0E9994DDF48C2562434CBA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941386, "uuid": "0848a571-93bc-4b3c-af3a-618dacb202ca", "value": "12:kvu1AxXaAo3JAX9Ki3qdG3X8y0iU04ANxXUYFmwuw3XU74QmxXU6FuR7wdXUpc:kNRKM9D8ymh4UYFRuwHU7dmRUWblUpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941386, "uuid": "d133d6e0-be44-4e9a-91f1-c495e74dfbce", "value": 978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941386, "uuid": "d9c1e816-ae80-4f07-a35c-ec007b85cd44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941386, "uuid": "637c849e-dca3-4af5-8202-ba71c98b3882", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78e1fd9-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955817, "uuid": "b6154089-9737-4e4a-8d58-c95428b7910d", "comment": "Malware payload (Mirai)", "value": "b144fc2e6d178ebff52c2ebc4f810e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955817, "uuid": "5ba18dce-28f9-42c6-9d4a-b4158fdb65f2", "comment": "Malware payload (Mirai)", "value": "dbac3279a395c435d82e3854a1807b42b554d3fd6c25c3d84ac5da2f5fa8fbcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955817, "uuid": "40add3e2-0589-43fa-b5ca-f4b6d3465ac0", "comment": "Malware payload (Mirai)", "value": "12b9a8021276375a07b8b04f73d176f405d55698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955817, "uuid": "aa04ad88-5d6a-40f8-bfaf-53241fb7254e", "comment": "Malware payload (Mirai)", "value": "bf3eb64961dc0a610cecda13b3bc7b3db08c684ff9f565395f5de9e7e4e0e4edbcc46e42e372d49a487b650931beb8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955817, "uuid": "6708fccd-c97c-4826-8407-72ba32d1338a", "value": "T151630234C827E8314F9A79332E7BC88EB915CBB4D637221AF716CBC87752801B55A529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955817, "uuid": "af76f896-22aa-4a65-9718-0971c11ba16f", "value": "1536:yYyE6qAPFCCwUiVmNrIKG+DfjQhgf+88WLVRc/VMHTN2:yYJiPUpVsO+DjQhxWLQNkZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955817, "uuid": "f3738a6c-5b73-4954-a503-a04f99898d1d", "value": 67044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955817, "uuid": "efaa6a6a-85c9-4815-9c63-12a378f3eeb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955817, "uuid": "8fd33c2f-7d58-4c33-b996-f48959cebe1b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3aa226-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015530, "uuid": "f8289d01-8cbb-4b21-839b-0521d81d8797", "comment": "Malware payload (Mirai)", "value": "08bb3cd77398fb74c1e1cf589e3a770a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015530, "uuid": "c749f049-2ce9-4ef4-87ee-952ef914b541", "comment": "Malware payload (Mirai)", "value": "dc493211028fcb476fab853082254a2abcab3f9e4b85fdce73a8e5d8068a1559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015530, "uuid": "1d576358-a8d1-42a5-be55-c81067781315", "comment": "Malware payload (Mirai)", "value": "e3e254747e7de0e90dbb4afc020cf847c6c415bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015530, "uuid": "a0581e0e-e4ce-41fb-8ce4-22f91f6030cc", "comment": "Malware payload (Mirai)", "value": "9bb44b2bc6c082ff251932e5621c90b9c4d9812294d6e4fcb9772ca57b765614f2d616b0591a156cd20dc8b9dc4bb2b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015530, "uuid": "5ee1b64d-6ba3-4a56-9619-58299f21d104", "value": "T1F12309C9F483D9F9DC4A09742036FF369AF2F2BA222DDE43D7A49523AC41742E50599C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015530, "uuid": "69311f6f-6d8f-47e5-80c8-c2ec7d07f7b2", "value": "1536:CNPmu/xVf5sraz6Kz1yMyGk3e//4Qw/Un2Du:CYu/xVf5sraz6KzUFTO/AQw82Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015530, "uuid": "0d141113-b4b2-4d0c-a5f3-b494cf945b0a", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015530, "uuid": "62165a96-ea29-4106-88c9-6fb422fc17a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015530, "uuid": "a8199f65-72a7-4983-94ad-cc9833c6dce4", "value": "SecuriteInfo.com.Linux.Mirai.9816.30376.3598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad332a4-08a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770961969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770961969, "uuid": "16af57b5-fd47-49c1-9658-d55695241e2c", "comment": "Malware payload (Formbook)", "value": "fd1a4f466e6bb0bf385677e343635b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770961969, "uuid": "3fc978f0-c5a5-4020-8564-925cb892ff37", "comment": "Malware payload (Formbook)", "value": "dc77b3fe9314c4744d95490796d021c5cc902be80c6c81483fad500a5d22f303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770961969, "uuid": "a87881a9-21b7-4866-a017-4ef38d19a550", "comment": "Malware payload (Formbook)", "value": "41dfb77148f03751540618f6440cd0765a0ca5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770961969, "uuid": "d4e861e8-c014-4cf5-8da6-d86cd3142f56", "comment": "Malware payload (Formbook)", "value": "5a16da336e4e7699d90c91805426fad25db01a492e69645447475b931bee0dc5d27c8038028a1c36738f7070d39e8775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770961969, "uuid": "7545081e-e5aa-4f79-8f9b-9869253f5af2", "value": "T119351220629FC953C2881B7744E1D37017B09E4EE663E21B6EEE6EE37926B535D90343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770961969, "uuid": "39e2aa46-eb75-440f-9467-16d488274f26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770961969, "uuid": "c61d214b-452c-4153-b7ae-bd836f679120", "value": "24576:42/9xl9X2aPC2/qDJpGjKT6dpZsI5FLwQRar6P4guQlVict:42/9r12an/qDJ0quPVRar6PduWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770961969, "uuid": "19110575-e64d-4f81-b9b7-4af2a67fc2e5", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770961969, "uuid": "0edaa73b-13ae-4846-9ff1-7645f7d662b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770961969, "uuid": "d361b369-7d99-4ed7-bf7d-2cc67c5c5ac8", "value": "PO-MOQ-0130356-501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0207659-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026698, "uuid": "7901fd38-37c1-46df-917c-940bab0812f9", "comment": "Malware payload (Mirai)", "value": "c8507d22615820c4d299c48a0db89f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026698, "uuid": "b28b3042-240f-4f8b-bc5b-6eaaf471177f", "comment": "Malware payload (Mirai)", "value": "dd3609dc2fbba7338f7f9d47a8ec5e97203948158dcb4cb9e1f43ce52dc34791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026698, "uuid": "12ffbe0b-739b-42ba-bb7f-f31e14bc1532", "comment": "Malware payload (Mirai)", "value": "76ff4469308a04c60b2ec929630b14876e2b7727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026698, "uuid": "24c90205-5210-47d1-99c6-da01e87bdde2", "comment": "Malware payload (Mirai)", "value": "7dcf8f94bd96d239415e0ebed6a615f9c23bfc5c546c0e0327e4288633cb3239be667371f1e165f4a97ca08c31d8fe2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026698, "uuid": "97b95258-2185-4d8a-9090-171f627755bb", "value": "T164F33B46E6408B13C0D6177AB6DF42563323A764D3DB33069928BFB43F8679E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026698, "uuid": "b2eba44d-cfc8-4673-80f2-c1a51cc9bbc5", "value": "3072:GrJNCg9sMpha9Ygf1DbsrJ3Mw7SHEVRuqu9GM/9lzHNJ:GrJtha9Ygf1DbSJJ7aEzuqu8M/9lrNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026698, "uuid": "964f3562-ad94-4b6e-b225-bdca560cca29", "value": 157579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026698, "uuid": "e1327743-51d5-4e1a-8840-79d7ad1f6a9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026698, "uuid": "b3bdad34-4ef8-40b4-bb99-76052a5d678b", "value": "amsarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70800b3b-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011452, "uuid": "a4a16a89-790e-4e6e-802f-7c78c31ef444", "comment": "Malware payload (Gafgyt)", "value": "282898fac2e6a88c4108e9751cfc8ce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011452, "uuid": "39b02b78-1985-4c55-aed8-5d159c5f0c87", "comment": "Malware payload (Gafgyt)", "value": "dd47b075f79b9583991b3e742dcf3f89ebc8d4d568dcc376c15dcdb3b2715324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011452, "uuid": "c2b482de-668c-4a05-a1aa-e947b335cec2", "comment": "Malware payload (Gafgyt)", "value": "af8d90c5de1fe4c33fe480ee1ec721fd1d6c504f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011452, "uuid": "14b4fd54-4bd8-4076-804a-b8201d84332a", "comment": "Malware payload (Gafgyt)", "value": "628eebce2281def00677269c9b26ad6df4baf718f03192ca2afd833287ba2d87b7b294f761d28d9f54ba60a1a5b3b5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011452, "uuid": "aa2e9d83-da43-452c-8440-81b1eca7d2c0", "value": "T14464942ABB614EB7D85FCE7301EA8912188CE18752997F6BB274C618FB4B94F04C3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011452, "uuid": "21b6592b-ffa6-4c77-932b-9272e6a5e2a6", "value": "6144:o0VrtOBE+qMeMaf5hagnFYRU6Qz64mylXYgt6iPFhn+f:T5WE+qlf5hak6Qz64mylXYgt6iPFhn+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011452, "uuid": "0909ec77-f639-41bb-8763-d650f40fd90d", "value": 323275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011452, "uuid": "b6405e0d-7815-4fa0-b090-91d8105b88c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011452, "uuid": "9ecf30da-b564-4a1f-84fa-f195e8b5db07", "value": "net", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5266e9d-08ef-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770996132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996132, "uuid": "9dee933a-2180-45b9-8d90-aa26146b68e8", "comment": "Malware payload (SalatStealer)", "value": "9eb4f1f47bc7a47ed57d96ac3d1f897f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996132, "uuid": "a6c7f956-c14f-4c7f-98b2-0efbfeee7960", "comment": "Malware payload (SalatStealer)", "value": "dd612237db833c7763fce4499b08c49e9dee34049c0c4a17688bd870ac390e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996132, "uuid": "629cf6f9-fe03-4d9d-8215-4f274d3d262d", "comment": "Malware payload (SalatStealer)", "value": "ab44106232a2f1ee13cb713613db28b7282506c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996132, "uuid": "b0f148da-b140-4567-a1ba-0c9158235cde", "comment": "Malware payload (SalatStealer)", "value": "4f8a10f46d523de5885da449d51f2c03fb73cb297d01324bbc8e4ad84589911971528446c0cf04875530fce2e0102257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996132, "uuid": "41569891-1670-443f-86b7-a5bfe1b0fe22", "value": "T1C4E53307A067E843D39122F761D6F68BDE4A1FB1651A79FBB304C616602BE0D37C492B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996132, "uuid": "aee4a4d9-983c-47d2-b489-9e6f8292b1b2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996132, "uuid": "1ef563b4-75d0-4810-bf08-309090b6d124", "value": "98304:r2E6sc2YYC/NaRznDdZFANj+Y745gsATA:r29stGN6nDvItmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996132, "uuid": "336a670b-26a2-4600-bb74-e48c97a93ccb", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996132, "uuid": "68f718f0-f9ee-498e-a46d-a949c7e3ab63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996132, "uuid": "19955243-b2de-42a7-b66d-f3ab2e0a7bd7", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaafda8-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025758, "uuid": "3f03d1a9-14ee-4ada-a725-1c3aff35bf47", "comment": "Malware payload", "value": "848da127969e7155c11c679a88bf1420", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025758, "uuid": "d2d74660-02b6-4144-91a7-c41a4750eff2", "comment": "Malware payload", "value": "dd96c0754f9b4722cb4d6181dcf69abe6ed7d32b6857da8b1b2809338e11f910", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025758, "uuid": "a1ea3549-a589-4513-ae80-eb461aa63118", "comment": "Malware payload", "value": "f7c4e426de972c1762f46d3202b5c43ea4bb6630", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025758, "uuid": "ed581bb5-fef3-45b3-aab3-b2eee526c39c", "comment": "Malware payload", "value": "0997bcc41cffc3b2bbfe3e738c39553c344c4a863a2f8380dd9b7b5ef2550bc525e194433ff50843df7843f82f06c98a", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025758, "uuid": "6dcf2348-016f-4470-aa13-51559c665367", "value": "T1153623729D411C5ECAA187B1301F7F226F3E7663858C96E278EDE1423B4BED1892B4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025758, "uuid": "34f39282-fda9-4447-8554-6b9fb39ff21d", "value": "49152:GIaUr0i1MdjQSorQ/8wEXEmaqMfa9WkkSVZgBjNXo4t6aw:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025758, "uuid": "0abb8a19-fea6-4b12-8574-230ff5d64e3b", "value": 5099520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025758, "uuid": "2c21a444-d79f-438f-91c3-bf06fbb7ecf1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025758, "uuid": "f248cbe9-d612-42d6-b264-e83c16f11e25", "value": "O28V49_4970OVMENK-Reg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1178312-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978032, "uuid": "165bf860-74d0-43c2-b28f-270a5c1bb365", "comment": "Malware payload", "value": "8a8bdc2bb73a00590e187f4cd47ee6b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978032, "uuid": "e49534fe-3394-41c2-ba95-236dbff7b07a", "comment": "Malware payload", "value": "dee24bb0842d5d36d328335ea37483b68813ab260c5181246eb3e7e6b002c7b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978032, "uuid": "4cc22184-eee3-4525-8681-2cb900ef5698", "comment": "Malware payload", "value": "e9464f1d1e89d4550e3b9e7928ccd9f3e76f44d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978032, "uuid": "3906f0c8-75d1-4c7a-8cb9-dd709f27b347", "comment": "Malware payload", "value": "b1ea942e9af1abe457655a67a160f20519f388d79d3d3da7a6743c189b827d1c778f7c9d7ec0a08727aefe163029ba02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978032, "uuid": "0883e5fa-8967-4aa2-8bd4-a9c7d02a7dc5", "value": "T176B44A02EF641FDBC0AFCE30456E825B049D9A9606C5963472FCCA4CBB6DA9D0FD7498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978032, "uuid": "1ac3e439-bbc9-48fb-ac29-20a00810cb21", "value": "12288:7/7sOcICfKcfsKUXdbrtVE0mKcNvdlQu54IV3+JcRvDUaU8YTBzpzeh7wylpHyWC:Nc4IZtbUx4sv5AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978032, "uuid": "f7529d82-8e45-4d44-993e-1c3e2ac2e313", "value": 539576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978032, "uuid": "96d3d5a8-b7da-4601-88dd-967c6d99f46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978032, "uuid": "8468c7c8-758f-4188-b511-dac0f8b6900c", "value": "mirai.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea2739a-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974055, "uuid": "05c69fc5-f602-4c8e-bdcf-c2a1dd5dd856", "comment": "Malware payload (Mirai)", "value": "77d8f12c98bcc6c7ab9727c86c453319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974055, "uuid": "0604840e-4cf6-4e20-b1f2-9e1793a156d3", "comment": "Malware payload (Mirai)", "value": "df030f5456e64274e3f8c11c2d58e50827ede6616eaa4de698c8195af03945d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974055, "uuid": "a2a0808a-7602-44ad-adfe-7ed1afd949d4", "comment": "Malware payload (Mirai)", "value": "c02083fa161deb9898f1093ce72891765a1a7698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974055, "uuid": "53b9013e-7d9a-47b5-b48b-0d347e536c91", "comment": "Malware payload (Mirai)", "value": "f805e915494ff524a79efe5f77f07f4d5b010a49feeb07037563f613cc3ec05f7dcbbedceef21f95d51bb6d75de49ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974055, "uuid": "7b0c4575-f997-4721-8c5c-6ed009be2e65", "value": "T135339E73C42E7D94F24A8278B9244B385B23D40696833EF4D68AC6974047EECF6593F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974055, "uuid": "91f9d2b6-a257-4608-8962-d1f4f81241a5", "value": "768:TQaZ/HTfpYtWja5FLMqwtAHekrxqhDo+LtQnFCWlrSeF74u6CZAoqrcCIL/Ea:TQaZ/rpY6OnwtA92oUQFDtSY6iIcCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974055, "uuid": "f97ea79e-adce-4dfc-9e6e-f7d6f7be23b8", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974055, "uuid": "f6de90cc-c9e3-4eba-95cb-c600e909ca1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974055, "uuid": "4d123c78-67e3-4127-a65d-e892af9f0ed0", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ada77c-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013289, "uuid": "fc89ce70-26a3-4de8-a449-67b77d925acb", "comment": "Malware payload", "value": "613ebdecb559d654da3beaf861c8b884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013289, "uuid": "2be5a1ec-cfe6-490c-8d0a-2299353f62c3", "comment": "Malware payload", "value": "df98695d86ca756030e00a58eb601aa6d9f8706737c9a0d67cafd6cdf600db2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013289, "uuid": "ecd7c91c-7d2a-43c3-a97d-5f54acf5bd17", "comment": "Malware payload", "value": "3f7d3c075313ecd12a6cf55e2a15fdb3b7579ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013289, "uuid": "473b2e2f-309d-4018-b04d-cc146fd93cf7", "comment": "Malware payload", "value": "dab84dfbc925ff18eed7d300e1ef3fd977b1f4b40d60c522450dd809d13faee41ef4e09d249f1d51514b680dfa9b20ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013289, "uuid": "b1dca7d4-cf92-45de-b5c4-273ef908cea9", "value": "T1A332C517A7BBAE1BC4D037770193072162E95F916124472FBD0D1C8E6E9B3412E3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013289, "uuid": "e3748e9d-a335-4db8-a838-44d900542810", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSyboqeif:xvrbCzfap2GwIU/kwGSPUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013289, "uuid": "f8bcbcc0-f29b-4482-ade7-0e72d8e42906", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013289, "uuid": "d0aa1487-cb1d-4e87-bad0-753a278da5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013289, "uuid": "5c66c045-d798-4c56-96a2-ebb006557cb2", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2053856-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026648, "uuid": "eb340bc5-b152-40f6-9d4b-dc917f0a05c2", "comment": "Malware payload (Mirai)", "value": "7f856898cc6e18a0fe8e85f944d6781f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026648, "uuid": "182a7522-cb1e-43e5-8e3e-156aed1f60a3", "comment": "Malware payload (Mirai)", "value": "e00581db1cde61344ba2869f4950e7fe6033e073f48c62196460dfddcfb19ed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026648, "uuid": "cc74d7aa-309f-4638-9238-33a3246508bb", "comment": "Malware payload (Mirai)", "value": "b43f534c6e6f6329ff742b2819248c5903afd0c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026648, "uuid": "f271bc49-6158-49d0-9cdd-69a99a07986b", "comment": "Malware payload (Mirai)", "value": "dc52a108d9bb9f6f1c97044bc05aa94933f0980588535cbb9204604d4cc2aafc82ced9f7722331337e7587108ec8a6cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026648, "uuid": "759d71c1-5027-4588-9558-82e7bf6c6d0b", "value": "T17A539E77D5296E94D15482B4F8308EB82B73F58082871FFB1A95C7799043DACFA0A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026648, "uuid": "5eff52d7-da93-44de-8c29-b4f16b1055d9", "value": "1536:IaItwt2tDFJMHcWnoKiDNOmNnxCEeg3Bky9/F:Irt5D/MHNnPiXNnxmgW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026648, "uuid": "43b905c2-1e8e-4f72-9b57-3d8287e91438", "value": 64872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026648, "uuid": "ef9fa3fa-5dcb-4781-89c9-21bea7982bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026648, "uuid": "bf7011e3-27b1-408f-a05c-500a57204808", "value": "amssh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aee106-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014512, "uuid": "aad15085-c1d1-4dd8-b5e6-c7cfbdb49700", "comment": "Malware payload (Mirai)", "value": "86a6f48b5943aa23f9fbac32e2e6a50d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014512, "uuid": "44a86f08-83c7-499f-afb7-2616bd3e3378", "comment": "Malware payload (Mirai)", "value": "e044778ee08faf044477d9722f929ca5007947036950a7581ad41ed9e4337f9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014512, "uuid": "d7cf55df-68c4-4633-95cb-d706e75ce929", "comment": "Malware payload (Mirai)", "value": "252568f822aceea03419cd3e92e69c02eccaad9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014512, "uuid": "15af0f6a-f2b2-4dec-ba11-9c6d1d88853e", "comment": "Malware payload (Mirai)", "value": "0ae946ff3e53eb7dbac83853c5dee5776103a632ec3025092fc867bb7dca9571a70c210f0b59dbe968c18cd807c89412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014512, "uuid": "d7cb33be-cb58-4a18-84e6-3c1158100b8e", "value": "T144B2D07418591E72D9E19437AE3E0653B6F17BA834C47336330807F8A6582C7A67B38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014512, "uuid": "0e3936df-3d53-49bb-8819-34869a10d960", "value": "384:jESFn0Z+QkojQ3miViXZd9hnuuSnjDeiH+LmjfeFQhymdGUop5hJIy:BF5osPVGLnd2feiH+Cm6s3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014512, "uuid": "1d0f2098-d87c-475d-a329-dcd42bdc129b", "value": 23972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014512, "uuid": "6190d9ef-14dd-4e2c-a21e-aa298df30d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014512, "uuid": "392df9e3-d553-46a0-860e-92b3266e5772", "value": "Calix.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a25a5e0-08fd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771002046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002046, "uuid": "e9f595aa-4339-4d04-8f3f-06f556246b22", "comment": "Malware payload", "value": "2fcc100be9ac0f159f40272da5c14112", "object_relation": "md5", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002046, "uuid": "bdc9ce17-8c45-468e-866a-47a378b5520c", "comment": "Malware payload", "value": "e094f2cb67cb71e0536243a7abddb74b64462f461a72df66cfcd40afdd5c2963", "object_relation": "sha256", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002046, "uuid": "7ba98f80-60ba-4e0c-aaaf-e2f8bb7634a7", "comment": "Malware payload", "value": "ff4625d607576e96366b02b4537f71681cab4074", "object_relation": "sha1", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771002046, "uuid": "fae28f7d-e669-4d7c-a238-68815888c39e", "comment": "Malware payload", "value": "2b86e3d262321c7881864216150f6cee15955ff3a69d9e0a5e2ad0584b958e61f09a3535296bf419a1463c22648d6c07", "object_relation": "sha3-384", "Tag": [ { "name": "54-94-0-249", "colour": "#33A78B", "exportable": true, "hide_tag": false }, { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002046, "uuid": "948029a9-d8dd-40e4-b7b6-55f01d977892", "value": "T1034633EDA5B37A8BF1D9867BC5846CF5D72C9441A26C3C4E8D3150563E83A0E273ECA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002046, "uuid": "e8989b54-708e-4686-9ff1-b883a68a0625", "value": "98304:1hZkQf/mrRGa7TrrNUJ05xgQ5AGJYtH/IPdIs8aNYczITBMPbpUXJWbqBbApsBK:1AQHmrRGETrriJ8x/KtwVbbuBcVUXUhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771002046, "uuid": "1f3063e0-024f-4057-a498-a1ef16ab5736", "value": 5472724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771002046, "uuid": "1ede1e99-5628-4768-ba30-35591757b41b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771002046, "uuid": "76e818d3-d92a-4db6-953a-096f48991942", "value": "cIvIxyYThey.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe01320-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026644, "uuid": "fdcf509d-6f38-4a6d-932f-36fc7feb0db1", "comment": "Malware payload (Mirai)", "value": "12bc6ba6d3d368d97e067bd6f11686cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026644, "uuid": "6db547e8-6120-4f40-8544-d19e9a66f0df", "comment": "Malware payload (Mirai)", "value": "e162749e3528890e32050b8288aeb5a6a79f1aeb8a29de37cee6113bc405706d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026644, "uuid": "09a3be9b-ee25-44c9-8fa6-e7cc46b72f81", "comment": "Malware payload (Mirai)", "value": "1bd6cf2a48448da3286a96308825ac3e21f1aab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026644, "uuid": "59ed322b-4db2-4616-b6b3-362547d267e2", "comment": "Malware payload (Mirai)", "value": "1db6cb0756f5208bdc9ba6780fe4bdab3bb5d5ca560a7283cd711309dc06d74e5b3a065d340ee0cde65180cdb4b22ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026644, "uuid": "ba4c4827-fed1-4f78-8888-7a8e34a77c09", "value": "T1CFF2F1A2C69E3D85FFBB2EB83B72C69373E18E4F3B3A4D5254818A30961B7591009954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026644, "uuid": "e443123c-ad79-4d69-8ba3-e1406368b653", "value": "768:sIA295BT2hFOf7+FnDeKxsi3nVIYO8f4uVcqgw09u:syBT2hFOSdDbui3nx4u+qgw09u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026644, "uuid": "becbf23c-906c-4d95-b0d8-898f08eada26", "value": 34668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026644, "uuid": "a93ea25e-c180-4017-81ed-b9e48a9900eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026644, "uuid": "e79f485d-11ce-4711-a243-9f4ff79b6229", "value": "amsppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0b24e8-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974026, "uuid": "879940b5-f25b-4085-a8c1-412fd73e5b36", "comment": "Malware payload (Mirai)", "value": "65303d20e54415b62e7f700ccb679aaf", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974026, "uuid": "5394b5f7-0f9b-41c7-a67d-848c9acb5bc4", "comment": "Malware payload (Mirai)", "value": "e1f2739803085912e0421c5e498c4fde79ea54ee561ea439f5ba7fc31e113638", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974026, "uuid": "30f47dee-1ba7-4404-b947-2a83911747ef", "comment": "Malware payload (Mirai)", "value": "d58ba5da207395c93646691615c44c9583118362", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974026, "uuid": "bca43745-6744-4a6e-8cc6-8fb277152fa8", "comment": "Malware payload (Mirai)", "value": "11e7d66c32f80a8c1e4e258616443a1bdc7095b4015b794fa4c4bcd4d7685fc3af8b9f171a843b1a7bd3bf58aa8f0b75", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974026, "uuid": "4d4f7f7d-d550-4d02-b9ba-9cb22bcbd784", "value": "T19DB43A55F8809FA1C6C12976F64D86AC33134779C3EB72069A245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974026, "uuid": "6324203b-b828-42b8-b33a-6bafff0215d1", "value": "12288:9bQV6S86XxBO265zdyZhU5KnaB4XNIN+P2gpjrMn:9boZ56FdwhU5KnTqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974026, "uuid": "8da73c5d-5f34-4122-8f7d-8ef15fe96f41", "value": 516976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974026, "uuid": "8a3a7a7b-7499-45a6-800d-ff376d60fe51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974026, "uuid": "53081d80-674f-4f28-b36b-309b05ed0b66", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d6ab79-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995141, "uuid": "2c45d963-2f3a-415c-be50-16f7ea181efa", "comment": "Malware payload (SSHdKit)", "value": "49db6ed6b861dca6a988c9be48548efb", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995141, "uuid": "2b643273-dedc-476a-8897-16934d266a67", "comment": "Malware payload (SSHdKit)", "value": "e23e627aa69b6bb7504be5ead2ca9165b80396e8f905d4b27d85a273b12fa49f", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995141, "uuid": "fac738ba-be94-4523-a186-c1592abc56ba", "comment": "Malware payload (SSHdKit)", "value": "34554f2ab5b189f25ea4a964e7315063bb51bd23", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995141, "uuid": "70a97891-295f-4ca7-adc1-be513c6f0ee5", "comment": "Malware payload (SSHdKit)", "value": "d36724205bac9fcbb5123b4480913ce301955fbbe65526b0c89cef02dacd636616aa54f51655f41ee49f701ef86190e2", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995141, "uuid": "891bece8-0374-43c9-a6a3-97bd5a5d63ec", "value": "T130D76C51FA908B73C1C03779B6DF034C7366CA75C7D92106B90D96383FA769B4A3AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995141, "uuid": "a41041d1-ea6b-48b4-b465-032bc0327a16", "value": "196608:tfrWSxdmYu5s/wO6cJzGkioLPw/aBHTNTktRXTukMOWedw6XaZDRvoZ:85bix9Tw/qTGfOO5zXuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995141, "uuid": "238c3046-0be1-46a4-a0ac-946963f3a957", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995141, "uuid": "94565d71-6aa1-494f-9a48-b4a23a4708bf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995141, "uuid": "1333eafe-7b11-4ee2-8e39-db72550c1d06", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c86ab74-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011445, "uuid": "3e25c459-a045-417f-95fe-fad9cbb7688b", "comment": "Malware payload (Gafgyt)", "value": "abccf21a652f8d012fe811cf961e0119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011445, "uuid": "f978ec59-ae95-4815-a104-c9e222687345", "comment": "Malware payload (Gafgyt)", "value": "e2578409bc4c8185a7a7b45d5f07c2b44233d4e4b30ef63aeeeb1bc98ecf5bf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011445, "uuid": "6d0b3629-9cf4-4e39-ab0a-16d85e35ec3b", "comment": "Malware payload (Gafgyt)", "value": "7c84da5f69796d92f73101387241d03bf1e89b8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011445, "uuid": "c9842b2c-51de-4edf-8839-821d0ee687d0", "comment": "Malware payload (Gafgyt)", "value": "f7a1540f5d9ddc33073af8f88f1111c6ec923137fd40cf6664fdc0d9fc84c87e6f0d585a70a121a64f77401cba024f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011445, "uuid": "8f36ad0b-e78e-4c80-b11c-814b1f4e100b", "value": "T198243A21F703C6F3C8830BF2119B9A674D32B5A75A6FA545F32D6CB09E628C97109E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011445, "uuid": "28ec58e8-84da-4ab4-8806-4565a6b19cd2", "value": "6144:G1fj320VjDepgUNKGdPQtK7i3mr5hP9FwAbaNDgHhyHy/0m0Qvha9x4s:G1fj320VjDep/NKYPZ7X5hP1baNDgHhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011445, "uuid": "6cab6f96-e196-4507-b963-0fae48577e0e", "value": 218273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011445, "uuid": "9d47713b-2d7d-4061-a7e0-6180b11a624c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011445, "uuid": "1fecd2ab-4c8d-4542-b495-f3cb30bf2121", "value": "fucknet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a74cd27-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973136, "uuid": "d9fda469-4a1e-447c-90ec-f3b2bb54ce5c", "comment": "Malware payload (Mirai)", "value": "ac1eb62842ef53dbcc16e6075f22d4e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973136, "uuid": "ab51356b-e703-44e4-b4c1-287d0282b294", "comment": "Malware payload (Mirai)", "value": "e3470fd0f00a7af342bcc1fa92776364233c5bc9f94995230165e7ffa575965b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973136, "uuid": "3e3a05d0-d6c5-4f6d-87c3-26928c31d9ec", "comment": "Malware payload (Mirai)", "value": "3102ac475f42a5212297e9c5e344c4c5aeb54168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973136, "uuid": "7e9d140e-a9d6-40ed-ba39-d7877ad5592a", "comment": "Malware payload (Mirai)", "value": "275da4cd8fcddd0f14cfa06ba3e4dfe76c9022db73a048eafcb4c753928c8a32db33a8c19246ddb647b22aaf5433ce24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973136, "uuid": "b84f3bd6-8221-4047-9a1c-6cdeaf2cc5bb", "value": "T1FCA38D9BF74B1490C86187F007CB5B9E7E2372119E6789E33C1E2A7919792DF5E0A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973136, "uuid": "8d732e96-f017-450f-a8b8-0ee5df3d6b8c", "value": "1536:llJ4/NCEDRWBn5T/QcoLiLNYwMoIA0+E+yOgtJ/LW:8fWBJ/yLiLFMoIb+ExOg3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973136, "uuid": "d492a05f-ee63-43ed-ae14-8549e4547b97", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973136, "uuid": "4b7a1b98-5bb4-40f8-b6e8-a93514a2ff85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973136, "uuid": "484b21a4-cd2f-4515-824d-3e0b7e33cbde", "value": "sys_arc-linux-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f273d3-08d5-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770984941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984941, "uuid": "67570364-d252-4b7d-808a-eb015d3ecd7e", "comment": "Malware payload (PhantomStealer)", "value": "be0930fc1d862072effdd01493361fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984941, "uuid": "62482d4f-4f4b-42b8-9aee-e3832a407b03", "comment": "Malware payload (PhantomStealer)", "value": "e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984941, "uuid": "6f4c7d64-f261-4a69-8b0b-d2fe3d2d50f5", "comment": "Malware payload (PhantomStealer)", "value": "e421261bf9c56bc5390d1f1b5be10f4fa53ba34c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770984941, "uuid": "805af42f-2f8b-4922-bd76-9b1e4afe03e3", "comment": "Malware payload (PhantomStealer)", "value": "61363fbae5f9a09c2dbefced205e7a341b40d34772186db754d54d4fcc862ca1fc2cf58527a2b4638691d0ff5263d306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984941, "uuid": "a10beb0e-f32a-4ba9-bab6-e49b9636ce06", "value": "T1D6751254669FC913C1A85B7284E1E63017F09E4EA023D25B6EDE2EE77E537A71E80343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984941, "uuid": "ef30409b-2222-4b52-acf8-393d49b2d887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984941, "uuid": "6f4d1fd1-e2c6-4358-a748-4d756538a352", "value": "49152:xORW7rRaIcKdnFVb4C/mxjcNDJwF3ZQQuWQc:xn79hFFlHexjWFwF36/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770984941, "uuid": "56517c46-61ea-41c3-84b1-378ef40a42be", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770984941, "uuid": "6cd1eb07-3b5c-4c52-9137-064af3e6869a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770984941, "uuid": "2ba7237f-05ba-4412-8279-b4bd767006de", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03874bf0-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986788, "uuid": "49f9b091-1ebc-473d-a409-b0130174c7b9", "comment": "Malware payload (Mirai)", "value": "98cae3ac50728b0527630453196b8151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986788, "uuid": "b71f54d1-4cde-4fff-a056-1eab983bc93a", "comment": "Malware payload (Mirai)", "value": "e38169dddc4ba684abb9a7e35d46bc4c2271dc6f458eb8f36e3178840078aab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986788, "uuid": "9d01bb83-5986-4130-a3be-c38af9a98af9", "comment": "Malware payload (Mirai)", "value": "e8a4925310a4e326330dd204a9d4969ef80648f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986788, "uuid": "e4d0776e-c7dc-49aa-8470-56d06274f3d5", "comment": "Malware payload (Mirai)", "value": "9cc4ab2b0cb2abc01c4c6e5025f2090ff4d9c3d089206613a5d7db460608d4ecc8166bf311a45d310996d65f034b9e21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986788, "uuid": "1cd055c0-d107-44a3-8cfa-a53ca4724c66", "value": "T17E631946F9818A25C5D502BEFA2D258E371317E9E3DF7212AE205F7037CA91B0A7BC45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986788, "uuid": "acdb031d-01da-42a5-8015-d117b84d397f", "value": "1536:9CnG6fAGH7XZUb67kaKMN4CDjGoQBMmiM4XcISrEy:d6fdZEPP4XcISr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986788, "uuid": "1a4747d7-b053-40ce-9756-30f5b78d5ce0", "value": 71492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986788, "uuid": "acbbe46e-7286-4c3a-b4bd-703c2b37fa08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986788, "uuid": "1c0fde14-1455-413c-908f-8d59d957a2d4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5957b6-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771011446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011446, "uuid": "99ef080f-695d-4bc5-ba55-1c294e201268", "comment": "Malware payload (Gafgyt)", "value": "904adc6569d83a1f3be37956740f1d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011446, "uuid": "491348db-14a6-4373-9929-5bc9c212a7e1", "comment": "Malware payload (Gafgyt)", "value": "e5879f80e740e48d7d2e379e921b213d00d16b02b8d147b0e3f3c2d3e0bf431f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011446, "uuid": "847fff59-e53d-4ffd-a67d-138985688252", "comment": "Malware payload (Gafgyt)", "value": "c115357ecb53a5e971ea2aab008c60e6132717b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011446, "uuid": "a8bfcd01-6c6f-4c94-8554-3cdefeac2442", "comment": "Malware payload (Gafgyt)", "value": "52333f4d292dfc25286235d9f4e0a2a83fe16d9a9974ef88d22a856babf305d5b8c3ac5bc3bb6ec4fb1f455f8abd19de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011446, "uuid": "ecf7926e-44e2-4365-96ba-7a99eb7cb004", "value": "T1B1344C27B60C0B43C4571DF02A7B6BF18F9EA6F216E76184E21DEA805772A721505F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011446, "uuid": "5fa3bff8-69db-430b-8f3e-ee1b0fa7ecf7", "value": "6144:v57L9/ZH6xdzVYsmlLb5hh0OQfL1DRB5/wCarShb9H4u:zRQrmlv5hh0DfL1DRB5/wCarShb9H4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011446, "uuid": "76259c23-8801-4a10-8a67-1f12087ff464", "value": 240378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011446, "uuid": "235d76cd-923f-4547-b9e1-f0c7841f9775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011446, "uuid": "09df5fad-bf5a-4107-9e10-8998a19cf2dd", "value": "cracknet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff6b4c2-08ee-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995720, "uuid": "80d2398b-dd9c-459b-910d-70afd0d6a262", "comment": "Malware payload (SSHdKit)", "value": "38dc6bc595abb4876c67160a2787f480", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995720, "uuid": "5d8d9ed0-a227-4ea2-a1aa-641444e8833e", "comment": "Malware payload (SSHdKit)", "value": "e702f4cdacc78d8e11274132a6485354b0021ba52447e66fe910efa06b9bb5e0", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995720, "uuid": "ce98c98a-0601-4570-8eee-86a27c6a8b0d", "comment": "Malware payload (SSHdKit)", "value": "540b1b25bb15f6c1f5f079a7c20391f324c97c17", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995720, "uuid": "f5607258-3b4d-4afb-89a0-1303ae789d36", "comment": "Malware payload (SSHdKit)", "value": "f9239267cf573daaecbce8e296a6c1e54aa2fb42173467fdd54ec0a151ffe86feee696553108a4f05d248be6e991c061", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995720, "uuid": "07ed60b2-f4b7-465a-94ff-4534547a6ef1", "value": "T17DD76C03FBA2587BC495E33016EF43647775F8599322161B368C723C2FA3BA18F69691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995720, "uuid": "84fecaa8-fee1-4141-94f6-9a4704da1449", "value": "196608:ZkH85hcmMMYiR8Hf6mXaQNw2BtjYjQ81W/xcRK2lTXEjiHajC2aP2XBEi5WBscaj:Z5h98HyCamuvacRK2l9ajC2auiZSnfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995720, "uuid": "8f4fa39b-37a8-451d-991b-9ca6e2d85df8", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995720, "uuid": "886110c9-65d2-45a8-830d-6a47337cc8ce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995720, "uuid": "75801d7f-fe99-45b9-8170-e17e2b0722bc", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93033e7f-0934-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771025683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025683, "uuid": "05538cf8-58cb-4c6c-9802-9f4385c3d047", "comment": "Malware payload", "value": "57503d3dbb306b7984499433dd260f16", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025683, "uuid": "7e648929-da32-4e2a-b364-e5205b731262", "comment": "Malware payload", "value": "e7464787c60f9e014289c9ead9788f48471ade7803abf6a57b28e67064960335", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025683, "uuid": "1667cfb3-0277-4f7d-82aa-0bf3bae5e1fd", "comment": "Malware payload", "value": "c735a078291b8eab1c555b60e102a9daf9a6a066", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771025683, "uuid": "1ccbe932-c207-4042-9d80-642a2eecd679", "comment": "Malware payload", "value": "561f4b01f156d16ef61ceee54178ccf3410e93e3125d4826006446527587b71c2f495e4b4841bfbabca3bc5e044fe776", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025683, "uuid": "d2f0269e-9a22-47ba-bf0d-5bdff9abf946", "value": "T1E88633B2AF115CABD5948B76B02F3E242F7D9F0388C9A5D570AC66C3378EAC0152B571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025683, "uuid": "f0fb46a0-d392-4000-aa7b-9382cf11ba56", "value": "49152:Ly96WHpHut4xPj4Ad987UmZ0AfCNwe+14qVSsQWgBFZiplrmLRnqviH/mpLXsAXA:ivUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771025683, "uuid": "42165fbd-6c4e-4c08-8f85-261bc5aeea4b", "value": 7960576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771025683, "uuid": "7423b9bf-244a-4f8c-a414-4ac174aae6b5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771025683, "uuid": "d9f51c42-0c23-4566-b112-91c0605052cd", "value": "NFSPTCn-SJOC00109_Autr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5e3f96-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973142, "uuid": "bb663d75-828d-49a2-b912-79df6095fc08", "comment": "Malware payload (Mirai)", "value": "92a3629cfb186c69601e636c00f68124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973142, "uuid": "57096cd6-2a1e-4983-b6fc-f6908c1f5ebb", "comment": "Malware payload (Mirai)", "value": "e7b63533f02093ad78c2147a5d337e9905426cbebc034d5373cec94ef897493f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973142, "uuid": "5f342f63-7b2c-463f-a725-6c5c068acbf3", "comment": "Malware payload (Mirai)", "value": "5b4df526734476e9d56bcdeb14b0229620fa2a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973142, "uuid": "8761cc47-d239-4b39-b753-d1422c3eb155", "comment": "Malware payload (Mirai)", "value": "5ec30132bad2b27566f809464b5ac27d833a6be02435ab714791ac0864f58bc0d83e0ecc02fd4f02ac890e4481a00f55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973142, "uuid": "b5d54b27-93e8-42ca-950d-0a2b4042914f", "value": "T1D1C30663DD269F56D156A8F071F28E781B53BD6689070FBEA472EAE44043CCCB6053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973142, "uuid": "72efe2b8-1cdb-41e8-b70b-e6a76cfdb10e", "value": "1536:zc926RzFrCpKzb9B4oyy4dHNcaKNWNWHGQnR8Yf:zc9tRzVZzhyjdHlmWYHGR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973142, "uuid": "924504a7-9f0f-416d-b6b2-2385ddd2d47b", "value": 120616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973142, "uuid": "ffd6b53a-f5fc-416e-9de3-391899e0a533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973142, "uuid": "a81d1f33-ea2d-4de5-8bdf-04716c4b157c", "value": "sys_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68974f0-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999516, "uuid": "4fb7c6cd-e36c-4cc2-b174-9b6f44c4b5b5", "comment": "Malware payload", "value": "1328fc9854c311e3d8935976a8697a68", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999516, "uuid": "eca90571-fe28-4700-80d6-7ce497452b00", "comment": "Malware payload", "value": "e7e7c7723307db502312194d00b6849679c09fe97604a91d9f47dc74c5dfc14a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999516, "uuid": "7541c3d1-fb55-48db-b838-5f6636a9cad9", "comment": "Malware payload", "value": "a3190ed7ad1620276448660b58c9c2ad7987a145", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999516, "uuid": "2c6ce626-d303-4064-a670-5401878bbb87", "comment": "Malware payload", "value": "cfa0049b9c88bd293924a2cda868fe6c966a1df2cc62e8da51fd36e8db7abafd442f8302e1fea52fa4fffbaf8223bee7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999516, "uuid": "13a1cbe3-dd5c-47c8-90ec-30f7ebc91ea1", "value": "T1406623717EA919ABCA840B76705F3B215D6D754387CCE4D3B87C65823B8BFD0823A099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999516, "uuid": "ac053ef3-b042-436f-8fb4-4a341c4defac", "value": "49152:QCZnJ2GK38uyaMQrn1lsKHbnZrXgdzINMHTxh3JvHb/jwYGPohnt2AmjmUWrpoSe:cww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999516, "uuid": "abe8a18f-d864-4b41-8b92-3a4ddd7c01d2", "value": 6891520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999516, "uuid": "1ba73ed0-5b6b-408b-9bf9-371884842f31", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999516, "uuid": "7b682baa-6acd-4287-bfb5-ab0db5d98d20", "value": "CnsltLBMV1_89893VTKLZ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c455c5a2-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015458, "uuid": "ca26fb7e-e292-4051-94f1-dfaf2dc013f8", "comment": "Malware payload (Mirai)", "value": "25a8d713c59c95333a3e9f198aa98694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015458, "uuid": "ac5a47a7-45b5-4f71-8993-e0d4d1c3ba48", "comment": "Malware payload (Mirai)", "value": "e819284570cf81525c135d913d300c0aa7c0f6e8dc6e38e06f8a18676c4bf299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015458, "uuid": "6d501c51-ed46-4a6c-b833-c2d342dd7daa", "comment": "Malware payload (Mirai)", "value": "6d73df6291834ec29d1f894bf5330ea721a64237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015458, "uuid": "e9577485-096e-4b4a-9203-b60ed8d25207", "comment": "Malware payload (Mirai)", "value": "aa68e911194d0a43e3924c5734ce136b5b0b0b35147d6a1670994afa7ed6ce2f6aed1098368c312f822d8ad2b6eb4c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015458, "uuid": "ccd26856-56dd-4fad-8487-d806d4401072", "value": "T1C5B2E1B6838101A7E585D2FC07B04BE139B50BA25D420D6ABBE8FE47CC45E279D82FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015458, "uuid": "aefd3415-7ab6-428c-a165-b7c2bbe78dac", "value": "384:/HOCePqebU7ZboqSjIZD+7Oiy2ZwEdaVIx5G5n82O4IUWJgGlzDpH7uNj1JYu:fOCePxU1Yc6O6V6ak5dOUWJgGlzDpbux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015458, "uuid": "9c0f3b30-0f92-44d5-ae54-5fd2614acda0", "value": 23832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015458, "uuid": "9d485e2e-a745-4b83-ba3e-f8603b3c2f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015458, "uuid": "640427b9-ed48-4a80-ae20-281e8ebb2353", "value": "SecuriteInfo.com.Linux.Mirai.9816.12932.2643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fa6fcd-08d6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770985257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985257, "uuid": "88a22e6e-2b00-4adc-b36b-33c84aa0bfe6", "comment": "Malware payload", "value": "5d804e3c902f0fe32194780305cb7809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985257, "uuid": "044023db-0327-4dcc-bacf-5bdcb743ab0a", "comment": "Malware payload", "value": "e84e4977591f7b3946822df65b6bc54557570563c9687bb202c19561398b9c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985257, "uuid": "584c04f0-ca53-4451-8d00-14f2537ecbcd", "comment": "Malware payload", "value": "806b9f8e45a8cdfa36e55637dbb868db3ef7170a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770985257, "uuid": "aab6090e-75bf-45b2-ac13-57789ec7d067", "comment": "Malware payload", "value": "58264bbfdc244ccd545c3076fb2678e32cc0209b8f6b64b08fba4d1c07743254561705166f91ac88e44aad0e1fac27e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985257, "uuid": "2f1c0234-60d4-4288-8bbc-6f6e5258a52d", "value": "T152F35A23D683CB7BF2510630C8E5A205693FBE5546A24B7EE9C17CC8CD6924F2D166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985257, "uuid": "0254dffb-ca7c-42cd-918a-40b30b44b468", "value": "bfe41f48fe61963319751f1efac6b758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985257, "uuid": "700c17a0-46b7-40e0-94e7-4c78f0abb6b7", "value": "3072:rFDVESApLltNnQUHcXR0LDcgxi4MSkMqr:rFJESAFNnQecBqDcg6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770985257, "uuid": "e025e957-9a1d-46d3-aca3-db798fe90735", "value": 164448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770985257, "uuid": "a8218995-1050-447f-a135-fd91c812e994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770985257, "uuid": "0a9cfa8f-0623-4fad-ba1f-81f224409166", "value": "475au4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27331778-08ed-11f1-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1770995008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995008, "uuid": "f6f74ab0-7370-4292-8bbf-dcef70a0b70f", "comment": "Malware payload (SSHdKit)", "value": "cc9b8e70571100aabc86e1b1396d1294", "object_relation": "md5", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995008, "uuid": "958b03c7-6778-40ef-9420-45ea28822165", "comment": "Malware payload (SSHdKit)", "value": "e98b9a8864f347d6ecb29d3c8fc6318a45fb4bfb70b0a479b8e4a5d684e38be0", "object_relation": "sha256", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995008, "uuid": "e0ee2a46-c465-48a3-9b10-686469719967", "comment": "Malware payload (SSHdKit)", "value": "e3cb01c8349f1852366be46ae97cc81436b89733", "object_relation": "sha1", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770995008, "uuid": "e8de1ff5-62ce-4adf-a6b2-181382b984e2", "comment": "Malware payload (SSHdKit)", "value": "394ff47ce2b2bf698d2788efda9ac0922f6ba1b8ce01b69ce0689275f59e695e2c757e47dec0944e769dbb6ccd807086", "object_relation": "sha3-384", "Tag": [ { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995008, "uuid": "abeac01a-7f3d-45eb-9f04-c134bdd7a0da", "value": "T15AD76C51FA908B73C1C03779B6DF034C7366CA75C7D92106B90D96383FA769B4A3AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995008, "uuid": "3e808714-3969-4d59-b774-9aa258f36e08", "value": "196608:ifrWSxdmYu5skwO6cJzGkioLPw/aBHTNTktRXTukMOWedw6XaZDRvoZ:f5Kix9Tw/qTGfOO5zXuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770995008, "uuid": "d9b76bb9-a283-4c46-bd2d-3510e175b506", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770995008, "uuid": "30ca4ef6-b719-427a-b249-db7c7b305b62", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770995008, "uuid": "d69626f7-ae56-4eed-bc01-552d94c979ad", "value": "rootfs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260b5f54-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955492, "uuid": "14bb4ca3-698b-437e-9483-67d82e80b901", "comment": "Malware payload (Mirai)", "value": "20e43f4fec22965dcf6bf3c907fea3de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955492, "uuid": "8ec77a4d-4554-4512-984c-c08fa15b08dc", "comment": "Malware payload (Mirai)", "value": "ea1429402580cd3843199bbb96fc7daccf4cba632a66ebeef94e2eec82efa004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955492, "uuid": "6b257610-976e-4a5a-9ad0-7855f212c340", "comment": "Malware payload (Mirai)", "value": "15b36335f9eff767c60af4f9152250a9c666ec65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955492, "uuid": "526437aa-50c6-46c7-8c48-c084069d1292", "comment": "Malware payload (Mirai)", "value": "f86054f2f3decb41bd812ccdc745f4b19f09c9f383ce09e7e09dc7491b43456c218feba0a6bebe8f70c08a043603d28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955492, "uuid": "4b509cb3-aafb-4f3e-9de0-f378a1af6f4f", "value": "T12103F10BF2518B1BFAE641BD0A57E6830520EC3F99204C675EEDE0334A76F38A6597D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955492, "uuid": "96bfcefb-19c1-415f-a72c-298208bfcae3", "value": "768:0yMV+N3wtJmuQms3n5UEY/AjiHtRx/kPL+YKGLuDNMiuEgNqxhjPsOen2f5X1drH:0yMMNUEFNnGN/WiHbe05uvkHP8nY5vfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955492, "uuid": "70159744-91a5-43d2-95d7-5026b2133bed", "value": 39404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955492, "uuid": "e60f98da-e44b-4b43-bd64-9766a178d4fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955492, "uuid": "4ec5b395-8407-4a5d-830f-d05e3efe7302", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253495ba-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955491, "uuid": "7b242981-6ac2-4b4f-b87f-d99924f1b3bf", "comment": "Malware payload (Mirai)", "value": "ff4ee1e92f548876d6ac07703222bdc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955491, "uuid": "13b4575a-401a-40fd-94fc-a6dc4ce2603f", "comment": "Malware payload (Mirai)", "value": "eb150fe94ce7aa697007123ed6c3935033454ddf1b9c8a9c9d0c14622e6fd539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955491, "uuid": "685357ae-5ebf-49be-8429-34767e0715c9", "comment": "Malware payload (Mirai)", "value": "ee2a916c88c8b61baa7bf998b3ee578321925454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955491, "uuid": "4d90b25e-45d7-4cab-831a-5f3e1d8813a5", "comment": "Malware payload (Mirai)", "value": "cd9bc497d5f0c6bd65b4097bba49a0b5f05d60f2b17f8b15d175bfb4f75a328623651453a840842b1fb3e713c66204cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955491, "uuid": "5876eac0-f1e4-4768-8d58-935b3893b476", "value": "T18EC39E87B78B10A0C8624AF017C71B9D6F53A211CE5FE8E3BC1D663F5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955491, "uuid": "a608bcee-57f6-4112-929b-978d777c1a02", "value": "1536:VA1gd4LBcz09nedFrW7+2k7r+Z2Tmz6H99Zxlq/s1oYExP/EgcPEq/LW0:mG4Lmzanedc7+226ZcIivZxN1oYRgKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955491, "uuid": "5ca4f5a9-45ea-4888-871a-d95b5d431827", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955491, "uuid": "02107b5d-2a3e-4ddb-8c5a-185765d86c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955491, "uuid": "09e6e5dc-f1eb-4a44-a3a3-80c649666997", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc65898-0910-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771010242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010242, "uuid": "8b3eb3be-e1fe-4a15-ad82-f684634305e0", "comment": "Malware payload (Mirai)", "value": "31af70c34aaee93297c24bd4c20b3cd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010242, "uuid": "5fc1189d-6cc2-42fe-8951-3d3df98fcd2c", "comment": "Malware payload (Mirai)", "value": "ec7ae4d0271fb79a77a9bb0ef914805291bbb42d4b5e4155120acfe0f93d9a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010242, "uuid": "aa780500-aa61-4916-bb40-37cd58d5c19e", "comment": "Malware payload (Mirai)", "value": "81de8d2510c686ffd4edf3422182ce7c3b452ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771010242, "uuid": "595a442e-f4a6-489a-99ad-0f8a7267dbde", "comment": "Malware payload (Mirai)", "value": "31675dccc5c08b86a482df52b74013e2fb555224ff69d1efac924351e24af05dd2c2644ba45950441d441e9168ca03ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010242, "uuid": "babb5df3-28f0-462e-8db3-4e0256bc3bc7", "value": "T19EB2D0AC1B001BECEDEE91781BD00BA16B9203BEED43B54679A25DD79F074A8F4439D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010242, "uuid": "2e94fd5d-d2bb-492d-b75b-a82e7383dcef", "value": "384:UgOgoSS9B3uQT36jvfzlFB9CDJArg6+5yGkrjgJgGlzDpH7uNj1JZT1:oT91KjhFrsJYgG9QJgGlzDpbuR1JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771010242, "uuid": "2aa9f4a7-3e3f-4f22-ac6c-65bc3c45d559", "value": 23808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771010242, "uuid": "33dd325c-895c-40df-a611-2bf063b23b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771010242, "uuid": "e3209cef-9266-4138-9cf9-66c25e2835b1", "value": "SecuriteInfo.com.Linux.Mirai.9816.8242.24198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc7285e-08bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770975582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975582, "uuid": "0159c4c5-fed4-4dfa-8c23-b28f77a6630c", "comment": "Malware payload (Mirai)", "value": "a7382b3a43989ddd7d6a05064093a23c", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975582, "uuid": "ff049490-7c22-4fdd-adef-ab1e7531df20", "comment": "Malware payload (Mirai)", "value": "edb0b5e6bc05322b0f389bb03734dcfff721dfad89af8ca5c5b87c1d935700bf", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975582, "uuid": "2dafc922-e982-4293-8472-36203bc3dd64", "comment": "Malware payload (Mirai)", "value": "5e15af7fb362abe3962b69d1bc89fd35e4d6a24c", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770975582, "uuid": "00830244-0e43-4777-b44f-7e5a63bfe3f2", "comment": "Malware payload (Mirai)", "value": "6be74941a2edaabb18650f8d8e3f8d1c303b0dd2d06357336ac7d3e94402222dedc31f13f71ee387c11fe49e98c59251", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975582, "uuid": "91f5f361-214f-41bd-a198-8f90828b0e19", "value": "T1A6430986F8818B12C5D412BAFE2E118D331727B8E2DF7216DD106F247B8A92F0E77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975582, "uuid": "7420257f-b4e9-47fe-8b21-478c87f30daa", "value": "1536:fNnhRv/ofFJ0SD1qFc1NIj1CbcM2iyNwara:ZHooShqFc1NIfNwara", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770975582, "uuid": "cf1b4b70-21ce-4dfc-995c-6f13eac47fea", "value": 60448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770975582, "uuid": "cf234af3-403d-47a8-9c8f-82c7b0470c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770975582, "uuid": "b3da5f90-6559-45a3-bb15-9da24e6f0856", "value": "StormStresser.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2dba82-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026636, "uuid": "a8a39e8f-5241-4c2b-8445-308518c81fb9", "comment": "Malware payload (Mirai)", "value": "8b77cdafbb318e9b7ba3ae30acae0537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026636, "uuid": "81cdeaf0-4f02-4dbe-abd6-ec9d98d9d3f1", "comment": "Malware payload (Mirai)", "value": "ee15042dec79e36d12cd57489a7ba7f09f752a39343a2c0b35ba877e7cc607d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026636, "uuid": "026c3d1e-aa6c-47a8-a5ec-e86315da1768", "comment": "Malware payload (Mirai)", "value": "aa72899ed2f77bbcf939dfee5e29a7a2aac7560c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026636, "uuid": "b5d852df-e552-4965-a28a-f533dca42fc0", "comment": "Malware payload (Mirai)", "value": "4b6a33d7c209933c8af3d3b223a943f9011d416a4dc20b8acb0c6bd74a8e92b0344ecec67d63029e415b3d933c4329bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026636, "uuid": "80c68f60-baa0-4005-a39e-63eb55b294a9", "value": "T19103F1A1B8C7718DCE0F2D3D26DB6AA37DADF4D6774C06841F094E89E8E9C0E6406974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026636, "uuid": "f8c80c1e-275e-415a-964c-47f7e03820f7", "value": "768:28nsS0f7CIdwQBCzh+W5u6+ywjeZbNP/77yHN9oflyLeXLdsxV0Wr:Zn5A73dwvhNu6xTbRT7ON9oqeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026636, "uuid": "00eb472a-7b39-4920-b1e6-6a1ae359b309", "value": 38476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026636, "uuid": "1d3cf7d2-cfa9-4384-bc8c-9236814ec1de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026636, "uuid": "7aed969f-3c66-4baf-a6ab-52b1d130e6d5", "value": "amsmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eabdb7-090b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771007966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007966, "uuid": "205f0b2a-d545-46cb-bf32-c346a1ff4965", "comment": "Malware payload (Mirai)", "value": "65ecaba2aec005395719400062bda42c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007966, "uuid": "ee27d17c-9392-4a78-ba19-04ff299deb57", "comment": "Malware payload (Mirai)", "value": "ee1d3724bc47acf4819e2a1a6fc2bd1db42f1d617a41b4d1aaea09697c8c0311", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007966, "uuid": "b971753b-bbef-43ce-a4ad-441b418c805e", "comment": "Malware payload (Mirai)", "value": "42927732cc182c0605ba7799dba655289911e47a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771007966, "uuid": "fc0bf6dd-8d8d-4ff8-935b-dde037e3c3c7", "comment": "Malware payload (Mirai)", "value": "c2367cbfa7c7c7d47aeb8c5f9d10990aad915ed89e20951933f2ea19eccd1311711042aa3753c3ff72729203858473eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007966, "uuid": "eb27d277-8515-4d3f-8ee5-d0c8aa2ecc10", "value": "T16F431991B8819A13C6D4137AF56E46CD3B2133E8E2CB7217DE214F617AC682F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007966, "uuid": "5a37d64b-51ba-4cae-ae38-f8489ffd3e43", "value": "768:nVRQCLzOD6NZCwW9bYm0smQZQw/XV1Xw3c+c7O4tQoY/xzAHUGyVIDKoKEuMqTRM:DQCtW930smkNXVxhOWQ/zYG0leAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771007966, "uuid": "1e5c9f30-40f1-4554-a94f-8bc5f326a46e", "value": 56176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771007966, "uuid": "81c79f89-07b7-421a-86f6-360055be1669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771007966, "uuid": "28c70d58-9e31-4913-93b4-45091b006d19", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd2ca51-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013298, "uuid": "4d9d7f1e-4a99-4f7f-8779-32f484597c8f", "comment": "Malware payload", "value": "177f9cf2fb0541acedc15d60a09e7bf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013298, "uuid": "8df7599e-0d7f-4e6f-af72-e057f69f3f45", "comment": "Malware payload", "value": "eea46f97f66a19312f19f57662d1cc4cc042f200282dd8f2506d436ed3dec16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013298, "uuid": "742c4325-d864-458d-8c76-66b4c0418880", "comment": "Malware payload", "value": "e67d7cee995e43c54f79ca8a151144318db260c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013298, "uuid": "a1e5c6f0-e203-4ddd-8c31-96f511c664bf", "comment": "Malware payload", "value": "a891985e59b39fb4f2e7b3d8a5c6e81455b9f43f883e40bdc0b0388ca0bed7e20fae3387ab57565f8807a32e2c4574ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013298, "uuid": "ad0cd553-5ca0-423a-94d9-d0badfb31a46", "value": "T11BE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013298, "uuid": "067fdaf7-dd3c-4d60-ae68-3da0b13540b2", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxGdbK:pYlybKpzEOfGQ+vEubTt4ouftL4ydO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013298, "uuid": "992c12d5-c122-4de4-880a-c785584a9af0", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013298, "uuid": "d699ad33-c9b7-40a9-bee3-aea7c0af808c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013298, "uuid": "0ffed471-ffde-42ce-b014-da9955d1a8ea", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b807888-08f0-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770996491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996491, "uuid": "d7fcdd2c-0ec9-4475-bf1a-2f1a47fd9baf", "comment": "Malware payload (SalatStealer)", "value": "1a81dfeba522545b90954cc75c626880", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996491, "uuid": "323a1549-bd82-4d44-872d-6e50230f7f87", "comment": "Malware payload (SalatStealer)", "value": "eedad4cf24e967c22432ce4670bde75c8ee41b77fbd208bff7d54204ec0992e6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996491, "uuid": "c19ed256-7d23-48dd-8a60-09d162f9c96e", "comment": "Malware payload (SalatStealer)", "value": "1bf9d2adfe5a5d0a264ab850a8787264dffbfd7b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770996491, "uuid": "4f8fcc81-de4c-4dfd-b926-323e0593c0f0", "comment": "Malware payload (SalatStealer)", "value": "b3c3a58b75d73ebf48853ba15410285fff05e423e624aec42b613bed5ddc29b0761302354c04c6c5bdf296a215549377", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996491, "uuid": "9b0273d3-5133-4e9e-86be-46d8943c2dd9", "value": "T1E2A633867C590939E34711B6EF1F435E05DA8F2CCDEDF5CBDA93114E8AD00E4A89A9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996491, "uuid": "77e80118-ae76-4472-bec3-c16132b9fb57", "value": "196608:ECKIhXh95Y4OcY2TC3371QBCq4F7ELH/QlLidtE01ekFNd:6aQH2+3K4diYl8tEiekHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770996491, "uuid": "05df6c89-aadf-45fa-bbc0-365a201cd161", "value": 9590458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770996491, "uuid": "1fba5a15-ee02-47fa-a96d-7f780d6e1256", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770996491, "uuid": "99539d76-5a64-4d70-8117-8fe6013a683c", "value": "Xeno-v1.3.25.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b092856-0913-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771011469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011469, "uuid": "4409a78a-87f3-4214-90c4-b5d04d5ca4eb", "comment": "Malware payload (Mirai)", "value": "8b79ca73f2c445197e98176ba6819296", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011469, "uuid": "f951275f-d296-4188-b7bb-bf4268004d8d", "comment": "Malware payload (Mirai)", "value": "ef03f76f01d6d709a698047e094bb7525a7f5b7adf2a6166559949d52be6bcd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011469, "uuid": "3cb05a72-c2a4-40ae-97fd-07c19e5a6729", "comment": "Malware payload (Mirai)", "value": "e497ad59ff3b89c1dad3054e28d04683f1234a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771011469, "uuid": "9704551c-46cc-4736-9cc9-77722b6fc86b", "comment": "Malware payload (Mirai)", "value": "d8482155214df02c8a40839cc76233609c4cd46f8bd0e81b14c8bf770d824d0a526144e6522aaf489ee2f302b13d3670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011469, "uuid": "3a10353f-76ce-45af-a31e-e0c6157396f7", "value": "T18B633BDAB800DDBDF80BD77F48670505B231A79515830F3627ABBDA3AD731A80962F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011469, "uuid": "882d17b6-e85a-4f92-9489-caf243945205", "value": "1536:W+pyeg8J2qJdg5z9C9/ki9Z8yhrjWFNDLCnzBu27YIR+HU+:npy0b9si9r9oDLuzMb0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771011469, "uuid": "8d054788-7723-4332-9a0a-375e81c5ff49", "value": 68788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771011469, "uuid": "33cd1f0e-e5ca-4c7d-80f9-0046ac10755b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771011469, "uuid": "f37660b6-2314-43da-b0b6-9418f938159b", "value": "boota.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd34bae-0918-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771013487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013487, "uuid": "f7a28f59-4603-443e-b198-de7ca1b2ce57", "comment": "Malware payload (Mirai)", "value": "b038a9d06df067eec32dbad09e9a56f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013487, "uuid": "f1185c50-e2e9-4208-912f-734698c5f149", "comment": "Malware payload (Mirai)", "value": "ef15218a93fd7274e3904f9e58831fea865d69020a91635b0bed69379b22ab41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013487, "uuid": "b381cf8d-baeb-4aba-a257-dcdac0a8b24a", "comment": "Malware payload (Mirai)", "value": "ff8a8a8ac5b85223ccdc5d1c23cb74ec3e60d12d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013487, "uuid": "b636e5de-4ae5-4c36-820b-e8dcb75dfce6", "comment": "Malware payload (Mirai)", "value": "21e5b4c2eb2597992b3be2b7cb11611026811ad218e804f4c5dffe7db726792ca4f1549d8d77bd68d1743ab5f108b586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013487, "uuid": "10f1c2cb-e92f-4fe8-b557-22c5eb0dd129", "value": "T191E32A45A646DAF3C8830FF612A75A260633EC295F2FDE45F32DBCB45E055C8B10A768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013487, "uuid": "6250bfc2-8163-4cea-b69a-5ed6aa2d1899", "value": "3072:RvKS2YjfdJIy++r42Re13Yv48LywHJZZYxJuKgTh:RvhaIM2Reqv48LywHJZZYxJuKgTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013487, "uuid": "c13b32c4-c66e-424f-97e1-59f3b93d98ff", "value": 151863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013487, "uuid": "39e6c6b2-fc5b-4cc2-aa28-83f4eb9745fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013487, "uuid": "a1e8dc88-c11b-4110-86be-67e3603ec16d", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b968fc6-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770971044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971044, "uuid": "566c5b76-d0cd-450a-88b8-f46f55436839", "comment": "Malware payload", "value": "838d5bb511319f9e82840bf82b116e03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971044, "uuid": "5ba79d47-ab47-4c73-9ea7-8ee0f35d54b5", "comment": "Malware payload", "value": "ef9c31901054865e3198c967a9568b664bbdb7a3117dffce80cc44b8ff874314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971044, "uuid": "aed36051-8418-40bf-aad3-e1c133e0aed1", "comment": "Malware payload", "value": "acc0cc8dde8255976dd964d5c860d15eadd16a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971044, "uuid": "2522de22-2956-437e-ae6a-6f0c62dba142", "comment": "Malware payload", "value": "f71a5dbe4cd0466fd3ef4d87168d07638b5043abfadcbef52c6d4363107758ae7124170dd19de7d2656bee002a9a3a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971044, "uuid": "296ef782-4c26-4dbf-8419-5ad621effc85", "value": "T1BA252318B708E02FE5EA6BF00431E1322739AD9EEB15C14A9FD43ECF796A7591A41317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971044, "uuid": "52f2613f-c1ad-48f9-8e94-ece9d81b41c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971044, "uuid": "b0e3698c-7458-4d0d-bf4f-36b02c0dd78c", "value": "24576:9m9KRmeASrnTcpUE+qWtQRitgxTVya7lTu9iWjRcYu8oXIea+gT:9m6mDInTkJtWtJteF7lTeixjLRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971044, "uuid": "004f72dd-0ef9-4b43-9fee-fee79efc0882", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971044, "uuid": "a1b149fc-ba40-49dd-b9a3-5b06a3c33d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971044, "uuid": "2a53ef62-da7c-4f5a-8b48-e183e195f5ff", "value": "SecuriteInfo.com.Win32.MalwareX-gen.23111954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c71d9e8-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770973139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973139, "uuid": "c966a2c2-0fcf-4f18-a4d8-bd4bfc6c672c", "comment": "Malware payload", "value": "8cf12acf045767e6943b0f3ad43d5725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973139, "uuid": "b5c0ad62-3e53-44c8-bda6-c7647d431877", "comment": "Malware payload", "value": "efb30a47c18707519298f2d58361c4ef8376d52d5cc65f4d5e273b67f310b6ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973139, "uuid": "7ee4ea29-7a1d-4795-9b3c-fe5463833470", "comment": "Malware payload", "value": "b78f253230b76d68393fd344e6b801545d1733a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973139, "uuid": "905842b2-fe0d-4ece-b985-5dd3ff756217", "comment": "Malware payload", "value": "46b6b4fa875eedb7e96be012b6ec950684b413f3348243c4286aef43266221c261d126eda21c5d75dfec843a5bc08903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973139, "uuid": "401d7399-991d-4483-8c38-f24786f48221", "value": "T154D3F946BD418F13C6C321F7FBDE42983B166B6DD6FA3102A925BFA137464DA0D36212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973139, "uuid": "2571d770-63c8-4786-ba4f-adb3a698659f", "value": "1536:wL3sq2tlL79BpfW5UENZjVrNbRhmWy2J5I04VUvQrTW9NJlyU/KjdGeWelsiwyw5:wLcmZJxrmWyUt4ygq9NJi0TEw2yIr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973139, "uuid": "be04533f-49a6-4992-bba7-05c6d37da1a5", "value": 135556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973139, "uuid": "30c1f0ac-9f92-4f15-a8c9-7eb85f8c893b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973139, "uuid": "f6262dc4-ec8a-44b4-8507-97617a8a10d0", "value": "sys_armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9669cd4c-08f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770999489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999489, "uuid": "58575387-c487-478d-803b-a7477900da2b", "comment": "Malware payload", "value": "94d39ed2d346373da7cb64f3c96ab9d0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999489, "uuid": "c20a940f-31b6-4bfd-a12f-e180a451d331", "comment": "Malware payload", "value": "efc800462445785e6b217019be1c9fe356edbb50f80806735f9a591b4d9b3d1e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999489, "uuid": "e463bec6-fee2-4e13-979d-aa8dd7e7522a", "comment": "Malware payload", "value": "c5873e8671f28f144b52ed3d96c624893fe64333", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770999489, "uuid": "c7c6ee88-fbb5-4c5b-a2c2-a2059f4fe3e3", "comment": "Malware payload", "value": "65895e50e9adb96feb4c42661ed90a40c5aea1cb3ecad48612a48b06290c75048007ba09bfa55b65a6b78c4711e6e5de", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999489, "uuid": "f9afc342-36d6-464f-97b8-c685916a8f77", "value": "T1A0662332BE862C93C2640732B5AF7D396F6C2307468DF6D358691DC23F83AC1966B495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999489, "uuid": "ba00fa23-d9a0-4369-97d3-b10a52ff313f", "value": "49152:/OBNmmAAGavO2b/UEjuDTysPB47mZxOmxC0JIPEp2JZLZ+lNaAYQPAF+vQmuBvnQ:jxYkgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770999489, "uuid": "4366983b-fba3-4ed0-9ad6-37773679cf1c", "value": 6787072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770999489, "uuid": "95768c98-ea15-4017-9afa-c64e9bcc84b6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770999489, "uuid": "ee5963cd-d40e-49a8-8ac5-40f36d9350cb", "value": "CnvnHLVYAQ2634-8SLU8GOHFF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c98c0b-08bc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770974096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974096, "uuid": "6bb595e3-9dae-4086-a6d1-fb959c18974b", "comment": "Malware payload (Mirai)", "value": "93493dc2641c77de5bfcec30965c8212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974096, "uuid": "89e24761-3748-4722-b3eb-5e8779cae53b", "comment": "Malware payload (Mirai)", "value": "f0f7b77571d62fcf3b845c3c78cfb73985e0378d277de57113be3b00b6da0f2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974096, "uuid": "d3f257c3-a226-4c0f-b3ea-b29203a10c30", "comment": "Malware payload (Mirai)", "value": "4d382dfbd00c818f122a211149fa75c56cf131f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770974096, "uuid": "f63fb73b-7d46-4dc2-8d01-1ce54022cf10", "comment": "Malware payload (Mirai)", "value": "d9b3f795c37ebf7bae37817d6ddc526491df77d560ca0115872cbc759d7e3f53d8e27d3b156ea07bf90f10926a5b7238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974096, "uuid": "fca3e9e7-459e-4a2e-bf74-6a9dd924388f", "value": "T199F46D2BA1B3B1BCC117C03047EBDAB25632F47512316E7B16C4DA353E6ADE02729B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974096, "uuid": "4d086d9b-135e-4220-bfe5-c18e8933b4f0", "value": "12288:mg08Bh9R7fViwDliSAisNglBBDUQd4Hv5pnapeZsl/h2NoayUGuHX:X08Bh9R79iwDnAisNgljDggeZs9h2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770974096, "uuid": "2954ab8a-876c-4227-b0a8-1e434c1b228b", "value": 759384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770974096, "uuid": "febfaad5-d8d8-4f7d-bc42-80254a4b5119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770974096, "uuid": "9d196763-91e2-42cf-b5fb-06e50a307d23", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc060267-0936-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771026638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026638, "uuid": "e70d00f5-7bda-4602-8cfb-90882f1c50e8", "comment": "Malware payload (Mirai)", "value": "09eed0dbbcf3515c7380e00cbd3f60b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026638, "uuid": "dcbd69ae-8321-4418-9a18-b52cdea220d2", "comment": "Malware payload (Mirai)", "value": "f1096f20630e8882267d6348830e24f48ace2fcf79376c3ba8d8d5cea3642020", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026638, "uuid": "bfe48012-f9e0-480c-8353-42067dd2c016", "comment": "Malware payload (Mirai)", "value": "c8da03618bc4d068fd6b59ff235cc1d4a2fd0298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026638, "uuid": "589f5ce2-d84f-4df1-9528-b4b596b33602", "comment": "Malware payload (Mirai)", "value": "d226025b3f8b745fe207e1616a025c8e6c929012fa0d93202ff7ddf23780189e0d2770163875dda4899ac8c7dc5197c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026638, "uuid": "7a2cb092-0eb0-4d30-9066-1654edd4fcb5", "value": "T1018319D7F400DDBDF80ED77B44630A06B670B39146930F3AA397B963AD321A55922F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026638, "uuid": "167e64b7-cbb8-4aa3-85f0-b1815083cd21", "value": "1536:+BQKO7YrLPcXevIZKaUbj58VyHtFB8pR9aHBxz/6N3b+diMhEvuCRXyq:+RO7EPPAQaUbjGyHtF+WH3z/K+hEv/sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026638, "uuid": "37cc683b-c39d-4d58-bb0a-0318cf490b53", "value": 82588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026638, "uuid": "e323c559-1c0c-4add-a5f2-f73b210c6ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026638, "uuid": "60152ed1-3751-4af2-93ce-9adba4b8c9b0", "value": "amsm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af786b-087c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770946742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946742, "uuid": "61889722-a014-47cf-a742-abcd5462e4d1", "comment": "Malware payload (Mirai)", "value": "09b7e3d42ab600e58985bd4bc0ca7943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946742, "uuid": "812dbb64-0bfe-4846-9389-41f8da9cb686", "comment": "Malware payload (Mirai)", "value": "f10d917253b539c3cab67236bcb20f12d6e260a51d8c9172a22bde66de2af26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946742, "uuid": "e9ffcf3f-d698-48d0-a996-10676bce6717", "comment": "Malware payload (Mirai)", "value": "5c6390db937586394874a1ff7bb5b54df487cf7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770946742, "uuid": "b0b4ba96-00ec-43d2-8dfd-adb0dd397e8a", "comment": "Malware payload (Mirai)", "value": "2c3f7be16a77e2bb4c97f943bd1521ac3c5ea081a89f3ca3ce30988853c201710864d7841541afa1d8c77c605e486a76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946742, "uuid": "8de1da62-65a1-40e1-9540-976d3a325e05", "value": "T1B34301C240DE4A42877B2037A3CFFA028992474569C103DDAFF8782569DEB797247797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946742, "uuid": "ce622400-ed1f-4ed9-959e-1f8a3549ea59", "value": "1536:b/2gJkgfeSjUUmZ9rqzG/u486qytSRO6/Kv+BL0yOnouy8HyR:yEJNs9+zCNjtiJM+BL0yOoutC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770946742, "uuid": "ad6e94f4-0c5e-4246-9a95-9c8189113d7e", "value": 60020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770946742, "uuid": "d81e938b-d41f-4c61-9880-2d5b7d9642da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770946742, "uuid": "145b61b9-dcfa-40c6-9e93-10a0936bcc4a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a641b6-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955812, "uuid": "f0b280eb-0fe0-49d7-a82d-b992344646fd", "comment": "Malware payload (Mirai)", "value": "acb08fd5052b41612560d2884f090929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955812, "uuid": "673a9981-d9b8-4611-af48-0310aa6a5535", "comment": "Malware payload (Mirai)", "value": "f10e74e8f6fda02ec4d273472147bcba0e17cf85f0d55d3fd1b048f5f3379bb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955812, "uuid": "613a182e-dfeb-4c6a-9c99-59c6db3f79cf", "comment": "Malware payload (Mirai)", "value": "82b0bec95eb49cd916f4362f7ab71372ea834055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955812, "uuid": "f37945dc-6248-4db7-8342-0aaf90cd5529", "comment": "Malware payload (Mirai)", "value": "7ef4aa410a76b093e10a77aa1b694f4239f768cded060c2e13176d917e5b762bccd406c8d5aae963bb5a782060bb42c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955812, "uuid": "77d31e20-5ab3-4aa2-8eab-bdd2ac1067db", "value": "T14CB2E17A4186DDF2CF722535A1D8CA81135907FD62FC357238644AAC7B7831AA5EC2B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955812, "uuid": "fd52e052-5128-40b1-9876-534444031268", "value": "384:n/ER+iqnafXmMdXtuo1mE8y8jlI09xMTVYivM0JUDr1b73edN3wwTE1iAhymdGUm:/EdqQBtuSmEl8jC0UTVV09x73CN3HAPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955812, "uuid": "cac7188f-c93c-47c2-a70a-8f8dae980be5", "value": 24068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955812, "uuid": "c954240c-d507-47c3-a52e-f3a7de12a580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955812, "uuid": "a6c07396-b654-42a1-b01b-ee8d2dde857d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf3cb3f-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015469, "uuid": "09c6ab0c-2655-45c8-bae8-ed189da2d855", "comment": "Malware payload (Mirai)", "value": "08ec5755818ba8a1b7b9679d34d72e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015469, "uuid": "c708ae92-a3a8-447b-81dc-051247541349", "comment": "Malware payload (Mirai)", "value": "f1337674c6883f2cae04cd83d971768dc0b7a8e69e522cdc44415350de147eb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015469, "uuid": "d1cb3986-0c00-4911-814b-b37b9699f819", "comment": "Malware payload (Mirai)", "value": "f8415404988a7752f5e5165b2c3c5b8557d33387", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015469, "uuid": "f8585443-24a9-4a6a-92f1-ee344b817116", "comment": "Malware payload (Mirai)", "value": "b7ab4bbbaa01767ba33ad7f72f99245ffd0bad39361019121bf6209a3870d33031a7fe9864f4299ab3fcfb0940bbea11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015469, "uuid": "6a6dbf3d-244b-4356-b83a-650329799e85", "value": "T14EC2D03023B7FEE1CEB14DBE9AF308526E4957B4E5FA302362224D20ADF24463975462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015469, "uuid": "5925762a-9b3a-472d-88fb-874091a0f929", "value": "384:H9gEeIYFbnhN4b4KkffYd4isADomZy4fDeuOU7KfumxnYWje0h7qmdGUEpiazs:dgJph+b18sDXy4f73GfumxVJ9q3UELzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015469, "uuid": "f54a6832-f85b-4240-8383-80063b288e0d", "value": 27320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015469, "uuid": "8c3d8be2-d055-4c38-99cf-ced0e207004c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015469, "uuid": "a4b0f7a6-0c8b-4d49-8078-9f32c454e5f8", "value": "SecuriteInfo.com.Linux.Mirai.9816.920.29084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c77e52-091c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771015455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015455, "uuid": "2065193b-5988-4c94-a9d1-e5ba3aa35cc9", "comment": "Malware payload (Mirai)", "value": "2da7f0c78b89a4ccb1c2f69115fbe689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015455, "uuid": "6d65b2e0-76dd-4303-9e73-cb5dcdb15ecd", "comment": "Malware payload (Mirai)", "value": "f2baedade86256f99aeb884f21a5977d44f633c0c5518a67daf6b13d166af47f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015455, "uuid": "1b9e12a3-e51b-4746-aad6-de3a7d2b3198", "comment": "Malware payload (Mirai)", "value": "0b5ba757c953e24673d71881bb26c407aea68c38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771015455, "uuid": "4da73c3f-90e2-4d67-9421-e135cf08ff1d", "comment": "Malware payload (Mirai)", "value": "07503d40cfa0a92eee02e6c96d2f9692c8cf136d0e2872dd27e0aa9a0ea2046e6ad372a184e302b37f93f11f6d3359af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015455, "uuid": "a15bfb1d-5afa-465d-92a4-fe2ca88d76cb", "value": "T1D8A2E13BC2A9815DE481E77D6C0915E7949BB42A87EDC4462C7258C3057B9D8343FFB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015455, "uuid": "9c8c86b4-d4b9-4cc6-83ec-9f7e1dd5f7c8", "value": "384:vnyKVW/L05AXGer6EkpHhBYrUfJLL6CChYtFp44s0RAymShiNFbW6cuiFqcJn:vnFVW/dLrFkpIrgt6CnJs0kHnsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771015455, "uuid": "399877b8-2885-4963-994d-6a77a62d708b", "value": 23268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771015455, "uuid": "1d6a83a5-49c9-4b20-ae99-f3c48b7fc18d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771015455, "uuid": "461f9711-8b60-44fc-b805-39e6093c94b7", "value": "SecuriteInfo.com.Linux.Mirai.9816.7834.5513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94614a5-091a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771014580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014580, "uuid": "07ffe82e-5546-44f8-bf4b-955bd0bc814a", "comment": "Malware payload (Mirai)", "value": "3dad32634806090b075c95645eef076f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014580, "uuid": "acaf56e1-41b2-4f5e-b558-e752346b27bf", "comment": "Malware payload (Mirai)", "value": "f36b02a37451a008154b74caed47ef32983b756a97c1cf7b8be35b423ccec0b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014580, "uuid": "76afd699-e9cf-4c97-b6be-7c6a4de29cbf", "comment": "Malware payload (Mirai)", "value": "505f1e38fa2c8aeeb750db3eac342f6c0a511f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771014580, "uuid": "adc98655-75b9-46d7-b8bb-1e62fa87c777", "comment": "Malware payload (Mirai)", "value": "fbe9b945eab942487c55f08cb132ea64be35f0e9827b53519565d611346910ecb1883771c300a7761676adc1f5c2c65d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014580, "uuid": "c2441cf3-cb63-4a92-91e9-6b979bf231c4", "value": "T1AB043A46EB414A13C4D227B5B79F42453323AB68D3EB330699286FB43F87B9E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014580, "uuid": "96ab48bc-7812-4248-ac37-e2af7efddeaa", "value": "3072:4sq3VO+Bb4naQg5rvJ1U2YJLWoQIpjsKXZwSHTyM/9AynOU:Dq3rMnaJ5rvJ1fYJLvpQKpwSHWM/9AcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771014580, "uuid": "5aadb9cb-889b-4e9e-b990-c5055e235e1b", "value": 177795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771014580, "uuid": "e706bb91-434a-408d-af60-b0bbae2060cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771014580, "uuid": "e7523535-9fb2-4f57-92ba-6c4f71ae8ff9", "value": "Calix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb60751-0891-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770955507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955507, "uuid": "2ddcf8df-bf0a-4bbe-87da-e3e57f93a64a", "comment": "Malware payload (Mirai)", "value": "57df4eb0e10a54e2d15e6d7c940c2637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955507, "uuid": "9e200a55-d7b0-441a-8cc5-0279317693d5", "comment": "Malware payload (Mirai)", "value": "f38d0612ff4ea36e0c1f0caeeccc8b561f3f0807d883e1bc66427e47e30e4090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955507, "uuid": "bca1e1cf-647b-4a40-af84-7d2d95faf2b2", "comment": "Malware payload (Mirai)", "value": "44e6fd13a442b3d88faaaa39103a08e9056887a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770955507, "uuid": "3e749221-7274-4a29-ac10-c1d2fc697341", "comment": "Malware payload (Mirai)", "value": "5c05816b98da4a04355e8ccfe7a616f474bd6e18fb21d01e8a81cb56567b25b58f8dfdbd5c0a07a13c585fe96feb5778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955507, "uuid": "654a394e-6e01-4269-a426-81b80e3e9919", "value": "T1CB13F26742EF977EC9286E394A4F078CF7F108192987834F48E98DFA48367961F106D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955507, "uuid": "041c0dc9-a500-4958-b6f5-bb04ba87eb87", "value": "768:Y4qOn4kpBjrlQEac/xybE6r5YGlzBlQjGw0WPV2sccSTeumGsT96eRx0Y1:YvO42jLa8Ib3vzBlQjGw0Wt2scJSNx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770955507, "uuid": "8953b241-77f7-46c7-a29b-6028ae949cc5", "value": 41948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770955507, "uuid": "d14ad392-c518-4c34-a15b-6459cfafb69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770955507, "uuid": "78be3177-b458-4aa6-9d99-12c3de8b7aaa", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0469cf-08b5-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770971046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971046, "uuid": "42da2fff-93dd-4fdb-b9b8-7675e16ab1fd", "comment": "Malware payload (MassLogger)", "value": "81220d157d2a87c0ce688597163740a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971046, "uuid": "a2d075d1-8948-438b-924c-0185787d309b", "comment": "Malware payload (MassLogger)", "value": "f444b36b457dfcbe9f2ce3d8c6766c5886f568b6ce1a2b01b43ec9ea0f650243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971046, "uuid": "ca3d68a9-d90b-4804-ac64-64a1686a5816", "comment": "Malware payload (MassLogger)", "value": "81e8cb4c58b51f08979ac0b5a186c2217ae6fb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770971046, "uuid": "d6a6c281-4fac-486c-9b1f-6e0dafde9935", "comment": "Malware payload (MassLogger)", "value": "20b23d0b618f23d2011611890dc0cbd084edf5fbf6461c79f6b235ad7bb0895e38e99de6e4e526473988e02b250a29d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971046, "uuid": "c096d9c3-3a1c-4e5e-b70a-cc1dbacd4131", "value": "T1DEC401141166CB0AC85C2B7A16A1F13403F84EBAB112F752AFD5BEFBBD5AB450E445C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971046, "uuid": "e23bc02c-25a1-4ef0-ad86-bb7ee4852586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971046, "uuid": "ca34d568-e76a-4343-806b-4db8a3de3c73", "value": "12288:H4CpKQNWU6tr0ydz5u1yPrfD4rR7+OsX42iL4u:H4gKQ0UyrtdGS74V6X2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770971046, "uuid": "0425d059-8c26-4cdb-8908-3e797a14ceec", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770971046, "uuid": "e08bc768-f323-4f1b-951e-a153c3c5708a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770971046, "uuid": "c8f40d82-7190-41d5-8bd3-f02636fc96ce", "value": "SecuriteInfo.com.Win32.MalwareX-gen.81473582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cbce75-0870-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770941392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941392, "uuid": "94166b6a-b6e7-4d78-9044-d2c32a1d1b88", "comment": "Malware payload (Mirai)", "value": "891261f761088953682973f4aab4ef43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941392, "uuid": "3562f3a1-6323-4054-8735-bdf785e36db3", "comment": "Malware payload (Mirai)", "value": "f53ac40dcd7fc5392041756ce0c422eb634fd8025d6dbeab88d038269074bbd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941392, "uuid": "e55f68c7-8c9c-44df-9ac6-c9cdfb313036", "comment": "Malware payload (Mirai)", "value": "1a3f058f7e67655ea084d9485c642fc64cd54ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770941392, "uuid": "82ccef99-e3a2-423d-a46e-b279bd91c3f6", "comment": "Malware payload (Mirai)", "value": "809fd2e0feb9fad03a08ad6c4c887ea837ba256f3169d9ab2e4fddab10c0c4bf33340ca484268a8822b061acee0d1316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941392, "uuid": "f993ba28-016f-457a-a815-43e2cfb4f639", "value": "T160E32A85FC519F26C6D225BBFB5E438D372A1768D3EE720389255F20378A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941392, "uuid": "e07690c4-8536-4fe5-bccf-422bd2f1c3a8", "value": "1536:CDbkeAvfeTCwXiQPeWWUD+c9vfpFA0M7zwADwuyTThfBUfNO5tl7s839hlBVwywY:CDbvOfWtwctfX4vwA1yhfOY9sOjrhIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770941392, "uuid": "c0ae8ae1-bcdb-401a-b9ad-03239c1618ef", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770941392, "uuid": "55eff350-af8f-40bf-b579-e299ac6dd5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770941392, "uuid": "47b68cdf-2c3b-41de-94e6-27b7e79fc69e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de9cbdd-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949117, "uuid": "d7c5a86c-ccf4-45b4-828e-f2157345f8db", "comment": "Malware payload (Mirai)", "value": "fed30346d609298da1fb23eeb292582b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949117, "uuid": "cb714eee-6316-49a8-98e2-d96e0a984cf9", "comment": "Malware payload (Mirai)", "value": "f57230a7826aef03dcaca2337fcf3e5b9cead6bcf8938a65811973c9cb45b973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949117, "uuid": "bcf609f1-81ba-4a1b-800d-dfe68ae51ef2", "comment": "Malware payload (Mirai)", "value": "2a8523ce3101e960513c80fe1592259618ccb3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949117, "uuid": "d1ee1ff1-85ca-4c06-b378-0fa411224ef2", "comment": "Malware payload (Mirai)", "value": "4cad1537089b72a3cba13d7b5cc9bf030af5dfec7e9743da74183a327ebb1b7f46fa7fef321db060fd2a22eaac11fcc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949117, "uuid": "3eec314b-cb06-4850-bca3-c3321f6d2222", "value": "T1C2E2F1D155B7A8B8CE710D7AFC774A4E2529C6FC85FB102257F8372423B09964AB0452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949117, "uuid": "466f9442-8e85-4cfb-bf10-e9f6c616ed2a", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8LreaEH9q3UELdo:zLJCmjpkcMKUBL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949117, "uuid": "5323a155-35bf-4d32-b143-2d5f67c9a062", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949117, "uuid": "1ad4b653-9b80-4f15-b74b-102a42a5218e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949117, "uuid": "1f823d04-976c-4076-b2aa-68d513a0efa4", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba421701-0917-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771013293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013293, "uuid": "980585de-26ea-41e7-9864-183853a63c08", "comment": "Malware payload", "value": "bdd1f5f448aa3aaa3eba13b4f3308c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013293, "uuid": "2b75a133-6ca1-4b75-abd7-a636718ddfc7", "comment": "Malware payload", "value": "f5922b2b54b376e5b5cba484cf400ff7b963b720622611783ef083b61e1efe6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013293, "uuid": "827ec72f-e035-4f9d-8dc7-e97d7558d3d0", "comment": "Malware payload", "value": "88df4249bcfa144d568b6d8278925921ae16bc8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771013293, "uuid": "c6fdcead-41a4-483c-b7f6-1d68e288833a", "comment": "Malware payload", "value": "4618b3616b78001e59e6c5113816e24e739a0626cbb62f1d0a2604266e601117cf4117c80fa2e14008d35fb6c998b168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013293, "uuid": "df79e229-103c-4e16-b4f8-afa2dd574d6d", "value": "T1C8E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013293, "uuid": "90cea19d-ba92-4922-8a68-b31f060334ca", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+JonGy:axlw1xAop0YfRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771013293, "uuid": "1840013d-62c8-4677-945d-2b023b76f82e", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771013293, "uuid": "6491e429-c9e8-4760-90f0-7ed512d11aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771013293, "uuid": "18962265-b51c-4a76-985f-d16e650265de", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d65c321-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973141, "uuid": "023119bb-2e7c-4226-8227-b5a34497df35", "comment": "Malware payload (Mirai)", "value": "50c7d80ad6750a97e7bea69cec507085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973141, "uuid": "39c72e9b-5049-4d0b-b087-d71852ae10b0", "comment": "Malware payload (Mirai)", "value": "f5a1efbeaea9c8caf5db4ac5a1571afdf5c91132fe5d9cf7ae0d69a5ef51904d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973141, "uuid": "acd3aceb-5b2f-4b00-9671-7aa56a1037f8", "comment": "Malware payload (Mirai)", "value": "ed864913ff7110861962e6c59b8baa7de19a568e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973141, "uuid": "98aa0839-57e0-4bc7-81fd-a244bf151b62", "comment": "Malware payload (Mirai)", "value": "33bab98c92146277038831a59a2a57249f84ab15859f3de66ec6a58004fc6e95f3c3f71913213eaea18018d4d1ea563d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973141, "uuid": "31c140f4-37ff-46bb-81bb-52bec82d6a1c", "value": "T1F95302B10FBDF75ED17EC879022C6B82754124CA346AE4CB29DC9BA042549F58FD05B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973141, "uuid": "9f6e182a-fb8d-4077-9da9-03ec5ade4da1", "value": "1536:JZIFT0LpvxCOFP84/7MyrSDU8JPZFGssxhN+2SD5+pQl:PiTaxCHyrqGswhU2SDAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973141, "uuid": "8e34a027-f118-43de-b733-65fb3f355009", "value": 60940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973141, "uuid": "973690f6-b3a0-4a76-9c93-4b29c4ab1f1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973141, "uuid": "f1bfb403-8289-4057-90b2-54cc0962542e", "value": "sys_powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bdedeb-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977955, "uuid": "5a2dbbf0-02eb-4cd9-a29b-e746c84660be", "comment": "Malware payload", "value": "bfa5af23992dd8277535e5d93f96f3ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977955, "uuid": "7b055e4c-c001-49f7-8572-be1b46dc14f7", "comment": "Malware payload", "value": "f6ae0a0dbcaa60de4a4d57d6796d684e6384bab38d24d7273665a671969560ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977955, "uuid": "9c05b4a6-3e17-483a-806e-30a03c83c22c", "comment": "Malware payload", "value": "f7057793abbecb6d822b4efdb2d1ea27433c9190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977955, "uuid": "4dd6d7b2-5027-41e8-ab70-6cfd7644c881", "comment": "Malware payload", "value": "47e1eb4152faff1ae52fb9cf3ac261cfd16d63bd184f5263601cadbfda16418f11a8e213b8a038c461297ce937abfb1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977955, "uuid": "8853ef22-0540-4f24-9836-6cd465a2ca1f", "value": "T13A521159E2A1CE3ECCBC5338899B0A3023B65498A3B353331B08AA761ED375857B58C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977955, "uuid": "9f8de4e3-6ecc-499f-8c31-4fb2b3b41739", "value": "96:RrEOTBB+BgTWhhUMkc05AMyx2D3lkiZ8o0:RvlwOEhUMkc0vpVki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977955, "uuid": "2bb77adc-585d-4a2f-86ac-a958d2334966", "value": 14032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977955, "uuid": "baf5b012-d157-4193-8061-b285335e7d60", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977955, "uuid": "7cf57a68-32fe-487a-96ed-5bca77a528be", "value": "dlr.XOR_ENCRYPTION_KEYGEN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54baee6c-08ba-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770973180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973180, "uuid": "e45ca327-ebe2-42a2-b93c-6204e972db79", "comment": "Malware payload (Mirai)", "value": "a4d6824dfe1226c42b3d50b93b4f283c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973180, "uuid": "bcd18f32-32a9-4ea6-a141-30afc2206cf7", "comment": "Malware payload (Mirai)", "value": "f6e2007afdf0904d9c194dc421c5ec593beee238d9a3be63eeea72bbbcb19590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973180, "uuid": "5de7cbcc-b35f-4260-9a4a-3057c54bd491", "comment": "Malware payload (Mirai)", "value": "f3650bf27e9d9d1d5fe4719502ec9e0c1c29a87c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770973180, "uuid": "b651b68c-6a1f-40b5-914e-f7df2a9bc7a9", "comment": "Malware payload (Mirai)", "value": "b872cc8a8522c02976acb32a6c71afb87806fd943a6a320ecdecc2fc1ea4ca2cc8f139bf8602c7b8d1739c4a13b72843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973180, "uuid": "f3ca0b16-278a-4225-ac13-441148ae1b1b", "value": "T113632946F343D4F1D90706B002EBEB795934FD670524996AEBA0FFE19E316C2B05A728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973180, "uuid": "f9c3be24-2e77-4b13-9494-85b3bae0b00b", "value": "1536:joXhDNp7w49IEZ4vPOsKUxr5MVawhU93108Yj8VjprQ:+p7wDEZ4vPO/jCe8NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770973180, "uuid": "fdab21e3-992d-4128-b0f0-17bea27bcb7b", "value": 69360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770973180, "uuid": "ac523c0a-1236-4eb5-8cf5-15926a26359c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770973180, "uuid": "38525982-9c19-443e-8faa-f42d6fd54460", "value": "sys_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a927b61-08a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770963284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963284, "uuid": "c90b1386-5b29-4d69-9844-6b3772682c3b", "comment": "Malware payload (Mirai)", "value": "c2436090ff6758470f9ccab050ea825c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963284, "uuid": "ef12fc07-955f-4098-adb7-720baaf52d47", "comment": "Malware payload (Mirai)", "value": "f876a25abd9c0e2b92809fc7bb9fdc263973ed91662193b982fd98bf6709dab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963284, "uuid": "b42943ce-5bbc-4c5b-b550-c67d730936e6", "comment": "Malware payload (Mirai)", "value": "f90fa92f83b4f55a1d47d28c1622563abfc2c7cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770963284, "uuid": "89127a8e-32d4-4c81-be6a-82c985ff0b82", "comment": "Malware payload (Mirai)", "value": "85377805a67f7a55873354e955e4041c10eb4c023f6eca9ed16d4d7528a0af24271a2a6ba3105461818d847f379f11a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963284, "uuid": "e2a42f7d-b0db-4beb-bd4a-8433502f5ba2", "value": "T177933AD7F401DD7EF80ED77B4443090AB231E7A10A831F366397B967ED721A81966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963284, "uuid": "ac8385de-e850-483e-aca4-8ca1f84e0315", "value": "1536:Jyn7fqhPBo0w1dP0Pfz2l85KhU68FR4nNc70+Id3NZYrrstBKio54vY41:Jy7CzoD1dP0Pfz2lCKhUn4mA+w+vio5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770963284, "uuid": "85f64c2a-0e03-4153-94b3-d6ae20aad66c", "value": 95568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770963284, "uuid": "cc4b59b4-a618-447b-a58e-483a5913efac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770963284, "uuid": "ccabd344-1d33-4ec6-b0a6-94fdcb73ae1c", "value": "herios.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3cc01a-0901-11f1-a129-42010a9c0007", "comment": "Malware payload (SystemBC)", "timestamp": 1771003880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771003880, "uuid": "d3b83ad6-2683-49eb-a41c-71389244c523", "comment": "Malware payload (SystemBC)", "value": "2ab5a623873192c173b1f4803a29a3c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771003880, "uuid": "8ad1eac6-38fc-4b45-a852-2d567a9e35d0", "comment": "Malware payload (SystemBC)", "value": "f8cc41bd09cdc151422a813652150a579775d6c9ff4a6f0e86306533f72f671c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771003880, "uuid": "f9a42b5c-588e-435e-befa-134d8c0b57b8", "comment": "Malware payload (SystemBC)", "value": "553c94b04547202018c827c13b81718632401ba0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771003880, "uuid": "246230a4-5b4b-487a-9ae5-07bfd9b6962f", "comment": "Malware payload (SystemBC)", "value": "e781ccbedab3c95fbbfccaae47e4d3eb7def93cd291d534c77b29e77d74250ab7ff80c4daaa9015fd06f58941bfeaba3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771003880, "uuid": "dfd9397e-89d4-42e1-96f9-b8b2d97fe3cc", "value": "T18A72FAA7346189A9C411CAF43E6FA660D47D787252349039EFE04E18377EAE3E712B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771003880, "uuid": "cb3660a0-08ab-4af8-9b35-bbe9d7784fe0", "value": "b83b4c7be0b1cdd8e117bba9096d9768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771003880, "uuid": "4589c0e3-1b45-4e0a-8d99-470161b50f4d", "value": "384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771003880, "uuid": "aee202ff-6940-4ea5-8fa2-f5990a520986", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771003880, "uuid": "64d22cab-6a83-4200-87ce-7ef827e759d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771003880, "uuid": "39a770dd-3522-425c-b5c6-0d352fe8cb4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f5da52-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770977965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977965, "uuid": "d3a3f4dd-7cd6-41a2-b078-a4f32de595fc", "comment": "Malware payload", "value": "d352cd1b311296e66c35b3349476f553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977965, "uuid": "2ff24f73-99c4-4f40-9fab-d531a33defd2", "comment": "Malware payload", "value": "f9d007ca472f5a2a7706dbfbb9447430ed24c8e035abe6235c5672272216922e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977965, "uuid": "2060b6c8-fc29-4576-8104-c3b8398c4f02", "comment": "Malware payload", "value": "dcd14f28d633ad1273ba47e41447ea51c30537bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770977965, "uuid": "de7dc110-c742-462c-885b-d6cdcc76701f", "comment": "Malware payload", "value": "3c863372a4baf50eabdacaca330d911585e0e25007318593525cf05da698cb37917491639ee477ac7cc2a4f2d0a06908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977965, "uuid": "e195cb57-5f76-4652-ae23-5100f6b1ee33", "value": "T16A3423AC4A90A3C3E478DB7E63DF88501746F146A6FC9312E3D5CA5B1C7E27434529A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977965, "uuid": "e1ce6b56-43e9-4f49-bf0f-df542b6588b5", "value": "6144:aGt38XIZLedW0OI00uPF3AKA2B+DqZzn9E4WbQKU0vkSvB1i87b:aw33AdWnhPF3AKA5up9HFK1vko1i87b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770977965, "uuid": "ef107f66-cb2e-4de3-b7d1-138dd0131e7d", "value": 251780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770977965, "uuid": "37b663c3-5c82-47b6-b903-20c128495e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770977965, "uuid": "71d3a969-3b1f-4f62-938e-c3583622efd4", "value": "mirai.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fba58c-08da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986795, "uuid": "fe9c7cc3-00f8-4542-bf54-82fe0d05e1b2", "comment": "Malware payload (Mirai)", "value": "f4a60a0306c0e334de6e3d35ba7658e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986795, "uuid": "0c62d93e-7464-4259-8854-b32a529c3042", "comment": "Malware payload (Mirai)", "value": "fb7079a4f6161a36907c51980382f99ac7696b75f82aecb9f602cf3749f3b507", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986795, "uuid": "878661c8-6b3f-40ca-b22f-0925f7009c4b", "comment": "Malware payload (Mirai)", "value": "0b9e092f6a1eb0b2a32584aa11917c0708e1709c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986795, "uuid": "4426d34a-a0c2-4e0f-adbe-24eef2226605", "comment": "Malware payload (Mirai)", "value": "3aab423ac4ae0132c335fd89ef0a9bde4232f676340656ce393115475dfa24560ab1afd0045b79df1cf3b18fa1ca3477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986795, "uuid": "706528fe-b0d1-434d-9c1f-401010dc7ee5", "value": "T139437C02736C0E43C1172AF4252F2BE59BFBEAD621E4F146364E8B468975E331586EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986795, "uuid": "26bbbb62-ba01-4c4d-ab78-6e01071ddfc3", "value": "768:xWWSFeLbqomQqTsT5C7rzVHPYm7L3a+uMwgyA7cW3rttW0gIXQZUi/:hSFkqoksT5srZPPLKTvUNgIgZUi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986795, "uuid": "f413dacd-c726-4570-abee-2a700a9b7c42", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986795, "uuid": "0a5d4eae-87b2-4190-b338-22cf5a1bdaba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986795, "uuid": "81412900-ee1c-453d-8513-19286a967b04", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca78abfe-0936-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771026635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026635, "uuid": "984ceec3-7976-497b-9af7-ddf39e3c435f", "comment": "Malware payload", "value": "a0326cefe12ada466e7738704eb282f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026635, "uuid": "1eb31e29-b514-4110-a0f6-39fff0c7e36c", "comment": "Malware payload", "value": "fbda1d301783e63db44bf57e3aa238f60c742d6c19d68d60ee224190236460c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026635, "uuid": "027e67c9-8841-444e-a868-0dfeab44651f", "comment": "Malware payload", "value": "43886c0e47c7738a5c1ef6c0c3b2d888802ea41b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771026635, "uuid": "424b2a7c-28d2-4097-9835-0c5a0ab67dc0", "comment": "Malware payload", "value": "db8b5c3e1b01988410719368d0c9687606ac9c7937effaa88b8fadd209568f8510281bae80e8edb9c04cb97171d79840", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026635, "uuid": "51391a9e-e180-4bc7-9a42-35c158218d78", "value": "T16831B5C91001D309D6DAEBA4A3BED488E13AF9932DC8EF5BDDC44E79C88C954703DA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026635, "uuid": "76674922-9397-42b3-888b-e29e52c62549", "value": "24:olstMHNWNNIuiqMGhGRaiGiZ8MrNgBN0NLi/CLWzN:olstMtqrw32r8OCLWzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771026635, "uuid": "d17d57f3-9f14-4ec9-a2e1-b5f1cbe59516", "value": 1649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771026635, "uuid": "4988535a-ad59-46b5-a063-ffd223152230", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771026635, "uuid": "93aa96e7-117d-479e-8229-e2e4d337626c", "value": "nad.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5095b28f-0882-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770949121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949121, "uuid": "a824227b-d014-4a38-822c-2cbbf2bdf03a", "comment": "Malware payload (Mirai)", "value": "0646f31de8c986d47a377334e0e4d544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949121, "uuid": "de43ca8e-2722-46ed-8210-adcf302536d2", "comment": "Malware payload (Mirai)", "value": "fcdc360e1d9a085040baf472583a2a64c1dc7b75caf739c3c8f76d59ed71e715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949121, "uuid": "da1b229b-d3c8-4439-b802-cae65648e7e8", "comment": "Malware payload (Mirai)", "value": "83f93f8fc29acf0cfe917f27b3d46ad1e65200d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770949121, "uuid": "37076a3f-2f35-427e-b170-f45dacdf2f28", "comment": "Malware payload (Mirai)", "value": "a64d0a5411e520fa148832db20f2dece3c76df5ea9d9ef60d26db85cc6ce9736a93c5ce0cf74854cf50769da2de17fab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949121, "uuid": "cafaf790-f654-416e-b385-577ecf8f9a43", "value": "T1F4D2E27C6B0149D7C66FA1744EE50B223E90CFB2F0526C076668E5D77B0585C7CA5EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949121, "uuid": "705702a9-f53b-44c7-9122-ed51764ffe31", "value": "768:U4ylAtv6pqLJM0RXaxGyUbXtheU/SHUAUMJgGlzDpbuR1JT:HMBqTRXa+Zhr/Y9VJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770949121, "uuid": "376082d8-7e3b-4348-b72b-800aae67d0c8", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770949121, "uuid": "a3896d61-d832-4c8a-999e-c136885005fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770949121, "uuid": "30a9bdac-7ca3-4222-a467-3ba61c84c28a", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222f0987-0906-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771005737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005737, "uuid": "cb39d3fe-dce1-485a-9db6-748728885b72", "comment": "Malware payload", "value": "9b2501b925fc314a40c74e59705275ba", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005737, "uuid": "ed47905b-ffc5-4a23-82f1-15ebe0a7d635", "comment": "Malware payload", "value": "fd318bc10c5c92ce3fb47c0009e76d62c32e1599524e4482f6c4dd2f9351bfdb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005737, "uuid": "f1dd34d3-24a6-46cc-82a0-b4dd5ddfa15a", "comment": "Malware payload", "value": "fa542983a3fe4f0b27ef4c222a7aafdd3eddb74f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771005737, "uuid": "bfd91c3a-7566-4f12-a704-5512b0ba3f0e", "comment": "Malware payload", "value": "f786b088d0d5d20d1f8a107d0e30252105e1b17dcaa779c7ec06aa3d6c50ea65bc1b1919e94e57566d562553e1d9dbb8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005737, "uuid": "7ae08c15-c7b7-4551-9b5b-d1556e5cb43b", "value": "T1E1D02B3B1296A7E4CFE52DD2A46B1B95D243B83A5061A0142AAB90211C485B1E389822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005737, "uuid": "7c0d9262-f21c-4f03-b912-b945e7a5e9b5", "value": "6:pRzMI7U31pEA+yheB5Td4Sr8zV/WRIMFoLACxpSTF3PBVpMAR3K8LP0d:7MIQ3vIB5hIORIMqJxMTFJEAk8Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771005737, "uuid": "3a106664-2fe3-4bbc-b04a-2960b2bd1433", "value": 270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771005737, "uuid": "11c47356-775d-4b39-a219-e3307f7de80e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771005737, "uuid": "02f6e6dc-b5b5-4aca-a2f1-239213d700c6", "value": "qww.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60397ca-08d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770986765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986765, "uuid": "0577636c-079e-40c2-a480-4ab358433b36", "comment": "Malware payload (Mirai)", "value": "037e425269d0815774e07fc8db2a8990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986765, "uuid": "079f00d5-425a-44f5-83a2-59077da04eab", "comment": "Malware payload (Mirai)", "value": "fd73b727f42a7ea851e2d40a76a4f9e0eafa64da81d1cdbd1a541f4f0ba108c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986765, "uuid": "b702b9a4-6c69-4c85-a8b4-56ccdc0ac696", "comment": "Malware payload (Mirai)", "value": "90e6f0b70f37be38db349c5598fc013dc5c4ccbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770986765, "uuid": "fe9738d1-d00c-4411-9209-85bcc5f601e5", "comment": "Malware payload (Mirai)", "value": "1d526761aff4af26ecafdba0c957e45e6e663c4b2d4fd621fc70507866160ed9c85227d622f65a022a594497f0ca534c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986765, "uuid": "c44fdd70-2411-4903-893a-a1ddb52be6fe", "value": "T1F5534A21B9790B27C0D0A47A22FB8729B5F14BDE61A8C64E7D310F8EFF11A8019579B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986765, "uuid": "a0c99c42-07ca-4f82-8f65-67ab196978a4", "value": "768:jNnkFEo8myAh/7mRvFzS9WAbG8ga/bNbDZmIC7qy7xfdy4nO+UYaFY:JkFEwy6mRv1SEAbG8ga/bNbDZmICV78a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770986765, "uuid": "5c112882-2712-4662-8ea2-6abde2036341", "value": 62512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770986765, "uuid": "a92e49e8-be67-489d-ab15-88be2e153121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770986765, "uuid": "a49b70c3-bc3a-4be4-8454-2e4429d17b54", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b156cabe-08c5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770978060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978060, "uuid": "59650871-03f0-4c21-a5f7-db3117c96215", "comment": "Malware payload", "value": "58e253e78bb39acad43f5d6a3d661ef0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978060, "uuid": "b29c205f-4ba1-474a-b164-e902a5f7c628", "comment": "Malware payload", "value": "fdb991f6aaad78495c6641d93d616c8b777a57111bc35c5611549bd034457270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978060, "uuid": "cb7d7430-4cf6-405c-a893-67c32bb8ddae", "comment": "Malware payload", "value": "054ac3491f347601f290221546e71f0d63542438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770978060, "uuid": "4e3cb6cf-eb0a-47c0-b7fe-30b3a45af88f", "comment": "Malware payload", "value": "d2b5238008c1ce482b3de975ca2d5528d4b6b466c81a6efc6af3ac6270a3a2483ba721e3cdebfb1161836dff3b541e6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978060, "uuid": "98ebe47c-219a-4b3d-8d7f-a8121142917b", "value": "T165E44A42FF2C0463D9470DF0697F43E1F3213A4150F9922A371E6B672622E769AC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978060, "uuid": "200440cf-7d23-44a0-a670-799ab9c27499", "value": "12288:OaG6QoWVk4vyo1yfCo9JiPZXMDyOWhLv+F3ZkEqF4UOf4aAsHep6cC4s:OeQoWVk4vyw9hXMDZdZkEga977", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770978060, "uuid": "17e95ed3-972e-48ec-874e-4966e4e6a6be", "value": 660104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770978060, "uuid": "b1b7fccf-6441-4432-a792-c9b35b94dbef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770978060, "uuid": "7a498d77-a5f3-4ace-b96d-d252398a6f80", "value": "dlr.POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ddc6d-08e6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770992175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992175, "uuid": "fff14796-d2fc-46a8-b4a6-fe722019339f", "comment": "Malware payload", "value": "e482714450f5f06242e19d7542bf69f3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992175, "uuid": "c82d1bd9-4236-4a99-aaff-4828d6eee578", "comment": "Malware payload", "value": "ff451d8bc86d8bd484a70d1781469f8e9302c64f0c914dafae8c66795e6a2272", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992175, "uuid": "8c1d0427-14b9-4745-ad4f-c0750d999110", "comment": "Malware payload", "value": "e3d3b2e430ec4add7554759ff233cb50b5338d9c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770992175, "uuid": "e2783dff-a2d1-4f00-9b9f-dc1ad72067b0", "comment": "Malware payload", "value": "b536991e597b1a745cf8fc6a6d8a2c1d2fc46a0df51ad49036eefb931dace26e624382c0fbc04b51b5b5918432422f61", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992175, "uuid": "8f95f621-01c8-4a4b-83b5-46ea07615343", "value": "T1BDF1B6F8C56AB8D48757734079D2C8C62193DB23CD636B6CE35D08902BE1765EFE8889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992175, "uuid": "a6fc447a-6a08-4925-9b00-d298d8bd352d", "value": "192:URkm+ODU5UKQFGPB3eAQLft4VQnmV54l5zCvsiD7xyH3th:wg5tQ0PUAsft4VU1/zgsWxq3th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770992175, "uuid": "c979c153-197b-4fc9-9235-e1b8d0515d3b", "value": 7651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770992175, "uuid": "ec90e936-b24a-4f92-886c-4e19dd4efe16", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770992175, "uuid": "7c106098-167d-4cf2-9e68-74a85d201a7b", "value": "Sars Letter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }